Function at 0x10033e34
Capabilities:
Check os version
Get common file path
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10075975
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe34
push esi
push edi
push 3
lea ecx, [ebp - 0x304]
call fcn.10008eaf
and dword [ebp - 4], 0
mov dword [ebp - 0x824], 0xfffffffc
mov dword [ebp - 0x348], 4
mov dword [ebp - 0x38], 0
jmp 0x10033e89
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x10033ea5
push dword [ebp - 0x38]
lea ecx, [ebp - 0x304]
call fcn.10008f1c
mov dword [eax], 0x8261f9c2
jmp 0x10033e82
mov dword [ebp - 0x38], 0
jmp 0x10033eb5
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x10033ecb
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xcc], 0xffffffff
jmp 0x10033eae
mov dword [ebp - 0x38], 0
jmp 0x10033edb
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x10033ef1
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xbb8], 2
jmp 0x10033ed4
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xcc], 2
jmp 0x10033f1f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xcc]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xcc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xcc], 0
jl 0x1003424c
mov dword [ebp - 0x1c0], 0xcf2e5664
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xcc]
lea ecx, [ebp - 0x304]
call fcn.10008f1c
mov esi, eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xcc]
lea ecx, [ebp - 0x304]
call fcn.10008f1c
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x1c0], 0xfffffffe
jmp 0x10033f8c
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0xb
jge 0x10034247
mov dword [ebp - 0x2f4], 1
mov dword [ebp - 0x134], 6
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xcc]
lea ecx, [ebp - 0x304]
call fcn.10008f1c
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xcc]
lea ecx, [ebp - 0x304]
call fcn.10008f1c
cmp dword [eax], 0x2afd77cc
jge 0x10033ff1
mov dword [ebp - 0x410], 1
jmp 0x10033ff8
and dword [ebp - 0x410], 0
cmp dword [ebp - 0x410], 0xf5f40e13
je 0x10034010
mov dword [ebp - 0x804], 1
jmp 0x10034017
and dword [ebp - 0x804], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xcc]
lea ecx, [ebp - 0x304]
call fcn.10008f1c
mov ecx, dword [ebp - 0x804]
cmp ecx, dword [eax]
jg 0x10034045
mov dword [ebp - 0x80c], 1
jmp 0x1003404c
and dword [ebp - 0x80c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xcc]
add eax, dword [ebp - 0x80c]
cmp eax, 0xffffffff
jg 0x10034070
mov dword [ebp - 0x814], 1
jmp 0x10034077
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x2f4], eax
je 0x1003409d
mov dword [ebp - 0x81c], 1
jmp 0x100340a4
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x81c]
sub eax, dword [ebp - 0x134]
mov dword [ebp - 0x824], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xcc]
cmp dword [ebp - 0x824], eax
jge 0x100340d7
mov dword [ebp - 0x82c], 1
jmp 0x100340de
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x82c], eax
jge 0x100340f8
mov dword [ebp - 0x834], 1
jmp 0x100340ff
and dword [ebp - 0x834], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xcc]
lea ecx, [ebp - 0x304]
call fcn.10008f1c
mov ecx, dword [ebp - 0x834]
cmp ecx, dword [eax]
jg 0x1003412d
mov dword [ebp - 0x8a4], 1
jmp 0x10034134
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0xb60], eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xcc]
lea ecx, [ebp - 0x304]
call fcn.10008f1c
mov ecx, dword [ebp - 0x134]
cmp dword [eax], ecx
jne 0x1003416e
mov dword [ebp - 0x83c], 1
jmp 0x10034175
and dword [ebp - 0x83c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xcc]
cmp dword [ebp - 0x83c], eax
jl 0x10034196
mov dword [ebp - 0x340], 1
jmp 0x1003419d
and dword [ebp - 0x340], 0
push 0
lea ecx, [ebp - 0x304]
call fcn.10008f1c
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xcc]
add ecx, dword [ebp - 0x340]
cmp dword [eax], ecx
jge 0x100341cd
mov dword [ebp - 0x294], 1
jmp 0x100341d4
and dword [ebp - 0x294], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xcc]
lea ecx, [ebp - 0x304]
call fcn.10008f1c
mov ecx, dword [ebp - 0x294]
mov dword [eax], ecx
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x294], eax
jg 0x1003420e
mov dword [ebp - 0x910], 1
jmp 0x10034215
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x2f4], eax
jge 0x1003422f
mov dword [ebp - 0x760], 1
jmp 0x10034236
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x348], eax
jmp 0x10033f7f
jmp 0x10033f04
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbb8]
mov dword [ebp - 0x348], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x304]
call fcn.10008f17
mov dword [ebp - 0x30], 0xfffffff8
push 3
lea ecx, [ebp - 0x9c0]
call fcn.10008eaf
mov dword [ebp - 4], 1
mov dword [ebp - 0x7c], 0
jmp 0x10034299
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x100342b5
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x9c0]
call fcn.10008f1c
mov dword [eax], 0xf767
jmp 0x10034292
mov dword [ebp - 0x7c], 0
jmp 0x100342c5
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x100342db
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x940], 6
jmp 0x100342be
mov dword [ebp - 0x30], 0xffffffec
jmp 0x100342eb
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffee
jge 0x100345c8
mov dword [ebp - 0x9c], 0x29c4
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x290], 0xc869b7d6
mov dword [ebp - 0x350], 0x7b35f197
mov dword [ebp - 0x370], 6
mov dword [ebp - 0x2f8], 0x45b6d4f5
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 1
jle 0x1003435f
cmp dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0xc10], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x290], eax
jle 0x100343a9
mov dword [ebp - 0x918], 1
jmp 0x100343b0
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xc18], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc20], eax
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0xc28], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc30], eax
cmp dword [ebp - 0x30], 5
jbe 0x100343f5
cmp dword [ebp - 0x9c], 0
je 0x100343f5
mov dword [ebp - 0x768], 1
jmp 0x100343fc
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x350], eax
jg 0x1003441f
mov dword [ebp - 0x770], 1
jmp 0x10034426
and dword [ebp - 0x770], 0
cmp dword [ebp - 0x770], 0x87c5
jge 0x1003443e
mov dword [ebp - 0x358], 1
jmp 0x10034445
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x358], eax
jne 0x1003445f
mov dword [ebp - 0x778], 1
jmp 0x10034466
and dword [ebp - 0x778], 0
cmp dword [ebp - 0x778], 0xb5bf2d3f
ja 0x1003447e
mov dword [ebp - 0x360], 1
jmp 0x10034485
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x360], eax
jl 0x1003449f
mov dword [ebp - 0x780], 1
jmp 0x100344a6
and dword [ebp - 0x780], 0
push 1
lea ecx, [ebp - 0x9c0]
call fcn.10008f1c
mov ecx, dword [ebp - 0x780]
cmp ecx, dword [eax]
jl 0x100344c9
mov dword [ebp - 0x368], 1
jmp 0x100344d0
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x368], eax
jge 0x100344ea
mov dword [ebp - 0x920], 1
jmp 0x100344f1
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xc38], eax
push 1
lea ecx, [ebp - 0x9c0]
call fcn.10008f1c
mov esi, eax
push 0
lea ecx, [ebp - 0x9c0]
call fcn.10008f1c
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x1003452b
mov dword [ebp - 0x788], 1
jmp 0x10034532
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x2f8], eax
jg 0x1003456d
cmp dword [ebp - 0x2f8], 0
je 0x1003456d
mov dword [ebp - 0x790], 1
jmp 0x10034574
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x790]
cmp eax, dword [ebp - 0x30]
jge 0x10034591
mov dword [ebp - 0x378], 1
jmp 0x10034598
and dword [ebp - 0x378], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x378]
mov dword [ebp + eax - 0x940], ecx
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x100345c3
call dword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x100342e4
mov byte [ebp - 0xce], 0
movzx eax, byte [ebp - 0xce]
test eax, eax
je 0x100345e7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c0]
call fcn.10008f17
push 3
lea ecx, [ebp - 0x324]
call fcn.10008eaf
mov dword [ebp - 4], 2
mov dword [ebp - 0x3f4], 0xfffffffc
push 4
lea ecx, [ebp - 0x894]
call fcn.10008eaf
mov byte [ebp - 4], 3
mov dword [ebp - 0x84], 0
jmp 0x1003463e
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x1003465a
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xde0], 0xdc85
jmp 0x10034631
mov dword [ebp - 0x84], 0
jmp 0x10034673
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x10034692
push dword [ebp - 0x84]
lea ecx, [ebp - 0x894]
call fcn.10008f1c
and dword [eax], 0
jmp 0x10034666
push 2
lea ecx, [ebp - 0x894]
call fcn.10008f1c
and dword [eax], 0
jmp 0x100346c8
push 2
lea ecx, [ebp - 0x894]
call fcn.10008f1c
mov dword [ebp - 0x798], eax
mov eax, dword [ebp - 0x798]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x798]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x894]
call fcn.10008f1c
cmp dword [eax], 3
jg 0x1003471d
mov byte [ebp - 0xcf], 0
movzx eax, byte [ebp - 0xcf]
test eax, eax
je 0x10034700
push 0
push 0x110a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 2
lea ecx, [ebp - 0x894]
call fcn.10008f1c
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xde0], 0
je 0x1003471b
jmp 0x1003471d
jmp 0x100346a4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x894]
call fcn.10008f17
mov dword [ebp - 0x40c], 4
mov dword [ebp - 0x238], 0x68206240
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x1003475a
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x238], 0
jmp 0x10034773
mov eax, dword [ebp - 0x238]
dec eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0xffffffeb
je 0x1003479a
mov byte [ebp - 0xd3], 0
movzx eax, byte [ebp - 0xd3]
test eax, eax
je 0x10034798
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x10034766
push 4
lea ecx, [ebp - 0x314]
call fcn.10008eaf
mov byte [ebp - 4], 4
mov dword [ebp - 0x24], 0x2ba39464
mov dword [ebp - 0x60], 0x3371247a
mov dword [ebp - 0x1b4], 1
mov dword [ebp - 0x1d0], 0
jmp 0x100347dc
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 4
jge 0x100347fb
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0x314]
call fcn.10008f1c
or dword [eax], 0xffffffff
jmp 0x100347cf
mov dword [ebp - 0x24], 3
jmp 0x1003480b
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x10034888
mov dword [ebp - 0x144], 0xfffffff9
mov dword [ebp - 0x144], 3
jmp 0x10034834
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jl 0x1003487c
push dword [ebp - 0x144]
lea ecx, [ebp - 0x314]
call fcn.10008f1c
mov esi, eax
push dword [ebp - 0x144]
lea ecx, [ebp - 0x314]
call fcn.10008f1c
mov ecx, dword [esi]
mov dword [eax], ecx
push dword [ebp - 0x24]
lea ecx, [ebp - 0x314]
call fcn.10008f1c
cmp dword [eax], 0
je 0x1003487a
jmp 0x1003487c
jmp 0x10034827
mov dword [ebp - 0x60], 0x3c0b
jmp 0x10034804
push 0
lea ecx, [ebp - 0x314]
call fcn.10008f1c
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x24], eax
je 0x100348b2
cmp dword [ebp - 0x24], 0
je 0x10034a98
mov dword [ebp - 0x2d8], 0x90ae73
mov dword [ebp - 0x14c], 0xf213ed42
mov dword [ebp - 0x2a0], 0x3ce7
mov dword [ebp - 0x950], 0xfffffff9
cmp dword [ebp - 0x24], 0
jne 0x100348f5
cmp dword [ebp - 0x2d8], 0
je 0x100348f5
mov dword [ebp - 0x380], 1
jmp 0x100348fc
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1003491b
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1003491b
and dword [ebp - 0x7a0], 0
jmp 0x10034925
mov dword [ebp - 0x7a0], 1
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x10034946
mov eax, 0xac3e
test eax, eax
jne 0x10034946
and dword [ebp - 0x388], 0
jmp 0x10034950
mov dword [ebp - 0x388], 1
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x388], eax
jne 0x1003496a
mov dword [ebp - 0x948], 1
jmp 0x10034971
and dword [ebp - 0x948], 0
push 2
lea ecx, [ebp - 0x314]
call fcn.10008f1c
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xc40], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1b4], eax
push 1
lea ecx, [ebp - 0x314]
call fcn.10008f1c
mov eax, dword [eax]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x24], eax
jge 0x10034a7d
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0xc48], eax
mov eax, dword [ebp - 0x2a0]
sub eax, 5
cmp eax, dword [ebp - 0x2a0]
jg 0x100349e0
mov dword [ebp - 0x7a8], 1
jmp 0x100349e7
and dword [ebp - 0x7a8], 0
cmp dword [ebp - 0x7a8], 1
jb 0x100349fc
mov dword [ebp - 0x390], 1
jmp 0x10034a03
and dword [ebp - 0x390], 0
cmp dword [ebp - 0x390], 0
je 0x10034a18
mov dword [ebp - 0x7b0], 1
jmp 0x10034a1f
and dword [ebp - 0x7b0], 0
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x7b0]
sub eax, dword [ebp - 0x2a0]
add esi, eax
push 3
lea ecx, [ebp - 0x314]
call fcn.10008f1c
cmp esi, dword [eax]
jge 0x10034a4d
mov dword [ebp - 0x398], 1
jmp 0x10034a54
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x14c], eax
imul eax, dword [ebp - 0x14c], 3
test eax, eax
je 0x10034a74
cmp dword [ebp - 0x2d8], 0
jne 0x10034a7d
and dword [ebp - 0x7b8], 0
jmp 0x10034a87
mov dword [ebp - 0x7b8], 1
mov eax, dword [ebp - 0x7b8]
mov dword [ebp - 0x950], eax
jmp 0x10034e37
mov dword [ebp - 0xe0], 0xffffffff
push 2
lea ecx, [ebp - 0x9e0]
call fcn.10008eaf
mov byte [ebp - 4], 5
push 2
lea ecx, [ebp - 0x9d0]
call fcn.10008eaf
mov byte [ebp - 4], 6
mov dword [ebp - 0x3d4], 0xe056
mov dword [ebp - 0xa4], 0
jmp 0x10034ae7
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x10034b09
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x9e0]
call fcn.10008f1c
mov dword [eax], 0xcfd1f913
jmp 0x10034ada
mov dword [ebp - 0xa4], 0
jmp 0x10034b22
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x10034b44
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x9d0]
call fcn.10008f1c
mov dword [eax], 0x2f470b9c
jmp 0x10034b15
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x60], eax
jge 0x10034b5b
mov dword [ebp - 0x3b0], 1
jmp 0x10034b62
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0xe0], eax
jne 0x10034b7c
mov dword [ebp - 0x3a8], 1
jmp 0x10034b83
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xc50], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xc58], eax
push 2
lea ecx, [ebp - 0x314]
call fcn.10008f1c
mov ecx, dword [ebp - 0xe0]
cmp dword [eax], ecx
jl 0x10034bbe
mov dword [ebp - 0x3a0], 1
jmp 0x10034bc5
and dword [ebp - 0x3a0], 0
cmp dword [ebp - 0x3a0], 1
jle 0x10034bda
mov dword [ebp - 0x7c0], 1
jmp 0x10034be1
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x7c0]
sub eax, dword [ebp - 0xe0]
dec eax
mov ecx, dword [ebp - 0x3a8]
sub ecx, eax
jne 0x10034c0a
cmp dword [ebp - 0x1b4], 0
jne 0x10034c0a
and dword [ebp - 0x7ec], 0
jmp 0x10034c14
mov dword [ebp - 0x7ec], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x7ec], eax
jl 0x10034c2b
mov dword [ebp - 0x7f4], 1
jmp 0x10034c32
and dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0x3b0]
cmp eax, dword [ebp - 0x7f4]
je 0x10034c4c
mov dword [ebp - 0x7fc], 1
jmp 0x10034c53
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0x1b4], eax
push 1
lea ecx, [ebp - 0x9e0]
call fcn.10008f1c
cmp dword [ebp - 0x60], 0
jne 0x10034d74
push 0
lea ecx, [ebp - 0x9d0]
call fcn.10008f1c
cmp dword [eax], 0
jne 0x10034c95
xor eax, eax
jne 0x10034c95
and dword [ebp - 0x958], 0
jmp 0x10034c9f
mov dword [ebp - 0x958], 1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc60], eax
push 1
lea ecx, [ebp - 0x314]
call fcn.10008f1c
cmp dword [eax], 0xd7cb
je 0x10034cc9
mov dword [ebp - 0x3bc], 1
jmp 0x10034cd0
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
neg eax
cmp eax, dword [ebp - 0x1b4]
jge 0x10034cec
mov dword [ebp - 0x60c], 1
jmp 0x10034cf3
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x60c], eax
jle 0x10034d0d
mov dword [ebp - 0x960], 1
jmp 0x10034d14
and dword [ebp - 0x960], 0
push 1
lea ecx, [ebp - 0x9e0]
call fcn.10008f1c
push 0
lea ecx, [ebp - 0x9d0]
call fcn.10008f1c
mov ecx, dword [ebp - 0x3d4]
cmp dword [eax], ecx
je 0x10034d44
mov dword [ebp - 0x3c4], 1
jmp 0x10034d4b
and dword [ebp - 0x3c4], 0
cmp dword [ebp - 0x3c4], 0xfffffff7
jle 0x10034d60
mov dword [ebp - 0x734], 1
jmp 0x10034d67
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x734]
add eax, 0xae93
je 0x10034d89
mov eax, 0xffff
test eax, eax
je 0x10034d89
mov dword [ebp - 0x3cc], 1
jmp 0x10034d90
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x3cc], eax
jge 0x10034da7
mov dword [ebp - 0x614], 1
jmp 0x10034dae
and dword [ebp - 0x614], 0
push 1
lea ecx, [ebp - 0x9e0]
call fcn.10008f1c
mov ecx, dword [ebp - 0x614]
cmp ecx, dword [eax]
jg 0x10034dd1
mov dword [ebp - 0x968], 1
jmp 0x10034dd8
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc68], eax
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x10034dfd
cmp dword [ebp - 0x3d4], 0
je 0x10034dfd
mov dword [ebp - 0x7e4], 1
jmp 0x10034e04
and dword [ebp - 0x7e4], 0
push 0
lea ecx, [ebp - 0x9d0]
call fcn.10008f1c
mov ecx, dword [ebp - 0x7e4]
mov dword [eax], ecx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9d0]
call fcn.10008f17
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x9e0]
call fcn.10008f17
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x314]
call fcn.10008f17
mov dword [ebp - 0x3c], 0
jmp 0x10034e56
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x10034e72
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x324]
call fcn.10008f1c
mov dword [eax], 0x8261f9c2
jmp 0x10034e4f
mov dword [ebp - 0x970], 0x2eb9
mov dword [ebp - 0x3dc], 0xc69aed23
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x10034ea4
push 0
push 0xa
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp dword [ebp - 0x970], 0
je 0x10034eb9
mov dword [ebp - 0x3dc], 0xffffc714
jmp 0x10034eee
mov dword [ebp - 0x978], 0x126ff23b
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x10034ee2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x978], eax
mov dword [ebp - 0x3c], 0
jmp 0x10034efe
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x10034f14
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xc4], 0xffffffff
jmp 0x10034ef7
mov dword [ebp - 0x3c], 0
jmp 0x10034f24
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x10034f3a
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xbc4], 2
jmp 0x10034f1d
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xc4], 2
jmp 0x10034f68
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xc4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc4], 0
jl 0x10035295
mov dword [ebp - 0x1b8], 0xcf2e5664
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xc4]
lea ecx, [ebp - 0x324]
call fcn.10008f1c
mov esi, eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xc4]
lea ecx, [ebp - 0x324]
call fcn.10008f1c
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x1b8], 0xfffffffe
jmp 0x10034fd5
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xb
jge 0x10035290
mov dword [ebp - 0x318], 1
mov dword [ebp - 0x154], 6
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xc4]
lea ecx, [ebp - 0x324]
call fcn.10008f1c
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xc4]
lea ecx, [ebp - 0x324]
call fcn.10008f1c
cmp dword [eax], 0x2afd77cc
jge 0x1003503a
mov dword [ebp - 0x61c], 1
jmp 0x10035041
and dword [ebp - 0x61c], 0
cmp dword [ebp - 0x61c], 0xf5f40e13
je 0x10035059
mov dword [ebp - 0x3e4], 1
jmp 0x10035060
and dword [ebp - 0x3e4], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xc4]
lea ecx, [ebp - 0x324]
call fcn.10008f1c
mov ecx, dword [ebp - 0x3e4]
cmp ecx, dword [eax]
jg 0x1003508e
mov dword [ebp - 0x73c], 1
jmp 0x10035095
and dword [ebp - 0x73c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc4]
add eax, dword [ebp - 0x73c]
cmp eax, 0xffffffff
jg 0x100350b9
mov dword [ebp - 0x3ec], 1
jmp 0x100350c0
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x318], eax
je 0x100350e6
mov dword [ebp - 0x624], 1
jmp 0x100350ed
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x624]
sub eax, dword [ebp - 0x154]
mov dword [ebp - 0x3f4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc4]
cmp dword [ebp - 0x3f4], eax
jge 0x10035120
mov dword [ebp - 0x828], 1
jmp 0x10035127
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x828], eax
jge 0x10035141
mov dword [ebp - 0x3fc], 1
jmp 0x10035148
and dword [ebp - 0x3fc], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xc4]
lea ecx, [ebp - 0x324]
call fcn.10008f1c
mov ecx, dword [ebp - 0x3fc]
cmp ecx, dword [eax]
jg 0x10035176
mov dword [ebp - 0x980], 1
jmp 0x1003517d
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0xc70], eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xc4]
lea ecx, [ebp - 0x324]
call fcn.10008f1c
mov ecx, dword [ebp - 0x154]
cmp dword [eax], ecx
jne 0x100351b7
mov dword [ebp - 0x62c], 1
jmp 0x100351be
and dword [ebp - 0x62c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc4]
cmp dword [ebp - 0x62c], eax
jl 0x100351df
mov dword [ebp - 0x404], 1
jmp 0x100351e6
and dword [ebp - 0x404], 0
push 0
lea ecx, [ebp - 0x324]
call fcn.10008f1c
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xc4]
add ecx, dword [ebp - 0x404]
cmp dword [eax], ecx
jge 0x10035216
mov dword [ebp - 0x2a8], 1
jmp 0x1003521d
and dword [ebp - 0x2a8], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xc4]
lea ecx, [ebp - 0x324]
call fcn.10008f1c
mov ecx, dword [ebp - 0x2a8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x2a8], eax
jg 0x10035257
mov dword [ebp - 0x988], 1
jmp 0x1003525e
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x318], eax
jge 0x10035278
mov dword [ebp - 0x744], 1
jmp 0x1003527f
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x744]
mov dword [ebp - 0x40c], eax
jmp 0x10034fc8
jmp 0x10034f4d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc4]
mov dword [ebp - 0x40c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x324]
call fcn.10008f17
mov dword [ebp - 0x164], 0x76820624
mov dword [ebp - 0xc78], 0x5a1fa147
mov dword [ebp - 0xc80], 0xffffffff
push 2
lea ecx, [ebp - 0xcf0]
call fcn.10008eaf
mov dword [ebp - 4], 7
mov dword [ebp - 0xc88], 0xffffffff
mov dword [ebp - 0xa78], 0xb9ba5e0b
mov dword [ebp - 0xa74], 0xb9ba5e0b
mov dword [ebp - 0xa70], 0xb9ba5e0b
mov dword [ebp - 0xa6c], 0xb9ba5e0b
mov dword [ebp - 0x44], 0
jmp 0x1003532b
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x10035341
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xc90], 0xd976ff55
jmp 0x10035324
mov dword [ebp - 0x44], 0
jmp 0x10035351
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x1003536d
push dword [ebp - 0x44]
lea ecx, [ebp - 0xcf0]
call fcn.10008f1c
mov dword [eax], 0xfffffffd
jmp 0x1003534a
mov dword [ebp - 0x44], 0
jmp 0x1003537d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x10035393
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xda8], 0x42b9193c
jmp 0x10035376
mov dword [ebp - 0x164], 0x19
jmp 0x100353ac
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0x13
je 0x100353f0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x240], 0
jmp 0x100353d8
mov eax, dword [ebp - 0x240]
dec eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jl 0x100353ee
cmp dword [ebp - 0x164], 0
je 0x100353ec
jmp 0x100353ee
jmp 0x100353cb
jmp 0x1003539f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa78]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa78], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf0]
call fcn.10008f17
push 3
lea ecx, [ebp - 0x2ec]
call fcn.10008eaf
mov dword [ebp - 4], 8
mov dword [ebp - 0x194], 7
mov dword [ebp - 0x248], 8
mov dword [ebp - 0x9a0], 0x1bb35b68
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x9b0], 9
mov dword [ebp - 0x194], 0xffffffef
jmp 0x10035479
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0x19
jg 0x100357b6
mov dword [ebp - 0xb4], 0xbeccce1e
mov dword [ebp - 0x654], 0
xor eax, eax
je 0x100354a5
cmp dword [ebp - 0x248], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xc98], eax
cmp dword [ebp - 0xb4], 0
je 0x100354cf
cmp dword [ebp - 0x194], 0
je 0x100354cf
mov dword [ebp - 0x998], 1
jmp 0x100354d6
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xca0], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xca8], eax
cmp dword [ebp - 0x248], 0
jle 0x10035503
mov dword [ebp - 0x634], 1
jmp 0x1003550a
and dword [ebp - 0x634], 0
cmp dword [ebp - 0x634], 0
ja 0x1003551f
mov dword [ebp - 0x414], 1
jmp 0x10035526
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x414], eax
jle 0x10035540
mov dword [ebp - 0x7d8], 1
jmp 0x10035547
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x7d8]
add eax, 0x8af0
imul eax, eax, 5
test eax, eax
jne 0x1003556b
cmp dword [ebp - 0x9a0], 0
jne 0x1003556b
and dword [ebp - 0x41c], 0
jmp 0x10035575
mov dword [ebp - 0x41c], 1
mov eax, dword [ebp - 0x248]
add eax, dword [ebp - 0x41c]
jne 0x1003558f
mov dword [ebp - 0x63c], 1
jmp 0x10035596
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0x63c], eax
je 0x100355b0
mov dword [ebp - 0x424], 1
jmp 0x100355b7
and dword [ebp - 0x424], 0
cmp dword [ebp - 0x424], 4
jg 0x100355cc
mov dword [ebp - 0x74c], 1
jmp 0x100355d3
and dword [ebp - 0x74c], 0
cmp dword [ebp - 0x74c], 0xa5616d21
jae 0x100355eb
mov dword [ebp - 0x42c], 1
jmp 0x100355f2
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x2b0], eax
jne 0x10035618
mov dword [ebp - 0x644], 1
jmp 0x1003561f
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x644]
jg 0x10035683
mov dword [ebp - 0x9a8], 1
mov dword [ebp - 0x1d8], 0
jmp 0x10035650
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 3
jge 0x1003566c
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0xd7c], 0xfffffffc
jmp 0x10035643
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x9a8]
mov dword [ebp + eax - 0xd7c], ecx
jmp 0x10035781
mov dword [ebp - 0x444], 0x6daafd55
mov dword [ebp - 0x810], 0x1e07ad46
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x100356be
push 0x20b3
push 0x2423
push 0x1267
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov eax, dword [ebp - 0x9b0]
cmp dword [ebp - 0x444], eax
jl 0x100356d8
mov dword [ebp - 0x434], 1
jmp 0x100356df
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x810], eax
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x810], eax
jne 0x10035705
mov dword [ebp - 0x64c], 1
jmp 0x1003570c
and dword [ebp - 0x64c], 0
cmp dword [ebp - 0x248], 0
jg 0x10035727
cmp dword [ebp - 0x654], 0
jne 0x10035727
and dword [ebp - 0x43c], 0
jmp 0x10035731
mov dword [ebp - 0x43c], 1
mov eax, dword [ebp - 0x43c]
neg eax
cmp dword [ebp - 0x64c], eax
jl 0x1003574d
mov dword [ebp - 0x754], 1
jmp 0x10035754
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x444]
cmp dword [ebp - 0x754], eax
jle 0x1003576e
mov dword [ebp - 0x44c], 1
jmp 0x10035775
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x654], eax
mov byte [ebp - 0x12f], 0
movzx eax, byte [ebp - 0x12f]
test eax, eax
je 0x100357b1
push 0x77f
push 0x1d4d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x1003546c
mov dword [ebp - 0x7a4], 0xfffffffc
mov dword [ebp - 0x6fc], 4
mov dword [ebp - 0xcb0], 0
mov dword [ebp - 0xcb8], 0xb3f4f46d
mov dword [ebp - 0xcc0], 0x61f66568
mov dword [ebp - 0xcc8], 0x737a9a97
mov dword [ebp - 0xcd0], 0xf5f49900
mov dword [ebp - 0xcd8], 0xffffffff
mov dword [ebp - 0xce0], 1
mov dword [ebp - 0xd40], 0x65e3edfa
mov dword [ebp - 0xd48], 1
mov dword [ebp - 0xd2c], 0xb2aee5a9
push 2
lea ecx, [ebp - 0xd00]
call fcn.10008eaf
mov byte [ebp - 4], 9
mov dword [ebp - 0xbdc], 0xd1022782
mov dword [ebp - 0xc24], 0xffffffff
mov dword [ebp - 0xac8], 0x29694d2b
mov dword [ebp - 0xd28], 0xadb82134
mov dword [ebp - 0xad0], 0
mov dword [ebp - 0xc2c], 0xaf9f7c8b
mov dword [ebp - 0xad8], 0x32e3ca36
mov dword [ebp - 0xcbc], 2
or dword [ebp - 0xaa0], 0xffffffff
or dword [ebp - 0xa9c], 0xffffffff
or dword [ebp - 0xa98], 0xffffffff
or dword [ebp - 0xa94], 0xffffffff
lea ecx, [ebp - 0x2d1]
call fcn.10008f2b
push eax
lea eax, [ebp - 0xa90]
push eax
lea eax, [ebp - 0xaa0]
push eax
lea ecx, [ebp - 0xe10]
call fcn.10008f2e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd88]
call fcn.10008ef1
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x454], 0xfffffff9
mov dword [ebp - 0x8c], 0
jmp 0x10035907
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x10035923
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xa50], 0x8bac04ee
jmp 0x100358fa
mov dword [ebp - 0x8c], 0
jmp 0x1003593c
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1003595e
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xd00]
call fcn.10008f1c
mov dword [eax], 0xedade098
jmp 0x1003592f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa50]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa50], eax
mov eax, dword [ebp - 0x454]
inc eax
mov dword [ebp - 0x454], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xd88]
call fcn.10008f17
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xd00]
call fcn.10008f17
mov dword [ebp - 0x34], 0
jmp 0x100359b4
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x100359d0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2ec]
call fcn.10008f1c
mov dword [eax], 0x8261f9c2
jmp 0x100359ad
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x1f0], 0xfffffffe
mov dword [ebp - 0x1e8], 4
mov dword [ebp - 0x158], 0xd371
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x6c], 0xffffffea
jmp 0x10035a16
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xffffffe7
jg 0x10036236
mov dword [ebp - 0xe8], 0x5ce
push 1
lea ecx, [ebp - 0x84c]
call fcn.10008eaf
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x67c], 0xfffffff9
mov dword [ebp - 0x68c], 0x9d2d10a6
push 2
lea ecx, [ebp - 0xa48]
call fcn.10008eaf
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x774], 0xc2479274
mov dword [ebp - 0x4d4], 0xd11537c3
mov dword [ebp - 0x14], 0
jmp 0x10035a84
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10035a97
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x54], 1
jmp 0x10035a7d
mov dword [ebp - 0x14], 0
jmp 0x10035aa7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10035ac3
push dword [ebp - 0x14]
lea ecx, [ebp - 0x84c]
call fcn.10008f1c
mov dword [eax], 0x5621
jmp 0x10035aa0
mov dword [ebp - 0x14], 0
jmp 0x10035ad3
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10035ae9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x87c], 0xe9d3b05e
jmp 0x10035acc
mov dword [ebp - 0x14], 0
jmp 0x10035af9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10035b15
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa48]
call fcn.10008f1c
mov dword [eax], 1
jmp 0x10035af2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xc34], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x54]
cmp dword [ebp + eax - 0x54], ecx
jg 0x10035b50
mov dword [ebp - 0x7e0], 1
jmp 0x10035b57
and dword [ebp - 0x7e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
cmp dword [ebp - 0x7e0], eax
jne 0x10035b75
mov dword [ebp - 0x45c], 1
jmp 0x10035b7c
and dword [ebp - 0x45c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
cmp dword [ebp - 0x45c], eax
jle 0x10035b9a
mov dword [ebp - 0x65c], 1
jmp 0x10035ba1
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x10035bc5
mov eax, 0x8e92eda8
test eax, eax
je 0x10035bc5
mov dword [ebp - 0x464], 1
jmp 0x10035bcc
and dword [ebp - 0x464], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x464]
sub ecx, dword [ebp + eax - 0x54]
imul ecx, dword [ebp - 0xe8]
cmp ecx, dword [ebp - 0x6c]
jne 0x10035bf4
mov dword [ebp - 0x75c], 1
jmp 0x10035bfb
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x75c]
add eax, 8
je 0x10035c11
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x54], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x54], 0
je 0x10035d39
mov dword [ebp - 0x1e0], 0
jmp 0x10035c3b
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 4
jge 0x10035c57
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0xd60], 0x62b56095
jmp 0x10035c2e
mov dword [ebp - 0xe8], 0
jmp 0x10035c70
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jg 0x10035d34
mov dword [ebp - 0x664], 0x162c80f3
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xae8], eax
xor eax, eax
inc eax
sub eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x5c], eax
jne 0x10035caa
mov dword [ebp - 0x46c], 1
jmp 0x10035cb1
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
add eax, 0x3c3fa3c9
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f0]
imul eax, dword [ebp - 0x6c]
push 4
pop ecx
shl ecx, 1
cmp dword [ebp + ecx - 0xd60], eax
jle 0x10035ce6
mov dword [ebp - 0x908], 1
jmp 0x10035ced
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0xd24], eax
mov eax, dword [ebp - 0x5c]
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0xd60]
cmp eax, dword [ebp - 0x664]
jg 0x10035d1c
mov dword [ebp - 0x474], 1
jmp 0x10035d23
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x1e8], eax
jmp 0x10035c63
jmp 0x10035e76
mov dword [ebp - 0x250], 0
jmp 0x10035d52
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 1
jge 0x10035d6e
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x838], 0xafa0b2b0
jmp 0x10035d45
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x838]
mov dword [ebp - 0xaf0], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x838]
push 0
lea ecx, [ebp - 0x84c]
call fcn.10008f1c
sub esi, dword [eax]
neg esi
cmp esi, 0xb4ff
jl 0x10035db3
mov dword [ebp - 0x66c], 1
jmp 0x10035dba
and dword [ebp - 0x66c], 0
mov eax, 0xc34f9703
test eax, eax
je 0x10035dd8
cmp dword [ebp - 0x1f0], 0
je 0x10035dd8
mov dword [ebp - 0x47c], 1
jmp 0x10035ddf
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x47c]
neg eax
cmp eax, 1
jne 0x10035df8
mov dword [ebp - 0x484], 1
jmp 0x10035dff
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x66c]
cmp eax, dword [ebp - 0x484]
je 0x10035e19
mov dword [ebp - 0x764], 1
jmp 0x10035e20
and dword [ebp - 0x764], 0
cmp dword [ebp - 0x764], 0xfffffffd
jne 0x10035e38
cmp dword [ebp - 0x5c], 0
jne 0x10035e38
and dword [ebp - 0x48c], 0
jmp 0x10035e42
mov dword [ebp - 0x48c], 1
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x48c], eax
jl 0x10035e5c
mov dword [ebp - 0x674], 1
jmp 0x10035e63
and dword [ebp - 0x674], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x674]
mov dword [ebp + eax - 0x87c], ecx
push 0
lea ecx, [ebp - 0x84c]
call fcn.10008f1c
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x87c]
cmp dword [eax], ecx
jle 0x10035ea0
mov dword [ebp - 0x494], 1
jmp 0x10035ea7
and dword [ebp - 0x494], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
cmp eax, dword [ebp - 0x494]
jge 0x10035ec5
mov dword [ebp - 0x7e8], 1
jmp 0x10035ecc
and dword [ebp - 0x7e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x87c]
cmp dword [ebp - 0x7e8], eax
je 0x10035ee5
cmp dword [ebp - 0x5c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x87c], 3
jl 0x10035f07
mov eax, 0xef14
test eax, eax
jne 0x10035f07
and dword [ebp - 0x49c], 0
jmp 0x10035f11
mov dword [ebp - 0x49c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
imul eax, dword [ebp - 0x49c]
test eax, eax
jne 0x10035f38
cmp dword [ebp - 0x67c], 0
jne 0x10035f38
and dword [ebp - 0x4a4], 0
jmp 0x10035f42
mov dword [ebp - 0x4a4], 1
mov eax, dword [ebp - 0x67c]
add eax, dword [ebp - 0x4a4]
sub eax, dword [ebp - 0x158]
imul eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x158]
jge 0x10035f6c
mov dword [ebp - 0x76c], 1
jmp 0x10035f73
and dword [ebp - 0x76c], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x87c]
neg esi
push 0
lea ecx, [ebp - 0x84c]
call fcn.10008f1c
mov ecx, dword [ebp - 0x76c]
add ecx, dword [eax]
cmp esi, ecx
jl 0x10035fa7
mov dword [ebp - 0x4ac], 1
jmp 0x10035fae
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x4ac], eax
jl 0x10035fc8
mov dword [ebp - 0x684], 1
jmp 0x10035fcf
and dword [ebp - 0x684], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
cmp dword [ebp - 0x684], eax
jg 0x10035fed
mov dword [ebp - 0x4b4], 1
jmp 0x10035ff4
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
add eax, 0xbda6
imul eax, eax, 0xe547
imul eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x158]
je 0x1003601d
mov dword [ebp - 0x818], 1
jmp 0x10036024
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x1e8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
cmp dword [ebp - 0x1e8], eax
jle 0x10036054
cmp dword [ebp - 0x158], 0
jne 0x10036054
and dword [ebp - 0x8b8], 0
jmp 0x1003605e
mov dword [ebp - 0x8b8], 1
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0xc3c], eax
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x258]
je 0x1003608a
cmp dword [ebp - 0x258], 0
je 0x1003608a
mov dword [ebp - 0x2e0], 1
jmp 0x10036091
and dword [ebp - 0x2e0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2e0]
mov dword [ebp + eax - 0x87c], ecx
mov eax, dword [ebp - 0x258]
cmp dword [ebp - 0x2e0], eax
jge 0x100360be
mov dword [ebp - 0x4bc], 1
jmp 0x100360c5
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xaf8], eax
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x68c], eax
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0x8b4], eax
push 1
lea ecx, [ebp - 0xa48]
call fcn.10008f1c
mov ecx, dword [ebp - 0x8b4]
mov dword [eax], ecx
mov esi, dword [ebp - 0x158]
push 0
lea ecx, [ebp - 0x84c]
call fcn.10008f1c
cmp esi, dword [eax]
jg 0x1003611e
mov dword [ebp - 0x9e4], 1
jmp 0x10036125
and dword [ebp - 0x9e4], 0
cmp dword [ebp - 0x5c], 0xffffffff
jle 0x10036137
mov dword [ebp - 0x4c4], 1
jmp 0x1003613e
and dword [ebp - 0x4c4], 0
imul eax, dword [ebp - 0x4c4], 0xf08
cmp eax, dword [ebp - 0x5c]
jle 0x1003615a
push 1
lea ecx, [ebp - 0xa48]
call fcn.10008f1c
push 0
lea ecx, [ebp - 0x84c]
call fcn.10008f1c
mov eax, dword [eax]
mov dword [ebp - 0x774], eax
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x774], eax
jl 0x10036186
mov dword [ebp - 0x4cc], 1
jmp 0x1003618d
and dword [ebp - 0x4cc], 0
cmp dword [ebp - 0x4cc], 0xb408
jne 0x100361a5
mov dword [ebp - 0x694], 1
jmp 0x100361ac
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x4d4], eax
mov esi, dword [ebp - 0x4d4]
push 0
lea ecx, [ebp - 0x84c]
call fcn.10008f1c
sub esi, dword [eax]
jne 0x100361db
mov dword [ebp - 0x7f0], 1
jmp 0x100361e2
and dword [ebp - 0x7f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
cmp dword [ebp - 0x7f0], eax
je 0x10036200
mov dword [ebp - 0x4dc], 1
jmp 0x10036207
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x1f0], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xa48]
call fcn.10008f17
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x84c]
call fcn.10008f17
jmp 0x10035a0f
mov byte [ebp - 0x12c], 0
movzx eax, byte [ebp - 0x12c]
test eax, eax
je 0x1003625e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
mov dword [ebp - 0x34], 0
jmp 0x1003626e
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10036284
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xbc], 0xffffffff
jmp 0x10036267
mov dword [ebp - 0x16c], 0x97eede0b
mov dword [ebp - 0x1ac], 0x48c66f5a
mov eax, dword [ebp - 0x16c]
inc eax
inc eax
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x16c], 0xb
jmp 0x100362bf
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 5
jge 0x10036303
mov dword [ebp - 0x1ac], 0
jmp 0x100362e1
mov eax, dword [ebp - 0x1ac]
dec eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0xffffffe4
je 0x10036301
mov dword [ebp - 0x8bc], 0
cmp dword [ebp - 0x8bc], 0
je 0x100362ff
jmp 0x10036301
jmp 0x100362d4
jmp 0x100362b2
mov dword [ebp - 0x34], 0
jmp 0x10036313
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10036329
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xbd0], 2
jmp 0x1003630c
mov dword [ebp - 0x2c], 0xfffffff8
push 3
lea ecx, [ebp - 0x9f0]
call fcn.10008eaf
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xa0], 0
jmp 0x1003635a
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x1003637c
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x9f0]
call fcn.10008f1c
mov dword [eax], 0xf767
jmp 0x1003634d
mov dword [ebp - 0xa0], 0
jmp 0x10036395
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x100363b1
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x9ac], 6
jmp 0x10036388
mov dword [ebp - 0x2c], 0xffffffec
jmp 0x100363c1
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffee
jge 0x1003669e
mov dword [ebp - 0x94], 0x29c4
mov dword [ebp - 0x1f8], 0
mov dword [ebp - 0x260], 0xc869b7d6
mov dword [ebp - 0x4e4], 0x7b35f197
mov dword [ebp - 0x504], 6
mov dword [ebp - 0x2b8], 0x45b6d4f5
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xcc4], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 1
jle 0x10036435
cmp dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc44], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xd30], eax
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0xb10], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x260], eax
jle 0x1003647f
mov dword [ebp - 0x95c], 1
jmp 0x10036486
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xc4c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0xccc], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xb20], eax
cmp dword [ebp - 0x2c], 5
jbe 0x100364cb
cmp dword [ebp - 0x94], 0
je 0x100364cb
mov dword [ebp - 0x69c], 1
jmp 0x100364d2
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x69c]
mov dword [ebp - 0x4e4], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x4e4], eax
jg 0x100364f5
mov dword [ebp - 0x77c], 1
jmp 0x100364fc
and dword [ebp - 0x77c], 0
cmp dword [ebp - 0x77c], 0x87c5
jge 0x10036514
mov dword [ebp - 0x4ec], 1
jmp 0x1003651b
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x4ec], eax
jne 0x10036535
mov dword [ebp - 0x6a4], 1
jmp 0x1003653c
and dword [ebp - 0x6a4], 0
cmp dword [ebp - 0x6a4], 0xb5bf2d3f
ja 0x10036554
mov dword [ebp - 0x4f4], 1
jmp 0x1003655b
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x4f4], eax
jl 0x10036575
mov dword [ebp - 0x830], 1
jmp 0x1003657c
and dword [ebp - 0x830], 0
push 1
lea ecx, [ebp - 0x9f0]
call fcn.10008f1c
mov ecx, dword [ebp - 0x830]
cmp ecx, dword [eax]
jl 0x1003659f
mov dword [ebp - 0x4fc], 1
jmp 0x100365a6
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x4fc], eax
jge 0x100365c0
mov dword [ebp - 0x8c4], 1
jmp 0x100365c7
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xc54], eax
push 1
lea ecx, [ebp - 0x9f0]
call fcn.10008f1c
mov esi, eax
push 0
lea ecx, [ebp - 0x9f0]
call fcn.10008f1c
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x10036601
mov dword [ebp - 0x6ac], 1
jmp 0x10036608
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x6ac]
mov dword [ebp - 0x504], eax
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x2b8], eax
jg 0x10036643
cmp dword [ebp - 0x2b8], 0
je 0x10036643
mov dword [ebp - 0x784], 1
jmp 0x1003664a
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x784]
cmp eax, dword [ebp - 0x2c]
jge 0x10036667
mov dword [ebp - 0x50c], 1
jmp 0x1003666e
and dword [ebp - 0x50c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x50c]
mov dword [ebp + eax - 0x9ac], ecx
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x10036699
call dword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x100363ba
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x100366bd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x9f0]
call fcn.10008f17
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xbc], 2
jmp 0x100366fa
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbc]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xbc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbc], 0
jl 0x1003728f
mov dword [ebp - 0x19c], 0xcf2e5664
push 4
lea ecx, [ebp - 0x864]
call fcn.10008eaf
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x70], 0
jmp 0x10036739
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x1003674f
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xe00], 0xdc85
jmp 0x10036732
mov dword [ebp - 0x70], 0
jmp 0x1003675f
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x10036778
push dword [ebp - 0x70]
lea ecx, [ebp - 0x864]
call fcn.10008f1c
and dword [eax], 0
jmp 0x10036758
push 2
lea ecx, [ebp - 0x864]
call fcn.10008f1c
and dword [eax], 0
jmp 0x100367ae
push 2
lea ecx, [ebp - 0x864]
call fcn.10008f1c
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x6b4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x6b4]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x864]
call fcn.10008f1c
cmp dword [eax], 3
jg 0x10036803
mov byte [ebp - 0xd0], 0
movzx eax, byte [ebp - 0xd0]
test eax, eax
je 0x100367e6
push 0
push 0x110a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 2
lea ecx, [ebp - 0x864]
call fcn.10008f1c
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xe00], 0
je 0x10036801
jmp 0x10036803
jmp 0x1003678a
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x864]
call fcn.10008f17
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xbc]
lea ecx, [ebp - 0x2ec]
call fcn.10008f1c
mov esi, eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xbc]
lea ecx, [ebp - 0x2ec]
call fcn.10008f1c
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x19c], 0xfffffffe
jmp 0x10036861
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0xb
jge 0x1003728a
mov dword [ebp - 0x268], 0x68206240
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x10036892
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x268], 0
jmp 0x100368ab
mov eax, dword [ebp - 0x268]
dec eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0xffffffeb
je 0x100368d2
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x100368d0
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x1003689e
mov dword [ebp - 0x2c8], 1
push 4
lea ecx, [ebp - 0x334]
call fcn.10008eaf
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x28], 0x2ba39464
mov dword [ebp - 0x68], 0x3371247a
mov dword [ebp - 0x174], 1
mov dword [ebp - 0x200], 0
jmp 0x1003691e
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 4
jge 0x1003693d
push dword [ebp - 0x200]
lea ecx, [ebp - 0x334]
call fcn.10008f1c
or dword [eax], 0xffffffff
jmp 0x10036911
mov dword [ebp - 0x28], 3
jmp 0x1003694d
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x100369ca
mov dword [ebp - 0x148], 0xfffffff9
mov dword [ebp - 0x148], 3
jmp 0x10036976
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
jl 0x100369be
push dword [ebp - 0x148]
lea ecx, [ebp - 0x334]
call fcn.10008f1c
mov esi, eax
push dword [ebp - 0x148]
lea ecx, [ebp - 0x334]
call fcn.10008f1c
mov ecx, dword [esi]
mov dword [eax], ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x334]
call fcn.10008f1c
cmp dword [eax], 0
je 0x100369bc
jmp 0x100369be
jmp 0x10036969
mov dword [ebp - 0x68], 0x3c0b
jmp 0x10036946
push 0
lea ecx, [ebp - 0x334]
call fcn.10008f1c
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x28], eax
je 0x100369f4
cmp dword [ebp - 0x28], 0
je 0x10036bda
mov dword [ebp - 0x2c0], 0x90ae73
mov dword [ebp - 0x140], 0xf213ed42
mov dword [ebp - 0x308], 0x3ce7
mov dword [ebp - 0x964], 0xfffffff9
cmp dword [ebp - 0x28], 0
jne 0x10036a37
cmp dword [ebp - 0x2c0], 0
je 0x10036a37
mov dword [ebp - 0x514], 1
jmp 0x10036a3e
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x10036a5d
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x10036a5d
and dword [ebp - 0x7f8], 0
jmp 0x10036a67
mov dword [ebp - 0x7f8], 1
mov eax, dword [ebp - 0x7f8]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jne 0x10036a88
mov eax, 0xac3e
test eax, eax
jne 0x10036a88
and dword [ebp - 0x51c], 0
jmp 0x10036a92
mov dword [ebp - 0x51c], 1
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x51c], eax
jne 0x10036aac
mov dword [ebp - 0x8cc], 1
jmp 0x10036ab3
and dword [ebp - 0x8cc], 0
push 2
lea ecx, [ebp - 0x334]
call fcn.10008f1c
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xb28], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x174], eax
push 1
lea ecx, [ebp - 0x334]
call fcn.10008f1c
mov eax, dword [eax]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x28], eax
jge 0x10036bbf
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0xd38], eax
mov eax, dword [ebp - 0x308]
sub eax, 5
cmp eax, dword [ebp - 0x308]
jg 0x10036b22
mov dword [ebp - 0x6bc], 1
jmp 0x10036b29
and dword [ebp - 0x6bc], 0
cmp dword [ebp - 0x6bc], 1
jb 0x10036b3e
mov dword [ebp - 0x524], 1
jmp 0x10036b45
and dword [ebp - 0x524], 0
cmp dword [ebp - 0x524], 0
je 0x10036b5a
mov dword [ebp - 0x78c], 1
jmp 0x10036b61
and dword [ebp - 0x78c], 0
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x78c]
sub eax, dword [ebp - 0x308]
add esi, eax
push 3
lea ecx, [ebp - 0x334]
call fcn.10008f1c
cmp esi, dword [eax]
jge 0x10036b8f
mov dword [ebp - 0x52c], 1
jmp 0x10036b96
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x140], eax
imul eax, dword [ebp - 0x140], 3
test eax, eax
je 0x10036bb6
cmp dword [ebp - 0x2c0], 0
jne 0x10036bbf
and dword [ebp - 0x6c4], 0
jmp 0x10036bc9
mov dword [ebp - 0x6c4], 1
mov eax, dword [ebp - 0x6c4]
mov dword [ebp - 0x964], eax
jmp 0x10036f5b
mov dword [ebp - 0xf0], 0xffffffff
push 2
lea ecx, [ebp - 0xa10]
call fcn.10008eaf
mov byte [ebp - 4], 0x10
push 2
lea ecx, [ebp - 0xa00]
call fcn.10008eaf
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x79c], 0xe056
mov dword [ebp - 0x74], 0
jmp 0x10036c20
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10036c3c
push dword [ebp - 0x74]
lea ecx, [ebp - 0xa10]
call fcn.10008f1c
mov dword [eax], 0xcfd1f913
jmp 0x10036c19
mov dword [ebp - 0x74], 0
jmp 0x10036c4c
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10036c68
push dword [ebp - 0x74]
lea ecx, [ebp - 0xa00]
call fcn.10008f1c
mov dword [eax], 0x2f470b9c
jmp 0x10036c45
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x68], eax
jge 0x10036c7f
mov dword [ebp - 0x544], 1
jmp 0x10036c86
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0xf0], eax
jne 0x10036ca0
mov dword [ebp - 0x53c], 1
jmp 0x10036ca7
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xb30], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xc5c], eax
push 2
lea ecx, [ebp - 0x334]
call fcn.10008f1c
mov ecx, dword [ebp - 0xf0]
cmp dword [eax], ecx
jl 0x10036ce2
mov dword [ebp - 0x534], 1
jmp 0x10036ce9
and dword [ebp - 0x534], 0
cmp dword [ebp - 0x534], 1
jle 0x10036cfe
mov dword [ebp - 0x820], 1
jmp 0x10036d05
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x820]
sub eax, dword [ebp - 0xf0]
dec eax
mov ecx, dword [ebp - 0x53c]
sub ecx, eax
jne 0x10036d2e
cmp dword [ebp - 0x174], 0
jne 0x10036d2e
and dword [ebp - 0x6cc], 0
jmp 0x10036d38
mov dword [ebp - 0x6cc], 1
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x6cc], eax
jl 0x10036d4f
mov dword [ebp - 0x794], 1
jmp 0x10036d56
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x544]
cmp eax, dword [ebp - 0x794]
je 0x10036d70
mov dword [ebp - 0x54c], 1
jmp 0x10036d77
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x174], eax
push 1
lea ecx, [ebp - 0xa10]
call fcn.10008f1c
cmp dword [ebp - 0x68], 0
jne 0x10036e98
push 0
lea ecx, [ebp - 0xa00]
call fcn.10008f1c
cmp dword [eax], 0
jne 0x10036db9
xor eax, eax
jne 0x10036db9
and dword [ebp - 0x8d4], 0
jmp 0x10036dc3
mov dword [ebp - 0x8d4], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xb38], eax
push 1
lea ecx, [ebp - 0x334]
call fcn.10008f1c
cmp dword [eax], 0xd7cb
je 0x10036ded
mov dword [ebp - 0x6d4], 1
jmp 0x10036df4
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
neg eax
cmp eax, dword [ebp - 0x174]
jge 0x10036e10
mov dword [ebp - 0x554], 1
jmp 0x10036e17
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x554], eax
jle 0x10036e31
mov dword [ebp - 0xa24], 1
jmp 0x10036e38
and dword [ebp - 0xa24], 0
push 1
lea ecx, [ebp - 0xa10]
call fcn.10008f1c
push 0
lea ecx, [ebp - 0xa00]
call fcn.10008f1c
mov ecx, dword [ebp - 0x79c]
cmp dword [eax], ecx
je 0x10036e68
mov dword [ebp - 0x800], 1
jmp 0x10036e6f
and dword [ebp - 0x800], 0
cmp dword [ebp - 0x800], 0xfffffff7
jle 0x10036e84
mov dword [ebp - 0x55c], 1
jmp 0x10036e8b
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x55c]
add eax, 0xae93
je 0x10036ead
mov eax, 0xffff
test eax, eax
je 0x10036ead
mov dword [ebp - 0x6dc], 1
jmp 0x10036eb4
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x6dc], eax
jge 0x10036ecb
mov dword [ebp - 0x564], 1
jmp 0x10036ed2
and dword [ebp - 0x564], 0
push 1
lea ecx, [ebp - 0xa10]
call fcn.10008f1c
mov ecx, dword [ebp - 0x564]
cmp ecx, dword [eax]
jg 0x10036ef5
mov dword [ebp - 0x8dc], 1
jmp 0x10036efc
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xcd4], eax
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x10036f21
cmp dword [ebp - 0x79c], 0
je 0x10036f21
mov dword [ebp - 0x56c], 1
jmp 0x10036f28
and dword [ebp - 0x56c], 0
push 0
lea ecx, [ebp - 0xa00]
call fcn.10008f1c
mov ecx, dword [ebp - 0x56c]
mov dword [eax], ecx
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xa00]
call fcn.10008f17
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xa10]
call fcn.10008f17
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x334]
call fcn.10008f17
mov dword [ebp - 0x150], 6
mov dword [ebp - 0x96c], 0x2eb9
mov dword [ebp - 0x6e4], 0xc69aed23
mov byte [ebp - 0xda], 0
movzx eax, byte [ebp - 0xda]
test eax, eax
je 0x10036fa6
push 0
push 0xa
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp dword [ebp - 0x96c], 0
je 0x10036fbb
mov dword [ebp - 0x6e4], 0xffffc714
jmp 0x10036ff0
mov dword [ebp - 0x8e4], 0x126ff23b
mov byte [ebp - 0xd4], 0
movzx eax, byte [ebp - 0xd4]
test eax, eax
je 0x10036fe4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0x8e4], eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xbc]
lea ecx, [ebp - 0x2ec]
call fcn.10008f1c
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xbc]
lea ecx, [ebp - 0x2ec]
call fcn.10008f1c
cmp dword [eax], 0x2afd77cc
jge 0x10037034
mov dword [ebp - 0x574], 1
jmp 0x1003703b
and dword [ebp - 0x574], 0
cmp dword [ebp - 0x574], 0xf5f40e13
je 0x10037053
mov dword [ebp - 0x840], 1
jmp 0x1003705a
and dword [ebp - 0x840], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xbc]
lea ecx, [ebp - 0x2ec]
call fcn.10008f1c
mov ecx, dword [ebp - 0x840]
cmp ecx, dword [eax]
jg 0x10037088
mov dword [ebp - 0x57c], 1
jmp 0x1003708f
and dword [ebp - 0x57c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbc]
add eax, dword [ebp - 0x57c]
cmp eax, 0xffffffff
jg 0x100370b3
mov dword [ebp - 0x6ec], 1
jmp 0x100370ba
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x2c8], eax
je 0x100370e0
mov dword [ebp - 0x584], 1
jmp 0x100370e7
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x584]
sub eax, dword [ebp - 0x150]
mov dword [ebp - 0x7a4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbc]
cmp dword [ebp - 0x7a4], eax
jge 0x1003711a
mov dword [ebp - 0x58c], 1
jmp 0x10037121
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x58c], eax
jge 0x1003713b
mov dword [ebp - 0x6f4], 1
jmp 0x10037142
and dword [ebp - 0x6f4], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xbc]
lea ecx, [ebp - 0x2ec]
call fcn.10008f1c
mov ecx, dword [ebp - 0x6f4]
cmp ecx, dword [eax]
jg 0x10037170
mov dword [ebp - 0x9b4], 1
jmp 0x10037177
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xb40], eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xbc]
lea ecx, [ebp - 0x2ec]
call fcn.10008f1c
mov ecx, dword [ebp - 0x150]
cmp dword [eax], ecx
jne 0x100371b1
mov dword [ebp - 0x594], 1
jmp 0x100371b8
and dword [ebp - 0x594], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbc]
cmp dword [ebp - 0x594], eax
jl 0x100371d9
mov dword [ebp - 0x808], 1
jmp 0x100371e0
and dword [ebp - 0x808], 0
push 0
lea ecx, [ebp - 0x2ec]
call fcn.10008f1c
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xbc]
add ecx, dword [ebp - 0x808]
cmp dword [eax], ecx
jge 0x10037210
mov dword [ebp - 0x2f0], 1
jmp 0x10037217
and dword [ebp - 0x2f0], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xbc]
lea ecx, [ebp - 0x2ec]
call fcn.10008f1c
mov ecx, dword [ebp - 0x2f0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x2f0], eax
jg 0x10037251
mov dword [ebp - 0x8ec], 1
jmp 0x10037258
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x2c8], eax
jge 0x10037272
mov dword [ebp - 0x59c], 1
jmp 0x10037279
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x6fc], eax
jmp 0x10036854
jmp 0x100366df
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbd0]
mov dword [ebp - 0x6fc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2ec]
call fcn.10008f17
mov dword [ebp - 0x78], 0x5d6c05ba
mov dword [ebp - 0x328], 0xffffffff
mov dword [ebp - 0x5bc], 1
mov dword [ebp - 0x78], 0
jmp 0x100372dc
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x16
jl 0x10037509
mov dword [ebp - 0x208], 0xf0aa6e6f
push 2
lea ecx, [ebp - 0xa20]
call fcn.10008eaf
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x270], 0
jmp 0x1003731d
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 2
jge 0x1003733f
push dword [ebp - 0x270]
lea ecx, [ebp - 0xa20]
call fcn.10008f1c
mov dword [eax], 0xb0639e6a
jmp 0x10037310
cmp dword [ebp - 0x208], 0
je 0x100374b3
cmp dword [ebp - 0x78], 0
je 0x10037432
mov eax, dword [ebp - 0x328]
cmp dword [ebp - 0x208], eax
jne 0x10037370
mov dword [ebp - 0x5a4], 1
jmp 0x10037377
and dword [ebp - 0x5a4], 0
cmp dword [ebp - 0x5a4], 0x2104
je 0x1003738f
mov dword [ebp - 0x7ac], 1
jmp 0x10037396
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x7ac]
sub eax, 0x93ba
js 0x100373af
mov dword [ebp - 0x974], 1
jmp 0x100373b6
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0xc64], eax
push 1
lea ecx, [ebp - 0xa20]
call fcn.10008f1c
cmp dword [eax], 0xffffffff
je 0x100373e0
mov dword [ebp - 0x5ac], 1
jmp 0x100373e7
and dword [ebp - 0x5ac], 0
cmp dword [ebp - 0x5ac], 0x27fa3dfa
jle 0x100373ff
mov dword [ebp - 0x704], 1
jmp 0x10037406
and dword [ebp - 0x704], 0
push 1
lea ecx, [ebp - 0xa20]
call fcn.10008f1c
mov ecx, dword [ebp - 0x704]
cmp ecx, dword [eax]
jle 0x10037432
cmp dword [ebp - 0x328], 0
je 0x10037432
mov dword [ebp - 0x5b4], 1
jmp 0x10037439
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x5b4], eax
jg 0x10037450
mov dword [ebp - 0x7c4], 1
jmp 0x10037457
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x208]
add eax, dword [ebp - 0x7c4]
sub eax, dword [ebp - 0x328]
cmp eax, 0xa8fad749
jae 0x10037488
cmp dword [ebp - 0x78], 0
jne 0x10037488
cmp dword [ebp - 0x5bc], 0
jne 0x10037488
and dword [ebp - 0x8f4], 0
jmp 0x10037492
mov dword [ebp - 0x8f4], 1
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xb48], eax
cmp dword [ebp - 0x5bc], 0xd975
je 0x100374b3
mov dword [ebp - 0x70c], 1
jmp 0x100374ba
and dword [ebp - 0x70c], 0
cmp dword [ebp - 0x70c], 0xbadcab39
je 0x100374d2
mov dword [ebp - 0x9f4], 1
jmp 0x100374d9
and dword [ebp - 0x9f4], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xd44], eax
push 1
lea ecx, [ebp - 0xa20]
call fcn.10008f1c
mov dword [eax], 0x19bd12f8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa20]
call fcn.10008f17
jmp 0x100372d5
mov dword [ebp - 0x1bc], 0xfffffffb
mov dword [ebp - 0x17c], 0xffffffff
mov dword [ebp - 0x8fc], 0xffffffff
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x17c], 0
jmp 0x1003754c
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0xfffffff0
jge 0x100375a7
mov dword [ebp - 0x1bc], 0
jmp 0x1003756e
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0x2b
jg 0x100375a5
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x10037598
push 0
push 0x2089
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
cmp dword [ebp - 0x8fc], 0
je 0x100375a3
jmp 0x10037561
jmp 0x10037561
jmp 0x1003753f
mov dword [ebp - 0x80], 0x5d6c05ba
mov dword [ebp - 0x2d0], 0xffffffff
mov dword [ebp - 0x5dc], 1
mov dword [ebp - 0x80], 0
jmp 0x100375d2
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x16
jl 0x100377ff
mov dword [ebp - 0x210], 0xf0aa6e6f
push 2
lea ecx, [ebp - 0xa30]
call fcn.10008eaf
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x278], 0
jmp 0x10037613
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 2
jge 0x10037635
push dword [ebp - 0x278]
lea ecx, [ebp - 0xa30]
call fcn.10008f1c
mov dword [eax], 0xb0639e6a
jmp 0x10037606
cmp dword [ebp - 0x210], 0
je 0x100377a9
cmp dword [ebp - 0x80], 0
je 0x10037728
mov eax, dword [ebp - 0x2d0]
cmp dword [ebp - 0x210], eax
jne 0x10037666
mov dword [ebp - 0x5c4], 1
jmp 0x1003766d
and dword [ebp - 0x5c4], 0
cmp dword [ebp - 0x5c4], 0x2104
je 0x10037685
mov dword [ebp - 0x7b4], 1
jmp 0x1003768c
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x7b4]
sub eax, 0x93ba
js 0x100376a5
mov dword [ebp - 0x97c], 1
jmp 0x100376ac
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0xb50], eax
push 1
lea ecx, [ebp - 0xa30]
call fcn.10008f1c
cmp dword [eax], 0xffffffff
je 0x100376d6
mov dword [ebp - 0x5cc], 1
jmp 0x100376dd
and dword [ebp - 0x5cc], 0
cmp dword [ebp - 0x5cc], 0x27fa3dfa
jle 0x100376f5
mov dword [ebp - 0x714], 1
jmp 0x100376fc
and dword [ebp - 0x714], 0
push 1
lea ecx, [ebp - 0xa30]
call fcn.10008f1c
mov ecx, dword [ebp - 0x714]
cmp ecx, dword [eax]
jle 0x10037728
cmp dword [ebp - 0x2d0], 0
je 0x10037728
mov dword [ebp - 0x5d4], 1
jmp 0x1003772f
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x5d4], eax
jg 0x10037746
mov dword [ebp - 0x7d4], 1
jmp 0x1003774d
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x210]
add eax, dword [ebp - 0x7d4]
sub eax, dword [ebp - 0x2d0]
cmp eax, 0xa8fad749
jae 0x1003777e
cmp dword [ebp - 0x80], 0
jne 0x1003777e
cmp dword [ebp - 0x5dc], 0
jne 0x1003777e
and dword [ebp - 0x904], 0
jmp 0x10037788
mov dword [ebp - 0x904], 1
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xc6c], eax
cmp dword [ebp - 0x5dc], 0xd975
je 0x100377a9
mov dword [ebp - 0x71c], 1
jmp 0x100377b0
and dword [ebp - 0x71c], 0
cmp dword [ebp - 0x71c], 0xbadcab39
je 0x100377c8
mov dword [ebp - 0x9c4], 1
jmp 0x100377cf
and dword [ebp - 0x9c4], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xb58], eax
push 1
lea ecx, [ebp - 0xa30]
call fcn.10008f1c
mov dword [eax], 0x19bd12f8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa30]
call fcn.10008f17
jmp 0x100375cb
mov dword [ebp - 0x1a4], 0xfffffffb
mov dword [ebp - 0x184], 0xffffffff
mov dword [ebp - 0x90c], 0xffffffff
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x184], 0
jmp 0x10037842
mov eax, dword [ebp - 0x184]
dec eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0xfffffff0
jge 0x1003789d
mov dword [ebp - 0x1a4], 0
jmp 0x10037864
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0x2b
jg 0x1003789b
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x1003788e
push 0
push 0x2089
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
cmp dword [ebp - 0x90c], 0
je 0x10037899
jmp 0x10037857
jmp 0x10037857
jmp 0x10037835
mov dword [ebp - 0x88], 0x5d6c05ba
mov dword [ebp - 0x298], 0xffffffff
mov dword [ebp - 0x5fc], 1
mov dword [ebp - 0x88], 0
jmp 0x100378d4
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x16
jl 0x10037b13
mov dword [ebp - 0x288], 0xf0aa6e6f
push 2
lea ecx, [ebp - 0x994]
call fcn.10008eaf
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x280], 0
jmp 0x10037918
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 2
jge 0x1003793a
push dword [ebp - 0x280]
lea ecx, [ebp - 0x994]
call fcn.10008f1c
mov dword [eax], 0xb0639e6a
jmp 0x1003790b
cmp dword [ebp - 0x288], 0
je 0x10037aba
cmp dword [ebp - 0x88], 0
je 0x10037a30
mov eax, dword [ebp - 0x298]
cmp dword [ebp - 0x288], eax
jne 0x1003796e
mov dword [ebp - 0x5e4], 1
jmp 0x10037975
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0x5e4], 0x2104
je 0x1003798d
mov dword [ebp - 0x7bc], 1
jmp 0x10037994
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x7bc]
sub eax, 0x93ba
js 0x100379ad
mov dword [ebp - 0x984], 1
jmp 0x100379b4
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0xcdc], eax
push 1
lea ecx, [ebp - 0x994]
call fcn.10008f1c
cmp dword [eax], 0xffffffff
je 0x100379de
mov dword [ebp - 0x5ec], 1
jmp 0x100379e5
and dword [ebp - 0x5ec], 0
cmp dword [ebp - 0x5ec], 0x27fa3dfa
jle 0x100379fd
mov dword [ebp - 0x724], 1
jmp 0x10037a04
and dword [ebp - 0x724], 0
push 1
lea ecx, [ebp - 0x994]
call fcn.10008f1c
mov ecx, dword [ebp - 0x724]
cmp ecx, dword [eax]
jle 0x10037a30
cmp dword [ebp - 0x298], 0
je 0x10037a30
mov dword [ebp - 0x5f4], 1
jmp 0x10037a37
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x5f4], eax
jg 0x10037a51
mov dword [ebp - 0x7dc], 1
jmp 0x10037a58
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x288]
add eax, dword [ebp - 0x7dc]
sub eax, dword [ebp - 0x298]
cmp eax, 0xa8fad749
jae 0x10037a8c
cmp dword [ebp - 0x88], 0
jne 0x10037a8c
cmp dword [ebp - 0x5fc], 0
jne 0x10037a8c
and dword [ebp - 0x914], 0
jmp 0x10037a96
mov dword [ebp - 0x914], 1
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xabc], eax
cmp dword [ebp - 0x5fc], 0xd975
je 0x10037aba
mov dword [ebp - 0x72c], 1
jmp 0x10037ac1
and dword [ebp - 0x72c], 0
cmp dword [ebp - 0x72c], 0xbadcab39
je 0x10037ad9
mov dword [ebp - 0xa14], 1
jmp 0x10037ae0
and dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xc74], eax
push 1
lea ecx, [ebp - 0x994]
call fcn.10008f1c
mov dword [eax], 0x19bd12f8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x994]
call fcn.10008f17
jmp 0x100378c7
mov dword [ebp - 0x21c], 8
mov dword [ebp - 0x21c], 0
jmp 0x10037b36
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
je 0x10037b8e
mov dword [ebp - 0x274], 0x2f4a8b10
mov dword [ebp - 0x274], 0xffffffed
jmp 0x10037b62
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0x12
jle 0x10037b8c
mov byte [ebp - 0xd8], 0
movzx eax, byte [ebp - 0xd8]
test eax, eax
je 0x10037b8a
push 0x263a
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x10037b55
jmp 0x10037b29
mov byte [ebp - 0x12b], 0
movzx eax, byte [ebp - 0x12b]
test eax, eax
je 0x10037baa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov dword [ebp - 0x15c], 0xfffffffb
mov dword [ebp - 0x18c], 0xffffffff
mov dword [ebp - 0x91c], 0xffffffff
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x18c], 0
jmp 0x10037bed
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0xfffffff0
jge 0x10037c48
mov dword [ebp - 0x15c], 0
jmp 0x10037c0f
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0x2b
jg 0x10037c46
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x10037c39
push 0
push 0x2089
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
cmp dword [ebp - 0x91c], 0
je 0x10037c44
jmp 0x10037c02
jmp 0x10037c02
jmp 0x10037be0
mov dword [ebp - 0x224], 8
mov dword [ebp - 0x224], 0
jmp 0x10037c6b
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 1
je 0x10037cc3
mov dword [ebp - 0x25c], 0x2f4a8b10
mov dword [ebp - 0x25c], 0xffffffed
jmp 0x10037c97
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x12
jle 0x10037cc1
mov byte [ebp - 0x12a], 0
movzx eax, byte [ebp - 0x12a]
test eax, eax
je 0x10037cbf
push 0x263a
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x10037c8a
jmp 0x10037c5e
mov byte [ebp - 0xd2], 0
movzx eax, byte [ebp - 0xd2]
test eax, eax
je 0x10037cdf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
movzx eax, byte [0x10667c98]
test eax, eax
je 0x10037cfd
mov esi, 0x10665f68
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x1003a50b
mov dword [ebp - 0xb68], 0x198a
mov dword [ebp - 0xd34], 0x94a18885
mov dword [ebp - 0xb70], 0x506e60b0
mov dword [ebp - 0xc7c], 0x4fe5f36f
mov dword [ebp - 0xb78], 1
mov dword [ebp - 0x604], 0x989b1ab4
mov dword [ebp - 0x22c], 0
jmp 0x10037d52
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 4
jge 0x10037d6e
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xe20], 0x93e9323d
jmp 0x10037d45
mov eax, dword [ebp - 0x604]
inc eax
mov dword [ebp - 0x604], eax
mov dword [ebp - 0x284], 8
mov dword [ebp - 0x284], 0
jmp 0x10037d9e
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 1
je 0x10037df6
mov dword [ebp - 0x234], 0x2f4a8b10
mov dword [ebp - 0x234], 0xffffffed
jmp 0x10037dca
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0x12
jle 0x10037df4
mov byte [ebp - 0x124], 0
movzx eax, byte [ebp - 0x124]
test eax, eax
je 0x10037df2
push 0x263a
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x10037dbd
jmp 0x10037d91
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x10037e12
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov dword [ebp - 0xce4], 0x10665f68
mov dword [ebp - 0x1c4], 8
mov dword [ebp - 0x1c4], 0
jmp 0x10037e3f
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
je 0x10037e97
mov dword [ebp - 0x264], 0x2f4a8b10
mov dword [ebp - 0x264], 0xffffffed
jmp 0x10037e6b
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0x12
jle 0x10037e95
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x10037e93
push 0x263a
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x10037e5e
jmp 0x10037e32
mov byte [ebp - 0x126], 0
movzx eax, byte [ebp - 0x126]
test eax, eax
je 0x10037eb3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov dword [ebp - 0x23c], 8
mov dword [ebp - 0x23c], 0
jmp 0x10037ed6
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 1
je 0x10037f2e
mov dword [ebp - 0x27c], 0x2f4a8b10
mov dword [ebp - 0x27c], 0xffffffed
jmp 0x10037f02
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0x12
jle 0x10037f2c
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x10037f2a
push 0x263a
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x10037ef5
jmp 0x10037ec9
mov byte [ebp - 0x12e], 0
movzx eax, byte [ebp - 0x12e]
test eax, eax
je 0x10037f4a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov dword [ebp - 0xb80], 0x10665f6c
mov dword [ebp - 0xc84], 0x198a
mov dword [ebp - 0xb88], 0x94a18885
mov dword [ebp - 0xd50], 0x506e60b0
mov dword [ebp - 0xb90], 0x4fe5f36f
mov dword [ebp - 0xc8c], 1
mov dword [ebp - 0x3b4], 0x989b1ab4
mov dword [ebp - 0x244], 0
jmp 0x10037fa9
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 4
jge 0x10037fc5
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0xe30], 0x93e9323d
jmp 0x10037f9c
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 0x90], 0
jmp 0x10037feb
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x10038007
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x870], 0
jmp 0x10037fde
mov dword [ebp - 0x90], 0
jmp 0x10038020
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 4
jge 0x1003803c
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0xdf0], 0
jmp 0x10038013
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x870], 0
jmp 0x1003806a
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x870]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x870], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x870], 0xfffffffa
jg 0x10038093
mov dword [ebp - 0x3b8], 0xe77dd688
mov eax, dword [ebp - 0x3b8]
inc eax
mov dword [ebp - 0x3b8], eax
jmp 0x1003804f
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xdf0], 0x164caf14
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x870], 0x164caf14
je 0x100380c3
mov dword [ebp - 0x3c0], 1
jmp 0x100380ca
and dword [ebp - 0x3c0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp + eax - 0x870], ecx
mov byte [0x10667c98], 1
mov dword [ebp - 0x20], 0x41b6
mov dword [ebp - 0xf8], 0xbbbdebf8
mov dword [ebp - 0xb98], 0x653e3f36
mov dword [ebp - 0x26c], 0
jmp 0x10038117
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 1
jge 0x10038133
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0x3f0], 0xc80ae7b1
jmp 0x1003810a
cmp dword [ebp - 0x20], 1
je 0x10038145
mov dword [ebp - 0x92c], 1
jmp 0x1003814c
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jl 0x10038160
mov dword [ebp - 0x3d8], 1
jmp 0x10038167
and dword [ebp - 0x3d8], 0
cmp dword [ebp - 0x20], 0
je 0x10038171
cmp dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0
jne 0x10038186
cmp dword [ebp - 0x20], 0
jne 0x10038186
and dword [ebp - 0x3c8], 0
jmp 0x10038190
mov dword [ebp - 0x3c8], 1
mov eax, dword [ebp - 0x3c8]
add eax, 0x2b90
cmp eax, 2
jb 0x100381ac
mov dword [ebp - 0x3d0], 1
jmp 0x100381b3
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x3d8], eax
jle 0x100381d9
mov dword [ebp - 0x924], 1
jmp 0x100381e0
and dword [ebp - 0x924], 0
cmp dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jg 0x10038201
cmp dword [ebp - 0xf8], 0
je 0x10038201
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x3e0]
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
je 0x10038222
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret