Function at 0x10036c66
Capabilities:
Accept command line arguments
Connect pipe
Query environment variable

Disassembly:
mov eax, 0x1005e20c
call fcn.1005d3b0
sub esp, 0x180
push ebx
push esi
mov dword [ebp - 0x50], ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x24], ebx
jmp 0x10036c9d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x144], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10036c90
push 3
mov dword [ebp - 0x20], ebx
pop esi
jmp 0x10036cf1
mov dword [ebp - 0x1c], 0xccce1e2c
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10036cc2
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetRgnBox]
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], ebx
jl 0x10036cee
mov dword [ebp - 0x24], 0x9e923e64
mov dword [ebp - 0x24], ebx
jmp 0x10036ce3
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x144], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10036cd6
dec dword [ebp - 0x1c]
jns 0x10036cca
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10036cab
mov dword [ebp - 0x2c], 0x94801897
xor edi, edi
mov dword [ebp - 0x18], 7
inc edi
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], ebx
jmp 0x10036d9b
mov dword [ebp - 0x2c], 0xfff6
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x34], edi
push esi
call fcn.1002a6d6
mov dword [ebp - 0x24], ebx
jmp 0x10036d46
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x110]
mov dword [eax + ecx*4], 0x678e045d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10036d33
cmp dword [ebp - 0x30], 0xffffffff
je 0x10036d57
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x110]
mov dword [eax + 4], 0x641b44ad
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10036d8d
push 0x1849
push 0x93d
push 0x2478
call dword [sym.imp.USER32.dll_CheckDlgButton]
lea ecx, [ebp - 0x110]
call fcn.1002a758
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jge 0x10036d18
mov eax, dword [0x10607640]
test al, 1
jne 0x10036e38
or eax, edi
mov dword [0x10607640], eax
push ebx
mov dword [ebp - 4], ebx
push ebx
mov dword [0x10607600], ebx
mov dword [0x10607604], ebx
call fcn.100388c8
mov dword [0x10607600], eax
mov dword [0x10607608], ebx
mov dword [0x10607610], ebx
mov byte [ebp - 4], 2
mov ecx, 0x10607608
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x94]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x118]
mov dword [0x1060761c], 0x3f800000
push eax
mov dword [0x1060760c], ebx
call fcn.100386a0
push 0x1005e7cd
mov dword [0x10607614], 7
mov dword [0x10607618], 8
call fcn.100480ac
or dword [ebp - 4], 0xffffffff
pop ecx
push 2
lea ecx, [ebp - 0x64]
call fcn.1002a6d6
push 2
lea ecx, [ebp - 0x90]
mov dword [ebp - 4], esi
call fcn.1002a6d6
mov dword [ebp - 0x58], edi
push 2
mov dword [ebp - 0x28], 0x7d872568
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10036e70
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x64]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10036e64
mov dword [ebp - 0x18], ebx
jmp 0x10036e8d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x90]
mov dword [eax + ecx*4], 0x6915a136
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10036e7a
mov edx, dword [ebp - 0x64]
mov esi, dword [ebp - 0x90]
mov dword [ebp - 0x34], esi
lea eax, [edx + 4]
mov dword [esi + 4], ebx
mov dword [ebp - 0x2c], eax
mov ecx, dword [esi + 4]
mov eax, dword [eax]
mov dword [ebp - 0x1c], 0x4bcd76ce
mov dword [ebp - 0x20], 0x17779a7
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], 0x49e864ad
mov dword [ebp - 0x48], 0x656207cc
mov dword [edx + ecx*4], eax
cmp eax, edi
jge 0x10036edb
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
test eax, eax
sets cl
imul ecx, dword [ebp - 0x30]
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], ebx
je 0x10036f0b
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100370cc
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x100370cc
mov dword [ebp - 0x40], 0xfffd
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 0x2e55fdcf
cmp dword [ebp - 0x40], ebx
je 0x10037025
mov dword [ebp - 0x1c], 6
xor edx, edx
mov dword [ebp - 0x24], 0xd469f41a
mov dword [ebp - 0x24], 4
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], edi
jg 0x100370cc
mov ebx, dword [ebp - 0x34]
mov eax, dword [ebx + 4]
xor edx, edx
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x24], 0xf2c0e848
mov dword [ebp - 0x24], 0x6fb6c717
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 4]
mov ecx, dword [ecx + eax*4]
mov eax, dword [ebp - 0x24]
sub ecx, 0x8356
add eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebx + 4]
mov ecx, dword [ebp - 0x64]
cmp dword [ecx + eax*4], edi
mov esi, dword [ecx + eax*4]
mov eax, dword [ebp - 0x18]
setne dl
add eax, edx
xor ecx, ecx
cmp eax, 0x44ba
setg cl
cmp ecx, 0xfffffff7
sbb eax, eax
xor ecx, ecx
inc eax
add eax, dword [ebp - 0x1c]
cmp eax, esi
setg cl
xor eax, eax
cmp esi, ecx
sete al
xor ecx, ecx
cmp eax, 0x138d7efb
mov eax, dword [ebp - 0x38]
setge cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebx + 4]
mov eax, dword [ebp - 0x64]
setne dl
mov dword [eax + ecx*4], edx
xor eax, eax
cmp edx, 0xc907
setle al
xor edx, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setge dl
mov dword [ebp - 0x24], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x10036f63
mov esi, dword [ebp - 0x34]
xor ebx, ebx
jmp 0x100370cc
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x38], 0xd465c301
cmp dword [ebp - 0x40], ebx
jne 0x1003703f
mov edx, ebx
cmp dword [ebp - 0x18], ebx
je 0x10037041
mov edx, edi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x58]
cmp dword [esi + 4], eax
mov eax, dword [ebp - 0x1c]
setg cl
add eax, ecx
cmp dword [ebp - 0x24], eax
jg 0x10037068
mov eax, dword [ebp - 0x90]
mov ecx, edi
cmp dword [eax], ebx
jne 0x1003706a
mov ecx, ebx
xor eax, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x1c]
setge al
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
imul ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x90]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x48]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x64]
setge dl
xor ecx, ecx
imul edx, dword [eax]
mov eax, dword [ebp - 0x28]
cmp edx, eax
sete cl
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
sub ecx, dword [ebp - 0x30]
cmp ecx, 0x4cd
setg al
mov dword [ebp - 0x38], eax
inc dword [esi + 4]
mov ecx, dword [esi + 4]
cmp ecx, edi
jg 0x100370e1
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x2c]
jmp 0x10036ea7
xor eax, eax
test ecx, ecx
mov ecx, dword [ebp - 0x2c]
setne al
mov dword [ecx], eax
lea ecx, [ebp - 0x90]
call fcn.1002a758
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.1002a758
imul eax, dword [ebp - 0x50], 0x2710
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x54]
push eax
call fcn.10037fb7
mov esi, dword [eax]
test esi, esi
je 0x10037236
mov dword [ebp - 0x18], 0x399841b3
mov dword [ebp - 0x18], 0xc
jmp 0x100371b2
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x24], ebx
jmp 0x10037151
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x84], 0xfc520ea
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10037140
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xad5a519d
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, 0xfff8
setge dl
cmp eax, edx
sbb eax, eax
inc eax
cmp eax, edi
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
sub eax, edx
mov edx, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [ebp - 0x18]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x28]
mov dword [ebp - 0x84], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff7
jg 0x10037134
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0x6432a276
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x28], 0x95010f7a
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0xa23fe5e8
mov dword [ebp - 0x28], 0xd94e8fe7
mov dword [ebp - 0x28], 0xb0ad8ea5
mov dword [ebp - 0x28], 0xc266d8ff
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x24], ebx
jmp 0x10037228
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x17c], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1003721b
inc dword [ebp - 0x2c]
jmp 0x10037e7f
mov eax, dword [0x10607640]
test al, 2
jne 0x100372ca
or eax, 2
mov dword [0x10607640], eax
push ebx
mov dword [ebp - 4], 4
push ebx
mov dword [0x10607620], ebx
mov dword [0x10607624], ebx
call fcn.100388c8
mov dword [0x10607620], eax
mov dword [0x10607628], ebx
mov dword [0x10607630], ebx
push 6
pop ecx
mov byte [ebp - 4], cl
mov ecx, 0x10607628
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x80]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x114]
mov dword [0x1060763c], 0x3f800000
push eax
mov dword [0x1060762c], ebx
call fcn.100386a0
push 0x1005e7c8
mov dword [0x10607634], 7
mov dword [0x10607638], 8
call fcn.100480ac
or dword [ebp - 4], 0xffffffff
pop ecx
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x20], 0x37ad4351
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x24], 0xf
jmp 0x10037313
mov dword [ebp - 0x2c], 0x1dbeccce
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xfffffff5
jmp 0x1003730a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x19
je 0x100372fe
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x15
jle 0x100372e8
xorps xmm0, xmm0
movdqu xmmword [ebp - 0xb0], xmm0
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], 0xffffffe2
jmp 0x10037347
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10037344
push 0x766
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x18
jl 0x10037330
mov dword [ebp - 0x18], ebx
jmp 0x10037365
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10037362
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffef
jle 0x10037352
lea eax, [ebp - 0x50]
push eax
call fcn.10038019
mov esi, dword [eax]
mov dword [ebp - 0x38], 0x5d1a
cmp dword [ebp - 0x38], 0x5e6f
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x48], esi
jle 0x100373f5
mov dword [ebp - 0x34], ebx
mov eax, ebx
mov dword [ebp - 0x2c], 0x73a6
mov dword [ebp - 0x30], eax
mov esi, ebx
mov ecx, esi
shl eax, cl
lea ecx, [ebp - 0x170]
cdq
push edx
push eax
call fcn.1000cd20
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100373b9
mov eax, dword [eax]
push eax
call fcn.100480d6
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x170]
call fcn.1002aa62
mov eax, dword [ebp - 0x30]
inc esi
cmp esi, 0x154a
jl 0x1003739d
mov esi, dword [ebp - 0x34]
add eax, esi
dec dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
jne 0x1003739b
inc esi
mov dword [ebp - 0x34], esi
cmp esi, 0x4a63
jl 0x1003738f
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x2c], 0xaed2
cmp dword [ebp - 0x38], 0x5c18
jge 0x10037410
push 0x1000abd0
call fcn.100480d6
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], 0xfc42ff18
mov dword [ebp - 0x28], 0xb65a
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1003743b
push 0x23bf
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [ebp - 0x20]
or ecx, 0xffffffff
sub ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, 0xc7ab
setg dl
xor ecx, ecx
sub eax, edx
cmp eax, 0xda72
setne cl
add ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x18]
jl 0x1003746d
mov edx, edi
cmp dword [ebp - 0x20], ebx
jne 0x1003746f
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, dword [ebp - 0x20]
jne 0x10037481
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], 0xfffffff9
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov al, byte [ebp + 0xc]
mov dword [ebp - 0x20], ebx
test al, al
jne 0x100374ac
test esi, esi
jne 0x10037923
lea ecx, [ebp - 0x18c]
mov dl, al
push ecx
mov ecx, dword [ebp - 0x50]
call fcn.1002c7de
mov esi, eax
lea edi, [ebp - 0xb0]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x30], 0xfb63
xor edi, edi
mov dword [ebp - 0x1c], 0xfffffff9
inc edi
mov dword [ebp - 0x20], ebx
jmp 0x100374ee
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x4c], 9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100374e0
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10037503
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
xor ecx, ecx
mov dword [ebp - 0x4c], 0xffffffff
mov eax, dword [ebp - 0x1c]
cmp eax, edi
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
cmp ecx, eax
setne dl
xor ecx, ecx
sub edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
sub edx, 0x6a76
cmp eax, 0xffffffff
setg cl
cmp ecx, edx
jg 0x10037628
mov dword [ebp - 0x30], 0x52ac
cmp dword [ebp - 0x30], 0x54f3
jle 0x100375c7
push ebx
push 0x12e1
push 0x26f0
push 0x6a
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, ebx
mov dword [ebp - 0x38], ebx
mov esi, ebx
mov dword [ebp - 0x34], ebx
mov eax, edi
mov ecx, ebx
cdq
idiv esi
mov dword [ebp - 0x2c], ecx
mov esi, edx
mov eax, esi
mov edi, 0x457d
cdq
idiv ecx
mov ebx, edx
mov eax, ebx
mov ecx, 0x10606538
cdq
push edx
push eax
call fcn.1002a5c1
inc ebx
dec edi
jne 0x10037582
mov ecx, dword [ebp - 0x2c]
inc ecx
mov dword [ebp - 0x2c], ecx
cmp ecx, 0x3203
jl 0x10037576
mov esi, dword [ebp - 0x34]
inc esi
mov dword [ebp - 0x34], esi
push edi
mov edi, dword [ebp - 0x38]
pop ebx
cmp esi, 0x35b3
jl 0x1003756a
inc edi
mov dword [ebp - 0x38], edi
cmp edi, 0x2e2
jl 0x10037565
xor edi, edi
inc edi
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100375d8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov dword [ebp - 4], 9
cmp dword [ebp - 0x30], 0x5211
jge 0x100375f7
mov edx, 0x1000abe8
mov ecx, 0x10606538
call fcn.1002c06b
or dword [ebp - 4], 0xffffffff
jmp 0x1003764b
mov dword [ebp - 0x28], 0x611fb8eb
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
add eax, 0x389a9b8f
mov dword [ebp - 0x28], eax
cmp byte [ebp + 0xc], 0
je 0x10037923
cmp dword [ebp - 0xa8], 0
je 0x10037923
mov dword [ebp - 0x28], 0xb0f73838
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x2c], 0x4a53
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], 0xd44ad374
push 2
call fcn.1002a6d6
mov dword [ebp - 0x18], 0xb6f9b691
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x20], ebx
jmp 0x100376ac
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], 0xcafe8b0d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10037699
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x18]
jne 0x10037704
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xcc]
neg eax
sbb eax, eax
inc eax
mov dword [ecx + 4], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jle 0x100376fe
mov eax, dword [ebp - 0x30]
mov dword [ecx + 4], eax
test eax, eax
je 0x100376ef
mov eax, dword [ebp - 0xcc]
mov ecx, edi
cmp dword [eax], ebx
jne 0x100376f1
mov ecx, ebx
mov eax, dword [ebp - 0x18]
imul eax, ecx
test eax, eax
jne 0x100376fe
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xffffffff
lea ecx, [ebp - 0xcc]
setl al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
call fcn.1002a758
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x28], 0x4daed0f1
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x18], ebx
jmp 0x10037764
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x44], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10037756
mov dword [ebp - 0x18], ebx
jmp 0x1003777f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa0], 0xc4475ee4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003776e
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1003781f
mov dword [ebp - 0x2c], 0x7a140552
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x44]
cmp eax, 0x7c2c
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x44]
dec eax
cmp edx, eax
setg cl
cmp ecx, 0xd0e75d5f
sbb eax, eax
neg eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0x44]
mov esi, dword [ebp - 0x98]
mov eax, dword [ebp - 0x18]
neg esi
sbb esi, esi
xor edx, edx
neg esi
mov ecx, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x44]
cmp ecx, eax
mov ecx, 0x38eacbec
setg dl
imul edx, esi
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x44]
sub ecx, eax
mov eax, dword [ebp - 0x2c]
add ecx, eax
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x44], ecx
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0x18]
jns 0x10037791
mov eax, dword [ebp - 0x98]
mov ecx, 0xc65a
mov eax, dword [ebp - 0x20]
sub ecx, eax
add ecx, dword [ebp - 0x20]
xor eax, eax
test ecx, ecx
mov ecx, 0x8ad64de8
setle al
cmp ecx, eax
mov eax, dword [ebp - 0x44]
sbb ecx, ecx
neg ecx
sub ecx, eax
mov eax, dword [ebp - 0x98]
add eax, ecx
xor ecx, ecx
cmp eax, 0x4e2e0f61
mov eax, dword [ebp - 0x98]
setne cl
sub ecx, eax
je 0x100378e2
mov dword [ebp - 0x28], 0x511c25c5
mov dword [ebp - 0x20], ebx
jmp 0x100378c6
push 3
lea ecx, [ebp - 0xec]
call fcn.1002a6d6
mov dword [ebp - 0x18], ebx
jmp 0x10037892
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10037883
mov eax, dword [ebp - 0xec]
inc dword [eax + 4]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100378b8
push ebx
push ebx
push ebx
push 0x1a02
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
lea ecx, [ebp - 0xec]
call fcn.1002a758
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe3
jge 0x10037871
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1003791a
push 0x74d
call dword [sym.imp.USER32.dll_GetKeyboardType]
jmp 0x1003791a
mov dword [ebp - 0x1c], edi
xor edx, edx
mov dword [ebp - 0x2c], 0x8d7cd142
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x68], eax
push 3
mov dword [ebp - 0x1c], ebx
pop esi
jmp 0x10037939
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7c], 0xa8eac8b1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003792b
mov dword [ebp - 0x74], ebx
jmp 0x1003795e
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1003795b
push ebx
push ebx
push 0x17a2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
dec dword [ebp - 0x74]
cmp dword [ebp - 0x74], 0xfffffffa
jne 0x10037943
mov ecx, dword [ebp - 0x24]
test ecx, ecx
jne 0x10037bc4
cmp dword [ebp - 0xb0], ecx
jle 0x10037bc4
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x20], ebx
je 0x100379a3
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], cl
je 0x10037a32
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
jmp 0x10037a32
mov dword [ebp - 0x18], 0x58fb770a
lea ecx, [ebp - 0x104]
push edi
call fcn.1002a6d6
mov dword [ebp - 0x1c], ebx
jmp 0x100379ce
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100379bb
cmp dword [ebp - 0x20], ebx
je 0x10037a0d
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x104]
mov dword [eax], edi
mov eax, dword [ebp - 0x18]
inc eax
cmp eax, 0x8589
mov eax, dword [ebp - 0x18]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, edi
setge cl
inc ecx
js 0x10037a0f
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
setge cl
sub ecx, 0x4615
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x104]
call fcn.1002a758
mov dword [ebp - 0x1c], 0xfe223643
mov dword [ebp - 0x1c], ebx
jmp 0x10037a4f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x158], 0xb55b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10037a3e
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], ebx
jl 0x10037a75
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10037a70
push ebx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
dec dword [ebp - 0x1c]
jns 0x10037a60
mov dword [ebp - 0x20], 0x60477862
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x10037aae
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe0], 0x336de018
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10037a9d
mov dword [ebp - 0x20], ebx
jmp 0x10037ad1
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10037ace
push ebx
push 0x8e4
call dword [sym.imp.USER32.dll_SetWindowTextA]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x13
jg 0x10037ab9
mov eax, dword [ebp - 0x20]
push 6
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setg cl
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov edx, dword [ebp - 0xe0]
mov dword [ebp - 0xe0], edx
mov eax, dword [ebp - 0x20]
cmp eax, edx
setl cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x18]
sub eax, 0xbfb2c41a
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x1bbb
setg al
cmp eax, dword [ebp - 0x30]
jg 0x10037b3c
mov eax, edi
cmp dword [ebp - 0x1c], ebx
jne 0x10037b3e
mov eax, ebx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jne 0x10037b4d
mov eax, ebx
cmp dword [ebp - 0x1c], ebx
je 0x10037b4f
mov eax, edi
cmp eax, dword [ebp - 0x40]
jge 0x10037b5b
mov eax, edi
cmp dword [ebp - 0x18], ebx
jne 0x10037b5d
mov eax, ebx
sub eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 0x40], eax
test ecx, ecx
je 0x10037bc4
call fcn.10036c15
mov dword [ebp - 0x1c], 0xfe0a8eac
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], ebx
jmp 0x10037b97
cmp byte [ebp - 0x11], 0
je 0x10037b94
push ebx
push 0x166d
push ebx
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffd
mov byte [ebp - 0x11], bl
jge 0x10037b81
cmp byte [ebp - 0x11], 0
je 0x10037bb6
push 0x449
push 0x64e
call dword [sym.imp.GDI32.dll_RestoreDC]
lea eax, [ebp - 0x50]
push eax
call fcn.10038019
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
lea ecx, [ebp - 0xb0]
call fcn.10032c95
cmp dword [ebp - 0x24], 0
je 0x10037ce1
push edi
lea ecx, [ebp - 0xf8]
call fcn.1002a6d6
mov dword [ebp - 0x1c], ebx
jmp 0x10037bfa
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf8]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10037bea
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10037c0e
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [ebp - 0xf8]
lea ecx, [ebp - 0xf8]
dec dword [eax]
call fcn.1002a758
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x24]
call fcn.10036c5c
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x3c], 0x57b5bf2d
mov dword [ebp - 0x28], 0x1d1b9849
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x1c], ebx
jmp 0x10037c5a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x14c], 0x61ece30
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10037c49
mov eax, edi
cmp dword [ebp - 0x18], ebx
jne 0x10037c69
mov eax, ebx
mov dword [ebp - 0x3c], eax
xor edx, edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
imul ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], ebx
jmp 0x10037cce
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10037cad
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10037ccb
push ebx
push 0x78
push 0x503
push 0x1d62
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x10037c9b
lea eax, [ebp - 0x54]
push eax
call fcn.10037fb7
mov ecx, dword [ebp - 0x70]
mov dword [eax], ecx
mov dword [ebp - 0x18], 0xfb871c7b
lea ecx, [ebp - 0xd8]
push edi
call fcn.1002a6d6
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x28], 0x8bee6da
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x38], 0xffffffff
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x1c], ebx
jmp 0x10037d4c
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xd8]
mov dword [eax + ecx*4], 0xc039
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10037d39
mov eax, dword [ebp - 0xd8]
cmp dword [eax], ebx
jne 0x10037d5e
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, 0xb274
mov eax, dword [ebp - 0xd8]
setne cl
xor edx, edx
cmp ecx, edi
setle dl
sub edx, dword [eax]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0xfffffff8
cmp eax, edx
setle cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], 0xffffffe3
cmp dword [ebp - 0x18], 0xfffffffb
jne 0x10037e74
mov eax, 0xffff
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x34], 0xdc32
mov dword [ebp - 0x1c], ebx
jmp 0x10037de8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x134], 0xefa025ec
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10037dd7
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10037dfd
push ebx
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov eax, dword [ebp - 0xb4]
dec dword [ebp - 0xb4]
mov dword [ebp - 0x2c], edi
cmp eax, 0x950c
jg 0x10037e16
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x34]
xor edx, edx
test eax, eax
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x12c]
cmp edx, eax
mov eax, dword [ebp - 0x28]
setg cl
imul eax, ecx
test eax, eax
jns 0x10037e41
mov edx, edi
cmp dword [ebp - 0x48], ebx
jne 0x10037e43
mov edx, ebx
mov ecx, dword [ebp - 0x3c]
add ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
sub edx, eax
inc ecx
imul ecx, edx
imul eax, ecx, 0x4f9d
mov dword [ebp - 0x38], eax
mov eax, 0xffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffb
je 0x10037db0
lea ecx, [ebp - 0xd8]
call fcn.1002a758
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x70]
mov ecx, dword [ebp - 0xc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret