Function at 0x10034746
Capabilities:
Accept command line arguments
Create directory
Get common file path
Get disk size
Get file size
Get file system object information
Get session user name
Log keystrokes
Parse pe header
Query service status
Set registry value

Disassembly:
mov eax, 0x1008e313
call fcn.1008c850
mov eax, 0x1604
call fcn.1008a470
or eax, 0xffffffff
mov byte [ebp - 0x71], dl
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebx
mov dword [ebp - 0x30], 0xe0f7
xor ebx, ebx
mov dword [ebp - 0x20], 0xb0badcab
inc ebx
mov dword [ebp - 0x38], eax
push esi
push edi
mov dword [ebp - 0x58], ecx
cmp dword [ebp - 0x38], ebx
jge 0x100347a2
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x94], 0xb194
xor eax, eax
inc dword [ebp - 0x38]
inc eax
cmp dword [ebp - 0x38], eax
jl 0x10034784
xor ebx, ebx
xor eax, eax
inc ebx
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100347ba
push eax
push eax
push 0x1cea
call dword [sym.imp.ADVAPI32.dll_CopySid]
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop edi
cmp dword [ebp - 0x1c], edi
jne 0x1003492c
mov dword [ebp - 0x10], 0x8531d14
xor ecx, ecx
mov eax, dword [ebp - 0x94]
cmp eax, ebx
setge cl
cmp ecx, dword [ebp - 0x1c]
jge 0x100347e5
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100347fc
cmp dword [ebp - 0x10], eax
je 0x100347fc
xor ebx, ebx
lea ecx, [eax + 1]
inc ebx
jmp 0x100347fe
mov ecx, eax
mov eax, dword [ebp - 0x1c]
sub eax, ecx
je 0x10034871
mov dword [ebp - 0x20], 0x39e6a413
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10034820
cmp dword [ebp - 0x1c], eax
je 0x10034820
lea edx, [eax + 1]
jmp 0x10034822
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x1003483a
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setg cl
add eax, 0xaedcd7f0
add eax, ecx
xor ecx, ecx
cmp eax, 0x1912
setle cl
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
jmp 0x1003491b
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 0x1fa46b4c
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x1003490a
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x94]
cmp eax, dword [ebp - 0x20]
jl 0x100348d8
mov eax, dword [ebp - 0x94]
xor edx, edx
test eax, eax
mov eax, dword [ebp - 0x30]
setns dl
xor ecx, ecx
mov esi, dword [ebp + eax*4 - 0x94]
mov eax, dword [ebp - 0x10]
cmp edx, eax
mov eax, dword [ebp - 0x94]
setge cl
add esi, ecx
xor ecx, ecx
cmp esi, eax
mov eax, dword [ebp - 0x30]
setge cl
cmp ecx, dword [ebp + eax*4 - 0x94]
jle 0x100348d8
mov eax, ebx
jmp 0x100348da
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x10034900
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x94], 0
jne 0x100348fe
inc dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
jle 0x100348e7
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x10034889
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1003491b
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
inc dword [ebp - 0x1c]
push 1
pop ebx
cmp dword [ebp - 0x1c], edi
je 0x100347c9
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x510]
mov dword [ebp - 0x34], 0xbf0ddd9c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0x32ffab8c
push edi
call fcn.10018732
xor eax, eax
lea ecx, [ebp - 0x1038]
xor ebx, ebx
mov dword [ebp - 4], eax
inc ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 8
push ebx
call fcn.10018732
mov byte [ebp - 4], bl
xor eax, eax
mov dword [ebp - 0x28], 0x2ad14ca7
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x100349a2
push dword [ebp - 0x10]
lea ecx, [ebp - 0x510]
call fcn.100187be
mov dword [eax], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10034984
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x100349be
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x14ac], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100349aa
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100349da
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1038]
call fcn.100187be
mov dword [eax], 0x6c49a7e1
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x100349c3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10034a79
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
inc ebx
cmp eax, ebx
setge cl
add ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x10034a14
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x510]
mov eax, dword [ebp - 0x34]
xor eax, eax
push eax
call fcn.100187be
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x510]
xor eax, eax
push eax
call fcn.100187be
mov esi, eax
lea ecx, [ebp - 0x510]
xor eax, eax
push eax
call fcn.100187be
mov ecx, dword [esi]
add ecx, dword [eax]
jne 0x10034a56
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10034a58
mov eax, ebx
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10034a75
push ebx
lea ecx, [ebp - 0x510]
call fcn.100187be
cmp dword [eax], 0
jne 0x10034a79
xor eax, eax
mov esi, eax
jmp 0x10034a7e
xor eax, eax
lea esi, [eax + 1]
push eax
lea ecx, [ebp - 0x510]
call fcn.100187be
xor ecx, ecx
cmp esi, dword [eax]
setge cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x1038]
dec dword [ebp - 0x20]
call fcn.100187b9
or esi, 0xffffffff
lea ecx, [ebp - 0x510]
mov dword [ebp - 4], esi
call fcn.100187b9
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10034abd
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, 0x1b9849b7
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x30]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setle dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x30]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], 0xd3df75dc
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x10034b2c
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1314], 0x2189f42
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jl 0x10034b13
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xa
jg 0x10034ba5
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 0x590f0234
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x10034b99
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
jg 0x10034b94
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1314], 0
jne 0x10034b92
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10034b8a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jle 0x10034b66
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10034b5e
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xa
push 0
pop eax
jle 0x10034b35
mov edi, dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [ebp - 0x34], 0x19
cmp dword [ebp - 0x34], eax
jg 0x10034c26
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x638]
call fcn.10018732
xor eax, eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x10034bf8
push dword [ebp - 0x38]
lea ecx, [ebp - 0x638]
call fcn.100187be
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x38]
inc eax
cmp dword [ebp - 0x38], eax
jl 0x10034bd7
xor ebx, ebx
xor eax, eax
inc ebx
cmp dword [ebp - 0x30], eax
je 0x10034f13
push eax
lea ecx, [ebp - 0x638]
call fcn.100187be
cmp dword [eax], 0
je 0x10034f22
lea ecx, [ebp - 0x638]
mov dword [ebp - 4], esi
call fcn.100187b9
xor eax, eax
mov dword [ebp - 0x30], esi
mov esi, 0xbf0ddd9c
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x30], eax
jne 0x10034c39
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, 0x1b9849b7
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0x19
cmp dword [ebp - 0x34], eax
jg 0x10034cf7
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x614]
call fcn.10018732
xor eax, eax
mov dword [ebp - 4], 3
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x10034cc6
push dword [ebp - 0x38]
lea ecx, [ebp - 0x614]
call fcn.100187be
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x38]
inc eax
cmp dword [ebp - 0x38], eax
jl 0x10034ca5
xor ebx, ebx
xor eax, eax
inc ebx
cmp dword [ebp - 0x30], eax
je 0x10034f51
push eax
lea ecx, [ebp - 0x614]
call fcn.100187be
cmp dword [eax], 0
je 0x10034f60
or eax, 0xffffffff
lea ecx, [ebp - 0x614]
mov dword [ebp - 4], eax
call fcn.100187b9
xor eax, eax
or ebx, 0xffffffff
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x30], eax
jne 0x10034d08
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, 0x1b9849b7
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0x19
cmp dword [ebp - 0x34], eax
jg 0x10034dc7
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x62c]
call fcn.10018732
xor eax, eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x10034d95
push dword [ebp - 0x38]
lea ecx, [ebp - 0x62c]
call fcn.100187be
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x38]
inc eax
cmp dword [ebp - 0x38], eax
jl 0x10034d74
xor ebx, ebx
xor eax, eax
inc ebx
cmp dword [ebp - 0x30], eax
je 0x10034f92
push eax
lea ecx, [ebp - 0x62c]
call fcn.100187be
cmp dword [eax], 0
je 0x10034fa1
or eax, 0xffffffff
lea ecx, [ebp - 0x62c]
mov dword [ebp - 4], eax
call fcn.100187b9
or ebx, 0xffffffff
push 3
lea ecx, [ebp - 0xeb8]
call fcn.10018732
push 5
pop eax
mov dword [ebp - 4], eax
xor esi, esi
inc esi
xor eax, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x10034e06
push dword [ebp - 0x38]
lea ecx, [ebp - 0xeb8]
call fcn.100187be
mov dword [eax], ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jl 0x10034deb
xor eax, eax
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], eax
jl 0x10034e28
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10034e23
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x10034e12
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10034e51
push 0x1f03
push 0x1c4a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_LineTo]
or eax, 0xffffffff
lea ecx, [ebp - 0xeb8]
mov dword [ebp - 4], eax
call fcn.100187b9
mov dword [ebp - 0x30], 0x638ecf54
or ecx, 0xffffffff
mov dword [ebp - 0x1c], 0xd8f8f576
xor eax, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x10034e9e
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x454], 0x61fc42ff
xor eax, eax
inc dword [ebp - 0x38]
inc eax
cmp dword [ebp - 0x38], eax
jl 0x10034e83
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10034eb7
push 0x2401
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0x565e08cc
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10034ece
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x30], eax
je 0x10035045
mov dword [ebp - 0x34], 4
xor eax, eax
mov dword [ebp - 0x2c], 0xce7aebb
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x34], eax
je 0x10034fd3
cmp dword [ebp - 0x454], eax
je 0x10034fd3
lea ecx, [eax + 1]
jmp 0x10034fd5
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10034f24
push eax
push eax
push eax
push eax
call edi
xor eax, eax
push eax
lea ecx, [ebp - 0x638]
call fcn.100187be
lea ecx, [ebp - 0x638]
mov dword [ebp - 4], esi
call fcn.100187b9
dec dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
jle 0x10034bba
jmp 0x10034c24
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10034f62
push eax
push eax
push eax
push eax
call edi
xor eax, eax
push eax
lea ecx, [ebp - 0x614]
call fcn.100187be
or eax, 0xffffffff
lea ecx, [ebp - 0x614]
mov dword [ebp - 4], eax
call fcn.100187b9
dec dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
jle 0x10034c88
jmp 0x10034cf5
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10034fa3
push eax
push eax
push eax
push eax
call edi
xor eax, eax
push eax
lea ecx, [ebp - 0x62c]
call fcn.100187be
or eax, 0xffffffff
lea ecx, [ebp - 0x62c]
mov dword [ebp - 4], eax
call fcn.100187b9
dec dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
jle 0x10034d57
jmp 0x10034dc4
mov ecx, eax
mov eax, dword [ebp - 0x34]
add eax, ecx
jne 0x10034fe5
cmp dword [ebp - 0x34], eax
jne 0x10034fe5
mov edx, eax
jmp 0x10034fea
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setge cl
xor edx, edx
cmp ecx, eax
setl dl
xor ebx, ebx
imul edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
cmp edx, eax
mov eax, dword [ebp - 0x454]
setg bl
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, ebx
setge al
cmp eax, 0xab4d
jg 0x10035034
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10035034
mov eax, dword [ebp - 0x48]
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
jmp 0x10035083
mov dword [ebp - 0x1c], 0xffffffe2
cmp dword [ebp - 0x1c], 0xfffffff4
jge 0x10035083
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1003507a
push eax
push 0x1dd0
push 0x1dd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff4
jl 0x10035054
or esi, 0xffffffff
lea ecx, [ebp - 0x110c]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x50], 0xbf0ddd9c
push 3
call fcn.10018732
push 6
pop eax
mov dword [ebp - 4], eax
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x100350cc
push dword [ebp - 0x38]
lea ecx, [ebp - 0x110c]
call fcn.100187be
mov dword [eax], ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jl 0x100350b1
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100350e8
push 0xaea
push 0xa64
push eax
call dword [sym.imp.USER32.dll_DeleteMenu]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10035108
push 0x316
push 0x2681
push eax
push 0x5f2
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 0x110c]
mov dword [ebp - 4], esi
call fcn.100187b9
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x10035120
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp eax, 0x1b9849b7
mov eax, dword [ebp - 0x40]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x30], 0xe0f7
mov dword [ebp - 0x20], 0xb0badcab
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x10035197
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x88], 0xb194
xor eax, eax
inc dword [ebp - 0x38]
inc eax
cmp dword [ebp - 0x38], eax
jl 0x10035179
xor ebx, ebx
xor eax, eax
inc ebx
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100351af
push eax
push eax
push 0x1cea
call dword [sym.imp.ADVAPI32.dll_CopySid]
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jne 0x10035324
mov dword [ebp - 0x10], 0x8531d14
xor ecx, ecx
mov eax, dword [ebp - 0x88]
cmp eax, ebx
setge cl
cmp ecx, dword [ebp - 0x1c]
jge 0x100351da
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100351f1
cmp dword [ebp - 0x10], eax
je 0x100351f1
xor ebx, ebx
lea ecx, [eax + 1]
inc ebx
jmp 0x100351f3
mov ecx, eax
mov eax, dword [ebp - 0x1c]
sub eax, ecx
je 0x10035266
mov dword [ebp - 0x20], 0x39e6a413
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10035215
cmp dword [ebp - 0x1c], eax
je 0x10035215
lea edx, [eax + 1]
jmp 0x10035217
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x1003522f
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setg cl
add eax, 0xaedcd7f0
add eax, ecx
xor ecx, ecx
cmp eax, 0x1912
setle cl
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
jmp 0x10035313
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 0x1fa46b4c
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x10035302
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x88]
cmp eax, dword [ebp - 0x20]
jl 0x100352cd
mov eax, dword [ebp - 0x88]
xor edx, edx
test eax, eax
mov eax, dword [ebp - 0x30]
setns dl
xor ecx, ecx
mov esi, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x10]
cmp edx, eax
mov eax, dword [ebp - 0x88]
setge cl
add esi, ecx
xor ecx, ecx
cmp esi, eax
mov eax, dword [ebp - 0x30]
setge cl
cmp ecx, dword [ebp + eax*4 - 0x88]
jle 0x100352cd
mov eax, ebx
jmp 0x100352cf
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x100352f5
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x88], 0
jne 0x100352f3
inc dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
jle 0x100352dc
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x1003527e
push 2
xor eax, eax
pop esi
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10035313
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
inc dword [ebp - 0x1c]
push 1
pop ebx
cmp dword [ebp - 0x1c], esi
je 0x100351be
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x50], 0x19
inc ebx
cmp dword [ebp - 0x50], eax
jg 0x100359e6
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x534]
mov dword [ebp - 0x34], 0x32ffab8c
push esi
call fcn.10018732
mov dword [ebp - 4], 7
lea ecx, [ebp - 0xed0]
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 8
push ebx
call fcn.10018732
mov byte [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x28], 0x2ad14ca7
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100353a2
push dword [ebp - 0x10]
lea ecx, [ebp - 0x534]
call fcn.100187be
mov dword [eax], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10035384
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100353be
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1394], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100353aa
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100353da
push dword [ebp - 0x10]
lea ecx, [ebp - 0xed0]
call fcn.100187be
mov dword [eax], 0x6c49a7e1
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x100353c3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10035479
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
inc ebx
cmp eax, ebx
setge cl
add ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x10035414
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x534]
mov eax, dword [ebp - 0x34]
xor eax, eax
push eax
call fcn.100187be
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x534]
xor eax, eax
push eax
call fcn.100187be
mov esi, eax
lea ecx, [ebp - 0x534]
xor eax, eax
push eax
call fcn.100187be
mov ecx, dword [eax]
add ecx, dword [esi]
jne 0x10035456
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10035458
mov eax, ebx
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10035475
push ebx
lea ecx, [ebp - 0x534]
call fcn.100187be
cmp dword [eax], 0
jne 0x10035479
xor eax, eax
mov esi, eax
jmp 0x10035481
xor eax, eax
xor ebx, ebx
inc ebx
lea esi, [eax + 1]
push eax
lea ecx, [ebp - 0x534]
call fcn.100187be
xor ecx, ecx
cmp esi, dword [eax]
setge cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0xed0]
dec dword [ebp - 0x20]
call fcn.100187b9
or eax, 0xffffffff
lea ecx, [ebp - 0x534]
mov dword [ebp - 4], eax
call fcn.100187b9
push ebx
lea ecx, [ebp - 0x65c]
call fcn.10018732
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x38], 0xd3df75dc
push 2
pop esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x100354fd
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x132c], 0x2189f42
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jl 0x100354e4
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xa
jg 0x10035577
jmp 0x1003550a
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 0x590f0234
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x1003556e
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jg 0x10035569
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x132c], 0
jne 0x10035567
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1003555f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x1003553b
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10035533
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xa
jle 0x10035508
mov dword [ebp - 0x30], 0xdbe8e56f
lea ecx, [ebp - 0x1d8]
push ebx
call fcn.10018732
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x14], 0xa9b8fa48
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x3c], 0x55f992db
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0x38], 0xb03be465
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x100355dd
or ebx, 0xffffffff
push dword [ebp - 0x38]
lea ecx, [ebp - 0x1d8]
call fcn.100187be
mov dword [eax], ebx
xor eax, eax
inc dword [ebp - 0x38]
inc eax
cmp dword [ebp - 0x38], eax
jl 0x100355be
xor eax, eax
jmp 0x100355e0
or ebx, 0xffffffff
cmp dword [ebp - 0x30], eax
je 0x100355fe
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, dword [ebp - 0x30]
jle 0x100355fe
lea esi, [eax + 1]
jmp 0x10035600
mov esi, eax
push eax
lea ecx, [ebp - 0x1d8]
call fcn.100187be
mov eax, dword [eax]
add eax, esi
je 0x1003561c
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1003561e
inc eax
jmp 0x1003561e
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10035634
push eax
lea ecx, [ebp - 0x1d8]
call fcn.100187be
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xa232
jg 0x10035660
xor eax, eax
lea ecx, [ebp - 0x1d8]
push eax
call fcn.100187be
cmp dword [eax], 0
je 0x10035660
xor eax, eax
lea esi, [eax + 1]
jmp 0x10035664
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x1d8]
call fcn.100187be
neg esi
sub esi, 0xdf8abff5
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
add esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0x6fd8
setle cl
xor eax, eax
cmp ecx, 0x63090707
mov ecx, 0x94b58fe4
setge al
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
lea ecx, [ebp - 0x1d8]
setge dl
xor eax, eax
mov dword [ebp - 0x38], edx
push eax
call fcn.100187be
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10035748
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x30], eax
jg 0x100356e9
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x100356eb
xor edx, edx
lea esi, [edx + 1]
jmp 0x100356ed
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x1d8]
call fcn.100187be
lea ecx, [ebp - 0x1d8]
mov eax, dword [eax]
add eax, esi
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.100187be
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x1d8]
xor eax, eax
push eax
call fcn.100187be
xor ecx, ecx
mov eax, dword [eax]
neg eax
test eax, eax
setg cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jne 0x10035740
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
lea ecx, [ebp - 0x1d8]
call fcn.100187be
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x1d8]
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x1c], esi
push eax
call fcn.100187be
lea ecx, [ebp - 0x1d8]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 9
call fcn.100187b9
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x100357aa
push dword [ebp - 0x38]
lea ecx, [ebp - 0x65c]
call fcn.100187be
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x38]
inc eax
cmp dword [ebp - 0x38], eax
jl 0x10035789
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x20], 0x85c9e53
push 0xfffffffffffffff8
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0x3531f145
mov dword [ebp - 0x2c], ebx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setge dl
mov dword [ebp - 0x14], edx
xor edx, edx
mov dword [ebp - 0x20], esi
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setle dl
xor ebx, ebx
cmp edx, eax
setle bl
sub ebx, dword [ebp - 0x10]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
or edx, 0xffffffff
cmp ebx, edx
setle cl
xor eax, eax
add ecx, dword [ebp - 0x10]
cmp ecx, 0xa4c
setle al
neg eax
je 0x1003585f
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1003595c
push 0x74d
push 0x242f
push 0x123
push 0x2356
call dword [sym.imp.GDI32.dll_CreateRectRgn]
jmp 0x1003595a
mov dword [ebp - 0x30], 0x8bc0
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x4c], edx
xor edx, edx
mov dword [ebp - 0x28], 0x31364f2c
mov dword [ebp - 0x20], 0xa83cd0cd
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
setg cl
xor ebx, ebx
sub edx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setl bl
xor ecx, ecx
cmp eax, ebx
setle cl
add ecx, dword [ebp - 0x30]
jne 0x100358c3
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x100358c3
mov edx, eax
jmp 0x100358cb
xor eax, eax
xor esi, esi
inc esi
lea edx, [eax + 1]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setne dl
cmp edx, dword [ebp - 0x30]
jge 0x10035911
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x48], 0x1552b9cb
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
jmp 0x1003592f
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1003592f
push eax
push eax
push 0x10bb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
dec dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x4c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x14], edx
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1003596f
push eax
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10035a36
mov dword [ebp - 0x38], 0xc184c506
push 2
mov dword [ebp - 0x38], eax
pop esi
cmp dword [ebp - 0x38], esi
jge 0x100359a1
or ecx, 0xffffffff
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xffc], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x1003598d
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], eax
jl 0x100359c0
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0xffc], 0
jne 0x100359be
dec dword [ebp - 0x38]
jns 0x100359ac
xor eax, eax
push eax
lea ecx, [ebp - 0x65c]
call fcn.100187be
cmp dword [eax], 0
je 0x10035ee5
or eax, 0xffffffff
lea ecx, [ebp - 0x65c]
mov dword [ebp - 4], eax
call fcn.100187b9
mov edi, 0x7ddc85f7
lea ecx, [ebp - 0xa14]
mov dword [ebp - 0x3c], edi
push esi
call fcn.10018732
xor eax, eax
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x10035a25
push dword [ebp - 0x38]
lea ecx, [ebp - 0xa14]
call fcn.100187be
mov dword [eax], esi
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x10035a0b
xor eax, eax
mov dword [ebp - 0x3c], 0xffffffe8
mov esi, 0xa77c874
jmp 0x10036026
mov esi, 0xb674
mov dword [ebp - 0x8a4], esi
mov dword [ebp - 0x8a0], esi
mov dword [ebp - 0x89c], esi
mov dword [ebp - 0x898], esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 0xa42b4837
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 0x5d63eb9c
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x8a0]
mov edx, dword [ebp - 0x2c]
imul ecx, eax
dec edx
mov eax, dword [ebp - 0x8a0]
neg edx
sbb edx, edx
neg edx
add edx, ecx
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], eax
jmp 0x10035ab6
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10035ab3
push eax
push eax
push eax
push eax
call edi
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jle 0x10035aa2
mov dword [ebp - 0x34], 0x478144ad
xor ebx, ebx
mov dword [ebp - 0x1c], 0xfffffff7
inc ebx
mov dword [ebp - 0x10], eax
push 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x38], eax
pop esi
jmp 0x10035aec
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x8d4], 0x7d711e7b
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x10035adb
mov dword [ebp - 0x1c], esi
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp eax, 0xd76715f0
setne cl
imul ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
imul ecx, eax
mov dword [ebp - 0x8d4], ecx
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x10]
jl 0x10035baf
or esi, 0xffffffff
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x38], 0xd9fabaf1
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x8d0], ecx
cmp ecx, dword [ebp - 0x34]
jl 0x10035b53
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
xor edx, edx
add eax, 0x563b52eb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
je 0x10035b7c
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10035d0f
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
xor eax, eax
jmp 0x10035d0f
mov dword [ebp - 0x44], 0x785e8a77
lea ecx, [ebp - 0xb84]
push ebx
call fcn.10018732
push esi
lea ecx, [ebp - 0x9fc]
mov byte [ebp - 4], 0xb
call fcn.10018732
mov byte [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x10035c07
push dword [ebp - 0x30]
lea ecx, [ebp - 0xb84]
call fcn.100187be
mov dword [eax], 0xd1afc438
xor eax, eax
inc dword [ebp - 0x30]
inc eax
cmp dword [ebp - 0x30], eax
jl 0x10035be3
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jge 0x10035c2d
push dword [ebp - 0x30]
lea ecx, [ebp - 0x9fc]
call fcn.100187be
mov dword [eax], 0x7260e960
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x10035c0f
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x10035cc9
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
push 6
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x44]
jne 0x10035c4d
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x9fc]
mov eax, dword [ebp - 0x8d0]
xor eax, eax
push eax
call fcn.100187be
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0xb84]
sete bl
xor eax, eax
push eax
call fcn.100187be
mov edx, 0x182
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x34]
cmp ebx, eax
setle cl
xor eax, eax
cmp ecx, edx
setge al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x10]
je 0x10035cb8
push 3
lea ecx, [ebp - 0x9fc]
call fcn.100187be
cmp dword [eax], 0
je 0x10035cb8
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x10035cbd
xor ebx, ebx
xor eax, eax
inc ebx
cmp eax, dword [ebp - 0x8d4]
jg 0x10035cc9
xor eax, eax
jmp 0x10035ccb
mov eax, ebx
xor ecx, ecx
cmp eax, 0xa5f72677
mov eax, dword [ebp - 0x44]
sete cl
xor edx, edx
cmp ecx, eax
lea ecx, [ebp - 0x9fc]
setne dl
xor eax, eax
mov dword [ebp - 0x8d4], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x8cc], eax
call fcn.100187b9
lea ecx, [ebp - 0xb84]
mov byte [ebp - 4], 9
call fcn.100187b9
xor eax, eax
or esi, 0xffffffff
mov byte [ebp - 0x15], al
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x10035d3b
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x7f4], 0xfffffffb
xor eax, eax
inc dword [ebp - 0x38]
inc eax
cmp dword [ebp - 0x38], eax
jl 0x10035d1d
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x10035d57
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x7f4], 0
jne 0x10035d55
dec dword [ebp - 0x30]
jns 0x10035d43
xor eax, eax
mov dword [ebp - 0x30], 0xc
jmp 0x10035d6b
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jne 0x10035d71
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffffb
jl 0x10035d60
cmp byte [ebp - 0x15], 0
push 2
pop esi
je 0x10035ee5
mov dword [ebp - 0x30], 0xce12
lea ecx, [ebp - 0xb90]
push esi
call fcn.10018732
or eax, 0xffffffff
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x10035dbf
push dword [ebp - 0x38]
lea ecx, [ebp - 0xb90]
call fcn.100187be
mov dword [eax], ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x10035da5
xor eax, eax
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x30], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x30], eax
jg 0x10035ecb
push 7
pop ebx
push 5
pop edi
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x644]
mov dword [ebp - 0x2c], 0x4198d72a
push 3
call fcn.10018732
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x48], 0x67b4
mov dword [ebp - 0x4c], 0x83adeb94
mov dword [ebp - 0x38], eax
jmp 0x10035e1c
push dword [ebp - 0x38]
call fcn.100187be
mov dword [eax], 0xe3f9150f
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
lea ecx, [ebp - 0x644]
jl 0x10035e0b
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
dec eax
neg eax
push esi
sbb eax, eax
add eax, 0xffff3559
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
call fcn.100187be
mov dword [eax], ebx
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10035e69
push dword [ebp - 0x30]
lea ecx, [ebp - 0xb90]
call fcn.100187be
mov dword [eax], 0x2ae4
push esi
lea ecx, [ebp - 0x644]
call fcn.100187be
push esi
lea ecx, [ebp - 0x644]
call fcn.100187be
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x644]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
push esi
call fcn.100187be
mov ecx, dword [ebp - 0x30]
cmp edi, ecx
mov byte [ebp - 4], 0xd
sbb ecx, ecx
neg ecx
imul ecx, ecx, 0x4257
mov dword [eax], ecx
lea ecx, [ebp - 0x644]
call fcn.100187b9
inc dword [ebp - 0x30]
xor eax, eax
inc eax
cmp dword [ebp - 0x30], eax
jle 0x10035ddb
mov edi, dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
lea ecx, [ebp - 0xb90]
mov byte [ebp - 4], 9
call fcn.100187b9
xor eax, eax
push eax
push eax
push eax
push eax
call edi
xor ebx, ebx
inc ebx
push 3
lea ecx, [ebp - 0x1050]
call fcn.10018732
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x10035f25
or ebx, 0xffffffff
push dword [ebp - 0x38]
lea ecx, [ebp - 0x1050]
call fcn.100187be
mov dword [eax], ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jl 0x10035f07
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x10035f43
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10035f3e
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x10035f2d
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10035f6a
push 0x1f03
push 0x1c4a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
lea ecx, [ebp - 0x1050]
mov byte [ebp - 4], 9
call fcn.100187b9
xor eax, eax
lea ecx, [ebp - 0x65c]
push eax
call fcn.100187be
or eax, 0xffffffff
lea ecx, [ebp - 0x65c]
mov dword [ebp - 4], eax
call fcn.100187b9
dec dword [ebp - 0x50]
xor eax, eax
cmp dword [ebp - 0x50], eax
jg 0x100359e6
jmp 0x10035337
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], eax
jmp 0x1003601e
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], ebx
jg 0x1003601b
mov dword [ebp - 0x38], 0xee6d058a
mov dword [ebp - 0x38], eax
jmp 0x10035ff6
mov dword [ebp - 0x14], 0x69bd697e
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x10035ff3
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa14]
call fcn.100187be
cmp dword [eax], 0
jne 0x10035ff1
dec dword [ebp - 0x14]
jns 0x10035fd9
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x10035fca
push dword [ebp - 0x50]
lea ecx, [ebp - 0xa14]
call fcn.100187be
cmp dword [eax], 0
jne 0x10036019
inc dword [ebp - 0x50]
push 0
pop eax
cmp dword [ebp - 0x50], ebx
jle 0x10035fbe
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x10035fb3
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffef
jl 0x10035fab
or eax, 0xffffffff
lea ecx, [ebp - 0xa14]
mov dword [ebp - 4], eax
call fcn.100187b9
mov dword [ebp - 0x3c], edi
lea ecx, [ebp - 0xa2c]
push 2
call fcn.10018732
xor eax, eax
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x10036080
push dword [ebp - 0x38]
lea ecx, [ebp - 0xa2c]
call fcn.100187be
push 2
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x10036063
xor eax, eax
mov dword [ebp - 0x3c], 0xffffffe8
jmp 0x10036104
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], eax
jmp 0x100360fc
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], ebx
jg 0x100360f9
mov dword [ebp - 0x38], 0xee6d058a
mov dword [ebp - 0x38], eax
jmp 0x100360d4
mov dword [ebp - 0x14], 0x69bd697e
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x100360d1
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa2c]
call fcn.100187be
cmp dword [eax], 0
jne 0x100360cf
dec dword [ebp - 0x14]
jns 0x100360b7
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x100360a8
push dword [ebp - 0x50]
lea ecx, [ebp - 0xa2c]
call fcn.100187be
cmp dword [eax], 0
jne 0x100360f7
inc dword [ebp - 0x50]
push 0
pop eax
cmp dword [ebp - 0x50], ebx
jle 0x1003609c
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x10036091
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffef
jl 0x10036089
or ebx, 0xffffffff
lea ecx, [ebp - 0xa2c]
mov dword [ebp - 4], ebx
call fcn.100187b9
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 0x3809d01
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x4c], eax
mov eax, 0xffff
mov dword [ebp - 0x79c], eax
mov dword [ebp - 0x798], eax
mov dword [ebp - 0x794], eax
mov dword [ebp - 0x790], eax
xor eax, eax
mov dword [ebp - 0x38], 4
cmp dword [ebp - 0x20], eax
jne 0x1003617b
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setg dl
xor eax, eax
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], eax
jne 0x1003617b
mov ecx, eax
jmp 0x10036180
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x790]
inc dword [ebp - 0x790]
cmp ecx, eax
jge 0x10036197
xor eax, eax
lea edx, [eax + 1]
jmp 0x1003619b
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
je 0x100361a9
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x100361c1
mov eax, dword [ebp - 0x790]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
mov ebx, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
neg ecx
push 0xfffffffffffffff9
sbb ecx, ecx
inc ecx
pop eax
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x100361f9
push eax
push eax
call ebx
mov dword [ebp - 0x3c], edi
lea ecx, [ebp - 0xa44]
push 2
call fcn.10018732
xor eax, eax
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x10036238
push dword [ebp - 0x38]
lea ecx, [ebp - 0xa44]
call fcn.100187be
push 2
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x1003621b
xor eax, eax
mov dword [ebp - 0x3c], 0xffffffe8
cmp dword [ebp - 0x3c], 0xffffffef
jge 0x100362d7
xor ecx, ecx
inc ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], eax
jmp 0x100362c5
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], ecx
jg 0x100362c2
mov dword [ebp - 0x38], 0xee6d058a
mov dword [ebp - 0x38], eax
jmp 0x1003629a
mov dword [ebp - 0x14], 0x69bd697e
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jl 0x10036297
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa44]
call fcn.100187be
cmp dword [eax], 0
jne 0x10036292
dec dword [ebp - 0x14]
jns 0x1003627a
xor ecx, ecx
xor eax, eax
inc ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jle 0x1003626b
push dword [ebp - 0x50]
lea ecx, [ebp - 0xa44]
call fcn.100187be
xor ecx, ecx
inc ecx
cmp dword [eax], 0
jne 0x100362c0
inc dword [ebp - 0x50]
push 0
pop eax
cmp dword [ebp - 0x50], ecx
jle 0x1003625f
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jle 0x10036254
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffef
jl 0x1003624c
or esi, 0xffffffff
lea ecx, [ebp - 0xa44]
mov dword [ebp - 4], esi
call fcn.100187b9
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 0x3809d01
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x4c], eax
mov eax, 0xffff
mov dword [ebp - 0x7b8], eax
mov dword [ebp - 0x7b4], eax
mov dword [ebp - 0x7b0], eax
mov dword [ebp - 0x7ac], eax
xor eax, eax
mov dword [ebp - 0x38], 4
cmp dword [ebp - 0x20], eax
jne 0x10036344
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setg dl
xor eax, eax
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], eax
jne 0x10036344
mov ecx, eax
jmp 0x10036349
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x7ac]
inc dword [ebp - 0x7ac]
cmp ecx, eax
jge 0x10036360
xor eax, eax
lea edx, [eax + 1]
jmp 0x10036364
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
je 0x10036372
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x1003638a
mov eax, dword [ebp - 0x7ac]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
neg ecx
push 0xfffffffffffffff9
sbb ecx, ecx
inc ecx
pop eax
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x100363bc
push eax
push eax
call ebx
mov dword [ebp - 0x28], 0x8c6a53d0
or edx, 0xffffffff
push 3
pop esi
mov dword [ebp - 0x3c], esi
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x60], 9
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x14], 0x29aa810d
inc eax
mov dword [ebp - 0x20], 0x283066c9
mov dword [ebp - 0x914], eax
mov dword [ebp - 0x910], eax
mov dword [ebp - 0x90c], eax
mov dword [ebp - 0x908], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 0xe3f9150f
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x90c]
neg eax
jne 0x10036438
mov eax, dword [ebp - 0x910]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x914]
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10036455
cmp dword [ebp - 0x3c], eax
je 0x10036455
lea ecx, [eax + 1]
jmp 0x10036457
mov ecx, eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x60]
sub ecx, eax
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 0x3809d01
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x4c], eax
mov eax, 0xffff
mov dword [ebp - 0x7d4], eax
mov dword [ebp - 0x7d0], eax
mov dword [ebp - 0x7cc], eax
mov dword [ebp - 0x7c8], eax
xor eax, eax
mov dword [ebp - 0x38], 4
cmp dword [ebp - 0x20], eax
jne 0x100364ca
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setg dl
xor eax, eax
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], eax
jne 0x100364ca
mov ecx, eax
jmp 0x100364cf
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x7c8]
inc dword [ebp - 0x7c8]
cmp ecx, eax
jge 0x100364e6
xor eax, eax
lea edx, [eax + 1]
jmp 0x100364ea
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
je 0x100364f8
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x10036510
mov eax, dword [ebp - 0x7c8]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
neg ecx
push 0xfffffffffffffff9
sbb ecx, ecx
inc ecx
pop eax
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10036542
push eax
push eax
call ebx
push esi
lea ecx, [ebp - 0x674]
call fcn.10018732
mov dword [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x20], 0x29c1464f
mov dword [ebp - 0x38], eax
jmp 0x10036574
push dword [ebp - 0x38]
call fcn.100187be
mov dword [eax], 0x399841b3
inc dword [ebp - 0x38]
lea ecx, [ebp - 0x674]
cmp dword [ebp - 0x38], esi
jl 0x10036563
xor esi, esi
inc esi
push esi
call fcn.100187be
xor ebx, ebx
lea ecx, [ebp - 0x674]
push esi
mov dword [eax], ebx
call fcn.100187be
push 0x14
pop esi
cmp dword [eax], ebx
jne 0x100365de
inc ebx
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x15
jmp 0x100365b8
mov dword [ebp - 0x20], 0xeb6b9dd9
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jge 0x100365ae
push ebx
lea ecx, [ebp - 0x674]
call fcn.100187be
push ebx
lea ecx, [ebp - 0x674]
inc dword [eax]
call fcn.100187be
cmp dword [eax], 0
je 0x100365a0
jmp 0x100365e1
xor ebx, ebx
inc ebx
or eax, 0xffffffff
lea ecx, [ebp - 0x674]
mov dword [ebp - 4], eax
call fcn.100187b9
push 4
lea ecx, [ebp - 0x1f4]
call fcn.10018732
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x1c], 0xb546158d
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x10036633
push dword [ebp - 0x38]
lea ecx, [ebp - 0x1f4]
call fcn.100187be
mov dword [eax], 0xad6f2ee7
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
jl 0x10036614
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jg 0x1003672f
jmp 0x10036646
xor eax, eax
mov dword [ebp - 0x50], 0x70a77c87
mov dword [ebp - 0x20], 0xffff
mov dword [ebp - 0x50], eax
jmp 0x100366a3
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10036678
push ebx
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1f4]
call fcn.100187be
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1f4]
mov esi, eax
call fcn.100187be
mov ecx, dword [esi]
push 3
pop esi
mov dword [eax], ecx
inc dword [ebp - 0x50]
push 0
pop eax
cmp dword [ebp - 0x50], esi
jle 0x10036659
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1f4]
call fcn.100187be
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1f4]
call fcn.100187be
push ebx
lea ecx, [ebp - 0x1f4]
call fcn.100187be
mov edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, dword [eax]
setg cl
cmp ecx, dword [ebp - 0x20]
jne 0x100366f3
xor eax, eax
lea ecx, [ebp - 0x1f4]
push eax
call fcn.100187be
xor eax, eax
lea ecx, [ebp - 0x1f4]
push eax
call fcn.100187be
xor eax, eax
lea ecx, [ebp - 0x1f4]
push eax
call fcn.100187be
push 2
lea ecx, [ebp - 0x1f4]
call fcn.100187be
mov dword [ebp - 0x50], 0x12c51978
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10036644
or eax, 0xffffffff
lea ecx, [ebp - 0x1f4]
mov dword [ebp - 4], eax
call fcn.100187b9
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0xba8]
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x20], 0x40421a16
push esi
call fcn.10018732
push esi
lea ecx, [ebp - 0xc98]
mov dword [ebp - 4], 0x15
call fcn.10018732
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x20], 0x8fb0c4f3
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jge 0x100367a0
push dword [ebp - 0x30]
lea ecx, [ebp - 0xba8]
call fcn.100187be
and dword [eax], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x10036785
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jge 0x100367c2
push dword [ebp - 0x30]
lea ecx, [ebp - 0xc98]
call fcn.100187be
mov dword [eax], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x100367a8
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100367e6
push eax
push 0xa1b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push 5
pop eax
mov dword [ebp - 0x44], eax
jmp 0x10036a85
mov dword [ebp - 0x1c], 0x7df2f4a8
lea ecx, [ebp - 0x2fc]
mov dword [ebp - 0x14], 0x21f1eb32
push ebx
call fcn.10018732
mov byte [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x4c], 0xa6f63eed
mov dword [ebp - 0x48], 0xd3e67b33
mov dword [ebp - 0x2c], 0x791a
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x10036852
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2fc]
call fcn.100187be
mov dword [eax], 4
xor eax, eax
inc dword [ebp - 0x38]
inc eax
cmp dword [ebp - 0x38], eax
jl 0x1003682e
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x1c], 0x13
cmp dword [ebp - 0x1c], 0xffffffe6
jge 0x1003691a
jmp 0x10036867
xor eax, eax
mov dword [ebp - 0x38], 0xd651
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10036880
mov eax, ebx
cmp eax, dword [ebp - 0x38]
je 0x10036888
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x44]
sub edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor edx, edx
imul eax, ecx, 0xffff
cmp eax, 0xfffffff9
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, dword [ebp - 0x44]
jle 0x100368d5
cmp dword [ebp - 0x38], eax
je 0x100368d5
lea edi, [eax + 1]
jmp 0x100368d7
mov edi, eax
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2fc]
mov dword [ebp - 0x14], eax
xor eax, eax
mov esi, dword [ebp - 0x14]
push eax
call fcn.100187be
xor edx, edx
cmp esi, edi
push 1
setl dl
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x38]
cmp eax, edx
pop ebx
setne cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe6
jl 0x10036865
xor eax, eax
lea ecx, [ebp - 0x2fc]
push eax
call fcn.100187be
cmp dword [eax], 0
je 0x10036a6b
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x10036a20
push eax
lea ecx, [ebp - 0x2fc]
call fcn.100187be
cmp dword [eax], 0
jne 0x10036a17
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x2fc]
xor eax, eax
push eax
call fcn.100187be
cmp dword [eax], 0
jne 0x1003696a
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x2fc]
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.100187be
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
neg eax
cmp eax, dword [ebp - 0x4c]
jge 0x10036995
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10036998
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x2fc]
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.100187be
mov ecx, dword [ebp - 0x44]
push 6
sub ecx, dword [eax]
mov eax, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
lea ecx, [ebp - 0xba8]
pop eax
setl dl
sub edx, eax
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, 0xfffd
setne bl
xor eax, eax
push eax
call fcn.100187be
xor ecx, ecx
test ebx, ebx
push 2
setne cl
mov dword [eax], ebx
xor ebx, ebx
mov eax, dword [ebp - 0x44]
cmp ecx, eax
lea ecx, [ebp - 0xc98]
setle bl
call fcn.100187be
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x14]
cmp ebx, eax
sete cl
add ecx, dword [ebp - 0x44]
mov dword [ebp - 0x4c], ecx
je 0x10036a1e
xor eax, eax
lea esi, [eax + 1]
jmp 0x10036a22
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x2fc]
call fcn.100187be
xor ecx, ecx
cmp esi, 2
setge cl
xor ebx, ebx
sub ecx, dword [ebp - 0x44]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x2fc]
setle bl
xor eax, eax
push eax
call fcn.100187be
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp ebx, ecx
setl dl
sub edx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [eax]
je 0x10036a6b
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x10036a70
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], 0x16
call fcn.100187b9
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x12
jl 0x100367f1
lea ecx, [ebp - 0xc98]
call fcn.100187b9
or eax, 0xffffffff
lea ecx, [ebp - 0xba8]
mov dword [ebp - 4], eax
call fcn.100187b9
push 2
pop esi
push esi
lea ecx, [ebp - 0xa5c]
call fcn.10018732
mov dword [ebp - 4], 0x18
lea ecx, [ebp - 0x4d4]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0x32ffab8c
push esi
call fcn.10018732
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xee8]
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 8
push ebx
call fcn.10018732
mov byte [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x28], 0x2ad14ca7
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10036b2b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4d4]
call fcn.100187be
mov dword [eax], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10036b0d
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10036b47
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1484], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10036b33
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10036b63
push dword [ebp - 0x10]
lea ecx, [ebp - 0xee8]
call fcn.100187be
mov dword [eax], 0x6c49a7e1
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10036b4c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10036c02
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
inc ebx
cmp eax, ebx
setge cl
add ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x10036b9d
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x4d4]
mov eax, dword [ebp - 0x34]
xor eax, eax
push eax
call fcn.100187be
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x4d4]
xor eax, eax
push eax
call fcn.100187be
mov esi, eax
lea ecx, [ebp - 0x4d4]
xor eax, eax
push eax
call fcn.100187be
mov ecx, dword [eax]
add ecx, dword [esi]
jne 0x10036bdf
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10036be1
mov eax, ebx
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10036bfe
push ebx
lea ecx, [ebp - 0x4d4]
call fcn.100187be
cmp dword [eax], 0
jne 0x10036c02
xor eax, eax
mov esi, eax
jmp 0x10036c0a
xor eax, eax
xor ebx, ebx
inc ebx
lea esi, [eax + 1]
push eax
lea ecx, [ebp - 0x4d4]
call fcn.100187be
xor ecx, ecx
cmp esi, dword [eax]
setge cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0xee8]
dec dword [ebp - 0x20]
call fcn.100187b9
lea ecx, [ebp - 0x4d4]
mov byte [ebp - 4], 0x18
call fcn.100187b9
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x7f0], eax
mov dword [ebp - 0x7ec], eax
mov dword [ebp - 0x7e8], eax
mov dword [ebp - 0x7e4], eax
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0xeea2
mov dword [ebp - 0x38], 3
cmp dword [ebp - 0x38], eax
jl 0x10036c8a
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10036c85
push eax
push eax
call edi
xor eax, eax
dec dword [ebp - 0x38]
jns 0x10036c76
mov eax, dword [ebp - 0x7f0]
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10036cc5
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x7e8]
mov eax, dword [ebp - 0x7ec]
mov eax, dword [ebp - 0x7f0]
sub eax, 0x5bfc
neg eax
sbb eax, eax
inc eax
cmp eax, 0xfffffffa
je 0x10036cc5
xor eax, eax
jmp 0x10036cc7
mov eax, ebx
mov dword [ebp - 0x38], eax
xor eax, eax
push 2
mov dword [ebp - 0x38], eax
pop esi
cmp dword [ebp - 0x38], esi
jge 0x10036cf1
push dword [ebp - 0x38]
lea ecx, [ebp - 0xa5c]
call fcn.100187be
mov dword [eax], esi
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x10036cd7
xor eax, eax
mov dword [ebp - 0x14], 0x73838a1f
mov dword [ebp - 0x28], 0xc3938dd4
mov dword [ebp - 0x28], 0x193e0566
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10036d2f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1590], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10036d16
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10036d4f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe44], 0xf7921e12
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10036d37
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10036d75
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1020], 0x1d99ea5d
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10036d57
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x10036df0
or edi, 0xffffffff
jmp 0x10036d84
xor eax, eax
mov dword [ebp - 0x28], 0xb1658084
lea ecx, [ebp - 0x11b0]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x6310fe
mov dword [ebp - 0x28], edi
push 3
call fcn.10018732
mov byte [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x38], eax
jmp 0x10036dcd
push dword [ebp - 0x38]
call fcn.100187be
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
lea ecx, [ebp - 0x11b0]
jl 0x10036dbc
inc dword [ebp - 0x20]
mov byte [ebp - 4], 0x18
call fcn.100187b9
dec dword [ebp - 0x14]
jns 0x10036d82
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xe44], eax
mov dword [ebp - 0x14], 0xffffffe8
jmp 0x1003818f
push esi
lea ecx, [ebp - 0x2e4]
call fcn.10018732
mov byte [ebp - 4], 0x1c
xor eax, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x48], 0xa7c6dd3
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x10036e4a
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2e4]
call fcn.100187be
mov dword [eax], 0xca631852
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x10036e2c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jg 0x10037008
or eax, 0xffffffff
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], 0xa048c840
push dword [ebp - 0x10]
call fcn.100187be
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10036e97
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2e4]
call fcn.100187be
cmp dword [eax], 0
je 0x10036e95
xor eax, eax
lea esi, [eax + 1]
jmp 0x10036e99
xor eax, eax
mov esi, eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2e4]
call fcn.100187be
mov ecx, dword [ebp - 0x10]
xor edx, edx
push dword [ebp - 0x10]
cmp esi, ecx
lea ecx, [ebp - 0x2e4]
sete dl
xor ebx, ebx
cmp edx, dword [eax]
setl bl
call fcn.100187be
xor ecx, ecx
cmp ebx, dword [eax]
sete cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x2e4]
push dword [ebp - 0x10]
call fcn.100187be
mov ecx, dword [ebp - 0x40]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x2e4]
setl bl
xor edi, edi
inc edi
push edi
call fcn.100187be
push 2
pop esi
mov dword [eax], ebx
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], esi
jle 0x10036fee
xor ebx, ebx
push 5
inc ebx
pop edi
mov dword [ebp - 0x1c], 0x83c67ee3
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
jmp 0x10036fc8
mov dword [ebp - 0x20], 0x355fff83
inc dword [ebp - 0x20]
jne 0x10036f36
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10036f79
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2e4]
call fcn.100187be
mov ecx, dword [ebp - 0x40]
cmp ebx, ecx
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10036f64
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x48], 0x5fbc01d4
jl 0x10036f77
mov eax, ebx
jmp 0x10036f79
xor eax, eax
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
test eax, eax
mov eax, dword [ebp - 0x10]
setns cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
push 0
setle dl
xor ecx, ecx
cmp eax, edx
setle cl
imul eax, ecx, 0x759f
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0x7dc4b54c
setge cl
xor eax, eax
test ecx, ecx
setle al
add eax, 0xdd0b
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], edi
jne 0x10036f25
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2e4]
call fcn.100187be
inc dword [ebp - 0x40]
push 0
pop eax
cmp dword [ebp - 0x40], esi
jg 0x10036f10
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jle 0x10036e56
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ebx, ebx
xor eax, eax
inc ebx
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10037031
push 0x21e1
push eax
push eax
push eax
push eax
push 0x2513
push 0x1cfc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 0x18
call fcn.100187b9
movdqa xmm0, xmmword [0x10008280]
lea ecx, [ebp - 0x13bc]
xor eax, eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x11c8]
push eax
lea eax, [ebp - 0x11d8]
mov dword [ebp - 0x34], 0x3e713e19
push eax
movdqu xmmword [ebp - 0x11d8], xmm0
call fcn.100187cd
lea ecx, [ebp - 0x205]
mov esi, eax
call fcn.10009623
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x51c]
push dword [esi]
call fcn.10018793
mov byte [ebp - 4], 0x1d
xor ecx, ecx
mov dword [ebp - 0x50], 0x8716b5b3
mov dword [ebp - 0x1c], 0xb56411d7
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 0x376e30f4
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x38], 0xdcf28d0d
mov eax, dword [ebp - 0x34]
test eax, eax
push 2
setle cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x51c]
mov esi, dword [ebp - 0x34]
call fcn.100187be
xor edx, edx
push 2
mov dword [eax], esi
mov eax, dword [ebp - 0x50]
inc dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
lea ecx, [ebp - 0x51c]
setne dl
xor eax, eax
cmp edx, 0x7617
setge al
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
call fcn.100187be
mov ecx, dword [ebp - 0x34]
cmp dword [eax], ecx
jle 0x10037195
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x51c]
mov dword [ebp - 0x4c], eax
xor eax, eax
push eax
call fcn.100187be
mov ecx, dword [ebp - 0x4c]
mov eax, dword [eax]
sub eax, ecx
jne 0x10037195
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setle dl
xor ecx, ecx
cmp edx, eax
push 2
setg cl
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x51c]
call fcn.100187be
mov ecx, dword [ebp - 0x50]
add ecx, dword [eax]
jne 0x10037195
push ebx
lea ecx, [ebp - 0x51c]
call fcn.100187be
cmp dword [eax], 0
jne 0x10037195
xor eax, eax
mov esi, eax
jmp 0x1003719d
xor eax, eax
xor ebx, ebx
inc ebx
lea esi, [eax + 1]
push 2
lea ecx, [ebp - 0x51c]
call fcn.100187be
xor ecx, ecx
push 2
cmp esi, dword [eax]
pop esi
setge cl
sub ecx, esi
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x51c]
mov eax, dword [ebp - 0x1c]
add eax, 0xf804
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 0x18
call fcn.100187b9
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jg 0x1003818c
jmp 0x100371ea
xor eax, eax
push 0xfffffffffffffff6
pop ecx
mov dword [ebp - 0x804], ecx
mov dword [ebp - 0x800], ecx
mov dword [ebp - 0x7fc], ecx
mov dword [ebp - 0x7f8], ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0xeea2
mov dword [ebp - 0x38], 3
cmp dword [ebp - 0x38], eax
jl 0x1003722f
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1003722a
push eax
push eax
call edi
xor eax, eax
dec dword [ebp - 0x38]
jns 0x1003721b
mov eax, dword [ebp - 0x804]
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1003726a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x7fc]
mov eax, dword [ebp - 0x800]
mov eax, dword [ebp - 0x804]
sub eax, 0x5bfc
neg eax
sbb eax, eax
inc eax
cmp eax, 0xfffffffa
je 0x1003726a
xor eax, eax
jmp 0x1003726c
mov eax, ebx
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x204]
mov dword [ebp - 0x60], 0xa77c874
push 4
call fcn.10018732
mov byte [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x1c], 0xb546158d
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x100372b8
push dword [ebp - 0x38]
lea ecx, [ebp - 0x204]
call fcn.100187be
mov dword [eax], 0xad6f2ee7
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
jl 0x10037299
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x100373be
mov edi, 0xffff
jmp 0x100372ce
xor eax, eax
mov dword [ebp - 0x50], 0x70a77c87
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jg 0x10037331
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10037300
push ebx
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x204]
call fcn.100187be
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x204]
mov esi, eax
call fcn.100187be
mov ecx, dword [esi]
push 0
mov dword [eax], ecx
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 3
pop eax
jle 0x100372e1
push 2
pop esi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x204]
call fcn.100187be
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x204]
call fcn.100187be
push ebx
lea ecx, [ebp - 0x204]
call fcn.100187be
mov edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, dword [eax]
setg cl
cmp ecx, dword [ebp - 0x20]
jne 0x1003737c
xor eax, eax
lea ecx, [ebp - 0x204]
push eax
call fcn.100187be
xor eax, eax
lea ecx, [ebp - 0x204]
push eax
call fcn.100187be
xor eax, eax
lea ecx, [ebp - 0x204]
push eax
call fcn.100187be
push esi
lea ecx, [ebp - 0x204]
call fcn.100187be
mov dword [ebp - 0x50], 0x12c51978
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x100372cc
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x204]
mov byte [ebp - 4], 0x18
call fcn.100187b9
xor eax, eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], ebx
jg 0x10038178
jmp 0x100373df
xor eax, eax
mov dword [ebp - 0x38], 0xd3df75dc
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x50], esi
push 3
mov dword [ebp - 0x38], eax
pop edi
cmp dword [ebp - 0x38], edi
jge 0x1003740f
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1344], 0x2189f42
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edi
jl 0x100373f7
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xa
jg 0x10037489
jmp 0x1003741c
movdqa xmm0, xmmword [0x10008260]
lea eax, [ebp - 0x11d8]
push eax
lea eax, [ebp - 0x11e8]
mov dword [ebp - 0x4c], 0xee6d058a
push eax
lea ecx, [ebp - 0x144c]
movdqu xmmword [ebp - 0x11e8], xmm0
call fcn.100187cd
lea ecx, [ebp - 0x1e5]
mov esi, eax
call fcn.10009623
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x380]
push dword [esi]
call fcn.10018793
mov byte [ebp - 4], 0x1f
xor eax, eax
mov dword [ebp - 0x28], 0xd8b2
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], edi
jge 0x10037515
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xd58], 0x6f1bf506
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edi
jl 0x100374fd
xor eax, eax
push eax
lea ecx, [ebp - 0x380]
call fcn.100187be
push 6
pop ecx
mov dword [eax], ecx
xor eax, eax
push eax
lea ecx, [ebp - 0x380]
call fcn.100187be
cmp dword [eax], 9
jl 0x10037716
xor eax, eax
lea ecx, [ebp - 0xbc0]
inc eax
mov dword [ebp - 0x38], eax
push eax
call fcn.10018732
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x10037577
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xbc], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1003755e
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x30], eax
inc ebx
cmp dword [ebp - 0x30], ebx
jge 0x100375a4
push dword [ebp - 0x30]
lea ecx, [ebp - 0xbc0]
call fcn.100187be
mov dword [eax], ebx
xor eax, eax
inc dword [ebp - 0x30]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x30], eax
jl 0x10037582
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0xbc], eax
jmp 0x100375c3
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0xd58], 0
inc dword [ebp - 0xbc]
cmp dword [ebp - 0xbc], edi
jl 0x100375ac
push ebx
lea ecx, [ebp - 0x380]
call fcn.100187be
inc dword [ebp - 0x38]
lea ecx, [ebp - 0x380]
xor eax, eax
push eax
call fcn.100187be
mov edx, dword [ebp - 0xbc]
mov esi, eax
mov ecx, dword [ebp - 0x38]
xor eax, eax
cmp ecx, edx
mov ecx, dword [ebp - 0xb8]
setg al
xor ebx, ebx
cmp eax, ecx
lea ecx, [ebp - 0x380]
setne bl
xor eax, eax
sub ebx, dword [esi]
push eax
call fcn.100187be
xor ecx, ecx
cmp dword [eax], ebx
mov eax, dword [ebp - 0xbc]
setl cl
xor edx, edx
cmp ecx, 0xb389
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
cmp ecx, 0x97d6
mov ecx, dword [ebp - 0xd54]
mov eax, dword [ebp - 0xbc]
setle dl
add eax, edx
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0xbc]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, dword [ebp - 0xbc]
jl 0x10037675
cmp dword [ebp - 0x38], eax
je 0x10037675
xor edi, edi
push 3
lea eax, [edi + 1]
pop edi
mov dword [ebp - 0xd58], eax
add eax, 0xee3b919d
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0x38], 0xb3a3fc4b
jae 0x100376a8
xor eax, eax
lea ecx, [ebp - 0x380]
push eax
call fcn.100187be
cmp dword [eax], 0
jne 0x100376a8
xor eax, eax
mov esi, eax
jmp 0x100376ad
xor eax, eax
lea esi, [eax + 1]
push eax
lea ecx, [ebp - 0xbc0]
call fcn.100187be
lea ecx, [ebp - 0xbc0]
mov dword [eax], esi
xor eax, eax
test esi, esi
setne al
cmp eax, 0xf8616691
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 0xfffe0f53
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0x1f
call fcn.100187b9
xor eax, eax
lea ecx, [ebp - 0x380]
push eax
call fcn.100187be
lea ecx, [ebp - 0x380]
inc dword [eax]
xor eax, eax
push eax
call fcn.100187be
cmp dword [eax], 9
jge 0x1003753d
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x380]
mov byte [ebp - 4], 0x18
call fcn.100187b9
push 2
pop esi
push esi
lea ecx, [ebp - 0x18c]
call fcn.10018732
mov byte [ebp - 4], 0x21
or eax, 0xffffffff
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x10037769
push dword [ebp - 0x38]
lea ecx, [ebp - 0x18c]
call fcn.100187be
mov dword [eax], 0x999d94b4
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x1003774b
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1003778e
push 0x156b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor eax, eax
push eax
lea ecx, [ebp - 0x18c]
call fcn.100187be
mov eax, dword [eax]
neg eax
je 0x10037824
xor eax, eax
lea ecx, [ebp - 0x18c]
push eax
call fcn.100187be
xor eax, eax
lea ecx, [ebp - 0x18c]
push eax
call fcn.100187be
xor eax, eax
lea ecx, [ebp - 0x18c]
push eax
call fcn.100187be
xor eax, eax
lea ecx, [ebp - 0x18c]
push eax
call fcn.100187be
xor eax, eax
lea ecx, [ebp - 0x18c]
push eax
call fcn.100187be
push ebx
lea ecx, [ebp - 0x18c]
call fcn.100187be
push 5
xor ecx, ecx
pop edx
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp eax, edx
setg cl
cmp ecx, 0xf8c8b02b
jle 0x10037821
push ebx
lea ecx, [ebp - 0x18c]
call fcn.100187be
cmp dword [eax], 0
je 0x10037824
mov eax, dword [ebp - 0x4c]
xor eax, eax
lea ecx, [ebp - 0x18c]
push eax
call fcn.100187be
xor eax, eax
lea ecx, [ebp - 0x18c]
push eax
call fcn.100187be
push ebx
lea ecx, [ebp - 0x18c]
call fcn.100187be
mov ecx, dword [ebp - 0x4c]
sub ecx, dword [eax]
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x18
call fcn.100187b9
xor eax, eax
mov dword [ebp - 0x4c], eax
inc eax
cmp dword [ebp - 0x4c], eax
jg 0x10038042
or ebx, 0xffffffff
lea ecx, [ebp - 0xcb0]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], 0xccfd66c4
mov dword [ebp - 0x20], 0x5bd52a28
push eax
call fcn.10018732
xor eax, eax
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jge 0x100378b4
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xaf4], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x100378a0
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x30], eax
inc ebx
cmp dword [ebp - 0x30], ebx
jge 0x100378e3
push dword [ebp - 0x30]
lea ecx, [ebp - 0xcb0]
call fcn.100187be
mov dword [eax], 0x38f58595
xor eax, eax
inc dword [ebp - 0x30]
inc eax
cmp dword [ebp - 0x30], eax
jl 0x100378bf
xor ebx, ebx
xor eax, eax
inc ebx
cmp dword [ebp - 0x1c], eax
je 0x100378ea
mov eax, ebx
mov dword [ebp - 0x30], eax
mov esi, 0xf90edcad
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xaf4], esi
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, esi
lea ecx, [ebp - 0xcb0]
setle al
mov dword [ebp - 0x20], eax
xor eax, eax
push eax
call fcn.100187be
mov edx, dword [ebp - 0x20]
mov esi, eax
mov ecx, dword [ebp - 0x1c]
xor eax, eax
cmp edx, ecx
setg al
xor edx, edx
imul ecx, eax, 0x956
or eax, 0xffffffff
cmp ecx, eax
setg dl
add edx, dword [ebp - 0x1c]
mov dword [esi], edx
mov dword [ebp - 0x30], 0x10
cmp dword [ebp - 0x30], 0xfffffff2
jl 0x10037985
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10037974
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
xor eax, eax
cmp dword [ebp - 0xaf4], eax
jne 0x10037985
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff2
jge 0x10037962
lea ecx, [ebp - 0xcb0]
mov byte [ebp - 4], 0x18
call fcn.100187b9
mov dword [ebp - 0x2c], 0x69bd697e
lea ecx, [ebp - 0xbd8]
push 4
call fcn.10018732
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x13cc]
movdqa xmm0, xmmword [0x10008250]
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x1298]
push eax
lea eax, [ebp - 0x12a8]
mov dword [ebp - 0x28], 0xba028ea3
mov dword [ebp - 0x28], edi
push eax
movdqu xmmword [ebp - 0x12a8], xmm0
call fcn.100187cd
lea ecx, [ebp - 0x2a6]
mov esi, eax
call fcn.10009623
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1374]
push dword [esi]
call fcn.10018793
xor eax, eax
mov byte [ebp - 4], 0x24
movdqa xmm0, xmmword [0x10008260]
lea ecx, [ebp - 0x14e4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1218]
push eax
lea eax, [ebp - 0x1228]
push eax
movdqu xmmword [ebp - 0x1228], xmm0
call fcn.100187cd
lea ecx, [ebp - 0x285]
mov esi, eax
call fcn.10009623
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x12e4]
push dword [esi]
call fcn.10018793
xor eax, eax
mov byte [ebp - 4], 0x25
push 4
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x10037a82
push dword [ebp - 0x10]
lea ecx, [ebp - 0xbd8]
call fcn.100187be
mov dword [eax], 0x29b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10037a64
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10037aa2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x135c], 0x90be4438
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10037a8a
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10037ab8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x14c4], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10037aa7
push ebx
lea ecx, [ebp - 0xbd8]
call fcn.100187be
lea ecx, [ebp - 0x12e4]
mov eax, dword [eax]
cmp eax, 0xb58e469a
mov dword [ebp - 0x1354], eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14b8], eax
inc dword [ebp - 0x20]
call fcn.100187b9
lea ecx, [ebp - 0x1374]
call fcn.100187b9
lea ecx, [ebp - 0xbd8]
mov byte [ebp - 4], 0x18
call fcn.100187b9
mov dword [ebp - 0x2c], ebx
xor eax, eax
push 2
pop esi
cmp dword [ebp - 0x2c], eax
jl 0x10038033
or eax, 0xffffffff
mov dword [ebp - 0x10], 0xf951fe7
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x6cc]
push edi
call fcn.10018732
xor eax, eax
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x38], eax
jmp 0x10037b52
inc dword [ebp - 0x4c]
push 1
pop eax
cmp dword [ebp - 0x4c], ebx
jle 0x10037872
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0xf00]
mov dword [ebp - 0x20], 0xd8cb4c23
or ebx, 0xffffffff
mov dword [ebp - 0x2c], 0xd329
mov dword [ebp - 0x54], 0x59bb7a14
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x28], ebx
push 0xfffffffffffffff8
mov dword [ebp - 0x28], 0x81de9829
pop eax
mov dword [ebp - 0x28], 0x7fb07d0
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x28], eax
push edi
call fcn.10018732
mov byte [ebp - 4], 0x28
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 0x8e188a74
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x48], 0x906e71eb
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jge 0x100380c4
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x13dc], 0x64de8cc1
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x100380ac
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x100380dd
push dword [ebp - 0x30]
lea ecx, [ebp - 0xf00]
call fcn.100187be
and dword [eax], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x100380c9
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x4c], eax
je 0x10038131
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x4c]
cmp eax, ebx
jg 0x10038103
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x10038103
mov edx, eax
jmp 0x10038108
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
imul ecx, ecx, 7
sub ecx, 0xfff9
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x4c]
je 0x10038131
xor edi, edi
inc edi
mov eax, edi
jmp 0x10038136
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0xf00]
mov dword [ebp - 0x54], edi
inc dword [ebp - 0x48]
mov byte [ebp - 4], 0x18
call fcn.100187b9
push dword [ebp - 0x60]
lea ecx, [ebp - 0xa5c]
call fcn.100187be
cmp dword [eax], 0
jne 0x10038172
inc dword [ebp - 0x60]
xor eax, eax
inc eax
push eax
pop ebx
cmp dword [ebp - 0x60], eax
jle 0x100373dd
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
inc dword [ebp - 0x3c]
xor eax, eax
inc eax
push eax
pop ebx
cmp dword [ebp - 0x3c], eax
jle 0x100371e8
xor ebx, ebx
inc ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffef
jl 0x10036e05
or eax, 0xffffffff
lea ecx, [ebp - 0xa5c]
mov dword [ebp - 4], eax
call fcn.100187b9
push ebx
lea ecx, [ebp - 0x314]
call fcn.10018732
mov dword [ebp - 4], 0x29
xor eax, eax
mov dword [ebp - 0x54], 0x28d5feaf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100381ef
push dword [ebp - 0x10]
lea ecx, [ebp - 0x314]
call fcn.100187be
mov dword [eax], 0x297
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x100381ce
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10038211
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1068], 0xef5d870a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100381f8
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10038231
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb04], 0x5158018d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10038219
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10038245
push eax
call edi
xor eax, eax
push eax
lea ecx, [ebp - 0x314]
call fcn.100187be
xor ebx, ebx
lea ecx, [ebp - 0x314]
cmp dword [eax], ebx
setne bl
xor eax, eax
mov dword [ebp - 0x1060], ebx
push eax
call fcn.100187be
lea ecx, [ebp - 0x314]
sub ebx, dword [eax]
xor eax, eax
push eax
lea esi, [ebx - 7]
mov dword [ebp - 0xb04], esi
call fcn.100187be
xor ecx, ecx
cmp esi, 0x13e1
setge cl
cmp dword [eax], ecx
jne 0x100382a5
xor eax, eax
cmp dword [ebp - 0xb00], eax
je 0x100382a7
xor edx, edx
lea esi, [edx + 1]
jmp 0x100382a9
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x314]
call fcn.100187be
xor ebx, ebx
lea ecx, [ebp - 0x314]
cmp esi, dword [eax]
sete bl
xor eax, eax
push eax
call fcn.100187be
cmp ebx, dword [eax]
je 0x100382dc
xor eax, eax
cmp dword [ebp - 0x1064], eax
jne 0x100382de
mov esi, eax
jmp 0x100382e3
xor eax, eax
xor ecx, ecx
lea esi, [ecx + 1]
push eax
lea ecx, [ebp - 0x314]
call fcn.100187be
add esi, 0x8716b5b3
lea ecx, [ebp - 0x314]
mov eax, dword [eax]
add esi, eax
xor eax, eax
push eax
call fcn.100187be
xor ecx, ecx
cmp dword [eax], esi
sete cl
or esi, 0xffffffff
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x314]
mov dword [ebp - 4], esi
call fcn.100187b9
mov dword [ebp - 0x28], 0x8c6a53d0
push 3
pop ebx
mov dword [ebp - 0x4c], ebx
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x14], 0x29aa810d
inc eax
mov dword [ebp - 0x20], 0x283066c9
mov dword [ebp - 0x8b4], eax
mov dword [ebp - 0x8b0], eax
mov dword [ebp - 0x8ac], eax
mov dword [ebp - 0x8a8], eax
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 0xe3f9150f
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x8ac]
neg eax
jne 0x1003839b
mov eax, dword [ebp - 0x8b0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x8b4]
mov eax, dword [ebp - 0x64]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x100383b8
cmp dword [ebp - 0x4c], eax
je 0x100383b8
lea ecx, [eax + 1]
jmp 0x100383ba
mov ecx, eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x38]
sub ecx, eax
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x3e4]
push ebx
call fcn.10018732
mov dword [ebp - 4], 0x2a
xor eax, eax
mov dword [ebp - 0x2c], 0xcadfb1af
mov dword [ebp - 0x20], 0xf6872920
mov dword [ebp - 0x14], eax
jmp 0x10038406
push dword [ebp - 0x14]
call fcn.100187be
mov dword [eax], esi
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x3e4]
cmp dword [ebp - 0x14], ebx
jl 0x100383f9
push 2
pop esi
push esi
call fcn.100187be
push esi
lea ecx, [ebp - 0x3e4]
mov dword [eax], 0x18
call fcn.100187be
cmp dword [eax], esi
jne 0x100385d1
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x214]
call fcn.10018732
xor eax, eax
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x10038475
push dword [ebp - 0x30]
lea ecx, [ebp - 0x214]
call fcn.100187be
mov dword [eax], 0xfffffffc
xor eax, eax
inc dword [ebp - 0x30]
inc eax
cmp dword [ebp - 0x30], eax
jl 0x10038451
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jge 0x10038495
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1188], 0xc06e3268
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x1003847d
xor eax, eax
push eax
lea ecx, [ebp - 0x214]
call fcn.100187be
cmp dword [eax], ebx
jb 0x10038556
xor eax, eax
lea ecx, [ebp - 0x214]
push eax
call fcn.100187be
cmp dword [eax], 0
je 0x10038526
xor eax, eax
lea ecx, [ebp - 0x214]
push eax
call fcn.100187be
xor ebx, ebx
lea ecx, [ebp - 0x214]
cmp dword [eax], ebx
setne bl
xor eax, eax
push eax
call fcn.100187be
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0x3e4]
push esi
setle dl
xor ebx, ebx
sub edx, dword [eax]
test edx, edx
setg bl
call fcn.100187be
xor ecx, ecx
cmp dword [eax], ebx
setle cl
xor eax, eax
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x214]
push eax
call fcn.100187be
mov edx, dword [ebp - 0x54]
xor ecx, ecx
cmp edx, dword [eax]
setle cl
xor ebx, ebx
mov dword [ebp - 0x20], ecx
inc ebx
push esi
lea ecx, [ebp - 0x3e4]
call fcn.100187be
xor eax, eax
lea ecx, [ebp - 0x214]
push eax
call fcn.100187be
lea ecx, [ebp - 0x214]
mov esi, dword [eax]
xor eax, eax
push eax
call fcn.100187be
mov eax, dword [eax]
add eax, esi
jne 0x10038559
mov eax, dword [ebp - 0x20]
xor eax, eax
lea ecx, [ebp - 0x214]
push eax
call fcn.100187be
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x214]
xor eax, eax
push eax
call fcn.100187be
mov eax, dword [eax]
mov dword [ebp - 0x1188], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1003859a
push 0x1ec5
push 0x135d
call dword [sym.imp.USER32.dll_SetCaretPos]
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 0x2a
call fcn.100187b9
push 2
pop esi
push esi
lea ecx, [ebp - 0x3e4]
call fcn.100187be
push esi
lea ecx, [ebp - 0x3e4]
dec dword [eax]
call fcn.100187be
cmp dword [eax], esi
je 0x10038437
push 3
pop ebx
or eax, 0xffffffff
lea ecx, [ebp - 0x3e4]
mov dword [ebp - 4], eax
call fcn.100187b9
mov dword [ebp - 0x28], 0x8c6a53d0
or ecx, 0xffffffff
mov dword [ebp - 0x4c], ebx
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x14], 0x29aa810d
inc eax
mov dword [ebp - 0x20], 0x283066c9
mov dword [ebp - 0x8c4], eax
mov dword [ebp - 0x8c0], eax
mov dword [ebp - 0x8bc], eax
mov dword [ebp - 0x8b8], eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 0xe3f9150f
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x8bc]
neg eax
jne 0x1003865b
mov eax, dword [ebp - 0x8c0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x8c4]
mov eax, dword [ebp - 0x64]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10038678
cmp dword [ebp - 0x4c], eax
je 0x10038678
lea ecx, [eax + 1]
jmp 0x1003867a
mov ecx, eax
mov eax, dword [ebp - 0x48]
xor ebx, ebx
mov dword [ebp - 0x20], eax
inc ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x38]
sub ecx, eax
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x350]
push ebx
call fcn.10018732
mov dword [ebp - 4], 0x2c
xor eax, eax
mov dword [ebp - 0x54], 0x28d5feaf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100386d9
push dword [ebp - 0x10]
lea ecx, [ebp - 0x350]
call fcn.100187be
mov dword [eax], 0x297
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x100386b8
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100386fb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf18], 0xef5d870a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100386e2
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003871b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb14], 0x5158018d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10038703
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10038729
push eax
call edi
xor eax, eax
push eax
lea ecx, [ebp - 0x350]
call fcn.100187be
xor ebx, ebx
lea ecx, [ebp - 0x350]
cmp dword [eax], ebx
setne bl
xor eax, eax
mov dword [ebp - 0xf10], ebx
push eax
call fcn.100187be
lea ecx, [ebp - 0x350]
sub ebx, dword [eax]
xor eax, eax
push eax
lea esi, [ebx - 7]
mov dword [ebp - 0xb14], esi
call fcn.100187be
xor ecx, ecx
cmp esi, 0x13e1
setge cl
cmp dword [eax], ecx
jne 0x10038789
xor eax, eax
cmp dword [ebp - 0xb10], eax
je 0x1003878b
xor ecx, ecx
lea esi, [ecx + 1]
jmp 0x1003878d
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x350]
call fcn.100187be
xor ebx, ebx
lea ecx, [ebp - 0x350]
cmp esi, dword [eax]
sete bl
xor eax, eax
push eax
call fcn.100187be
cmp ebx, dword [eax]
je 0x100387c3
xor eax, eax
cmp dword [ebp - 0xf14], eax
jne 0x100387c5
xor ebx, ebx
mov esi, eax
inc ebx
jmp 0x100387ca
xor eax, eax
xor ebx, ebx
inc ebx
mov esi, ebx
push eax
lea ecx, [ebp - 0x350]
call fcn.100187be
add esi, 0x8716b5b3
lea ecx, [ebp - 0x350]
mov eax, dword [eax]
add esi, eax
xor eax, eax
push eax
call fcn.100187be
xor ecx, ecx
cmp dword [eax], esi
sete cl
or eax, 0xffffffff
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x350]
mov dword [ebp - 4], eax
call fcn.100187b9
push ebx
lea ecx, [ebp - 0x38c]
call fcn.10018732
mov dword [ebp - 4], 0x2d
xor eax, eax
mov dword [ebp - 0x54], 0x28d5feaf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003884e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x38c]
call fcn.100187be
mov dword [eax], 0x297
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x1003882d
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10038870
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1124], 0xef5d870a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10038857
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10038892
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb0c], 0x5158018d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10038879
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100388a0
push eax
call edi
xor eax, eax
push eax
lea ecx, [ebp - 0x38c]
call fcn.100187be
xor ebx, ebx
lea ecx, [ebp - 0x38c]
cmp dword [eax], ebx
setne bl
xor eax, eax
mov dword [ebp - 0x111c], ebx
push eax
call fcn.100187be
lea ecx, [ebp - 0x38c]
sub ebx, dword [eax]
xor eax, eax
push eax
lea esi, [ebx - 7]
mov dword [ebp - 0xb0c], esi
call fcn.100187be
xor ecx, ecx
cmp esi, 0x13e1
setge cl
cmp dword [eax], ecx
jne 0x10038900