Function at 0x1003380a
Capabilities:
Delete registry key
Delete registry value
Parse pe header
Query environment variable
Set environment variable
Terminate process

Disassembly:
mov eax, 0x1008a0e1
call fcn.10088668
mov eax, 0x1984
call fcn.10083e90
push ebx
push esi
push edi
push 3
pop ebx
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x4d8]
push ebx
mov byte [ebp - 0x55], dl
call fcn.10019cd8
xor eax, eax
lea ecx, [ebp - 0xcac]
push 2
mov dword [ebp - 4], eax
pop eax
push eax
call fcn.10019cd8
xor eax, eax
inc eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x18], eax
push 0xffffffffffffffff
pop esi
cmp dword [ebp - 0x18], ebx
jge 0x10033877
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4d8]
call fcn.10019d62
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003385d
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x1003389d
push dword [ebp - 0x18]
lea ecx, [ebp - 0xcac]
call fcn.10019d62
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10033882
xor eax, eax
push eax
lea ecx, [ebp - 0x4d8]
call fcn.10019d62
lea ecx, [ebp - 0x4d8]
mov dword [eax], 0x1a
xor eax, eax
push eax
call fcn.10019d62
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x10033909
mov dword [ebp - 0x38], 0x9ea
mov dword [ebp - 0x34], 0x1738ab65
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x100338ed
push 0x268
push eax
call edi
xor eax, eax
push eax
lea ecx, [ebp - 0x4d8]
call fcn.10019d62
lea ecx, [ebp - 0x4d8]
dec dword [eax]
xor eax, eax
push eax
call fcn.10019d62
cmp dword [eax], 0xfffffff9
je 0x100338c5
xor eax, eax
lea ecx, [ebp - 0xcac]
push eax
call fcn.10019d62
lea ecx, [ebp - 0xcac]
dec dword [eax]
call fcn.10019d5d
or esi, 0xffffffff
lea ecx, [ebp - 0x4d8]
mov dword [ebp - 4], esi
call fcn.10019d5d
push ebx
lea ecx, [ebp - 0x4a8]
call fcn.10019cd8
push 2
pop eax
push eax
lea ecx, [ebp - 0xcc4]
mov dword [ebp - 4], eax
call fcn.10019cd8
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003397f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4a8]
call fcn.10019d62
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10033965
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x100339a5
push dword [ebp - 0x18]
lea ecx, [ebp - 0xcc4]
call fcn.10019d62
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1003398a
xor eax, eax
push eax
lea ecx, [ebp - 0x4a8]
call fcn.10019d62
mov dword [eax], 0x1a
jmp 0x100339ef
mov dword [ebp - 0x38], 0x9ea
mov dword [ebp - 0x34], 0x1738ab65
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x100339e1
push 0x268
push eax
call edi
xor eax, eax
push eax
lea ecx, [ebp - 0x4a8]
call fcn.10019d62
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x4a8]
push eax
call fcn.10019d62
cmp dword [eax], 0xfffffff9
je 0x100339b9
xor eax, eax
lea ecx, [ebp - 0xcc4]
push eax
call fcn.10019d62
lea ecx, [ebp - 0xcc4]
dec dword [eax]
call fcn.10019d5d
or eax, 0xffffffff
lea ecx, [ebp - 0x4a8]
mov dword [ebp - 4], eax
call fcn.10019d5d
push ebx
lea ecx, [ebp - 0x568]
call fcn.10019cd8
push esi
lea ecx, [ebp - 0xcdc]
mov dword [ebp - 4], 4
call fcn.10019cd8
push 5
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10033a78
push dword [ebp - 0x18]
lea ecx, [ebp - 0x568]
call fcn.10019d62
or dword [eax], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10033a5d
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10033a9b
push dword [ebp - 0x18]
lea ecx, [ebp - 0xcdc]
call fcn.10019d62
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10033a80
xor eax, eax
push eax
lea ecx, [ebp - 0x568]
call fcn.10019d62
mov dword [eax], 0x1a
jmp 0x10033ae5
mov dword [ebp - 0x38], 0x9ea
mov dword [ebp - 0x34], 0x1738ab65
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10033ad7
push 0x268
push eax
call edi
xor eax, eax
push eax
lea ecx, [ebp - 0x568]
call fcn.10019d62
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x568]
push eax
call fcn.10019d62
cmp dword [eax], 0xfffffff9
je 0x10033aaf
xor eax, eax
lea ecx, [ebp - 0xcdc]
push eax
call fcn.10019d62
lea ecx, [ebp - 0xcdc]
dec dword [eax]
call fcn.10019d5d
or eax, 0xffffffff
lea ecx, [ebp - 0x568]
mov dword [ebp - 4], eax
call fcn.10019d5d
xor ecx, ecx
or eax, 0xffffffff
inc ecx
mov edx, 0x9efededc
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0xdfc], edx
mov dword [ebp - 0xdf8], edx
mov dword [ebp - 0xdf4], edx
mov dword [ebp - 0xdf0], edx
mov dword [ebp - 0x34], 0x688cdf2a
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x10033b7f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x60], 0xa42b4837
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x10033b67
xor eax, eax
cmp dword [ebp - 0x1c], 6
je 0x10033bdd
cmp dword [ebp - 0x1c], eax
je 0x10033bb3
mov ecx, dword [ebp - 0x60]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setl dl
cmp edx, dword [ebp - 0x60]
jl 0x10033b9f
mov eax, dword [ebp - 0x60]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
je 0x10033bb3
xor eax, eax
cmp dword [ebp - 0x60], eax
je 0x10033bb1
inc eax
jmp 0x10033bb3
xor eax, eax
mov edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x60]
cmp edx, eax
mov eax, dword [ebp - 0x40]
setne cl
imul eax, ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x48]
dec dword [ebp - 0x40]
test eax, eax
je 0x10033bdd
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10033be1
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x60], ecx
mov eax, dword [ebp - 0x1c]
imul eax, ecx
xor ecx, ecx
cmp eax, 0xfff0698
setl cl
xor ebx, ebx
mov dword [ebp - 0x34], ecx
inc ebx
mov eax, dword [ebp - 0x60]
lea ecx, [ebp - 0xf84]
mov dword [ebp - 0xdfc], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0xf6af1124
mov dword [ebp - 0x28], 0xfddd3f46
push ebx
call fcn.10019cd8
xor eax, eax
mov dword [ebp - 4], 6
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10033c53
push dword [ebp - 0x20]
lea ecx, [ebp - 0xf84]
call fcn.10019d62
mov dword [eax], ebx
xor eax, eax
inc dword [ebp - 0x20]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x20], eax
jl 0x10033c31
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
push 0xfffffffffffffff6
pop eax
cmp dword [ebp - 0x20], eax
je 0x10033d74
push 4
pop esi
mov dword [ebp - 0x28], 0xfffffff7
lea ecx, [ebp - 0x1140]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x28], 0x4800fa7
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
or eax, 0xffffffff
mov dword [ebp - 0x28], 0x3773672
mov dword [ebp - 0x28], 0x1a4e6659
mov dword [ebp - 0x28], 0x5b6478c3
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x28], eax
push esi
call fcn.10019cd8
push 7
pop eax
push 2
pop ebx
push ebx
lea ecx, [ebp - 0xcf4]
mov byte [ebp - 4], al
call fcn.10019cd8
push 8
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jge 0x10033cf0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x1140]
call fcn.10019d62
mov dword [eax], 0x68cd546
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x10033cd2
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x10033d16
push dword [ebp - 0x30]
lea ecx, [ebp - 0xcf4]
call fcn.10019d62
mov dword [eax], 0x47cd
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x10033cf8
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10033d2c
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1364], 0x92e6c0b3
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x10033d1b
xor ebx, ebx
lea ecx, [ebp - 0xcf4]
inc ebx
push ebx
call fcn.10019d62
lea ecx, [ebp - 0xcf4]
dec dword [eax]
inc dword [ebp - 0x135c]
call fcn.10019d5d
lea ecx, [ebp - 0x1140]
mov byte [ebp - 4], 6
call fcn.10019d5d
dec dword [ebp - 0x20]
push 0xfffffffffffffff6
pop eax
cmp dword [ebp - 0x20], eax
jne 0x10033c65
push 2
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0xf84]
mov dword [ebp - 4], eax
call fcn.10019d5d
or eax, 0xffffffff
lea ecx, [ebp - 0x12c8]
mov dword [ebp - 0x1c], eax
push ebx
call fcn.10019cd8
xor eax, eax
mov dword [ebp - 4], 9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10033dc9
push dword [ebp - 0x20]
lea ecx, [ebp - 0x12c8]
call fcn.10019d62
mov dword [eax], 0x9b2cfb63
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x10033da8
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10033dfe
mov dword [ebp - 0x20], 0x10b999fb
mov dword [ebp - 0x20], eax
jmp 0x10033df6
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10033df3
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x10033dda
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe8
jle 0x10033dce
or eax, 0xffffffff
lea ecx, [ebp - 0x12c8]
mov dword [ebp - 4], eax
call fcn.10019d5d
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x4c0]
call fcn.10019cd8
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0xd0c]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], eax
inc eax
mov dword [ebp - 0x28], eax
push eax
call fcn.10019cd8
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x10033e76
push dword [ebp - 0x20]
lea ecx, [ebp - 0xd0c]
call fcn.10019d62
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x10033e58
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10033f0a
xor eax, eax
lea ecx, [ebp - 0xf9c]
inc eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], 0x289a695
mov dword [ebp - 0x28], 0x50b5f0b1
push eax
call fcn.10019cd8
xor eax, eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x20], eax
jmp 0x10033ec0
push dword [ebp - 0x20]
lea ecx, [ebp - 0xf9c]
call fcn.10019d62
mov dword [eax], 0x4b64b5c6
inc dword [ebp - 0x20]
xor eax, eax
inc eax
cmp dword [ebp - 0x20], eax
jl 0x10033ea9
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xd0c]
push eax
call fcn.10019d62
lea ecx, [ebp - 0xf9c]
inc dword [eax]
mov byte [ebp - 4], 0xb
call fcn.10019d5d
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff7
jge 0x10033e7e
lea ecx, [ebp - 0xd0c]
mov byte [ebp - 4], 0xa
call fcn.10019d5d
push esi
lea ecx, [ebp - 0xd6c]
call fcn.10019cd8
mov byte [ebp - 4], 0xd
push 0xfffffffffffffff6
mov dword [ebp - 0x20], 0x5baf43b
pop eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10033f64
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x197c], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10033f4b
xor eax, eax
inc dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x10033f80
xor ebx, ebx
inc ebx
mov dword [ebp - 0x38], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x10033f72
jmp 0x10033f83
xor ebx, ebx
inc ebx
mov dword [ebp - 0x20], 0x69fdf99f
or ecx, 0xffffffff
mov dword [ebp - 0x28], 0xd7953644
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x20], eax
jmp 0x10033fcd
mov dword [ebp - 0x48], ecx
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10033fc7
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x48]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x10
je 0x10033fa3
mov dword [ebp - 0x18], eax
jmp 0x10033fec
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4c0]
call fcn.10019d62
or dword [eax], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10033fd8
push esi
lea ecx, [ebp - 0x2a0]
call fcn.10019cd8
mov byte [ebp - 4], 0xe
or eax, 0xffffffff
mov dword [ebp - 0x18], 0xdf1febae
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x48], 0xe06985ba
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1003403a
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2a0]
call fcn.10019d62
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10034020
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x100341a0
jmp 0x1003404a
xor eax, eax
push 0xfffffffffffffff6
pop ecx
mov dword [ebp - 0x24], 0x7497f3c8
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x2a0]
push eax
call fcn.10019d62
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2a0]
mov dword [eax], ebx
call fcn.10019d62
cmp dword [eax], 0
jne 0x10034084
xor eax, eax
inc eax
cmp dword [ebp - 0x20], eax
jne 0x10034087
xor eax, eax
jmp 0x10034087
xor eax, eax
inc eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2a0]
mov esi, eax
call fcn.10019d62
push dword [ebp - 0x18]
xor ebx, ebx
lea ecx, [ebp - 0x2a0]
cmp dword [eax], esi
setle bl
call fcn.10019d62
mov dword [eax], ebx
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
or eax, 0xffffffff
cmp dword [ebp - 0x1c], eax
jle 0x100340e1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2a0]
call fcn.10019d62
cmp dword [eax], 0
jne 0x100340e1
xor eax, eax
mov edx, eax
jmp 0x100340e6
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x1c]
jle 0x1003410f
xor eax, eax
lea ecx, [ebp - 0x2a0]
inc eax
push eax
call fcn.10019d62
cmp dword [eax], 0
jne 0x1003410f
xor eax, eax
mov edx, eax
jmp 0x10034114
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setne cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [ebp - 0x20]
jne 0x10034142
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2a0]
call fcn.10019d62
cmp dword [eax], 0
jne 0x10034142
xor eax, eax
mov ecx, eax
jmp 0x10034147
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x20]
add eax, ecx
xor ecx, ecx
cmp eax, 4
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp ecx, 0x2830
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x18]
jge 0x10034171
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x2a0]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x18]
call fcn.10019d62
mov ecx, dword [ebp - 0x1c]
push 1
pop ebx
imul ecx, dword [eax]
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0x18]
jns 0x10034048
push 2
pop esi
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 0xd
call fcn.10019d5d
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100341ca
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd6c]
call fcn.10019d62
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100341b6
mov dword [ebp - 0x48], 0x949d
lea ecx, [ebp - 0x580]
push esi
call fcn.10019cd8
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xd24]
mov dword [ebp - 0x28], 0xbc106ec6
push ebx
call fcn.10019cd8
mov byte [ebp - 4], 0x10
push 7
pop eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x28], 0x8d92426f
mov dword [ebp - 0x40], 0xa014
mov dword [ebp - 0x50], 0x318b
mov dword [ebp - 0x10], 0x7441
push 2
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jge 0x1003424a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x580]
call fcn.10019d62
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003422c
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jge 0x10034274
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd24]
call fcn.10019d62
mov dword [eax], 0x87f6fb80
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10034255
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0x580]
push eax
call fcn.10019d62
xor ebx, ebx
lea ecx, [ebp - 0x580]
inc ebx
push ebx
mov dword [eax], esi
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
call fcn.10019d62
push ebx
lea ecx, [ebp - 0x580]
mov esi, eax
call fcn.10019d62
mov ecx, dword [eax]
xor eax, eax
mov dword [esi], ecx
test ecx, ecx
jne 0x100342c4
mov esi, eax
cmp dword [ebp - 0x10], eax
je 0x100342c6
mov esi, ebx
push eax
lea ecx, [ebp - 0xd24]
call fcn.10019d62
imul ecx, esi, 0xf8c5
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
lea ecx, [ebp - 0xd24]
call fcn.10019d5d
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], 0xd
call fcn.10019d5d
xor eax, eax
lea ecx, [ebp - 0x4c0]
push eax
call fcn.10019d62
lea ecx, [ebp - 0x4c0]
mov dword [eax], 0x1a
xor eax, eax
push eax
call fcn.10019d62
push 3
pop esi
cmp dword [eax], 0xfffffff9
push esi
jne 0x10034e8e
lea ecx, [ebp - 0xc4]
call fcn.10019cd8
xor eax, eax
mov byte [ebp - 4], 0x11
push 2
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x5f8]
pop eax
push eax
call fcn.10019cd8
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1003437a
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc4]
call fcn.10019d62
mov dword [eax], 0x7571177e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1003435c
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x100343a3
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5f8]
call fcn.10019d62
mov dword [eax], 0x73b2c57e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10034385
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jle 0x10034426
push 2
pop ebx
lea ecx, [ebp - 0x5f8]
call fcn.10019d5d
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 0xd
call fcn.10019d5d
mov dword [ebp - 0x2c], 0x9ea
xor ecx, ecx
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x244c3f4
mov dword [ebp - 0x48], 0xc2d621ec
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
test eax, eax
setg cl
add ecx, dword [ebp - 0x20]
jne 0x1003465a
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1003465a
mov edx, eax
jmp 0x1003465f
xor ebx, ebx
inc ebx
mov dword [ebp - 0x20], 0xb1d6a56c
lea ecx, [ebp - 0x8c0]
push ebx
call fcn.10019cd8
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x1c], eax
jmp 0x1003445b
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x8c0]
call fcn.10019d62
or dword [eax], 0xffffffff
inc dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x10034447
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc4]
call fcn.10019d62
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc4]
call fcn.10019d62
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x5f8]
xor eax, eax
inc eax
push eax
call fcn.10019d62
lea ecx, [ebp - 0xc4]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.10019d62
xor eax, eax
lea ecx, [ebp - 0xc4]
push eax
call fcn.10019d62
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc4]
call fcn.10019d62
push 2
pop eax
push eax
lea ecx, [ebp - 0xc4]
call fcn.10019d62
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc4]
call fcn.10019d62
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc4]
call fcn.10019d62
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0xc4]
push dword [ebp - 0x18]
sub esi, dword [eax]
neg esi
sbb esi, esi
inc esi
call fcn.10019d62
push 2
xor ebx, ebx
lea ecx, [ebp - 0xc4]
cmp esi, dword [eax]
pop eax
push eax
setl bl
call fcn.10019d62
cmp ebx, dword [eax]
jl 0x10034558
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10034535
push 0x14d8
push 0x2114
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 2
pop ebx
lea ecx, [ebp - 0x8c0]
mov byte [ebp - 4], 0x12
call fcn.10019d5d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10034423
jmp 0x100343ae
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1003457c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd3c], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10034563
xor eax, eax
push 2
mov dword [ebp - 0x20], eax
pop ebx
cmp dword [ebp - 0x20], ebx
jg 0x10034538
or esi, 0xffffffff
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x10034649
xor eax, eax
lea ecx, [ebp - 0x5f8]
inc eax
mov dword [ebp - 0x48], eax
push eax
call fcn.10019d62
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x8c0]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10019d62
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
cmp ecx, esi
lea ecx, [ebp - 0xc4]
push 2
setg bl
sub ebx, dword [eax]
pop eax
push eax
call fcn.10019d62
mov ecx, dword [ebp - 0xd34]
xor edx, edx
push dword [ebp - 0x18]
cmp ebx, ecx
lea ecx, [ebp - 0xc4]
setg dl
xor ebx, ebx
cmp dword [eax], edx
setge bl
call fcn.10019d62
lea ecx, [ebp - 0x8c0]
sub ebx, dword [eax]
xor eax, eax
push eax
call fcn.10019d62
cmp dword [eax], ebx
jne 0x10034619
mov eax, dword [ebp - 0xd34]
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x5f8]
mov dword [ebp - 0x48], eax
xor eax, eax
push eax
call fcn.10019d62
mov ecx, dword [ebp - 0x48]
push 2
pop ebx
mov dword [eax], ecx
mov eax, dword [ebp - 0xd38]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10034599
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1003458a
jmp 0x10034538
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
sete cl
xor edx, edx
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp - 0x20]
cmp edx, 0xa9ce
jl 0x10034697
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
jmp 0x1003479d
push 3
lea ecx, [ebp - 0x330]
call fcn.10019cd8
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x48], 0xdd8607f4
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x100346dd
push dword [ebp - 0x20]
lea ecx, [ebp - 0x330]
call fcn.10019d62
or dword [eax], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x100346c1
xor eax, eax
push eax
lea ecx, [ebp - 0x330]
call fcn.10019d62
push ebx
lea ecx, [ebp - 0x330]
and dword [eax], 0
mov eax, dword [ebp - 0x1c]
call fcn.10019d62
xor eax, eax
lea ecx, [ebp - 0x330]
push eax
call fcn.10019d62
cmp dword [ebp - 0x1c], 0xa59f3bc9
jl 0x1003472c
xor eax, eax
lea ecx, [ebp - 0x330]
push eax
call fcn.10019d62
cmp dword [eax], 0
je 0x1003472c
xor eax, eax
lea esi, [eax + 1]
jmp 0x10034730
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0x330]
call fcn.10019d62
lea ecx, [ebp - 0x330]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
xor eax, eax
push eax
call fcn.10019d62
mov ecx, dword [ebp - 0x48]
xor edx, edx
cmp ecx, esi
setge dl
sub edx, dword [ebp - 0x38]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [eax]
je 0x1003477e
xor eax, eax
lea ecx, [ebp - 0x330]
push eax
call fcn.10019d62
cmp dword [eax], 0
jne 0x1003477e
xor eax, eax
mov ecx, eax
jmp 0x10034783
xor eax, eax
lea ecx, [eax + 1]
xor eax, eax
cmp ecx, 0xffffffff
lea ecx, [ebp - 0x330]
setl al
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 0xd
call fcn.10019d5d
mov dword [ebp - 0x38], 0x1738ab65
or eax, 0xffffffff
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x20], 0x65d3e8ea
mov dword [ebp - 0x1c], 0xa43dee6e
mov dword [ebp - 0x24], 0x6f4846e1
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x3c], 0xec63f78c
mov dword [ebp - 0x30], eax
jmp 0x10034a84
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffc
inc eax
mov dword [ebp - 0x24], 0x357257ea
push eax
lea ecx, [ebp - 0x24c]
call fcn.10019cd8
mov byte [ebp - 4], 0x15
xor ebx, ebx
mov dword [ebp - 0x48], 0x9a65
inc ebx
push 5
pop eax
mov dword [ebp - 0x38], eax
xor eax, eax
inc eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x10], 0x27ab8100
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x34], 0xd0a5
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003484d
push dword [ebp - 0x18]
lea ecx, [ebp - 0x24c]
call fcn.10019d62
mov dword [eax], 0xfffffff8
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10034829
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x18], eax
jmp 0x10034863
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14e4], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10034852
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1003488b
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], ebx
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1003489d
cmp dword [ebp - 0x30], eax
je 0x1003489f
mov eax, ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x30]
sub edx, eax
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0x3729
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x24c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
xor eax, eax
push eax
call fcn.10019d62
xor eax, eax
lea ecx, [ebp - 0x24c]
push eax
call fcn.10019d62
xor eax, eax
lea ecx, [ebp - 0x24c]
push eax
call fcn.10019d62
xor ecx, ecx
cmp dword [eax], ebx
sete cl
xor eax, eax
cmp ecx, dword [ebp - 0x30]
jle 0x10034909
mov esi, eax
cmp dword [ebp - 0x30], eax
je 0x1003490b
mov esi, ebx
push eax
lea ecx, [ebp - 0x24c]
call fcn.10019d62
mov ecx, dword [ebp - 0x48]
xor edx, edx
cmp esi, ecx
push 5
setg dl
xor ebx, ebx
imul edx, dword [eax]
pop eax
cmp edx, 0x33954656
setle bl
xor ecx, ecx
add ebx, eax
mov eax, dword [ebp - 0x30]
cmp ebx, eax
setg cl
xor eax, eax
sub ecx, 0xa83a
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x24c]
push eax
call fcn.10019d62
imul ecx, dword [ebp - 0x18], 0x3db4
mov dword [eax], ecx
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x40]
cmp eax, ecx
je 0x10034971
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x24c]
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.10019d62
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
cmp eax, edx
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x1c]
jg 0x100349ba
cmp dword [ebp - 0x24], eax
je 0x100349ba
inc eax
imul esi, eax, 0xd0e6
lea ecx, [ebp - 0x24c]
xor eax, eax
push eax
call fcn.10019d62
mov dword [eax], esi
mov eax, dword [ebp - 0x50]
imul eax, esi
test eax, eax
je 0x100349dd
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], 6
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
xor eax, eax
inc eax
cmp dword [ebp - 0x34], eax
je 0x10034a6c
xor eax, eax
mov dword [ebp - 0x48], 0xdf6e77a7
push eax
lea ecx, [ebp - 0x24c]
call fcn.10019d62
xor edx, edx
mov dword [eax], 1
mov eax, dword [ebp - 0x14dc]
cmp eax, 0xe2d7
mov eax, dword [ebp - 0x48]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x14d8]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
imul eax, dword [ebp - 0x24], 0x96de
mov dword [ebp - 0x1c], eax
jmp 0x10034a72
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 0xd
call fcn.10019d5d
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffffa
jl 0x100347d7
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x17d4]
movdqa xmm0, xmmword [0x1000a8b0]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x1374]
push eax
lea eax, [ebp - 0x1384]
push eax
movdqu xmmword [ebp - 0x1384], xmm0
call fcn.10019d71
lea ecx, [ebp - 0x153]
mov esi, eax
call fcn.1000bd13
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xdc0]
push dword [esi]
call fcn.10019d37
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x30], 0xfffffffb
push 2
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x10034b0b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x9b4], 0xfffffffa
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10034af3
xor eax, eax
push 3
mov dword [ebp - 0x30], eax
pop ebx
jmp 0x10034d2f
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
jl 0x10034d2c
mov dword [ebp - 0x24], 0x65653d42
mov dword [ebp - 0x28], 0x51ef9953
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x10034d23
push ecx
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0xdcc]
mov dword [ebp - 0x28], 0xfffffffc
call fcn.10019cd8
xor eax, eax
mov byte [ebp - 4], 0x17
push 2
mov dword [ebp - 0x20], eax
pop esi
cmp dword [ebp - 0x20], esi
jge 0x10034b84
push dword [ebp - 0x20]
lea ecx, [ebp - 0xdcc]
call fcn.10019d62
mov dword [eax], 0x6b3e713e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10034b66
xor eax, eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x10034cf8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x10034cef
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x42c]
call fcn.10019cd8
mov byte [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x28], 0xe71b35d5
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10034beb
push dword [ebp - 0x18]
lea ecx, [ebp - 0x42c]
call fcn.10019d62
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10034bca
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x18], eax
jmp 0x10034c01
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x191c], 0xfffffff7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10034bf0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xdc0]
call fcn.10019d62
lea ecx, [ebp - 0x42c]
cmp dword [eax], 0
jne 0x10034ce1
xor eax, eax
push eax
call fcn.10019d62
mov dword [eax], 3
jmp 0x10034cb0
push esi
lea ecx, [ebp - 0xd54]
call fcn.10019cd8
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10034c6c
push dword [ebp - 0x20]
lea ecx, [ebp - 0xd54]
call fcn.10019d62
mov dword [eax], 0x5641
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10034c4e
xor eax, eax
push eax
lea ecx, [ebp - 0xd54]
call fcn.10019d62
dec dword [eax]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10034c91
push 0xa57
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ecx, [ebp - 0xd54]
mov byte [ebp - 4], 0x18
call fcn.10019d5d
xor eax, eax
lea ecx, [ebp - 0x42c]
push eax
call fcn.10019d62
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x42c]
push eax
call fcn.10019d62
cmp dword [eax], 0
jge 0x10034c34
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 0x17
call fcn.10019d5d
dec dword [ebp - 0x1c]
jns 0x10034ba9
jmp 0x10034cea
mov byte [ebp - 4], 0x17
call fcn.10019d5d
push 3
pop ebx
xor eax, eax
dec dword [ebp - 0x10]
jns 0x10034b90
push dword [ebp - 0x24]
lea ecx, [ebp - 0xdc0]
call fcn.10019d62
lea ecx, [ebp - 0xdcc]
mov byte [ebp - 4], 0x16
call fcn.10019d5d
dec dword [ebp - 0x24]
push 2
pop ecx
jns 0x10034b3f
xor eax, eax
dec dword [ebp - 0x3c]
jns 0x10034b25
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x10034b16
mov eax, dword [ebp - 0x9b4]
lea ecx, [ebp - 0xdc0]
mov dword [ebp - 0x9b4], eax
mov byte [ebp - 4], 0xd
call fcn.10019d5d
xor eax, eax
mov dword [ebp - 0x20], 4
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10034d74
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10034d8e
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10034d8b
push eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x10
je 0x10034d79
push 3
mov byte [ebp - 0x11], al
lea ecx, [ebp - 0xa00]
xor ebx, ebx
mov dword [ebp - 0x20], 0x3efc07e1
pop esi
inc ebx
mov dword [ebp - 0x1c], ebx
push esi
call fcn.10019cd8
xor eax, eax
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10034ddf
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa00]
call fcn.10019d62
mov dword [eax], 0xb0cb8ce3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10034dc1
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10034dee
xor eax, eax
xor ebx, ebx
inc ebx
lea ecx, [eax + 1]
jmp 0x10034df0
mov ecx, eax
xor eax, eax
cmp ecx, 0xfffffffc
push 2
setne al
mov dword [ebp - 0x1c], eax
pop eax
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jl 0x10034e4c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa00]
call fcn.10019d62
push 2
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
jl 0x10034e47
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10034e42
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x10034e23
dec dword [ebp - 0x1c]
jns 0x10034e08
lea ecx, [ebp - 0xa00]
mov byte [ebp - 4], 0xd
call fcn.10019d5d
cmp byte [ebp - 0x11], 0
je 0x10034e6b
push 0x268
xor eax, eax
push eax
call edi
xor eax, eax
lea ecx, [ebp - 0x4c0]
push eax
call fcn.10019d62
lea ecx, [ebp - 0x4c0]
dec dword [eax]
xor eax, eax
push eax
call fcn.10019d62
jmp 0x10034321
mov dword [ebp - 0x20], 0x76820624
lea ecx, [ebp - 0x1150]
mov dword [ebp - 0x48], ebx
call fcn.10019cd8
xor eax, eax
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10034ecc
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1150]
call fcn.10019d62
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10034eb1
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff1
jg 0x10034f19
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
xor edx, edx
push 5
pop eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 1
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
xor eax, eax
inc eax
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff1
jle 0x10034ed8
xor ebx, ebx
xor eax, eax
inc ebx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10034f2e
push 0xc08
push eax
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
lea ecx, [ebp - 0x1150]
mov byte [ebp - 4], 0xd
call fcn.10019d5d
xor eax, eax
lea ecx, [ebp - 0xd6c]
push eax
call fcn.10019d62
lea ecx, [ebp - 0xd6c]
dec dword [eax]
call fcn.10019d5d
or edi, 0xffffffff
lea ecx, [ebp - 0x4c0]
mov dword [ebp - 4], edi
call fcn.10019d5d
mov dword [ebp - 0x1c], ebx
xor eax, eax
mov dword [ebp - 0x40], edi
mov edi, 0x688cdf2a
mov dword [ebp - 0x48], esi
mov esi, 0x9efededc
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0xe3c], esi
mov dword [ebp - 0xe38], esi
mov dword [ebp - 0xe34], esi
mov dword [ebp - 0xe30], esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10034fbf
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x70], 0xa42b4837
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x10034fa7
xor eax, eax
cmp dword [ebp - 0x1c], 6
je 0x1003501d
cmp dword [ebp - 0x1c], eax
je 0x10034ff3
mov ecx, dword [ebp - 0x70]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setl dl
cmp edx, dword [ebp - 0x70]
jl 0x10034fdf
mov eax, dword [ebp - 0x70]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
je 0x10034ff3
xor eax, eax
cmp dword [ebp - 0x70], eax
je 0x10034ff1
inc eax
jmp 0x10034ff3
xor eax, eax
mov edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x70]
cmp edx, eax
mov eax, dword [ebp - 0x40]
setne cl
imul eax, ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x48]
dec dword [ebp - 0x40]
test eax, eax
je 0x1003501d
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10035021
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x70], ecx
mov ebx, 0xfff0698
mov eax, dword [ebp - 0x1c]
imul eax, ecx
xor ecx, ecx
cmp eax, ebx
setl cl
mov dword [ebp - 0x34], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x70]
inc ecx
mov dword [ebp - 0xe3c], eax
mov dword [ebp - 0x34], eax
or eax, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0xe1c], esi
mov dword [ebp - 0xe18], esi
mov dword [ebp - 0xe14], esi
mov dword [ebp - 0xe10], esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1003509b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6c], 0xa42b4837
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x10035083
xor eax, eax
cmp dword [ebp - 0x1c], 6
je 0x100350f9
cmp dword [ebp - 0x1c], eax
je 0x100350cf
mov ecx, dword [ebp - 0x6c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setl dl
cmp edx, dword [ebp - 0x6c]
jl 0x100350bb
mov eax, dword [ebp - 0x6c]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
je 0x100350cf
xor eax, eax
cmp dword [ebp - 0x6c], eax
je 0x100350cd
inc eax
jmp 0x100350cf
xor eax, eax
mov edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x6c]
cmp edx, eax
mov eax, dword [ebp - 0x40]
setne cl
imul eax, ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x48]
dec dword [ebp - 0x40]
test eax, eax
je 0x100350f9
xor eax, eax
lea ecx, [eax + 1]
jmp 0x100350fd
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x6c], ecx
mov esi, 0xe1e87df2
mov eax, dword [ebp - 0x1c]
imul eax, ecx
xor ecx, ecx
cmp eax, ebx
setl cl
xor edi, edi
mov dword [ebp - 0x34], ecx
inc edi
mov eax, dword [ebp - 0x6c]
lea ecx, [ebp - 0x1230]
mov dword [ebp - 0xe1c], eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], eax
push edi
call fcn.10019cd8
push 3
lea ecx, [ebp - 0xfb4]
mov dword [ebp - 4], 0x1c
call fcn.10019cd8
mov byte [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x48], 0x57f39cee
mov dword [ebp - 0x28], 0x4af7
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edi
jge 0x1003518f
push 0xfffffffffffffff6
pop ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x11f0], ecx
xor eax, eax
inc dword [ebp - 0x30]
inc eax
cmp dword [ebp - 0x30], eax
jl 0x10035175
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edi
jge 0x100351b9
push dword [ebp - 0x30]
lea ecx, [ebp - 0x1230]
call fcn.10019d62
mov dword [eax], edi
xor eax, eax
inc dword [ebp - 0x30]
inc eax
push eax
pop edi
cmp dword [ebp - 0x30], eax
jl 0x10035197
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x100351de
push dword [ebp - 0x30]
lea ecx, [ebp - 0xfb4]
call fcn.10019d62
or dword [eax], 0xffffffff
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x100351c2
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_DestroyCaret]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100351ef
call ebx
dec dword [ebp - 0x48]
lea ecx, [ebp - 0xfb4]
call fcn.10019d5d
or eax, 0xffffffff
lea ecx, [ebp - 0x1230]
mov dword [ebp - 4], eax
call fcn.10019d5d
mov dword [ebp - 0x28], 0xfffffffb
lea ecx, [ebp - 0xfcc]
mov dword [ebp - 0x28], esi
xor eax, eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], eax
push edi
call fcn.10019cd8
push 3
lea ecx, [ebp - 0xe58]
mov dword [ebp - 4], 0x1e
call fcn.10019cd8
mov byte [ebp - 4], 0x1f
xor eax, eax
mov dword [ebp - 0x48], 0x57f39cee
mov dword [ebp - 0x28], 0x4af7
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edi
jge 0x10035279
push 0xfffffffffffffff6
pop ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xecc], ecx
xor eax, eax
inc dword [ebp - 0x30]
inc eax
cmp dword [ebp - 0x30], eax
jl 0x1003525f
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edi
jge 0x100352a3
push dword [ebp - 0x30]
lea ecx, [ebp - 0xfcc]
call fcn.10019d62
mov dword [eax], edi
xor eax, eax
inc dword [ebp - 0x30]
inc eax
push eax
pop edi
cmp dword [ebp - 0x30], eax
jl 0x10035281
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x100352c8
push dword [ebp - 0x30]
lea ecx, [ebp - 0xe58]
call fcn.10019d62
or dword [eax], 0xffffffff
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x100352ac
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100352d3
call ebx
dec dword [ebp - 0x48]
lea ecx, [ebp - 0xe58]
call fcn.10019d5d
or ebx, 0xffffffff
lea ecx, [ebp - 0xfcc]
mov dword [ebp - 4], ebx
call fcn.10019d5d
movdqa xmm0, xmmword [0x1000a870]
lea eax, [ebp - 0x1594]
push eax
lea eax, [ebp - 0x15a4]
push eax
lea ecx, [ebp - 0x184c]
movdqu xmmword [ebp - 0x15a4], xmm0
call fcn.10019d71
lea ecx, [ebp - 0x155]
mov esi, eax
call fcn.1000bd13
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x520]
push dword [esi]
call fcn.10019d37
mov dword [ebp - 4], 0x20
lea ecx, [ebp - 0x520]
push edi
mov dword [ebp - 0x48], 0x51162f63
call fcn.10019d62
and dword [eax], 0
jmp 0x100353cd
push 2
pop eax
push 8
mov dword [ebp - 0x50], 0x9b8bc588
mov dword [ebp - 0x40], eax
pop eax
mov dword [ebp - 0x48], eax
xor eax, eax
push eax
call fcn.10019d62
mov ecx, dword [ebp - 0x40]
push edi
add ecx, dword [eax]
imul eax, ecx, 0x5cd3
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x52bf
setge cl
sub ecx, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x50]
neg ecx
cmp ecx, 0x7359b504
setle dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x520]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
call fcn.10019d62
dec dword [eax]
push edi
lea ecx, [ebp - 0x520]
call fcn.10019d62
lea ecx, [ebp - 0x520]
cmp dword [eax], 0xffffffef
jl 0x10035358
mov dword [ebp - 4], ebx
call fcn.10019d5d
mov dword [ebp - 0x24], 0x1897
xor eax, eax
mov dword [ebp - 0x18], 0xb57e8b72
mov dword [ebp - 0x10], 0xfffffff9
mov dword [ebp - 0x38], 0x96d56a42
mov dword [ebp - 0x48], 0x4275799d
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], eax
jmp 0x1003542e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc8], 0xfffffff8
inc dword [ebp - 0x20]
xor eax, eax
inc eax
cmp dword [ebp - 0x20], eax
jl 0x1003541d
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0xfffffff2
cmp dword [ebp - 0x18], 0xf
jle 0x10035564
xor ebx, ebx
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
mov dword [ebp - 0x20], 0x9892657
push 8
pop eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc8], ecx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp ecx, 0xe6ea
setg dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, dword [ebp - 0x1c]
jg 0x100354b1
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc8]
xor edx, edx
sub eax, 0x4ba09a16
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
imul ecx, edx, 0xfff6
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x20], 0xfffffffe
cmp dword [ebp - 0x1c], eax
jne 0x10035527
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setl dl
mov dword [ebp - 0xc8], edx
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x20]
jne 0x10035527
cmp dword [ebp - 0xc8], eax
jne 0x10035527
mov ecx, eax
jmp 0x1003552f
xor eax, eax
xor ebx, ebx
inc ebx
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x1c]
xor edx, edx
add ecx, 8
cmp ecx, eax
setle dl
add edx, 0x84ad
imul edx, dword [ebp - 0x34]
add edx, 4
jne 0x10035552
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10035554
mov eax, ebx
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jg 0x10035455
movdqa xmm0, xmmword [0x1000a870]
lea eax, [ebp - 0x1394]
push eax
xor ebx, ebx
lea eax, [ebp - 0x13a4]
inc ebx
lea ecx, [ebp - 0x17e4]
mov dword [ebp - 0x3c], ebx
push eax
movdqu xmmword [ebp - 0x13a4], xmm0
call fcn.10019d71
lea ecx, [ebp - 0x157]
mov esi, eax
call fcn.1000bd13
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x294]
push dword [esi]
call fcn.10019d37
mov dword [ebp - 4], 0x21
lea ecx, [ebp - 0xfe4]
mov dword [ebp - 0x38], 0xfffffffc
or esi, 0xffffffff
mov dword [ebp - 0x28], 0x22736378
push 2
mov dword [ebp - 0x28], 0xfffffffd
pop edi
mov dword [ebp - 0x28], 0xf1fcc103
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], edi
push 3
call fcn.10019cd8
xor eax, eax
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x20], eax
jmp 0x1003560e
push dword [ebp - 0x20]
lea ecx, [ebp - 0xfe4]
call fcn.10019d62
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x100355fb
push edi
lea ecx, [ebp - 0x294]
call fcn.10019d62
push edi
lea ecx, [ebp - 0x294]
and dword [eax], 0
call fcn.10019d62
cmp dword [eax], 0xffffffec
jne 0x1003571d
mov dword [ebp - 0x48], 0xa5efa20b
lea ecx, [ebp - 0x1168]
mov dword [ebp - 0x28], 0xca70051
mov dword [ebp - 0x28], 0x2415fb57
mov dword [ebp - 0x28], 0x6128f3b8
mov dword [ebp - 0x28], 0xc4aee507
push edi
call fcn.10019cd8
xor eax, eax
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x10035693
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1168]
call fcn.10019d62
mov dword [eax], 8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10035675
xor eax, eax
push eax
lea ecx, [ebp - 0x294]
call fcn.10019d62
cmp dword [eax], 0
jne 0x100356e0
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x294]
push 3
call fcn.10019d62
push ebx
lea ecx, [ebp - 0x294]
call fcn.10019d62
push 3
lea ecx, [ebp - 0x294]
call fcn.10019d62
push ebx
lea ecx, [ebp - 0x294]
call fcn.10019d62
mov eax, dword [ebp - 0x48]
xor eax, eax
jmp 0x100356e2
mov eax, ebx
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x1168]
dec dword [ebp - 0x50]
mov byte [ebp - 4], 0x22
call fcn.10019d5d
push edi
lea ecx, [ebp - 0x294]
call fcn.10019d62
push edi
lea ecx, [ebp - 0x294]
dec dword [eax]
call fcn.10019d62
cmp dword [eax], 0xffffffec
je 0x10035638
or esi, 0xffffffff
lea ecx, [ebp - 0xfe4]
call fcn.10019d5d
lea ecx, [ebp - 0x294]
mov dword [ebp - 4], esi
call fcn.10019d5d
push edi
lea ecx, [ebp - 0x108]
call fcn.10019cd8
mov dword [ebp - 4], 0x24
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x38], 0xb1f8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1003577a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xfc], 0xa8c6a53d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10035761
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100357a0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x108]
call fcn.10019d62
mov dword [eax], 0x16df251d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10035782
xor eax, eax
push eax
lea ecx, [ebp - 0x108]
call fcn.10019d62
mov dword [eax], edi
jmp 0x100358cb
push 2
mov dword [ebp - 0x18], 0x629aa810
xor eax, eax
pop ecx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jl 0x100358bd
mov dword [ebp - 0x70c], ebx
mov dword [ebp - 0x708], ebx
mov dword [ebp - 0x704], ebx
mov dword [ebp - 0x700], ebx
mov dword [ebp - 0x708], ecx
cmp dword [ebp - 0x708], eax
jl 0x100358b4
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x1003588c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], eax
jmp 0x1003587e
mov dword [ebp - 0x1c], 0xc1da7bc9
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x10035846
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003583e
push 0x1d2a
push 0xe37
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1003581b
push 2
pop ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jg 0x1003587b
push eax
lea ecx, [ebp - 0x108]
call fcn.10019d62
mov ecx, dword [ebp - 0x20]
push 2
mov ecx, dword [ebp + ecx*4 - 0xfc]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0xfc], ecx
inc dword [ebp - 0x1c]
pop ecx
push 0
pop eax
cmp dword [ebp - 0x1c], ecx
jle 0x1003584e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jle 0x1003580c
dec dword [ebp - 0x10]
jns 0x10035804
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100358a8
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
push 2
xor eax, eax
pop ecx
dec dword [ebp - 0x708]
jns 0x100357f5
dec dword [ebp - 0x18]
jns 0x100357cb
push eax
lea ecx, [ebp - 0x108]
call fcn.10019d62
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x108]
push eax
call fcn.10019d62
cmp dword [eax], 0
jge 0x100357b3
mov eax, dword [ebp - 0xf4]
neg eax
je 0x1003598e
xor eax, eax
lea ecx, [ebp - 0x108]
push eax
call fcn.10019d62
xor eax, eax
lea ecx, [ebp - 0x108]
push eax
call fcn.10019d62
push ebx
lea ecx, [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
call fcn.10019d62
mov eax, dword [ebp - 0xf8]
lea ecx, [ebp - 0x108]
xor eax, eax
push eax
call fcn.10019d62
mov ecx, dword [ebp - 0x40]
xor ebx, ebx
neg ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x108]
setl bl
xor eax, eax
push eax
dec ebx
call fcn.10019d62
mov ecx, 0x870b1b9b
mov dword [eax], ebx
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xfc]
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0xf4]
jne 0x1003598e
xor eax, eax
lea edx, [eax + 1]
jmp 0x10035992
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0xf4]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xf8]
setl cl
sub ecx, eax
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x108]
mov dword [ebp - 4], esi
call fcn.10019d5d
push 7
pop eax
push 2
pop ebx
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0xc28]
mov dword [ebp - 0x20], eax
push ebx
call fcn.10019cd8
xor eax, eax
mov dword [ebp - 4], 0x25
inc eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x50], 0x9b1ab445
lea ecx, [ebp - 0xa18]
push eax
call fcn.10019cd8
xor eax, eax
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10035a1c
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc28]
call fcn.10019d62
mov dword [eax], 0x3e38
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100359fe
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10035a38
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa18]
call fcn.10019d62
mov dword [eax], 0x2ca96836
inc dword [ebp - 0x18]
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10035a21
mov edi, dword [ebp - 0x20]
imul edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edi
sbb edi, edi
xor edx, edx
neg edi
cmp ecx, eax
lea ecx, [ebp - 0xc28]
setge dl
xor ebx, ebx
inc ebx
push ebx
lea esi, [edx - 1]
call fcn.10019d62
lea ecx, [ebp - 0xa18]
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x48], esi
push eax
call fcn.10019d62
mov ecx, dword [ebp - 0x50]
mov esi, eax
mov edx, dword [ebp - 0x48]
sub edx, ecx
xor ecx, ecx
cmp edi, edx
setge cl
sub ecx, dword [ebp - 0x50]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xced4
lea ecx, [ebp - 0xa18]
setge al
mov dword [esi], eax
call fcn.10019d5d
or edi, 0xffffffff
lea ecx, [ebp - 0xc28]
mov dword [ebp - 4], edi
call fcn.10019d5d
push 3
pop esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0x18], 0xc
jmp 0x10035b3f
mov dword [ebp - 0x1c], 0xb844a754
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10035b03
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x188c], 0x6aed1d25
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10035aea
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10035b14
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setle cl
mov dword [ebp - 0x1884], ecx
dec dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], 0xa
je 0x10035ada
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0xd30]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], 0xb7161ab6
push esi
call fcn.10019cd8
mov dword [ebp - 4], 0x27
xor eax, eax
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10035b92
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa30], 0x507e6732
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10035b79
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10035bae
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd30]
call fcn.10019d62
mov dword [eax], 0xbfb3a4d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10035b97
mov eax, dword [ebp - 0x40]
xor edx, edx
xor eax, eax
mov dword [ebp - 0xa2c], eax
mov dword [ebp - 0xa28], edi
mov ecx, dword [ebp - 0xa2c]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xffff4fe3
push 2
setne cl
sub eax, ecx
mov ecx, 0xffff
cmp eax, ecx
lea ecx, [ebp - 0xd30]
pop edi
sbb esi, esi
push edi
neg esi
call fcn.10019d62
lea ecx, [ebp - 0xd30]
mov dword [eax], esi
mov dword [ebp - 0x38], esi
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.10019d5d
mov edx, 0x9efededc
xor eax, eax
mov dword [ebp - 0xe0c], edx
mov dword [ebp - 0xe08], edx
mov dword [ebp - 0xe04], edx
mov dword [ebp - 0xe00], edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x48], 0xe7c650ba
push 0xfffffffffffffff6
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x15
je 0x10035f7d
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x2c], 0x7c6ae49a
mov dword [ebp - 0x1c], eax
jmp 0x10035c79
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x195c], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10035c6c
mov dword [ebp - 0x18], 0xffffffea
jmp 0x10035f3d
lea eax, [ebp - 0x14f4]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x1504]
push eax
lea ecx, [ebp - 0x18ac]
movdqu xmmword [ebp - 0x1504], xmm0
call fcn.10019d71
lea ecx, [ebp - 0x1f5]
mov esi, eax
call fcn.1000bd13
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x30c]
push dword [esi]
call fcn.10019d37
mov dword [ebp - 4], 0x28
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1c], eax
jmp 0x10035f1f
mov dword [ebp - 0x48], 0xbbbb
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
test eax, eax
je 0x10035d1a
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, 0xffffffff
setge cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
je 0x10035d1c
xor ebx, ebx
lea esi, [eax + 1]
inc ebx
jmp 0x10035d1e
xor eax, eax
mov esi, eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x30c]
call fcn.10019d62
xor edx, edx
cmp esi, ebx
setne dl
xor ecx, ecx
add edx, dword [ebp - 0x30]
cmp dword [eax], edx
setl cl
cmp ecx, 0xdc6b79df
je 0x10035d4e
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x30], eax
je 0x10035d50
mov esi, ebx
push 3
lea ecx, [ebp - 0x30c]
call fcn.10019d62
xor ecx, ecx
cmp esi, dword [eax]
setg cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x30c]
push dword [ebp - 0x1c]
call fcn.10019d62
cmp dword [eax], 0
je 0x10035e26
xor eax, eax
lea ecx, [ebp - 0x30c]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], 0x23279329
push dword [ebp - 0x1c]
call fcn.10019d62
xor ecx, ecx
push ebx
mov edx, dword [eax]
mov eax, dword [ebp - 0x2c]
neg edx
cmp edx, eax
setl cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x30c]
call fcn.10019d62
imul ecx, dword [ebp - 0x48], 0xad22
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x18]
sete dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x50]
setge cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
cmp edx, eax
setl cl
neg ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x30c]
push dword [ebp - 0x1c]
call fcn.10019d62
mov ecx, dword [ebp - 0x48]
mov esi, eax
xor eax, eax
cmp ecx, ebx
setge al
xor edx, edx
imul eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x50]
cmp ecx, eax
setle dl
xor eax, eax
cmp dword [esi], edx
setge al
mov dword [ebp - 0x48], eax
jmp 0x10035f1c
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10035e4b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x74c], 0xcb070fcb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10035e33
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x10035f17
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x24], eax
jmp 0x10035e75
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x16f0], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10035e64
push ebx
lea ecx, [ebp - 0x30c]
call fcn.10019d62
cmp dword [eax], 0
je 0x10035eb6
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0x30c]
mov dword [ebp - 0x74c], esi
push dword [ebp - 0x1c]
call fcn.10019d62
xor ecx, ecx
cmp esi, 0x25ac
setg cl
cmp ecx, dword [eax]
jge 0x10035eb6
mov eax, ebx
jmp 0x10035eb8
xor eax, eax
mov dword [ebp - 0x50], eax
xor ecx, ecx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x24], eax
imul eax, dword [ebp - 0x24], 0xfff9
push 5
sub eax, dword [ebp - 0x40]
cmp eax, 0x65fe
pop eax
setl cl
cmp eax, ecx
mov eax, dword [ebp - 0x16f0]
push 0
sbb ecx, ecx
add ecx, 0xffff3c6f
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
imul ecx, eax
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
cmp eax, edx
pop eax
setg cl
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x10035e58
cmp dword [ebp - 0x24], eax
jne 0x10035f29
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x10035ceb
or esi, 0xffffffff
lea ecx, [ebp - 0x30c]
mov dword [ebp - 4], esi
call fcn.10019d5d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff4
jle 0x10035c8b
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10035f67
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10035f64
push 0x17b9
call dword [sym.imp.KERNEL32.dll_TlsFree]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x10035f4e
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x15
push 0
pop eax
jne 0x10035c59
movdqa xmm0, xmmword [0x1000a8a0]
lea ecx, [ebp - 0x17f4]
mov dword [ebp - 0x38], 0x688cdf2a
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x13b4]
push eax
lea eax, [ebp - 0x13c4]
push eax
movdqu xmmword [ebp - 0x13c4], xmm0
call fcn.10019d71
lea ecx, [ebp - 0x140]
mov esi, eax
call fcn.1000bd13
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xa48]
push dword [esi]
call fcn.10019d37
mov dword [ebp - 4], 0x29
xor eax, eax
mov dword [ebp - 0x38], 0x4da86284
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10036000
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x129c], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10035fe7
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10036012
push eax
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
xor eax, eax
cmp dword [ebp - 0x129c], eax
jne 0x10036020
mov eax, dword [ebp - 0x129c]
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0xa48]
mov eax, dword [ebp - 0x34]
push edi
call fcn.10019d62
mov esi, 0x622b
lea ecx, [ebp - 0xa48]
push edi
sub esi, dword [eax]
call fcn.10019d62
or edi, 0xffffffff
lea ecx, [ebp - 0xa48]
sub esi, dword [eax]
mov dword [ebp - 0x38], esi
mov dword [ebp - 4], edi
call fcn.10019d5d
push ebx
lea ecx, [ebp - 0x324]
call fcn.10019cd8
lea eax, [ebp - 0x15f4]
mov dword [ebp - 4], 0x2a
movdqa xmm0, xmmword [0x1000a940]
lea ecx, [ebp - 0x175c]
push eax
lea eax, [ebp - 0x1604]
push eax
movdqu xmmword [ebp - 0x1604], xmm0
call fcn.10019d71
lea ecx, [ebp - 0x158]
mov esi, eax
call fcn.1000bd13
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x3f0]
push dword [esi]
call fcn.10019d37
xor eax, eax
mov byte [ebp - 4], 0x2b
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x100360da
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb0], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100360c6
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10036100
push dword [ebp - 0x18]
lea ecx, [ebp - 0x324]
call fcn.10019d62
mov dword [eax], 0x70cd5099
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100360e2
xor eax, eax
mov dword [ebp - 0xb0], eax
jmp 0x10036134
push eax
lea ecx, [ebp - 0x324]
call fcn.10019d62
mov edx, dword [ebp - 0xb0]
mov esi, eax
mov ecx, dword [ebp - 0xb0]
xor eax, eax
cmp edx, ecx
push 0
setl al
mov dword [esi], eax
inc dword [ebp - 0xb0]
pop eax
cmp dword [ebp - 0xb0], 0x11
je 0x10036108
push 3
pop edi
push edi
lea ecx, [ebp - 0x3f0]
call fcn.10019d62
and dword [eax], 0
jmp 0x10036400
movdqa xmm0, xmmword [0x1000a950]
lea ecx, [ebp - 0x17bc]
or eax, 0xffffffff
mov dword [ebp - 0x34], 0x18d
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x13d4]
push eax
lea eax, [ebp - 0x13e4]
push eax
movdqu xmmword [ebp - 0x13e4], xmm0
call fcn.10019d71
lea ecx, [ebp - 0x142]
mov esi, eax
call fcn.1000bd13
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xffc]
push dword [esi]
call fcn.10019d37
xor eax, eax
mov byte [ebp - 4], 0x2c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x100361d0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x18a4], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x100361b7
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100361e1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor eax, eax
push eax
lea ecx, [ebp - 0x324]
call fcn.10019d62
push edi
lea ecx, [ebp - 0x3f0]
call fcn.10019d62
xor eax, eax
lea ecx, [ebp - 0x324]
push eax
call fcn.10019d62
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10036220
mov dword [ebp - 0x34], 0xfffffffb
inc dword [ebp - 0x34]
jmp 0x100363e3
movdqa xmm0, xmmword [0x1000a890]
lea eax, [ebp - 0x1514]
push eax
lea eax, [ebp - 0x1524]
mov dword [ebp - 0x20], 0xefa97f51
mov dword [ebp - 0x48], 0xf4a7d2ae
lea ecx, [ebp - 0x1784]
push eax
movdqu xmmword [ebp - 0x1524], xmm0
call fcn.10019d71
lea ecx, [ebp - 0x1b5]
mov esi, eax
call fcn.1000bd13
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x718]
push dword [esi]
call fcn.10019d37
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x324]
mov dword [ebp - 0x34], 0x90ce61fa
xor eax, eax
mov dword [ebp - 0xdec], ebx
mov dword [ebp - 0xde8], ebx
mov dword [ebp - 0xde4], ebx
mov dword [ebp - 0xde0], ebx
push eax
call fcn.10019d62
mov esi, eax
lea ecx, [ebp - 0x324]
xor eax, eax
push eax
call fcn.10019d62
mov ecx, dword [esi]
push edi
mov dword [eax], ecx
lea ecx, [ebp - 0x718]
call fcn.10019d62
mov ecx, dword [ebp - 0x40]
mov esi, 0x7464
mov edx, dword [ebp - 0xac]
sub edx, ecx
xor ecx, ecx
cmp edx, 8
push ebx
setne cl
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xffc]
setne dl
sub esi, edx
call fcn.10019d62
push edi
lea ecx, [ebp - 0x718]
mov dword [eax], esi
call fcn.10019d62
mov ecx, dword [ebp - 0xb0]
xor ebx, ebx
push edi
cmp ecx, dword [eax]
lea ecx, [ebp - 0x718]
setne bl
neg ebx
call fcn.10019d62
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x20]
sete cl
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0xac], ecx
lea ecx, [ebp - 0x324]
push eax
call fcn.10019d62
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [eax]
je 0x10036349
mov eax, dword [ebp - 0x20]
xor eax, eax
lea ecx, [ebp - 0x324]
push eax
call fcn.10019d62
mov eax, dword [ebp - 0x18a0]
lea ecx, [ebp - 0x718]
mov dword [ebp - 0x48], eax
push 3
call fcn.10019d62
push 3
lea ecx, [ebp - 0x3f0]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
call fcn.10019d62
mov ecx, dword [ebp - 0x34]
mov esi, eax
mov edx, dword [ebp - 0x48]
inc ecx
neg ecx
push 3
sbb ecx, ecx
xor ebx, ebx
inc ecx
inc ebx
cmp ecx, ebx
pop edi
sbb ecx, ecx
inc ecx
neg edx
push edi
sbb edx, edx
xor eax, eax
inc edx
sub edx, ecx
lea ecx, [ebp - 0x3f0]
cmp edx, dword [esi]
setl al
mov dword [ebp - 0x40], eax
call fcn.10019d62
mov ecx, dword [ebp - 0xde4]
mov esi, dword [ebp - 0x40]
sub esi, ecx
mov ecx, dword [ebp - 0x20]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, esi
lea ecx, [ebp - 0x718]
setle dl
imul edx, dword [eax]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], edx
call fcn.10019d5d
lea ecx, [ebp - 0xffc]
mov byte [ebp - 4], 0x2b
call fcn.10019d5d
push edi
lea ecx, [ebp - 0x3f0]
call fcn.10019d62
inc dword [eax]
push edi
lea ecx, [ebp - 0x3f0]
call fcn.10019d62
cmp dword [eax], 6
jge 0x10036154
lea ecx, [ebp - 0x3f0]
call fcn.10019d5d
or esi, 0xffffffff
lea ecx, [ebp - 0x324]
mov dword [ebp - 4], esi
call fcn.10019d5d
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10036450
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x74], 0xa42b4837
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1003643b
xor eax, eax
mov dword [ebp - 0x20], 0x1a049fe3
mov dword [ebp - 0x20], 0x19
cmp dword [ebp - 0x20], ebx
jg 0x100364b9
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10036488
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x610], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10036473
xor eax, eax
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 0x1d
jne 0x100364ae
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x60c]
cmp dword [ebp - 0x60c], 0x1d
je 0x10036497
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10036463
push 3
pop edi
cmp dword [ebp - 0x3c], 6
je 0x10036512
cmp dword [ebp - 0x3c], eax
je 0x100364eb
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x74]
cmp ecx, eax
setl dl
cmp edx, dword [ebp - 0x74]
jl 0x100364d9
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x3c], ebx
je 0x100364e5
xor eax, eax
cmp dword [ebp - 0x74], eax
je 0x100364e9
mov edx, ebx
jmp 0x100364ed
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x74]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setne cl
imul eax, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x34]
dec dword [ebp - 0x10]
test eax, eax
je 0x10036512
mov ecx, ebx
jmp 0x10036516
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x74], ecx
mov esi, 0x76b0f738
mov eax, dword [ebp - 0x3c]
imul eax, ecx
xor ecx, ecx
push edi
cmp eax, 0xfff0698
setl cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x1180]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xe0c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], ebx
call fcn.10019cd8
mov dword [ebp - 4], 0x2e
xor eax, eax
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], edi
jge 0x1003658b
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1180]
call fcn.10019d62
mov dword [eax], 0xfe04822b
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jl 0x1003656d
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100365ad
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x100365b3
mov edi, dword [sym.imp.USER32.dll_GetDC]
inc dword [ebp - 0x34]
lea ecx, [ebp - 0x1180]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10019d5d
mov dword [ebp - 0x28], esi
lea ecx, [ebp - 0x1014]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], ebx
push 3
call fcn.10019cd8
mov dword [ebp - 4], 0x2f
xor eax, eax
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x10036618
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1014]
call fcn.10019d62
mov dword [eax], 0xfe04822b
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 3
jl 0x100365f9
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10036632
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
inc dword [ebp - 0x34]
lea ecx, [ebp - 0x1014]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10019d5d
push 8
pop eax
push 2
pop esi
mov dword [ebp - 0x1c], 0xa76aabec
lea ecx, [ebp - 0xc40]
mov dword [ebp - 0x34], eax
push esi
call fcn.10019cd8
xor eax, eax
mov dword [ebp - 4], 0x30
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1003668d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x490], 0x3dd3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10036674
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100366b3
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc40]
call fcn.10019d62
mov dword [eax], 0xb3659ea4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10036695
xor eax, eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x1003675d
mov dword [ebp - 0x34], 0xca70051
xor ecx, ecx
mov dword [ebp - 0x34], 0xa67d9261
mov eax, dword [ebp - 0x1c]
push ebx
mov eax, dword [ebp + eax*4 - 0x490]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp + eax*4 - 0x490]
mov eax, dword [ebp - 0x34]
cmp eax, 0xa0246c38
mov eax, dword [ebp - 0x1c]
setne cl
sub esi, ecx
sub esi, dword [ebp + eax*4 - 0x490]
mov eax, dword [ebp - 0x1c]
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
mov edx, dword [ebp + eax*4 - 0x490]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x490]
cmp edx, eax
sete cl
imul esi, ecx
lea ecx, [ebp - 0xc40]
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], ebx
call fcn.10019d62
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x488]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
neg edx
cmp edx, ebx
setge cl
mov dword [eax], ecx
dec dword [ebp - 0x1c]
jns 0x100366bf
push 2
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0xc40]
mov dword [ebp - 4], eax
call fcn.10019d5d
mov dword [ebp - 0x28], 0xfffffffb
lea ecx, [ebp - 0x102c]
mov dword [ebp - 0x28], 0xe1e87df2
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], eax
push ebx
call fcn.10019cd8
push 3
lea ecx, [ebp - 0x1248]
mov dword [ebp - 4], 0x31
call fcn.10019cd8
mov byte [ebp - 4], 0x32
xor eax, eax
mov dword [ebp - 0x34], 0x57f39cee
mov dword [ebp - 0x28], 0x4af7
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x100367d7
push 0xfffffffffffffff6
pop ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x10ec], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x100367c3
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x100367f9