Function at 0x10032c1a
Capabilities:
Accept command line arguments
Clear file content
Connect pipe
Create pipe
Get file attributes
Get geographical location
Get graphical window text
Log keystrokes via polling
Query environment variable
Set thread local storage value

Disassembly:
mov eax, 0x1007dfcd
call fcn.1007d960
mov eax, 0x12ac
call fcn.1007b690
mov dword [ebp - 0x50], ecx
xor eax, eax
push ebx
xor ecx, ecx
mov byte [ebp - 0x61], dl
mov edx, 0x3644
inc ecx
mov dword [ebp - 0x10], edx
mov ebx, 0x915bb00
mov dword [ebp - 0x28], ecx
push esi
mov dword [ebp - 0x40], ebx
mov esi, 0xee3f2f34
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
push edi
jge 0x10032c75
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xad0], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10032c60
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10032c94
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6a4], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10032c80
xor eax, eax
mov dword [ebp - 0x28], eax
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov edi, 0x485b
mov eax, dword [ebp - 0x6a0]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x6a0]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x6a0]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xacc], edi
mov eax, dword [ebp - 0x10]
cmp ecx, eax
push 2
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edi
mov eax, dword [ebp - 0x10]
setle cl
dec eax
neg eax
sbb eax, eax
inc eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
inc eax
mov dword [ebp - 0x6a4], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x40], ebx
xor ebx, ebx
mov dword [ebp - 0x38], esi
inc ebx
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x10032d1f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9e0], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10032d0b
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10032d3e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x674], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10032d2a
xor eax, eax
mov dword [ebp - 0x28], eax
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x670]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x670]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x670]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x9dc], edi
mov eax, dword [ebp - 0x10]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edi
mov eax, dword [ebp - 0x10]
setle cl
dec eax
neg eax
sbb eax, eax
inc eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x674], ecx
mov dword [ebp - 0x24], 0x74b666a7
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x10032dbd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf68], 0x963ba20b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10032da5
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x10032ddd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9e8], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10032dc5
xor eax, eax
mov edx, ebx
cmp dword [ebp - 0x24], eax
jne 0x10032de6
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
push 9
pop esi
cmp eax, esi
setne cl
xor eax, eax
cmp ecx, edx
je 0x10032e00
cmp dword [ebp - 0x48], eax
je 0x10032e00
mov eax, ebx
mov edi, dword [sym.imp.GDI32.dll_CreateFontA]
add eax, 0xd41e5596
je 0x10032e64
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10032e5d
mov dword [ebp - 0x48], eax
jmp 0x10032e3a
mov dword [ebp - 0x718], eax
mov dword [ebp - 0x714], eax
mov dword [ebp - 0x710], eax
mov dword [ebp - 0x70c], eax
dec dword [ebp - 0x710]
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
jle 0x10032e19
mov dword [ebp - 0x48], eax
jmp 0x10032e55
mov dword [ebp - 0x28], 0x9cb0befc
mov dword [ebp - 0x28], 0xc41ac3dc
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
jle 0x10032e44
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10032e14
jmp 0x10032edc
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], al
je 0x10032eaf
push eax
push 0x22b4
push 0xd
push 0x2405
push 0x54f
push 0xbc8
push 0x159b
push 0x281
push 0xa8
push 0x4c
push 0xcb2
push 0x24a6
push 0xb22
push 0x1603
call edi
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jle 0x10032ec6
cmp dword [ebp - 0x24], eax
je 0x10032ec6
mov eax, ebx
cmp eax, dword [ebp - 0x48]
jne 0x10032ece
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x9e8], eax
xor eax, eax
mov esi, dword [sym.imp.GDI32.dll_GetTextExtentPointA]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x10032f06
push eax
push 0x79a
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
xor eax, eax
mov dword [ebp - 0x10], 0x3644
xor ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x40], 0x915bb00
mov dword [ebp - 0x38], 0xee3f2f34
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10032f3f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9fc], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10032f2a
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10032f5e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x680], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10032f4a
xor eax, eax
mov dword [ebp - 0x28], eax
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov edx, 0x485b
mov eax, dword [ebp - 0x67c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x67c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x67c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x9f8], edx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
push 0xfffffffffffffffb
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
mov eax, dword [ebp - 0x10]
setle cl
dec eax
neg eax
sbb eax, eax
inc eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x680], ecx
mov dword [ebp - 0x14], 0xb9f9b319
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x38], 0xe28d
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0x14
cmp dword [ebp - 0x14], 0xe
pop ecx
je 0x1003307f
mov dword [ebp - 0x10], ecx
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x10032ff9
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add eax, 6
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x14], eax
jl 0x10033018
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10033018
mov edx, eax
jmp 0x1003301d
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
push 0
setle cl
xor ebx, ebx
cmp ecx, eax
setge bl
xor edx, edx
imul ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ebx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x14]
setge cl
sub edx, ecx
neg edx
sbb edx, edx
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov eax, dword [ebp - 0x38]
inc edx
cmp eax, edx
pop eax
setg cl
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xe
push 0xfffffffffffffffb
pop ecx
jne 0x10032fe4
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x24], 0x74b666a7
mov dword [ebp - 0x48], eax
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x100330ac
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xec8], 0x963ba20b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10033094
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x100330cc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa10], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100330b4
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100330d8
xor eax, eax
lea edx, [eax + 1]
jmp 0x100330da
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, 9
setne cl
xor eax, eax
cmp ecx, edx
je 0x100330f7
cmp dword [ebp - 0x48], eax
je 0x100330f7
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x100330fa
xor ecx, ecx
inc ecx
add eax, 0xd41e5596
je 0x10033158
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10033151
mov dword [ebp - 0x48], eax
jmp 0x1003312e
mov dword [ebp - 0x730], eax
mov dword [ebp - 0x72c], eax
mov dword [ebp - 0x728], eax
mov dword [ebp - 0x724], eax
dec dword [ebp - 0x728]
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ecx
jle 0x1003310d
mov dword [ebp - 0x48], eax
jmp 0x10033149
mov dword [ebp - 0x28], 0x9cb0befc
mov dword [ebp - 0x28], 0xc41ac3dc
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ecx
jle 0x10033138
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x10033108
jmp 0x100331d3
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], al
je 0x100331a6
push eax
push 0x22b4
push 0xd
push 0x2405
push 0x54f
push 0xbc8
push 0x159b
push 0x281
push 0xa8
push 0x4c
push 0xcb2
push 0x24a6
push 0xb22
push 0x1603
call edi
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jle 0x100331bd
cmp dword [ebp - 0x24], eax
je 0x100331bd
mov eax, ecx
cmp eax, dword [ebp - 0x48]
jne 0x100331c5
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xa10], eax
xor eax, eax
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x100331f1
push eax
push 0x79a
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
xor eax, eax
mov dword [ebp - 0x2c], eax
or ecx, 0xffffffff
mov dword [ebp - 0x3c], 0x15256ee9
mov dword [ebp - 0x30], 0x2dfce95
mov dword [ebp - 0x30], 0x83faa058
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x4f34d89b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10033234
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10bc], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003321f
xor eax, eax
mov dword [ebp - 0x2c], 0xc
jmp 0x10033321
mov dword [ebp - 0x34], 0x5dae5a6
mov dword [ebp - 0x30], 0x1456b864
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x30], 0x361cd5cc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10033281
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1168], 0xb531eaa4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10033268
xor eax, eax
mov dword [ebp - 0x5a0], eax
mov dword [ebp - 0x59c], eax
mov dword [ebp - 0x598], eax
mov dword [ebp - 0x594], eax
mov dword [ebp - 0x38], 0xcdf8abff
cmp dword [ebp - 0x34], eax
jne 0x1003332e
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
neg eax
cmp eax, ecx
jb 0x100333d2
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x100333d4
xor edx, edx
mov ecx, eax
inc edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x2c], eax
je 0x100332f3
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x5a0]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp eax, edx
mov eax, dword [ebp - 0x34]
setle cl
xor edx, edx
cmp ecx, eax
push 0
setl dl
sub edx, dword [ebp - 0x34]
neg edx
pop eax
sbb edx, edx
inc edx
mov dword [ebp - 0x5a0], edx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff4
push 0xfffffffffffffffa
pop ecx
jle 0x10033240
xor edx, edx
inc edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x38], 0xfffffff8
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x10033352
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff5
je 0x10033408
push 3
mov dword [ebp - 0x3c], 0x32fd2d1a
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x14], eax
jne 0x1003337a
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp eax, 0xfffffffd
setg cl
xor eax, eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x14], eax
je 0x100333b9
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0x6d5d64f6
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x100333ea
mov dword [ebp - 0x28], 0xaedf47f2
jmp 0x100333f1
xor eax, eax
cmp dword [ebp - 0x5a0], eax
je 0x100332c5
xor edx, edx
inc edx
mov ecx, edx
jmp 0x100332ca
mov dword [ebp - 0x28], 0xafca8629
cmp dword [ebp - 0x28], eax
jne 0x10033406
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff5
push 0
pop eax
jne 0x1003335f
xor eax, eax
mov dword [ebp - 0x30], eax
mov ecx, 0x51c3
mov dword [ebp - 0x30], 0x20398070
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x30], 0x974b666a
mov dword [ebp - 0x30], 0x9a92
mov dword [ebp - 0x748], ecx
mov dword [ebp - 0x744], ecx
mov dword [ebp - 0x740], ecx
mov dword [ebp - 0x73c], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10033462
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1248], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10033449
xor eax, eax
inc dword [ebp - 0x744]
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x10033497
push eax
call ebx
push eax
push 0xb7
push 0x49e
push 0x1c49
push 0x1e61
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenu]
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x24], 0x3644
mov dword [ebp - 0x38], 0x3edb
mov dword [ebp - 0x10], 0x19c2
mov dword [ebp - 0x3c], 0x1efae07d
push 0xfffffffffffffff9
pop ecx
mov dword [ebp - 0x2d4], ecx
mov dword [ebp - 0x2d0], ecx
mov dword [ebp - 0x2cc], ecx
mov dword [ebp - 0x2c8], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x100334fa
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x150], 0x26595ad3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100334e2
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10033510
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xee8], 0x2a7fad54
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100334ff
imul eax, dword [ebp - 0x38], 0xfffffff8
cmp eax, edx
ja 0x10033524
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x150]
xor ecx, ecx
mov eax, dword [ebp - 0x150]
cmp eax, edx
setl cl
mov dword [ebp - 0x150], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x10]
cmp eax, 0xa9864ba8
mov eax, dword [ebp - 0x2d4]
sbb ecx, ecx
xor edx, edx
neg ecx
sub ecx, eax
mov eax, dword [ebp - 0x2d4]
sub ecx, eax
mov eax, dword [ebp - 0x2c8]
imul ecx, ecx, 0xe213
cmp ecx, eax
setne dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x2d4]
mov eax, dword [ebp - 0x2cc]
xor eax, eax
mov dword [ebp - 0xee4], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2d4]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
xor eax, eax
cmp ecx, dword [ebp - 0x2d4]
jle 0x100335ad
cmp dword [ebp - 0x44], eax
je 0x100335b8
cmp dword [ebp - 0x150], eax
je 0x100335b8
xor eax, eax
inc eax
mov ecx, 0xdb3fa3ce
cmp ecx, eax
mov eax, dword [ebp - 0x44]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov ecx, 0x4e401d93
setne dl
xor eax, eax
sub edx, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x34], eax
or edx, 0xffffffff
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x10], 0x68ab8ac2
mov dword [ebp - 0x10], eax
jmp 0x10033620
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd48], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003360f
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
cmp eax, edx
mov eax, dword [ebp - 0x34]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x15bb
setle al
xor edx, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x42c]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x42c]
mov ecx, 0x14be495e
setle dl
add eax, edx
je 0x1003371c
xor eax, eax
cmp dword [ebp - 0x428], eax
je 0x1003371e
mov dword [ebp - 0x38], 0x88ad
mov dword [ebp - 0x28], 0x8c74c3ee
mov dword [ebp - 0x91c], ecx
mov dword [ebp - 0x918], ecx
mov dword [ebp - 0x914], ecx
mov dword [ebp - 0x910], ecx
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], al
je 0x100336dc
push eax
push 0x1cae
push 0x1315
push 0x7e1
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [ebp - 0x38]
xor edx, edx
push 9
pop eax
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, 0xa8d6e859
setg dl
cmp eax, edx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x91c], ecx
mov eax, dword [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0xd40], eax
mov eax, dword [ebp - 0x42c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
jmp 0x10033774
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1003375c
cmp byte [ebp - 0x16], 0
je 0x10033742
push eax
push 0x2474
push eax
push 0xad1
push 0x4a0
call dword [sym.imp.GDI32.dll_ExtCreatePen]
xor eax, eax
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x10033759
push 0x299
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
mov byte [ebp - 0x16], al
jle 0x10033723
cmp byte [ebp - 0x16], 0
je 0x10033776
call ebx
push eax
call dword [sym.imp.USER32.dll_IsIconic]
xor eax, eax
mov dword [ebp - 0x1c], 0xc03342eb
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x30], 0xc1e1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x100337b4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1108], 0x7ab89bdd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1003379b
xor eax, eax
mov dword [ebp - 0x14], eax
or edx, 0xffffffff
cmp dword [ebp - 0x14], 2
jge 0x100337d5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xfc8], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100337c0
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x1c], eax
inc ecx
cmp dword [ebp - 0x1c], 6
jl 0x1003385a
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10033808
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x11e8], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100337f3
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1003382a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xcf4], 0x7ae2718b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10033811
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10033840
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7f8], 0xae88b149
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003382f
inc dword [ebp - 0x7f8]
mov eax, dword [ebp - 0xcf0]
inc dword [ebp - 0x1c]
push 0
pop eax
jmp 0x100337db
mov dword [ebp - 0x4c], 0x915bb00
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x10], 0xfffffffd
mov eax, dword [ebp - 0x20]
push 0xfffffffffffffffa
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xfffffff5
pop edx
jmp 0x100339f6
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0xf9e
mov dword [ebp - 0x38], 0xb7bfbc35
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], eax
jmp 0x100338aa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x31c], 0x230b63e9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10033899
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
je 0x100338c0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x20]
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setne cl
xor eax, eax
add ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x1c]
jne 0x100338f0
cmp dword [ebp - 0x20], eax
je 0x100338f0
inc eax
push 0xfffffffffffffffa
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0xbf20160d
cmp edx, eax
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x31c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xb13b1067
sete cl
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
je 0x1003395c
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
inc ecx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setge dl
mov dword [ebp - 0x31c], eax
xor ecx, ecx
cmp edx, 0x9b22
setle cl
imul ecx, eax
neg ecx
je 0x100339b9
mov dword [ebp - 0x14], 4
jmp 0x100339a0
mov dword [ebp - 0x28], 0xc6c2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jge 0x10033990
xor eax, eax
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], al
je 0x100339ed
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x100339ed
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x100339da
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x100339d5
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x100339c3
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x100339ed
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_EndDialog]
inc dword [ebp - 0x20]
push 0xfffffffffffffffa
pop edx
push 1
pop ecx
xor eax, eax
cmp dword [ebp - 0x20], edx
jg 0x10033880
xor ebx, ebx
mov dword [ebp - 0x44], 0xee3f2f34
inc ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x10], eax
jmp 0x10033a27
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10033a1a
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
je 0x10033a47
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10033a47
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
add eax, 0xc424
je 0x10033bbf
mov dword [ebp - 0x2c], 0xe49a2f38
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], 0x47430797
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10033a89
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb14], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10033a74
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10033ad5
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0xb10], ecx
mov eax, dword [ebp - 0x118]
sub eax, ecx
je 0x10033aaf
xor eax, eax
cmp dword [ebp - 0x118], eax
je 0x10033ab1
mov ecx, ebx
jmp 0x10033ab3
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0x50dfa014
sete al
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10033ace
mov eax, dword [ebp - 0xb14]
mov eax, dword [ebp - 0x38]
mov ecx, ebx
jmp 0x10033ad7
mov ecx, eax
mov eax, dword [ebp - 0x2c]
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 9
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x11c]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x10033bda
mov dword [ebp - 0x28], 0x4cb070fc
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x10033b2e
push eax
push 0x83
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10033b4f
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x118]
add eax, 2
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
jne 0x10033b4f
xor eax, eax
mov ecx, eax
jmp 0x10033b51
mov ecx, ebx
mov eax, dword [ebp - 0x14]
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x11c]
cmp ecx, eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x118]
setle bl
xor edx, edx
cmp eax, ecx
setne dl
cmp edx, ebx
jne 0x10033b97
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x11c], ecx
je 0x10033b97
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x11c], ecx
je 0x10033b97
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x10033b9e
xor eax, eax
xor ebx, ebx
mov edx, eax
inc ebx
mov eax, dword [ebp - 0xb10]
xor ecx, ecx
cmp edx, eax
push 0
sete cl
imul eax, ecx, 5
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x14]
pop eax
jns 0x10033b0f
jmp 0x10033bd8
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x40], 0xc6b039b7
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10033bfb
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb8], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10033be6
xor eax, eax
dec dword [ebp - 0xb8]
cmp dword [ebp - 0xb4], eax
je 0x10033c5e
push 0xfffffffffffffffb
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], 0x13
jmp 0x10033c33
cmp dword [ebp - 0x14], eax
jne 0x10033c39
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x10033c30
push eax
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xf
jg 0x10033c18
mov dword [ebp - 0x14], eax
jmp 0x10033c53
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x10033c50
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe7
jne 0x10033c3e
jmp 0x10033d3a
mov dword [ebp - 0x48], 0xf37c04cc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], ebx
jg 0x10033d23
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0x389a
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0xb8]
mov edx, dword [ebp - 0x10]
sub edx, eax
mov eax, dword [ebp - 0x48]
imul edx, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x48]
sub edx, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x48]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
sub ecx, 6
cmp ecx, dword [ebp - 0xb8]
jge 0x10033cc6
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x10], 0x55f992db
jl 0x10033cf2
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
push 0
mov eax, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x48]
inc ecx
mov dword [ebp + eax*4 - 0xb8], ecx
inc dword [ebp - 0x48]
pop eax
cmp dword [ebp - 0x48], ebx
jle 0x10033c74
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x10033d3a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x10033d5b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa24], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10033d47
xor eax, eax
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], 6
jmp 0x10033df4
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10033d9b
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbcc], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10033d86
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x10033dbb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xed8], 0xd9637855
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10033da3
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10033dfe
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jg 0x10033df1
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xbcc]
cmp eax, ebx
mov eax, dword [ebp - 0x1c]
setg cl
imul ecx, dword [ebp + eax*4 - 0xbcc]
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x10033dc8
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffee
jl 0x10033d74
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x10033e19
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 2
xor eax, eax
pop edx
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10033e38
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x698], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10033e24
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x28], 0x19fa4a60
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x10033e66
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1bc], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10033e4e
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10033e85
or edx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd60], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10033e71
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x10033faf
mov dword [ebp - 0x38], 0x1e9942c3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10033eb5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x58], 0x9c17633e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10033ea0
xor eax, eax
mov dword [ebp - 0x58], ebx
cmp dword [ebp - 0x58], eax
jl 0x10033ecf
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0x1bc], 0
jne 0x10033ecf
dec dword [ebp - 0x58]
jns 0x10033ebd
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x1b8]
mov eax, dword [ebp - 0x1bc]
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
add ecx, 0xfffffff6
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x58]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x58]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x14]
sete bl
sub ebx, 0xfffffff6
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x1b8]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1bc]
setge dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x58]
cmp edx, eax
setle cl
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], 0x15d0
je 0x10033f70
xor eax, eax
cmp dword [ebp - 0x1bc], eax
je 0x10033f70
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x58]
xor edx, edx
mov eax, dword [ebp - 0x58]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
push 0
setl cl
xor ebx, ebx
inc ebx
mov dword [ebp - 0xd58], ecx
cmp ebx, ecx
sbb eax, eax
neg eax
sub eax, 0x4a08deb2
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x14]
pop eax
jns 0x10033e91
mov dword [ebp - 0x28], eax
or ecx, 0xffffffff
mov eax, dword [ebp - 0x24]
mov edx, 0x485b
mov eax, dword [ebp - 0x694]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x694]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x694]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xa20], edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
push 0xfffffffffffffff7
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
mov eax, dword [ebp - 0x24]
setle cl
dec eax
neg eax
sbb eax, eax
inc eax
sub ecx, eax
neg ecx
pop eax
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x698], ecx
mov dword [ebp - 0x14], 0x4e064826
mov dword [ebp - 0x38], 0x493e623b
mov dword [ebp - 0x8bc], eax
mov dword [ebp - 0x8b8], eax
mov dword [ebp - 0x8b4], eax
mov dword [ebp - 0x8b0], eax
mov dword [ebp - 0x14], 5
jmp 0x100340c5
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x38], 0x12f3ccd2
cmp dword [ebp - 0x14], eax
je 0x100340b0
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp eax, 0x145c
setl cl
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
setl bl
xor edx, edx
cmp ecx, eax
setle dl
xor eax, eax
cmp ebx, edx
setge al
add eax, dword [ebp - 0x10]
jne 0x100340a4
cmp dword [ebp - 0x14], eax
je 0x100340ab
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x100340b2
xor ebx, ebx
xor eax, eax
inc ebx
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x8b4], ecx
inc dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], 0x17
je 0x1003403c
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], al
je 0x100340e9
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
mov dword [ebp - 0x14], 0xb9f9b319
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x38], 0xe28d
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0x14
cmp dword [ebp - 0x14], 0xe
je 0x100341a5
push 0xfffffffffffffffb
pop ecx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x1003412a
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add eax, 6
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x14], eax
jl 0x10034147
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x10034149
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
push 0
setle cl
xor ebx, ebx
cmp ecx, eax
setge bl
xor edx, edx
imul ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ebx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x14]
setge cl
sub edx, ecx
neg edx
sbb edx, edx
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov eax, dword [ebp - 0x38]
inc edx
cmp eax, edx
pop eax
setg cl
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xe
push 1
pop ebx
jne 0x10034112
mov dword [ebp - 0x24], 0x74b666a7
mov dword [ebp - 0x48], eax
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x100341d2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf80], 0x963ba20b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100341ba
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x100341f2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa38], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100341da
xor eax, eax
xor ebx, ebx
inc ebx
mov edx, ebx
cmp dword [ebp - 0x24], eax
jne 0x100341fe
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, 9
setne cl
xor eax, eax
cmp ecx, edx
je 0x10034216
cmp dword [ebp - 0x48], eax
je 0x10034216
mov eax, ebx
add eax, 0xd41e5596
je 0x10034274
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1003426d
mov dword [ebp - 0x48], eax
jmp 0x1003424a
mov dword [ebp - 0x760], eax
mov dword [ebp - 0x75c], eax
mov dword [ebp - 0x758], eax
mov dword [ebp - 0x754], eax
dec dword [ebp - 0x758]
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
jle 0x10034229
mov dword [ebp - 0x48], eax
jmp 0x10034265
mov dword [ebp - 0x28], 0x9cb0befc
mov dword [ebp - 0x28], 0xc41ac3dc
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
jle 0x10034254
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10034224
jmp 0x100342ec
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], al
je 0x100342bf
push eax
push 0x22b4
push 0xd
push 0x2405
push 0x54f
push 0xbc8
push 0x159b
push 0x281
push 0xa8
push 0x4c
push 0xcb2
push 0x24a6
push 0xb22
push 0x1603
call edi
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jle 0x100342d6
cmp dword [ebp - 0x24], eax
je 0x100342d6
mov eax, ebx
cmp eax, dword [ebp - 0x48]
jne 0x100342de
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xa38], eax
xor eax, eax
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x1003430e
push eax
push 0x79a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
xor eax, eax
mov dword [ebp - 0x2c], eax
or ecx, 0xffffffff
mov dword [ebp - 0x3c], 0x15256ee9
mov dword [ebp - 0x30], 0x2dfce95
mov dword [ebp - 0x30], 0x83faa058
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x4f34d89b
push 3
mov dword [ebp - 0x10], eax
pop edi
cmp dword [ebp - 0x10], edi
jge 0x10034352
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x102c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003433e
xor eax, eax
mov dword [ebp - 0x2c], 0xc
jmp 0x10034445
mov dword [ebp - 0x34], 0x5dae5a6
mov dword [ebp - 0x30], 0x1456b864
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x30], 0x361cd5cc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1003439f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1128], 0xb531eaa4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10034386
xor eax, eax
mov dword [ebp - 0x5b4], eax
mov dword [ebp - 0x5b0], eax
mov dword [ebp - 0x5ac], eax
mov dword [ebp - 0x5a8], eax
mov dword [ebp - 0x38], 0xcdf8abff
cmp dword [ebp - 0x34], eax
jne 0x1003444f
mov eax, dword [ebp - 0x34]
neg eax
push 0xfffffffffffffffa
sbb eax, eax
neg eax
pop ecx
cmp eax, ecx
jb 0x100343e0
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x100343ec
jmp 0x100343e2
xor eax, eax
mov ecx, ebx
cmp dword [ebp - 0x5b4], eax
jne 0x100343ee
mov ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x2c], eax
je 0x10034417
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x5b4]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
mov eax, dword [ebp - 0x34]
setle cl
xor edx, edx
cmp ecx, eax
push 0
setl dl
sub edx, dword [ebp - 0x34]
neg edx
pop eax
sbb edx, edx
inc edx
mov dword [ebp - 0x5b4], edx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff4
jle 0x1003435e
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x38], 0xa43d9532
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003447f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa4c], 0xcbad86e5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10034466
xor eax, eax
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x100344a0
push eax
push 0x2b8
push eax
push eax
push 0x1121
push 0x646
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov eax, dword [ebp - 0x28]
neg eax
push 0xfffffffffffffff7
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xa48], eax
mov dword [ebp - 0x14], 0x4e064826
mov dword [ebp - 0x38], 0x493e623b
pop eax
mov dword [ebp - 0x9bc], eax
mov dword [ebp - 0x9b8], eax
mov dword [ebp - 0x9b4], eax
mov dword [ebp - 0x9b0], eax
mov dword [ebp - 0x14], 5
jmp 0x1003456f
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x38], 0x12f3ccd2
cmp dword [ebp - 0x14], eax
je 0x1003455a
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp eax, 0x145c
setl cl
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
setl bl
xor edx, edx
cmp ecx, eax
setle dl
xor eax, eax
cmp ebx, edx
setge al
add eax, dword [ebp - 0x10]
jne 0x1003454e
cmp dword [ebp - 0x14], eax
je 0x10034555
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x1003455c
xor ebx, ebx
xor eax, eax
inc ebx
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x9b4], ecx
inc dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], 0x17
je 0x100344ea
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], al
je 0x10034595
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov ecx, 0xbea5223f
mov dword [ebp - 0x44], 0xfffc
mov dword [ebp - 0x30], 0xfffb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe8
jne 0x10034656
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x3cc], eax
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x3c4], eax
mov dword [ebp - 0x3c0], eax
mov dword [ebp - 0x8dc], ecx
mov dword [ebp - 0x8d8], ecx
mov dword [ebp - 0x8d4], ecx
mov dword [ebp - 0x8d0], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x8d8], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x3cc]
cmp eax, 0xe503
setg cl
xor edx, edx
dec ecx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c4]
sub ecx, eax
mov eax, dword [ebp - 0x3cc]
cmp ecx, eax
mov eax, dword [ebp - 0x3cc]
sete dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x3cc], ecx
mov ecx, 0xbea5223f
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe8
je 0x100345b8
xor eax, eax
dec dword [ebp - 0x44]
mov dword [ebp - 0x14], 0xb9f9b319
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x38], 0xe28d
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0x14
cmp dword [ebp - 0x14], 0xe
je 0x10034715
push 0xfffffffffffffffb
pop ecx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x1003469a
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add eax, 6
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x14], eax
jl 0x100346b7
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x100346b9
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
push 0
setle cl
xor ebx, ebx
cmp ecx, eax
setge bl
xor edx, edx
imul ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ebx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x14]
setge cl
sub edx, ecx
neg edx
sbb edx, edx
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov eax, dword [ebp - 0x38]
inc edx
cmp eax, edx
pop eax
setg cl
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xe
push 1
pop ebx
jne 0x10034682
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10034735
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4dc], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003471d
xor eax, eax
mov dword [ebp - 0x4d4], 0xffffffe9
jmp 0x1003476d
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x10034767
push eax
push 0xcec
push 0x1fa8
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
xor eax, eax
inc dword [ebp - 0x4d4]
cmp dword [ebp - 0x4d4], 0xfffffff0
jl 0x10034741
push 0xfffffffffffffffb
pop ecx
mov dword [ebp - 0x14], 0x5d6c05ba
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffe6
push 8
pop ecx
jl 0x1003485d
xor ebx, ebx
inc ebx
mov dword [ebp - 0x10], eax
jmp 0x100347ac
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x204], 0x3c6fe23a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003479b
mov eax, dword [ebp - 0x200]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x100347ca
mov eax, dword [ebp - 0x200]
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1fc]
mov eax, dword [ebp - 0x204]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x200]
mov eax, dword [ebp - 0x204]
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x204], ebx
jl 0x10034841
mov dword [ebp - 0x3c], 0x2d50fa8f
mov ecx, ebx
mov dword [ebp - 0x28], 0x550e3526
mov dword [ebp - 0x200], 0xbb08
cmp dword [ebp - 0x14], eax
jne 0x10034819
mov ecx, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
inc eax
sub eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
jg 0x1003482f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp eax, ebx
push 8
setl cl
mov dword [ebp - 0x28], ecx
pop ecx
jmp 0x10034849
cmp dword [ebp - 0x200], eax
jne 0x10034859
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe6
push 0
pop eax
jge 0x10034796
xor eax, eax
jmp 0x10034860
xor ebx, ebx
inc ebx
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x10034872
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
xor eax, eax
mov dword [ebp - 0x14], 0xac204e2d
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov edi, 0xfff6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x13
jle 0x100348e3
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x100348ac
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x34]
test eax, eax
jne 0x100348ac
mov ecx, eax
cmp dword [ebp - 0x34], eax
je 0x100348ae
mov ecx, ebx
mov eax, dword [ebp - 0x34]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, edi
jb 0x100348c9
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x13
jg 0x1003488d
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffed
jle 0x1003495d
push 3
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1003490f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9f4], 0xb1af9d66
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100348f7
xor eax, eax
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], eax
jl 0x10034954
mov dword [ebp - 0x10], 0xcef3cf68
mov dword [ebp - 0x10], eax
jmp 0x10034938
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9f4], 0x92079655
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034927
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x9f4], 0
jne 0x10034952
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffed
jg 0x100348ef
mov dword [ebp - 0x34], 0x74b666a7
mov dword [ebp - 0x2c], 0x9841b3c6
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x1003497d
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x100349f6
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100349a7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc38], 0xd149febb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003498e
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x100349f3
cmp dword [ebp - 0x2c], 0x18
jne 0x10034982
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], 0xccc9
mov dword [ebp - 0x44], 0xc590f023
mov dword [ebp - 0x28], 0x7c
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], ebx
push 2
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x10034a39
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x708], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10034a25
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x10034a55