Function at 0x10030b57
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Create pipe
Create process on windows
Delete registry value
Get thread local storage value
Query environment variable
Query or enumerate registry value
Set environment variable
Set thread local storage value
Terminate process

Disassembly:
mov eax, 0x1008adb0
call fcn.1008ab08
mov eax, 0x12fc
call fcn.10074b20
mov dword [ebp - 0x34], 0x9b54
mov eax, 0xffff
mov dword [ebp - 0x2c], eax
mov eax, 0x57e6
mov dword [ebp - 0x1c], 0xd743ccc
push ebx
mov dword [ebp - 0x58], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], 0xd06de21e
mov dword [ebp - 0x7a0], eax
mov dword [ebp - 0x79c], eax
push esi
mov dword [ebp - 0x798], eax
push edi
mov dword [ebp - 0x794], eax
xor eax, eax
push 3
mov dword [ebp - 0x24], eax
pop ebx
mov byte [ebp - 0x65], dl
cmp dword [ebp - 0x24], ebx
jge 0x10030bd5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x8f0], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10030bc1
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10030bf5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x95c], 0x6ef6f0c3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10030bdd
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10030c0b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xdb8], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10030bfa
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
mov eax, 0x5a2e
mov dword [ebp - 0x8e8], edi
mov ecx, dword [ebp - 0x2c]
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov esi, dword [ebp - 0x34]
setne dl
xor ecx, ecx
sub esi, edx
sub esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
cmp esi, eax
push 1
setge cl
xor eax, eax
cmp edi, ecx
pop edi
setne al
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
jne 0x10030c68
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10030c6a
mov eax, edi
mov dword [ebp - 0x95c], eax
xor edx, edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x95c]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
push 2
setl cl
xor eax, eax
pop esi
cmp ecx, 0x2e84cbf7
je 0x10030d53
or ecx, 0xffffffff
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x3c], 0xb1a73b02
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x9d7fccea
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], 0xf3d0097e
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x3c], 0x464e
mov dword [ebp - 0x18], 0xee42ac9
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10030d03
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1124], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10030ceb
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10030d19
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x113c], 0x2b81
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10030d08
mov eax, dword [ebp - 0x48]
mov edx, edi
mov dword [ebp - 0x8e8], eax
mov eax, dword [ebp - 0xdac]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10030d3e
mov edx, eax
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x18]
jmp 0x10030e4d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10030d73
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x148], 0x7358
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10030d5b
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jg 0x10030e4f
mov dword [ebp - 0x18], eax
jmp 0x10030d95
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x33c], 0x1d9d30cd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10030d84
mov ecx, dword [ebp - 0x33c]
mov eax, dword [ebp - 0x148]
neg ecx
mov esi, dword [ebp - 0x148]
sbb ecx, ecx
neg ecx
add eax, ecx
imul esi, eax
push 2
mov dword [ebp - 0x8e8], esi
mov edx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x33c]
sub edx, 0xf50edc67
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, 6
mov eax, dword [ebp - 0x148]
setg cl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0xdb4]
setg bl
xor edx, edx
cmp esi, eax
mov eax, dword [ebp - 0x7a0]
pop esi
setne dl
imul ecx, edx
xor edx, edx
push 0
cmp ecx, eax
mov eax, dword [ebp - 0x7a0]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x148]
sete cl
xor edx, edx
cmp ecx, 0x7320
setge dl
xor ecx, ecx
imul edx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setle cl
mov dword [ebp + eax*4 - 0x95c], ecx
inc dword [ebp - 0x2c]
pop eax
cmp dword [ebp - 0x2c], esi
jle 0x10030d7f
push 3
pop ebx
xor eax, eax
mov ecx, 0x1a049fe3
mov dword [ebp - 0xa1c], ecx
mov dword [ebp - 0xa18], ecx
mov dword [ebp - 0xa14], ecx
mov dword [ebp - 0xa10], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x3c], 0x38591b6
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10030ea0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x708], 0x13e19f23
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10030e88
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10030ee1
mov dword [ebp - 0x18], 0x9ed080c1
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10030ebe
push eax
call dword [sym.imp.GDI32.dll_CreatePalette]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x10030ede
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xa1c], 0x365653d4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10030ec6
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x10030ea5
inc dword [ebp - 0x708]
mov dword [ebp - 0x34], 0x4801897a
mov dword [ebp - 0x1c], 0x692beaa3
mov dword [ebp - 0x38], edi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10030f20
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10030f39
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x10030f37
mov dword [ebp - 0x38], 0xbb67
mov dword [ebp - 0x44], 6
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10030f59
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x898], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10030f41
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], eax
jl 0x10031025
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x44], 0xe2cf4565
mov dword [ebp - 0x44], 9
cmp dword [ebp - 0x34], eax
jne 0x10030f88
mov edx, eax
cmp dword [ebp - 0x20], eax
je 0x10030f8a
mov edx, edi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
dec eax
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x898]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x6c0e263
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, 0xefbd
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x898]
mov eax, dword [ebp - 0x20]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x10031019
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10031014
push 0x2614
push eax
push eax
push eax
push eax
push 0x1342
push 0x8ad
call ebx
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x10030fed
dec dword [ebp - 0x34]
push 0
pop eax
jns 0x10030f6b
mov dword [ebp - 0x34], 0x4801897a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1003104c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x728], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10031034
xor eax, eax
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], eax
jl 0x10031112
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x44], 0xe2cf4565
mov dword [ebp - 0x44], 9
cmp dword [ebp - 0x34], eax
jne 0x10031075
mov edx, eax
cmp dword [ebp - 0x20], eax
je 0x10031077
mov edx, edi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
dec eax
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x728]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x6c0e263
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, 0xefbd
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x728]
mov eax, dword [ebp - 0x20]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x10031106
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10031101
push 0x2614
push eax
push eax
push eax
push eax
push 0x1342
push 0x8ad
call ebx
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x100310da
dec dword [ebp - 0x34]
push 0
pop eax
jns 0x10031058
mov dword [ebp - 0x34], 0x4801897a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10031139
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7f0], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10031121
xor eax, eax
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], eax
jl 0x100311ff
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x44], 0xe2cf4565
mov dword [ebp - 0x44], 9
cmp dword [ebp - 0x34], eax
jne 0x10031162
mov edx, eax
cmp dword [ebp - 0x20], eax
je 0x10031164
mov edx, edi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
dec eax
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x7f0]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x6c0e263
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, 0xefbd
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x7f0]
mov eax, dword [ebp - 0x20]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x100311f3
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x100311ee
push 0x2614
push eax
push eax
push eax
push eax
push 0x1342
push 0x8ad
call ebx
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x100311c7
dec dword [ebp - 0x34]
push 0
pop eax
jns 0x10031145
mov dword [ebp - 0x30], eax
or ecx, 0xffffffff
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x1c], 0xf20920a6
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], eax
jmp 0x1003122f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1d4], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1003121e
mov eax, dword [ebp - 0x30]
mov esi, 0xfbb9cf7d
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x100312ca
mov eax, dword [ebp - 0x30]
xor edx, edx
imul eax, dword [ebp - 0x1d4], 3
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setg dl
xor ecx, ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
test eax, eax
mov eax, dword [ebp - 0x1d4]
setns cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1d4]
setge dl
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp esi, edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 0x24]
jge 0x100312a8
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1d4], eax
je 0x100312aa
mov ecx, edi
xor eax, eax
cmp ecx, 0xe81d
setle al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x100312c8
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100312d2
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10031305
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x10031302
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x100312fd
push eax
push eax
call dword [sym.imp.GDI32.dll_GetRgnBox]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x100312ea
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x100312e2
mov dword [ebp - 0x34], 0xb26bdde0
or ecx, 0xffffffff
mov dword [ebp - 0x20], 0x9bac
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], ecx
push 3
mov dword [ebp - 0x18], eax
pop edx
cmp dword [ebp - 0x18], edx
jge 0x10031340
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe34], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003132c
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x1a
jl 0x10031419
mov dword [ebp - 0x1c], 0x34f5
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
cmp eax, 0xffff60b1
setl cl
sub ecx, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x15256ee9
setle al
xor ecx, ecx
cmp eax, edi
setl cl
xor eax, eax
imul ecx, dword [ebp - 0xe30]
mov byte [ebp - 0x49], al
test ecx, ecx
je 0x100313ba
cmp byte [ebp - 0x49], al
je 0x100313e1
push eax
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x100313df
cmp byte [ebp - 0x49], al
je 0x100313cb
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x100313df
push 0x164c
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10031401
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x100313fe
push eax
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x100313e6
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x1a
jge 0x10031353
push 3
xor eax, eax
pop edx
mov dword [ebp - 0x634], edx
mov dword [ebp - 0x630], edx
mov dword [ebp - 0x62c], edx
mov dword [ebp - 0x628], edx
mov dword [ebp - 0x34], 0xe327439c
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], eax
jmp 0x10031451
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x28c], 0xd21dfe4b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10031440
mov eax, dword [ebp - 0x628]
mov eax, dword [ebp - 0x634]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28c]
mov ecx, dword [ebp - 0x628]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
je 0x1003152e
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x100314ae
push eax
push 0x1442
push 0x2153
call dword [sym.imp.GDI32.dll_CreatePen]
push 3
pop edx
xor eax, eax
mov dword [ebp - 0x34], 0x9b54
or ecx, 0xffffffff
mov dword [ebp - 0x2c], 0xffff
mov esi, 0x57e6
mov dword [ebp - 0x1c], 0xd743ccc
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], 0xd06de21e
mov dword [ebp - 0x7b8], esi
mov dword [ebp - 0x7b4], esi
mov dword [ebp - 0x7b0], esi
mov dword [ebp - 0x7ac], esi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jge 0x10031509
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x974], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x100314f5
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jge 0x10031529
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x98c], 0x6ef6f0c3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x10031511
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10031562
xor eax, eax
mov dword [ebp - 0x44], 0xfffffffc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
jg 0x100314ac
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x34]
jmp 0x1003153a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xcd8], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10031551
mov eax, dword [ebp - 0x34]
mov ecx, 0x5a2e
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x96c], edi
mov eax, dword [ebp - 0x2c]
sub ecx, eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov esi, dword [ebp - 0x34]
setne dl
xor ecx, ecx
sub esi, edx
sub esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
cmp esi, eax
setge cl
xor eax, eax
cmp edi, ecx
setne al
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
jne 0x100315c1
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x100315c1
xor esi, esi
inc esi
jmp 0x100315c6
xor esi, esi
inc esi
mov eax, esi
mov dword [ebp - 0x98c], eax
xor edx, edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x98c]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x2e84cbf7
je 0x100316b1
or ecx, 0xffffffff
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x3c], 0xb1a73b02
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x9d7fccea
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], 0xf3d0097e
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x3c], 0x464e
mov dword [ebp - 0x18], 0xee42ac9
push 3
mov dword [ebp - 0x2c], eax
pop edi
cmp dword [ebp - 0x2c], edi
jge 0x1003165f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1154], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10031647
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10031675
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x116c], 0x2b81
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10031664
mov eax, dword [ebp - 0x48]
mov edx, esi
mov dword [ebp - 0x96c], eax
mov eax, dword [ebp - 0xccc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1003169a
mov edx, eax
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x18]
xor eax, eax
jmp 0x100317b3
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100316d1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14c], 0x7358
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100316b9
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x100317b0
mov dword [ebp - 0x18], eax
jmp 0x100316f4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x344], 0x1d9d30cd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100316e3
mov ecx, dword [ebp - 0x344]
mov eax, dword [ebp - 0x14c]
neg ecx
mov esi, dword [ebp - 0x14c]
sbb ecx, ecx
neg ecx
add eax, ecx
imul esi, eax
push 0
mov dword [ebp - 0x96c], esi
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x344]
sub edx, 0xf50edc67
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, 6
mov eax, dword [ebp - 0x14c]
setg cl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0xcd4]
setg bl
xor edx, edx
cmp esi, eax
mov eax, dword [ebp - 0x7b8]
setne dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x7b8]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14c]
sete cl
xor edx, edx
cmp ecx, 0x7320
setge dl
xor ecx, ecx
imul edx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setle cl
mov dword [ebp + eax*4 - 0x98c], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
pop eax
push 1
pop esi
jle 0x100316de
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 3
pop edi
mov dword [ebp - 0x18], 0x4801897a
mov ecx, 0x1a049fe3
mov dword [ebp - 0xabc], ecx
mov dword [ebp - 0xab8], ecx
mov dword [ebp - 0xab4], ecx
mov dword [ebp - 0xab0], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x3c], 0x38591b6
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1003180d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x738], 0x13e19f23
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100317f4
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x1003184e
mov dword [ebp - 0x18], 0x9ed080c1
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1003182b
push eax
call dword [sym.imp.GDI32.dll_CreatePalette]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jg 0x1003184b
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xabc], 0x365653d4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x10031833
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jle 0x10031812
inc dword [ebp - 0x738]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1003187b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x868], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10031862
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x10032265
mov dword [ebp - 0x1c], 0x692beaa3
mov dword [ebp - 0x38], esi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x100318ba
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x100318d3
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x100318d1
mov dword [ebp - 0x38], 0xbb67
mov dword [ebp - 0x44], 6
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x14], esi
or ecx, 0xffffffff
mov dword [ebp - 0x34], 0x3f4f46db
mov dword [ebp - 0x1c], 0x59c45c1d
mov dword [ebp - 0x54], 0xfffffffc
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], 0x694d2b5f
mov dword [ebp - 0x44], ecx
push 3
mov dword [ebp - 0x40], eax
pop ecx
cmp dword [ebp - 0x40], ecx
jge 0x1003191a
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xb74], esi
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ecx
jl 0x10031906
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x1003193c
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xc88], 0xdb821342
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 4
jl 0x10031923
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], esi
jge 0x1003195c
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xbf0], 0x8b16
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jl 0x10031944
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ecx
jge 0x1003197c
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xf48], 0xfffffff9
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ecx
jl 0x10031964
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1003199e
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x3e4], 0xffff
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 2
jl 0x10031985
xor eax, eax
mov dword [ebp - 0x34], 2
cmp dword [ebp - 0x34], eax
jl 0x100319b9
mov dword [ebp - 0x38], 0xc04ee7d2
dec dword [ebp - 0x38]
dec dword [ebp - 0x34]
jns 0x100319aa
dec dword [ebp - 0x3e0]
xor edx, edx
mov eax, dword [ebp - 0x3e0]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0xf48]
mov eax, dword [ebp - 0xc7c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3e0]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xb6c]
mov eax, dword [ebp - 0xc88]
mov eax, dword [ebp - 0xc84]
imul ecx, eax, 0x7186
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, 0xffff
setl dl
or ecx, 0xffffffff
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x44], 0xe2cf4565
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x38], 0x105a83d8
mov dword [ebp - 0x44], 0xac369029
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x10031a4f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x70], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x10031a3e
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x10031a6b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x2e4], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x10031a57
xor eax, eax
mov dword [ebp - 0x70], 0xffffffef
jmp 0x10031aa5
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10031aa2
push eax
push 0x1edb
push eax
push eax
push 0x70e
push 0x1634
push 0x16ef
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
xor eax, eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], esi
je 0x10031a74
mov dword [ebp - 0x20], 6
jmp 0x10031b6c
mov dword [ebp - 0x34], 0x1c6076fd
xor edx, edx
mov dword [ebp - 0x2c], 0xc46bc227
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setne dl
cmp dword [ebp - 0x34], edx
jl 0x10031ad9
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x70]
xor ecx, ecx
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, 3
setne cl
cmp ecx, dword [ebp - 0x38]
jge 0x10031b01
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x2e4], eax
je 0x10031b03
mov edx, esi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x70]
sete cl
xor edx, edx
cmp ecx, 8
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setne dl
sub edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, dword [ebp - 0x2e4]
jne 0x10031b5a
mov edx, esi
cmp dword [ebp - 0x70], eax
jne 0x10031b5c
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x48], ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
je 0x10031ab6
mov dword [ebp - 0x44], 9
xor eax, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], 0x8a062b00
mov dword [ebp - 0x1c], 0x61fc2da8
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff2
jle 0x10031be4
jmp 0x10031ba0
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffff9
cmp dword [ebp - 0x30], eax
jne 0x10031bbf
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
inc eax
jne 0x10031bcc
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x10031bce
mov ecx, esi
mov eax, dword [ebp - 0x30]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff2
jg 0x10031b9e
mov dword [ebp - 0x34], 8
jmp 0x10031c6a
push 3
pop eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0xfffffffd
jmp 0x10031c61
or eax, 0xffffffff
mov dword [ebp - 0x2c], 0xd3d47825
mov dword [ebp - 0x38], eax
mov ecx, 0xeee8
mov eax, dword [ebp - 0x30]
sub ecx, eax
cmp dword [ebp - 0x30], ecx
jle 0x10031c21
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp eax, esi
setl cl
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x2c], eax
jne 0x10031c67
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x14
jle 0x10031c02
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jge 0x10031bed
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10031c82
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x10031c84
mov edx, esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
dec eax
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x868]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x6c0e263
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
cmp ecx, 0xefbd
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x868]
mov eax, dword [ebp - 0x14]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], 0x6f1b
mov dword [ebp - 0x38], 0xa37bd55f
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x93905c80
jne 0x10031dae
push 3
mov dword [ebp - 0x20], 0xfffffffb
pop ecx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10031d8a
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x44], 0x9eb11de2
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ecx
jge 0x10031d40
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x9a4], 0xfffffffe
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x10031d28
xor eax, eax
cmp dword [ebp - 0x9a4], eax
je 0x10031d4f
mov ecx, esi
cmp dword [ebp - 0x20], eax
jne 0x10031d51
mov ecx, eax
mov eax, dword [ebp - 0x9a0]
lea eax, [ecx + 1]
test eax, eax
jne 0x10031d66
cmp dword [ebp - 0x9a0], eax
je 0x10031d68
mov eax, esi
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x44], eax
jmp 0x10031dbf
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10031dc1
push eax
push eax
push eax
push 0x208a
push 0x256f
push eax
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
jmp 0x10031dbf
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10031dbf
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x1003225a
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x34], 0xffffffe9
jmp 0x10031e04
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10031def
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10031e01
push eax
call dword [sym.imp.GDI32.dll_CreatePalette]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 7
jge 0x10031ddd
mov byte [ebp - 0xd], al
push 5
pop ecx
mov dword [ebp - 0x40], ecx
mov ecx, 0xfffd
mov dword [ebp - 0x30], 0x959c45c1
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x6b4], ecx
mov dword [ebp - 0x6b0], ecx
mov dword [ebp - 0x6ac], ecx
mov dword [ebp - 0x6a8], ecx
push 3
mov dword [ebp - 0x34], eax
pop edx
cmp dword [ebp - 0x34], edx
jge 0x10031e60
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x208], 0x4ba8b35e
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jl 0x10031e48
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10031e70
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x200], eax
xor eax, eax
mov dword [ebp - 0x30], eax
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp eax, esi
setl cl
dec ecx
je 0x10031f7a
mov dword [ebp - 0x38], 0xe2c9bf5e
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10031eb6
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x200]
mov eax, dword [ebp - 0x200]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], esi
xor eax, eax
mov dword [ebp - 0x30], 2
cmp dword [ebp - 0x30], eax
jl 0x1003205e
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + eax*4 - 0x208]
sub ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
imul ecx, dword [ebp + eax*4 - 0x208]
imul ecx, dword [ebp - 0x200]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x208]
cmp ecx, 0xa87ea82b
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x200]
je 0x10031f30
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x208], 0
je 0x10031f30
mov ecx, esi
jmp 0x10031f34
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x208], ecx
xor eax, eax
mov dword [ebp - 0x40], 2
cmp dword [ebp - 0x40], eax
jl 0x10031f69
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10031f64
push eax
push eax
push 0x1df0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
xor eax, eax
dec dword [ebp - 0x40]
jns 0x10031f4c
dec dword [ebp - 0x30]
jns 0x10031edd
push 3
pop edx
jmp 0x1003205c
mov dword [ebp - 0x3c], esi
or eax, 0xffffffff
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x2e43232a
mov dword [ebp - 0x3c], 0xfffffffc
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x44], 0x69838165
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edx
jge 0x10031fca
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xe58], 6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x10031fb2
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10031fe0
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1184], 0x9c591eb
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x10031fcf
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xe54], eax
add eax, 0x10dec533
jne 0x10032049
mov eax, dword [ebp - 0x6ac]
dec dword [ebp - 0x6ac]
cmp eax, 0x77fc
jl 0x1003200f
mov ecx, esi
jmp 0x10032013
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x44]
add eax, ecx
xor ecx, ecx
cmp eax, 0x7b92bb77
mov eax, 0xfffb
setge cl
cmp eax, ecx
sbb ecx, ecx
neg ecx
add ecx, dword [ebp - 0x208]
mov eax, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
jne 0x10032043
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x34], 0xc4ae3b72
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
xor eax, eax
cmp byte [ebp - 0xd], 0
je 0x1003224e
mov dword [ebp - 0x24], 9
mov dword [ebp - 0x38], 0x3d0e72ee
mov dword [ebp - 0x20], 0x321a0783
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1003209f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x2cc], 0xb9b5
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x10032086
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x100320bf
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x238], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x100320a7
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jg 0x10032232
mov dword [ebp - 0x34], 0xf51ae9a0
mov dword [ebp - 0x20], eax
jmp 0x100320e4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x22c], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100320d7
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x2cc], ecx
je 0x1003213f
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x2cc], ecx
jne 0x1003210c
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x1003210e
mov edx, esi
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x2cc]
cmp eax, edx
sete cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
add eax, 0x498d20b
jne 0x10032136
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x2cc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2cc]
mov eax, dword [ebp - 0x24]
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x2cc]
mov eax, dword [ebp - 0x2c4]
mov eax, dword [ebp - 0x2cc]
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c0]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle bl
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x2cc]
mov eax, dword [ebp - 0x24]
cmp ebx, eax
setg cl
xor ebx, ebx
cmp ecx, edx
setle bl
mov dword [ebp - 0x22c], ebx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x2cc]
sub eax, ebx
mov dword [ebp - 0x20], eax
jne 0x10032284
mov eax, 0xd07a051a
mov dword [ebp - 0x44], 0xfddf34ff
mov dword [ebp - 0xa3c], eax
mov dword [ebp - 0xa38], eax
mov dword [ebp - 0xa34], eax
mov dword [ebp - 0xa30], eax
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x100321f0
mov ecx, dword [ebp - 0x238]
mov eax, dword [ebp - 0x238]
sub ecx, eax
mov eax, dword [ebp - 0x22c]
add eax, ecx
cmp eax, 7
jne 0x100321ee
mov eax, esi
jmp 0x100321f0
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c0]
add eax, 0xa1676492
mov dword [ebp - 0xa3c], eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10032218
push eax
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
push 3
pop edx
inc dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], edx
jle 0x100320cb
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
push 0x2614
push eax
push eax
push eax
push eax
push 0x1342
push 0x8ad
call ebx
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
dec dword [ebp - 0x14]
push 0
pop eax
jns 0x10031dcd
dec dword [ebp - 0x18]
jns 0x1003188d
xor eax, eax
mov dword [ebp - 0x30], eax
or ecx, 0xffffffff
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x1c], 0xf20920a6
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], eax
jmp 0x10032303
or eax, 0xffffffff
mov dword [ebp - 0xb3c], eax
mov dword [ebp - 0xb38], eax
mov dword [ebp - 0xb34], eax
push 3
mov dword [ebp - 0xb30], eax
xor eax, eax
pop edx
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], eax
jl 0x100322e1
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jl 0x100322c7
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x238], eax
dec dword [ebp - 0x20]
jns 0x100322b4
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100322dc
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
push 3
xor eax, eax
pop edx
dec dword [ebp - 0x34]
jns 0x100322ac
cmp dword [ebp - 0xb3c], eax
jne 0x1003222a
jmp 0x1003221b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1d8], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100322f2
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x100323a2
mov eax, dword [ebp - 0x30]
xor edx, edx
imul eax, dword [ebp - 0x1d8], 3
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setg dl
xor ecx, ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
test eax, eax
mov eax, dword [ebp - 0x1d8]
setns cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1d8]
setge dl
sub edx, eax
mov eax, 0xfbb9cf7d
cmp eax, edx
mov eax, dword [ebp - 0x24]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 0x24]
jge 0x10032380
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1d8], eax
je 0x10032382
mov ecx, esi
xor eax, eax
cmp ecx, 0xe81d
setle al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x100323a0
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100323aa
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100323dd
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x100323da
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100323d5
push eax
push eax
call dword [sym.imp.GDI32.dll_GetRgnBox]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x100323c2
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x100323ba
mov ebx, dword [sym.imp.GDI32.dll_ExtCreatePen]
mov dword [ebp - 0x3c], 0xe0cf5720
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003240d
push eax
push 0x247d
push eax
push 0x19a4
push 0x12a0
call ebx
xor eax, eax
mov esi, dword [sym.imp.GDI32.dll_SetPaletteEntries]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003242c
push eax
push 0x21f9
push 0x19e0
push eax
call esi
xor eax, eax
mov dword [ebp - 0x30], eax
or ecx, 0xffffffff
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x1c], 0xf20920a6
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov dword [ebp - 0x18], eax
inc ecx
jmp 0x1003245f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1d0], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003244e
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10032503
mov eax, dword [ebp - 0x30]
xor edx, edx
imul eax, dword [ebp - 0x1d0], 3
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setg dl
xor ecx, ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
test eax, eax
mov eax, dword [ebp - 0x1d0]
setns cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1d0]
setge dl
sub edx, eax
mov eax, 0xfbb9cf7d
cmp eax, edx
mov eax, dword [ebp - 0x24]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 0x24]
jge 0x100324de
xor eax, eax
cmp dword [ebp - 0x1d0], eax
jne 0x100324de
mov ecx, eax
jmp 0x100324e3
xor eax, eax
lea ecx, [eax + 1]
xor eax, eax
cmp ecx, 0xe81d
setle al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10032501
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1003250b
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1003253e
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x1003253b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032536
push eax
push eax
call dword [sym.imp.GDI32.dll_GetRgnBox]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x10032523
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1003251b
mov ecx, 0x198a
or edx, 0xffffffff
mov dword [ebp - 0xa5c], ecx
mov dword [ebp - 0xa58], ecx
mov dword [ebp - 0xa54], ecx
mov dword [ebp - 0xa50], ecx
xor ecx, ecx
mov dword [ebp - 0x1c], 0xfffffffe
inc ecx
mov dword [ebp - 0x3c], 0x93e9323d
mov dword [ebp - 0x3c], 0x6923607a
mov dword [ebp - 0x3c], 0xcef054a2
mov dword [ebp - 0x3c], 0x2cb3a3fc
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x3c], 0xad9ddcef
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x3c], 0x2ca96836
mov dword [ebp - 0x3c], 0x1b0ae28d
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], 0x3d8c5378
push 3
mov dword [ebp - 0x2c], eax
pop edx
cmp dword [ebp - 0x2c], edx
jge 0x100325de
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x119c], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x100325c6
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jge 0x100325fe
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x330], 0xea311c3f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x100325e6
xor eax, eax
mov dword [ebp - 0x1c], edx
push 4
pop ecx
cmp dword [ebp - 0x1c], eax
jl 0x10032635
mov dword [ebp - 0x18], 0xafd94fe5
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10032630
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa5c], 0x6f6d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10032618
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10032609
inc dword [ebp - 0x330]
mov dword [ebp - 0x474], ecx
mov dword [ebp - 0x470], ecx
mov dword [ebp - 0x46c], ecx
mov dword [ebp - 0x468], ecx
mov dword [ebp - 0x474], eax
jmp 0x100326bf
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x10032681
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xee8], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003266d
xor eax, eax
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x100326b9
mov dword [ebp - 0x18], 0x1449c9fb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x100326b4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xee8], 0xb04800fa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003269c
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1003268d
dec dword [ebp - 0x474]
cmp dword [ebp - 0x474], 0xffffffe5
jl 0x1003265b
mov dword [ebp - 0x3c], 0xe0cf5720
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100326ed
push eax
push 0x247d
push eax
push 0x19a4
push 0x12a0
call ebx
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032706
push eax
push 0x21f9
push 0x19e0
push eax
call esi
xor eax, eax
mov dword [ebp - 0x3c], 0xe0cf5720
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003272b
push eax
push 0x247d
push eax
push 0x19a4
push 0x12a0
call ebx
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032744
push eax
push 0x21f9
push 0x19e0
push eax
call esi
xor eax, eax
mov ecx, 0x198a
xor esi, esi
mov dword [ebp - 0xadc], ecx
inc esi
mov dword [ebp - 0xad8], ecx
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xad0], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x3c], 0x93e9323d
mov dword [ebp - 0x3c], 0x6923607a
mov dword [ebp - 0x3c], 0xcef054a2
mov dword [ebp - 0x3c], 0x2cb3a3fc
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], 0xad9ddcef
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], 0x2ca96836
mov dword [ebp - 0x3c], 0x1b0ae28d
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], 0x3d8c5378
push 3
mov dword [ebp - 0x2c], eax
pop ebx
cmp dword [ebp - 0x2c], ebx
jge 0x100327df
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1130], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x100327c7
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x100327ff
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x2e0], 0xea311c3f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x100327e7
xor eax, eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x10032835
mov dword [ebp - 0x18], 0xafd94fe5
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10032830
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xadc], 0x6f6d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10032817
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10032807
inc dword [ebp - 0x2e0]
mov dword [ebp - 0x40], 0x1ec2db22
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x18], eax
jmp 0x1003285b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7d0], 0x8c0a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003284a
mov eax, dword [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], eax
je 0x1003288c
mov dword [ebp - 0x40], eax
jmp 0x10032884
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x7d0], 0x80c1
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 4
jl 0x10032873
jmp 0x100328f4
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xb
je 0x100328b0
mov dword [ebp - 0x44], 0x5bfc88eb
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xb
jne 0x10032898
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x100328ee
mov dword [ebp - 0x40], eax
jmp 0x100328d3
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100328d0
push 0x10b6
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
xor eax, eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jle 0x100328ba
mov dword [ebp - 0x40], eax
jmp 0x100328e5
cmp dword [ebp - 0x34], eax
jne 0x100328eb
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xfffffffb
jle 0x100328dd
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xf
jl 0x100328b5
mov eax, dword [ebp - 0x7c4]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x7c4]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x7cc]
mov eax, dword [ebp - 0x7d0]
dec eax
cmp eax, 0x69ff4ca9
setg cl
xor eax, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], 0x8a062b00
mov dword [ebp - 0x1c], 0x61fc2da8
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff2
jle 0x10032987
jmp 0x10032943
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffff9
cmp dword [ebp - 0x30], eax
jne 0x10032962
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
inc eax
jne 0x1003296f
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x10032971
mov ecx, esi
mov eax, dword [ebp - 0x30]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff2
jg 0x10032941
mov dword [ebp - 0x34], 8
jmp 0x10032a0a
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0xfffffffd
jmp 0x10032a01
or eax, 0xffffffff
mov dword [ebp - 0x18], 0xd3d47825
mov dword [ebp - 0x38], eax
mov ecx, 0xeee8
mov eax, dword [ebp - 0x30]
sub ecx, eax
cmp dword [ebp - 0x30], ecx
jle 0x100329c1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp eax, esi
setl cl
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x18], eax
jne 0x10032a07
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x14
jle 0x100329a2
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jge 0x10032990
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10032a39
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf9c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10032a24
xor eax, eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x10032a62
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032a5d
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10032a41
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x30], 0x42eb90da
mov dword [ebp - 0x18], 0xe08cccdd
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x10032aa0
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xf84], 0x6eae1177
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x10032a87
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xf
jg 0x10032bc5
push 5
pop ecx
mov dword [ebp - 0x20], 0xc3c69aed
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], eax
jmp 0x10032ae6
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x10032add
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xd58], esi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x10032ac8
xor eax, eax
inc dword [ebp - 0xd58]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1d
jle 0x10032abf
cmp dword [ebp - 0x18], esi
jb 0x10032b20
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032bb8
push 0x75a
push eax
push eax
push 0x20b1
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
jmp 0x10032bb3
mov dword [ebp - 0x34], eax
jmp 0x10032b36
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x10fc], 0xf7c295a5
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x10032b25
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x637b3047
push 0xfffffffffffffff6
setl cl
imul eax, ecx, 0x628e
mov ecx, dword [ebp - 0x28]
sub ecx, eax
neg ecx
pop eax
sbb ecx, ecx
inc ecx
cmp eax, ecx
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add eax, 0x4b2da730
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10fc]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setle dl
imul eax, edx
mov dword [ebp - 0x18], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10032bb3
push 0x929
push 0x69f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 5
xor eax, eax
pop ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xf
jle 0x10032ab0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jne 0x10032c32
mov dword [ebp - 0x1c], 0x4b79a97a
mov dword [ebp - 0x44], 0xd7e3c239
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x10032bf8
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xe70], esi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x10032be4
xor eax, eax
cmp dword [ebp - 0xf80], eax
jne 0x10032c18
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xe70]
xor eax, eax
mov dword [ebp - 0x18], eax
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x10032c1a
mov ecx, esi
mov eax, dword [ebp - 0x1c]
imul eax, ecx
push 0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
pop eax
je 0x10032bce
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x20], 0xae355683
mov dword [ebp - 0x38], 0x9d73ae4c
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x18], 0x91a8
mov dword [ebp - 0x44], 0xc53d8b3d
mov dword [ebp - 0x48], 0x452e
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032c75
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 3
pop eax
mov dword [ebp - 0x20], eax
jmp 0x10032d2d
mov dword [ebp - 0x1c], 0xe9973063
mov dword [ebp - 0x38], 0x1c3d076c
mov dword [ebp - 0x54], 0x133ecb40
mov ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x4f77722
setge al
xor edx, edx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x34]
sub ecx, eax
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setle dl
xor eax, eax
test edx, edx
sets al
cmp eax, dword [ebp - 0x18]
jne 0x10032cd7
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10032cd9
mov eax, esi
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10032d24
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032d1b
push 0x1e7c
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x34]
push 0
pop eax
cmp dword [ebp - 0x34], 0xfffffffe
jne 0x10032d01
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xa
je 0x10032c80
mov dword [ebp - 0x1c], 0xf20920a6
or ecx, 0xffffffff
mov dword [ebp - 0x5cc], esi
xor eax, eax
mov dword [ebp - 0x5c8], esi
mov dword [ebp - 0x5c4], esi
mov dword [ebp - 0x5c0], esi
push 6
pop edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], 0x8064
mov dword [ebp - 0x44], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10032d90
push 0x26d6
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
xor eax, eax
or ecx, 0xffffffff
cmp dword [ebp - 0x5cc], eax
jne 0x10032db6