Function at 0x100365ca
Capabilities:
Connect pipe
Create pipe
Create process on windows
Delete file
Delete registry value
Enumerate gui resources
Get disk information
Get geographical location
Get graphical window text
Get memory capacity
Get system information on windows
Identify system language via api
Parse pe header
Query or enumerate registry key
Query or enumerate registry value
Query service status
Resume thread
Set registry value

Disassembly:
mov eax, 0x1008fda5
call fcn.1008e2d8
mov eax, 0x16bc
call fcn.10076ef0
mov dword [ebp - 0x24], 0x8ef6
xor eax, eax
push ebx
mov dword [ebp - 0x10], 0x210e164c
inc eax
push esi
mov dword [ebp - 0x48], 0x90d29729
mov dword [ebp - 0x3c], 0xffff
push edi
mov dword [ebp - 0x28], eax
xor eax, eax
push 2
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x20], eax
pop ecx
mov byte [ebp - 0x8d], dl
cmp dword [ebp - 0x20], ecx
jge 0x10036631
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1558], 0x209a488d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10036619
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10036645
push eax
call edi
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10036673
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
sub eax, 0xd4a1
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x3c]
jg 0x10036671
xor eax, eax
lea edx, [eax + 1]
jmp 0x10036675
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x3c]
jle 0x10036687
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
push 0xfffffffffffffff8
setl dl
xor eax, eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
pop eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], 0xc902dafb
mov dword [ebp - 0x48], 0x53423637
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100366e3
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jne 0x100366e1
xor eax, eax
lea edx, [eax + 1]
jmp 0x100366e5
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
neg eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 5
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x18], ecx
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setle dl
xor ecx, ecx
cmp eax, edx
pop edx
setne cl
dec ecx
je 0x100367d7
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1003673a
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10036755
push 0xe88
push eax
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor esi, esi
inc esi
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
or eax, 0xffffffff
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x2c], 0x42bb
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1003679d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8bc], 0x1f2c29a3
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10036784
xor eax, eax
cmp dword [ebp - 0x8b0], eax
je 0x10036a6b
mov dword [ebp - 0x24], 0x91df82
lea ecx, [ebp - 0xde8]
mov dword [ebp - 0x48], 3
push esi
call fcn.10018ece
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x28], 0xaedf47f2
mov dword [ebp - 0x20], eax
jmp 0x10036977
xor ecx, ecx
mov dword [ebp - 0x38], 0x7c7a
xor esi, esi
inc esi
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x38]
cmp eax, 0xa720
setg cl
add ecx, edx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0xfffffff9
cmp edx, eax
mov eax, dword [ebp - 0x38]
setge cl
xor edx, edx
cmp ecx, 3
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x38]
jne 0x100368bf
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], eax
xor eax, eax
push 3
mov dword [ebp - 0x20], eax
pop edx
jmp 0x1003685b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xbf0], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1003684a
mov eax, dword [ebp - 0xbe8]
cmp dword [ebp - 0x18], eax
jle 0x1003688c
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp eax, 0xa81f
setg cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0xbe8], eax
je 0x1003688e
mov eax, esi
jmp 0x1003688e
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xbe8]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
jmp 0x10036758
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x10036952
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xe
jge 0x1003694f
push 2
pop eax
push eax
lea ecx, [ebp - 0x1174]
call fcn.10018ece
xor eax, eax
mov dword [ebp - 4], eax
push 2
mov dword [ebp - 0x20], eax
pop edx
cmp dword [ebp - 0x20], edx
jge 0x10036914
push edx
pop esi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1174]
call fcn.10018f3b
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100368f3
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x24], eax
jmp 0x1003692e
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1003692b
push eax
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10036919
or eax, 0xffffffff
lea ecx, [ebp - 0x1174]
mov dword [ebp - 4], eax
call fcn.10018f36
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xe
jl 0x100368d2
xor eax, eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffec
jg 0x100368c9
jmp 0x10036758
push dword [ebp - 0x20]
lea ecx, [ebp - 0xde8]
call fcn.10018f3b
push 5
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x20]
xor eax, eax
inc eax
cmp dword [ebp - 0x20], eax
jl 0x10036961
imul eax, dword [ebp - 0x24], 0xfa55
cmp eax, dword [ebp - 0x24]
jle 0x10036998
xor eax, eax
cmp dword [ebp - 0x8bc], eax
je 0x1003699a
inc eax
jmp 0x1003699a
xor eax, eax
imul ecx, eax, 0xf6a0
xor edx, edx
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
mov esi, dword [ebp - 0x8b0]
lea ecx, [ebp - 0xde8]
setl dl
xor eax, eax
push eax
add esi, edx
call fcn.10018f3b
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
add eax, esi
je 0x100369db
xor eax, eax
cmp dword [ebp - 0x8b0], eax
je 0x100369dd
lea edx, [eax + 1]
jmp 0x100369df
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edx
setne cl
imul ecx, dword [ebp - 0x8b4]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xc5a74d4b
setne al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x10], eax
jl 0x10036a15
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10036a1f
jmp 0x10036a17
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10036a1f
xor eax, eax
inc eax
mov edx, dword [ebp - 0x24]
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x8b0]
cmp edx, eax
setl cl
or edx, 0xffffffff
xor eax, eax
cmp ecx, edx
jle 0x10036a45
cmp dword [ebp - 0x48], eax
je 0x10036a45
lea ecx, [eax + 1]
jmp 0x10036a47
mov ecx, eax
mov eax, dword [ebp - 0x2c]
add eax, ecx
lea ecx, [ebp - 0xde8]
imul eax, eax, 0x90ba
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edx
call fcn.10018f36
jmp 0x10036ac7
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov dword [ebp - 0x34], 0xda4adcf8
mov eax, dword [ebp - 0x8b8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
inc edx
cmp edx, eax
setg cl
cmp dword [ebp - 0x28], ecx
jle 0x10036a9c
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
jmp 0x10036ab5
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10036ab7
push eax
push 0x1bca
call ebx
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10036ac9
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
xor eax, eax
mov dword [ebp - 0x24], 0x8ef6
or ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x34], 0x16580849
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10036af8
push 0x1464
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x3ffe0
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
sub edx, eax
mov eax, dword [ebp - 0x34]
cmp eax, edx
setge cl
xor ebx, ebx
mov dword [ebp - 0x28], ecx
inc ebx
mov dword [ebp - 0x10], 0x210e164c
lea ecx, [ebp - 0x1f0]
mov dword [ebp - 0x48], 0x90d29729
mov dword [ebp - 0x40], 7
push ebx
call fcn.10018ece
push 2
xor eax, eax
pop esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0x360abed9
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10036b98
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1f0]
call fcn.10018f3b
mov dword [eax], 0x34111d01
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10036b74
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10036bbd
push 5
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x160], ecx
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10036ba3
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x1f0]
call fcn.10018f3b
mov ecx, dword [ebp - 0x40]
xor edx, edx
neg ecx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x40]
setle dl
sub eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x40]
cmp eax, edx
jl 0x10036bfe
xor eax, eax
lea ecx, [ebp - 0x1f0]
push eax
call fcn.10018f3b
cmp dword [eax], 0
jne 0x10036bfe
mov eax, dword [ebp - 0x40]
xor eax, eax
lea ecx, [ebp - 0x1f0]
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0x40]
mov edx, ebx
sub edx, ecx
xor ebx, ebx
lea ecx, [ebp - 0x1f0]
cmp edx, dword [eax]
setg bl
xor eax, eax
push eax
call fcn.10018f3b
xor ecx, ecx
cmp ebx, dword [eax]
setg cl
xor eax, eax
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x1f0]
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x160]
sete dl
sub edx, 7
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x11fc
setle al
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10036cf2
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x1f0]
mov eax, dword [ebp - 0x160]
xor eax, eax
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0x160]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x1f0]
setne bl
xor eax, eax
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp ebx, ecx
setle dl
xor ecx, ecx
cmp edx, 0xfffffff9
setne cl
xor edx, edx
cmp ecx, 0x94ad
lea ecx, [ebp - 0x1f0]
setg dl
xor ebx, ebx
cmp edx, dword [eax]
setle bl
xor eax, eax
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ebx, ecx
sete dl
cmp edx, dword [eax]
jg 0x10036cf0
xor eax, eax
lea edx, [eax + 1]
jmp 0x10036cf4
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp eax, edx
setg cl
cmp ecx, 0x6fbc
jge 0x10036d20
xor eax, eax
lea ecx, [ebp - 0x1f0]
push eax
call fcn.10018f3b
cmp dword [eax], 0
jne 0x10036d20
xor ebx, ebx
xor eax, eax
inc ebx
jmp 0x10036d25
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x1f0]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor eax, eax
push eax
call fcn.10018f3b
xor ecx, ecx
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [ebp - 0x40]
cmp edx, eax
setg cl
or eax, 0xffffffff
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x1f0]
mov dword [ebp - 4], eax
call fcn.10018f36
mov eax, 0xffff
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10036d8e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1598], 0x209a488d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10036d76
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10036d9a
push eax
call edi
push esi
lea ecx, [ebp - 0x31c]
call fcn.10018ece
mov dword [ebp - 4], 3
lea eax, [ebp - 0x1224]
movdqa xmm0, xmmword [0x10007b50]
lea ecx, [ebp - 0x1568]
push eax
lea eax, [ebp - 0x1234]
mov dword [ebp - 0x38], 0xeaa32b1c
mov dword [ebp - 0x48], 6
push eax
movdqu xmmword [ebp - 0x1234], xmm0
call fcn.10018f4a
lea ecx, [ebp - 0x256]
mov esi, eax
call fcn.10008b23
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xa7c]
push dword [esi]
call fcn.10018f10
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xb18]
mov dword [ebp - 0x10], 0x8770ce40
push ebx
call fcn.10018ece
push 5
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x34], 0x1265a1b
push 2
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x10036e51
push dword [ebp - 0x18]
lea ecx, [ebp - 0x31c]
call fcn.10018f3b
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10036e33
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10036e7c
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb18]
call fcn.10018f3b
or ecx, 0xffffffff
mov dword [eax], ecx
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10036e59
xor ebx, ebx
xor eax, eax
inc ebx
push 3
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x10036e9f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc08], 0x57f02caa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10036e87
xor eax, eax
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], eax
jl 0x10037155
mov dword [ebp - 0x28], 0x89a5a40f
lea ecx, [ebp - 0x534]
push esi
call fcn.10018ece
mov byte [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x40], eax
or ecx, 0xffffffff
mov dword [ebp - 0x18], 0x5cab4306
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], eax
jmp 0x10036ef3
push dword [ebp - 0x20]
lea ecx, [ebp - 0x534]
call fcn.10018f3b
mov dword [eax], 0x19d81479
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10036edc
push ebx
lea ecx, [ebp - 0x31c]
call fcn.10018f3b
cmp dword [eax], 0
je 0x10036fca
push esi
lea ecx, [ebp - 0xa7c]
call fcn.10018f3b
mov esi, eax
lea ecx, [ebp - 0x31c]
xor eax, eax
push eax
call fcn.10018f3b
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [esi]
test ecx, ecx
je 0x10036f86
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x31c]
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x38]
call fcn.10018f3b
push 3
lea ecx, [ebp - 0xa7c]
mov dword [eax], 0x99b9
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x48]
call fcn.10018f3b
push 2
pop eax
push eax
lea ecx, [ebp - 0x534]
call fcn.10018f3b
mov esi, eax
lea ecx, [ebp - 0x534]
xor eax, eax
push eax
call fcn.10018f3b
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
mov dword [esi], ecx
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0xb18]
xor eax, eax
push eax
call fcn.10018f3b
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10036faa
push ebx
lea ecx, [ebp - 0x534]
call fcn.10018f3b
push ebx
lea ecx, [ebp - 0x534]
call fcn.10018f3b
mov ecx, dword [ebp - 0x50]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x38]
jle 0x10036fca
xor eax, eax
xor ebx, ebx
inc ebx
lea esi, [eax + 1]
jmp 0x10036fce
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xb18]
call fcn.10018f3b
cmp esi, dword [eax]
jle 0x10037126
mov dword [ebp - 0x20], 0x3e0c
xor eax, eax
push 3
pop esi
mov dword [ebp - 0xb40], esi
mov dword [ebp - 0xb3c], esi
mov dword [ebp - 0xb38], esi
mov dword [ebp - 0xb34], esi
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ebx
jg 0x10037135
mov dword [ebp - 0x2c], 0xfffffff7
lea ecx, [ebp - 0x31c]
push dword [ebp - 0x38]
call fcn.10018f3b
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x31c]
push dword [ebp - 0x40]
call fcn.10018f3b
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x31c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x34]
push dword [ebp - 0x40]
call fcn.10018f3b
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x31c]
mov eax, dword [ebp - 0x20]
dec esi
push dword [ebp - 0x40]
neg esi
sbb esi, esi
neg esi
sub esi, eax
call fcn.10018f3b
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x2c]
cmp esi, eax
setg cl
xor eax, eax
mov dword [ebp - 0xc04], ecx
cmp dword [ebp - 0x20], eax
je 0x1003708f
mov esi, ebx
cmp dword [ebp - 0xb38], eax
jne 0x10037091
mov esi, eax
push eax
lea ecx, [ebp - 0xa7c]
call fcn.10018f3b
xor ecx, ecx
cmp esi, 0xffffffff
setle cl
sub ecx, dword [eax]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
add eax, ecx
lea ecx, [ebp - 0x31c]
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x49fec891
setle bl
xor eax, eax
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0xb38]
mov dword [eax], ebx
mov eax, dword [ebp - 0x50]
add eax, ebx
add ecx, eax
mov eax, 0xffff
neg ecx
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc04]
sub ecx, 0x4231
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xc04], eax
xor eax, eax
inc dword [ebp - 0x40]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x40], eax
jle 0x10037012
jmp 0x10037130
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
jne 0x100371aa
push 3
pop esi
xor eax, eax
cmp dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x534]
push 5
pop eax
mov byte [ebp - 4], al
call fcn.10018f36
dec dword [ebp - 0x38]
push 1
pop ebx
jns 0x10036eab
lea ecx, [ebp - 0xb18]
call fcn.10018f36
lea ecx, [ebp - 0xa7c]
call fcn.10018f36
or eax, 0xffffffff
lea ecx, [ebp - 0x31c]
mov dword [ebp - 4], eax
call fcn.10018f36
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100371b7
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
sub eax, 0xd4a1
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x3c]
jg 0x100371b5
xor eax, eax
lea edx, [eax + 1]
jmp 0x100371b9
push 0x2470
call dword [sym.imp.KERNEL32.dll_ExitThread]
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x3c]
jle 0x100371cb
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
push esi
setl dl
lea ecx, [ebp - 0xf38]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 0x48bbca63
call fcn.10018ece
xor eax, eax
mov dword [ebp - 4], 7
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10037234
push dword [ebp - 0x20]
lea ecx, [ebp - 0xf38]
call fcn.10018f3b
push 5
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10037217
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10037247
push eax
push eax
call ebx
mov dword [ebp - 0x20], 0xfffffff6
jmp 0x10037267
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
dec dword [ebp - 0x10]
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffef
lea ecx, [ebp - 0xf38]
je 0x10037250
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10018f36
mov dword [ebp - 0x20], 0x48bbca63
lea ecx, [ebp - 0xc20]
push esi
call fcn.10018ece
xor eax, eax
mov dword [ebp - 4], 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100372bf
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc20]
call fcn.10018f3b
push 5
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100372a2
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x100372cc
push eax
push eax
call ebx
mov dword [ebp - 0x20], 0xfffffff6
jmp 0x100372ec
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
dec dword [ebp - 0x10]
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffef
lea ecx, [ebp - 0xc20]
je 0x100372d5
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10018f36
xor esi, esi
lea ecx, [ebp - 0x108]
inc esi
push esi
call fcn.10018ece
push 9
pop eax
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x400]
mov dword [ebp - 4], eax
call fcn.10018ece
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10037353
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x80], 0x624039b
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10037338
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1003737f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x108]
call fcn.10018f3b
mov dword [eax], 0xb743d837
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x1003735b
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100373a1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x400]
call fcn.10018f3b
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10037387
xor eax, eax
push eax
lea ecx, [ebp - 0x108]
call fcn.10018f3b
and dword [eax], 0
jmp 0x100375a7
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x48], 0x967684ab
push eax
call fcn.10018f3b
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x80]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffffe
jle 0x10037599
push 2
pop eax
push eax
lea ecx, [ebp - 0xe00]
call fcn.10018ece
mov byte [ebp - 4], 0xb
or eax, 0xffffffff
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003741d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11a0], 0xec01
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10037405
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ebx
jmp 0x1003743c
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe00]
call fcn.10018f3b
mov dword [eax], 0xb14151c8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10037425
push ebx
lea ecx, [ebp - 0x400]
call fcn.10018f3b
mov ecx, dword [ebp - 0x80]
mov dword [eax], ecx
lea ecx, [ebp - 0x108]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0x1198]
xor edx, edx
cmp ecx, dword [eax]
setne dl
cmp dword [ebp - 0x1c], edx
jle 0x1003747c
xor eax, eax
cmp dword [ebp - 0x80], eax
je 0x1003747e
mov eax, esi
xor ebx, ebx
lea ecx, [ebp - 0xe00]
cmp eax, esi
push esi
setne bl
call fcn.10018f3b
mov dword [eax], ebx
test ebx, ebx
je 0x100374b8
xor eax, eax
lea ecx, [ebp - 0x108]
push eax
call fcn.10018f3b
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x80], 0
je 0x100374b8
xor eax, eax
xor esi, esi
inc esi
lea ecx, [eax + 1]
jmp 0x100374bc
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x1c]
imul eax, ecx
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x100374d1
cmp dword [ebp - 0x1c], eax
jne 0x100374d3
mov esi, eax
push eax
lea ecx, [ebp - 0x108]
call fcn.10018f3b
xor ecx, ecx
mov ebx, 0xffff
cmp esi, 0x7cd95329
setne cl
xor edx, edx
cmp ecx, ebx
setne dl
xor ecx, ecx
cmp edx, dword [eax]
setge cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x108]
mov eax, dword [ebp - 0x48]
xor eax, eax
push eax
call fcn.10018f3b
xor eax, eax
lea ecx, [ebp - 0x108]
push eax
call fcn.10018f3b
xor esi, esi
xor edx, edx
inc esi
cmp dword [eax], esi
mov eax, dword [ebp - 0x1198]
sete dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x108]
push eax
call fcn.10018f3b
mov edx, dword [ebp - 0x48]
xor ebx, ebx
mov ecx, dword [ebp - 0x80]
cmp edx, ecx
push 2
mov eax, dword [eax]
setge bl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x80]
cmp ebx, eax
pop eax
setne cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x400]
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 4], 0xa
mov dword [eax], ecx
lea ecx, [ebp - 0xe00]
call fcn.10018f36
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffe
push 3
pop ebx
jg 0x100373df
xor eax, eax
push eax
lea ecx, [ebp - 0x108]
call fcn.10018f3b
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x108]
push eax
call fcn.10018f3b
lea ecx, [ebp - 0x108]
cmp dword [eax], 0
jge 0x100373b5
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
xor eax, eax
push eax
call fcn.10018f3b
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x400]
call fcn.10018f3b
mov eax, dword [ebp - 0x80]
lea ecx, [ebp - 0x400]
push ebx
call fcn.10018f3b
mov ecx, dword [ebp - 0x80]
xor edx, edx
cmp ecx, esi
setge dl
sub edx, dword [eax]
je 0x10037607
xor eax, eax
cmp dword [ebp - 0x80], eax
je 0x10037609
jmp 0x1003760b
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x108]
call fcn.10018f3b
mov ecx, dword [ebp - 0x34]
xor edx, edx
cmp esi, ecx
lea ecx, [ebp - 0x108]
setle dl
xor ebx, ebx
cmp edx, dword [eax]
setge bl
xor eax, eax
push eax
call fcn.10018f3b
push 2
lea ecx, [ebp - 0x400]
mov esi, dword [eax]
pop eax
push eax
add esi, ebx
call fcn.10018f3b
xor ebx, ebx
lea ecx, [ebp - 0x400]
push 2
cmp esi, dword [eax]
pop esi
sete bl
push esi
sub ebx, 6
call fcn.10018f3b
lea ecx, [ebp - 0x400]
mov dword [eax], ebx
call fcn.10018f36
or eax, 0xffffffff
lea ecx, [ebp - 0x108]
mov dword [ebp - 4], eax
call fcn.10018f36
xor ebx, ebx
mov dword [ebp - 0x50], 0x8ef6
inc ebx
lea ecx, [ebp - 0x950]
push ebx
call fcn.10018ece
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x100376ce
push dword [ebp - 0x20]
lea ecx, [ebp - 0x950]
call fcn.10018f3b
mov dword [eax], 0x1713b910
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x100376aa
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x10037732
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10037705
push eax
push 0x25a3
push 0x503
push 0x5b2
push 0x229a
push 0x2138
push 0x258e
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x950]
call fcn.10018f3b
push dword [ebp - 0x24]
lea ecx, [ebp - 0x950]
mov esi, eax
call fcn.10018f3b
mov ecx, dword [esi]
push 0
mov dword [eax], ecx
dec dword [ebp - 0x24]
pop eax
jns 0x100376d6
push 2
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0x950]
mov dword [ebp - 4], eax
call fcn.10018f36
mov dword [ebp - 0x10], 0x210e164c
lea ecx, [ebp - 0x78c]
mov dword [ebp - 0x20], 0xd8cb
or eax, 0xffffffff
mov dword [ebp - 0x10], 0xfffa
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x48], 0x6a71
push esi
call fcn.10018ece
push 4
lea ecx, [ebp - 0x854]
mov dword [ebp - 4], 0xd
call fcn.10018ece
mov byte [ebp - 4], 0xe
push 0xfffffffffffffff8
mov dword [ebp - 0x28], 4
pop eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100377bb
push dword [ebp - 0x18]
lea ecx, [ebp - 0x78c]
call fcn.10018f3b
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100377a0
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x100377e3
push dword [ebp - 0x18]
lea ecx, [ebp - 0x854]
call fcn.10018f3b
mov dword [eax], 0xb16aac89
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100377c4
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10037803
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5c4], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100377eb
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10037816
mov dword [ebp - 0x10], 6
cmp dword [ebp - 0x10], eax
je 0x10037816
mov eax, ebx
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x10037891
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0x4c20
setg cl
xor eax, eax
cmp ecx, 0x718e
setge al
sub eax, 0xa140
je 0x1003785a
push esi
lea ecx, [ebp - 0x854]
call fcn.10018f3b
cmp dword [eax], 0
je 0x1003785a
xor eax, eax
xor ebx, ebx
inc ebx
lea esi, [eax + 1]
jmp 0x1003785e
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x78c]
push ebx
call fcn.10018f3b
mov dword [ebp - 0x40], esi
lea ecx, [ebp - 0x854]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
push 2
pop esi
push esi
call fcn.10018f3b
cmp dword [eax], 0
jne 0x10037891
xor eax, eax
jmp 0x10037893
mov eax, ebx
imul eax, eax, 0x79a982ff
lea ecx, [ebp - 0x78c]
push ebx
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 0x40], 0xfff9
mov eax, dword [ebp - 0x5c4]
call fcn.10018f3b
mov eax, dword [ebp - 0x40]
xor ebx, ebx
xor eax, eax
mov ecx, 0xffff
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, ecx
push esi
setne bl
lea ecx, [ebp - 0x854]
sub ebx, 0xdb126295
neg ebx
sbb ebx, ebx
inc ebx
imul ebx, dword [ebp - 0x48]
neg ebx
sbb ebx, ebx
neg ebx
call fcn.10018f3b
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x5c4]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 4
jae 0x10037922
xor eax, eax
lea ecx, [ebp - 0x78c]
inc eax
push eax
call fcn.10018f3b
mov eax, dword [ebp - 0x5c4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1003793f
push eax
call dword [sym.imp.COMDLG32.dll_FindTextW]
lea ecx, [ebp - 0x854]
call fcn.10018f36
or eax, 0xffffffff
lea ecx, [ebp - 0x78c]
mov dword [ebp - 4], eax
call fcn.10018f36
mov dword [ebp - 0x48], 0x90d29729
mov eax, 0xffff
mov dword [ebp - 0x40], eax
xor ebx, ebx
xor eax, eax
inc ebx
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0xe8cff0ea
mov dword [ebp - 0x48], 0x3a4c924b
mov dword [ebp - 0x24], 0xf
cmp dword [ebp - 0x24], 0xfffffff2
jl 0x10037a7e
push esi
lea ecx, [ebp - 0x238]
call fcn.10018ece
mov dword [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x28], 0x24b2
mov dword [ebp - 0x20], eax
jmp 0x100379c4
push dword [ebp - 0x20]
call fcn.10018f3b
mov dword [eax], 6
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x238]
cmp dword [ebp - 0x20], esi
jl 0x100379b3
push ebx
call fcn.10018f3b
push ebx
lea ecx, [ebp - 0x238]
call fcn.10018f3b
push ebx
lea ecx, [ebp - 0x238]
and dword [eax], 0
mov eax, dword [ebp - 0x24]
call fcn.10018f3b
push ebx
lea ecx, [ebp - 0x238]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
call fcn.10018f3b
push ebx
lea ecx, [ebp - 0x238]
call fcn.10018f3b
push ebx
lea ecx, [ebp - 0x238]
call fcn.10018f3b
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x238]
push ebx
call fcn.10018f3b
push ebx
lea ecx, [ebp - 0x238]
call fcn.10018f3b
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x238]
xor eax, eax
push eax
call fcn.10018f3b
push ebx
lea ecx, [ebp - 0x238]
mov esi, eax
call fcn.10018f3b
mov ecx, dword [esi]
mov dword [eax], ecx
or eax, 0xffffffff
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], eax
call fcn.10018f36
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff2
push 2
pop esi
jge 0x10037992
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10037a95
push 0x2668
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10037ab5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x15a8], 0x209a488d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10037a9d
xor eax, eax
mov dword [ebp - 0x10], 7
or ecx, 0xffffffff
mov dword [ebp - 0x2c], 0x42bb
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10037af2
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8d8], 0x1f2c29a3
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10037ad9
xor eax, eax
cmp dword [ebp - 0x8cc], eax
je 0x10037c39
mov dword [ebp - 0x24], 0x91df82
lea ecx, [ebp - 0xc38]
mov dword [ebp - 0x48], 3
push ebx
call fcn.10018ece
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x28], 0xaedf47f2
mov dword [ebp - 0x20], eax
jmp 0x10037b43
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc38]
call fcn.10018f3b
push 5
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x20]
xor eax, eax
inc eax
cmp dword [ebp - 0x20], eax
jl 0x10037b2d
imul eax, dword [ebp - 0x24], 0xfa55
cmp eax, dword [ebp - 0x24]
jle 0x10037b64
xor eax, eax
cmp dword [ebp - 0x8d8], eax
je 0x10037b66
inc eax
jmp 0x10037b66
xor eax, eax
imul ecx, eax, 0xf6a0
xor edx, edx
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
mov esi, dword [ebp - 0x8cc]
lea ecx, [ebp - 0xc38]
setl dl
xor eax, eax
push eax
add esi, edx
call fcn.10018f3b
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
add eax, esi
je 0x10037ba7
xor eax, eax
cmp dword [ebp - 0x8cc], eax
je 0x10037ba9
lea edx, [eax + 1]
jmp 0x10037bab
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edx
setne cl
imul ecx, dword [ebp - 0x8d0]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xc5a74d4b
setne al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x10], eax
jl 0x10037be1
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10037beb
jmp 0x10037be3
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10037beb
xor eax, eax
inc eax
mov edx, dword [ebp - 0x24]
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x8cc]
cmp edx, eax
setl cl
or ebx, 0xffffffff
xor eax, eax
cmp ecx, ebx
jle 0x10037c11
cmp dword [ebp - 0x48], eax
je 0x10037c11
lea ecx, [eax + 1]
jmp 0x10037c13
mov ecx, eax
mov eax, dword [ebp - 0x2c]
add eax, ecx
lea ecx, [ebp - 0xc38]
imul eax, eax, 0x90ba
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
call fcn.10018f36
xor eax, eax
jmp 0x10037c9e
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov dword [ebp - 0x34], 0xda4adcf8
mov eax, dword [ebp - 0x8d4]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
inc edx
cmp edx, eax
setg cl
cmp dword [ebp - 0x28], ecx
jle 0x10037c6a
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
jmp 0x10037c87
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10037c89
push eax
push 0x1bca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10037c9b
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
xor eax, eax
or ebx, 0xffffffff
mov byte [ebp - 0x11], al
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x34], 0x16580849
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10037cc6
push 0x1464
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x3ffe0
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
sub edx, eax
mov eax, dword [ebp - 0x34]
cmp eax, edx
setge cl
mov dword [ebp - 0x28], ecx
cmp byte [ebp - 0x11], 0
je 0x10037d0c
xor eax, eax
push eax
call edi
xor eax, eax
mov dword [ebp - 0x24], eax
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], 0xc902dafb
mov dword [ebp - 0x48], 0x53423637
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10037d40
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jne 0x10037d3e
xor eax, eax
lea edx, [eax + 1]
jmp 0x10037d42
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp eax, ebx
mov eax, dword [ebp - 0x3c]
setle dl
xor ecx, ecx
cmp eax, edx
setne cl
dec ecx
je 0x10037df1
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10037d87
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10037f85
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0xe88
push eax
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 3
pop esi
or ebx, 0xffffffff
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x10037f8f
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
sub eax, 0xd4a1
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x40]
jg 0x10037f8d
xor eax, eax
lea edx, [eax + 1]
jmp 0x10037f91
xor ecx, ecx
mov dword [ebp - 0x38], 0x7c7a
xor ebx, ebx
inc ebx
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x38]
cmp eax, 0xa720
push 5
setg cl
pop eax
add ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
dec edx
neg edx
push 3
sbb edx, edx
xor ecx, ecx
add edx, 0xfffffff9
cmp edx, eax
mov eax, dword [ebp - 0x38]
pop esi
setge cl
xor edx, edx
cmp ecx, esi
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x38]
jne 0x10037edb
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10037e77
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf2c], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10037e66
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xf24]
jle 0x10037ea8
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp eax, 0xa81f
setg cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0xf24], eax
je 0x10037eaa
mov eax, ebx
jmp 0x10037eaa
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xf24]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
jmp 0x10037daf
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x10037f76
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xe
jge 0x10037f73
push 2
pop eax
push eax
lea ecx, [ebp - 0x103c]
call fcn.10018ece
xor eax, eax
mov dword [ebp - 4], 0x11
push 2
mov dword [ebp - 0x20], eax
pop edx
cmp dword [ebp - 0x20], edx
jge 0x10037f38
push edx
pop ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x103c]
call fcn.10018f3b
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10037f17
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x24], eax
jmp 0x10037f52
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10037f4f
push eax
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10037f3d
or eax, 0xffffffff
lea ecx, [ebp - 0x103c]
mov dword [ebp - 4], eax
call fcn.10018f36
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xe
jl 0x10037ef2
xor eax, eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffec
jg 0x10037ee5
jmp 0x10037daf
push 3
pop esi
jmp 0x10037db2
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x50]
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x40]
jle 0x10037fa3
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
push esi
setl dl
lea ecx, [ebp - 0xc50]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 0x48bbca63
call fcn.10018ece
xor eax, eax
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1003800c
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc50]
call fcn.10018f3b
push 5
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10037fef
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003801d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x20], 0xfffffff6
jmp 0x1003803d
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
dec dword [ebp - 0x10]
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffef
lea ecx, [ebp - 0xc50]
je 0x10038026
mov dword [ebp - 4], ebx
call fcn.10018f36
mov dword [ebp - 0x18], 0x5d16df25
xor eax, eax
mov dword [ebp - 0x24], 0x42573927
mov dword [ebp - 0x40], 0xb6b7be2d
push 2
mov dword [ebp - 0x20], eax
pop ebx
cmp dword [ebp - 0x20], ebx
jge 0x1003808b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1cc], 0x36ccb036
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10038073
xor eax, eax
mov dword [ebp - 0x18], 0x24a8c6a5
mov dword [ebp - 0x18], 0x13
cmp dword [ebp - 0x18], 9
jle 0x1003835e
xor ecx, ecx
inc ecx
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x38], 0x4c19fd8d
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ecx
jg 0x1003824b
mov dword [ebp - 0x10], 6
mov dword [ebp - 0x38], 0xe2e4ed3
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x1cc], 0x4057
je 0x10038177
or eax, 0xffffffff
xor edx, edx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1cc]
cmp ecx, eax
setl dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c8]
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setg dl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x1cc]
cmp edx, eax
setne bl
neg ebx
dec ebx
neg ebx
sbb ebx, ebx
inc ebx
sub ebx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
mov eax, dword [ebp + eax*4 - 0x1cc]
cmp eax, ebx
mov eax, dword [ebp - 0x30]
setl cl
sub ecx, dword [ebp + eax*4 - 0x1cc]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
inc eax
cmp ecx, eax
jbe 0x10038179
xor eax, eax
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x460]
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0xfffffff9
cmp dword [ebp - 0x40], 0xc
jg 0x10038239
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x48], 0x4764fe60
mov dword [ebp - 0x28], 0x275a8055
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jg 0x1003822c
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x460]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x458]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x460]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x460], 6
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, ebx
mov eax, dword [ebp - 0x30]
setge cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
cmp edx, eax
mov eax, dword [ebp - 0x30]
setne cl
mov dword [ebp + eax*4 - 0x458], ecx
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jle 0x100381ba
xor eax, eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xc
jle 0x100381a4
inc dword [ebp - 0x30]
xor ecx, ecx
inc ecx
push 0
pop eax
cmp dword [ebp - 0x30], ecx
jle 0x100380c0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x29
je 0x10038351
mov dword [ebp - 0x10], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x20], 0xd5126306
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
sbb ecx, ecx
neg ecx
imul ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
imul ecx, dword [ebp - 0x20]
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], eax
je 0x100382a9
cmp dword [ebp - 0x40], eax
je 0x100382a9
lea esi, [eax + 1]
jmp 0x100382ab
mov esi, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp ecx, esi
setg dl
xor ebx, ebx
cmp edx, eax
setne bl
xor ecx, ecx
add ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
cmp ebx, eax
setle cl
xor eax, eax
cmp eax, ecx
mov eax, dword [ebp - 0x30]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
dec dword [ebp - 0x10]
cmp eax, edx
je 0x100382f9
inc ecx
mov eax, ecx
jmp 0x100382fc
xor eax, eax
inc ecx
cmp eax, 0xfff7
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x33
jle 0x1003833f
push 2
pop ebx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x10038336
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1cc], 0
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1003831e
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x33
jg 0x10038316
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x29
jne 0x10038258
push 3
xor eax, eax
pop esi
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 9
jg 0x100380a6
xor esi, esi
mov dword [ebp - 0x40], 7
inc esi
lea ecx, [ebp - 0x220]
push esi
call fcn.10018ece
mov dword [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0x360abed9
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100383b6
push dword [ebp - 0x18]
lea ecx, [ebp - 0x220]
call fcn.10018f3b
mov dword [eax], 0x34111d01
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10038392
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100383db
push 5
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x174], ecx
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100383c1
xor esi, esi
xor eax, eax
inc esi
push eax
lea ecx, [ebp - 0x220]
call fcn.10018f3b
mov ecx, dword [ebp - 0x40]
xor edx, edx
neg ecx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x40]
setle dl
sub eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x40]
cmp eax, edx
jl 0x1003841c
xor eax, eax
lea ecx, [ebp - 0x220]
push eax
call fcn.10018f3b
cmp dword [eax], 0
jne 0x1003841c
mov eax, dword [ebp - 0x40]
xor eax, eax
lea ecx, [ebp - 0x220]
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0x40]
mov edx, esi
sub edx, ecx
xor ebx, ebx
lea ecx, [ebp - 0x220]
cmp edx, dword [eax]
setg bl
xor eax, eax
push eax
call fcn.10018f3b
xor ecx, ecx
cmp ebx, dword [eax]
setg cl
xor eax, eax
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x220]
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x174]
sete dl
sub edx, 7
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x11fc
setle al
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10038517
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x220]
mov eax, dword [ebp - 0x174]
xor eax, eax
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0x174]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x220]
setne bl
xor eax, eax
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp ebx, ecx
setle dl
xor ecx, ecx
cmp edx, 0xfffffff9
setne cl
xor edx, edx
cmp ecx, 0x94ad
lea ecx, [ebp - 0x220]
setg dl
xor ebx, ebx
cmp edx, dword [eax]
setle bl
xor eax, eax
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ebx, ecx
sete dl
cmp edx, dword [eax]
jg 0x10038515
xor eax, eax
xor esi, esi
inc esi
lea edx, [eax + 1]
jmp 0x10038519
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp eax, edx
setg cl
cmp ecx, 0x6fbc
jge 0x10038542
xor eax, eax
lea ecx, [ebp - 0x220]
push eax
call fcn.10018f3b
cmp dword [eax], 0
jne 0x10038542
xor eax, eax
jmp 0x10038544
mov eax, esi
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x220]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor eax, eax
push eax
call fcn.10018f3b
xor ecx, ecx
mov edx, esi
sub edx, dword [eax]
mov eax, dword [ebp - 0x40]
cmp edx, eax
setg cl
or eax, 0xffffffff
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], eax
call fcn.10018f36
push esi
lea ecx, [ebp - 0x120]
call fcn.10018ece
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x40c]
mov dword [ebp - 4], 0x14
call fcn.10018ece
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100385d1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8c], 0x624039b
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100385b3
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100385fd
push dword [ebp - 0x18]
lea ecx, [ebp - 0x120]
call fcn.10018f3b
mov dword [eax], 0xb743d837
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100385d9
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003861f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x40c]
call fcn.10018f3b
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10038605
xor eax, eax
push eax
lea ecx, [ebp - 0x120]
call fcn.10018f3b
and dword [eax], 0
jmp 0x10038837
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x48], 0x967684ab
push eax
call fcn.10018f3b
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x8c]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffffe
jle 0x10038829
push 2
pop eax
push eax
lea ecx, [ebp - 0xe18]
call fcn.10018ece
mov byte [ebp - 4], 0x16
or eax, 0xffffffff
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003869e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1140], 0xec01
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10038686
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ebx
jmp 0x100386bd
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe18]
call fcn.10018f3b
mov dword [eax], 0xb14151c8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100386a6
push ebx
lea ecx, [ebp - 0x40c]
call fcn.10018f3b
mov ecx, dword [ebp - 0x8c]
mov dword [eax], ecx
lea ecx, [ebp - 0x120]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0x1138]
xor edx, edx
cmp ecx, dword [eax]
setne dl
cmp dword [ebp - 0x1c], edx
jle 0x10038703
xor eax, eax
cmp dword [ebp - 0x8c], eax
je 0x10038705
mov eax, esi
xor ebx, ebx
lea ecx, [ebp - 0xe18]
cmp eax, esi
push esi
setne bl
call fcn.10018f3b
mov dword [eax], ebx
test ebx, ebx
je 0x10038742
xor eax, eax
lea ecx, [ebp - 0x120]
push eax
call fcn.10018f3b
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x8c], 0
je 0x10038742
xor eax, eax
xor esi, esi
inc esi
lea ecx, [eax + 1]
jmp 0x10038746
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x1c]
imul eax, ecx
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1003875b
cmp dword [ebp - 0x1c], eax
jne 0x1003875d
mov esi, eax
push eax
lea ecx, [ebp - 0x120]
call fcn.10018f3b
xor ecx, ecx
mov ebx, 0xffff
cmp esi, 0x7cd95329
setne cl
xor edx, edx
cmp ecx, ebx
setne dl
xor ecx, ecx
cmp edx, dword [eax]
setge cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x120]
mov eax, dword [ebp - 0x48]
xor eax, eax
push eax
call fcn.10018f3b
xor eax, eax
lea ecx, [ebp - 0x120]
push eax
call fcn.10018f3b
xor esi, esi
xor edx, edx
inc esi
cmp dword [eax], esi
mov eax, dword [ebp - 0x1138]
sete dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x120]
push eax
call fcn.10018f3b
mov edx, dword [ebp - 0x48]
xor ebx, ebx
mov ecx, dword [ebp - 0x8c]
cmp edx, ecx
push 2
mov eax, dword [eax]
setge bl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x8c]
cmp ebx, eax
pop eax
setne cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x40c]
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
mov dword [eax], ecx
lea ecx, [ebp - 0xe18]
call fcn.10018f36
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffe
push 3
pop ebx
jg 0x10038660
xor eax, eax
push eax
lea ecx, [ebp - 0x120]
call fcn.10018f3b
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x120]
push eax
call fcn.10018f3b
lea ecx, [ebp - 0x120]
cmp dword [eax], 0
jge 0x10038633
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
xor eax, eax
push eax
call fcn.10018f3b
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x40c]
call fcn.10018f3b
mov eax, dword [ebp - 0x8c]
lea ecx, [ebp - 0x40c]
push ebx
call fcn.10018f3b
mov ecx, dword [ebp - 0x8c]
xor edx, edx
cmp ecx, esi
setge dl
sub edx, dword [eax]
je 0x100388a6
xor eax, eax
cmp dword [ebp - 0x8c], eax
je 0x100388a8
jmp 0x100388aa
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x120]
call fcn.10018f3b
mov ecx, dword [ebp - 0x34]
xor edx, edx
cmp esi, ecx
lea ecx, [ebp - 0x120]
setle dl
xor ebx, ebx
cmp edx, dword [eax]
setge bl
xor eax, eax
push eax
call fcn.10018f3b
push 2
lea ecx, [ebp - 0x40c]
mov esi, dword [eax]
pop eax
push eax
add esi, ebx
call fcn.10018f3b
xor ebx, ebx
lea ecx, [ebp - 0x40c]
push 2
cmp esi, dword [eax]
pop esi
sete bl
push esi
sub ebx, 6
call fcn.10018f3b
lea ecx, [ebp - 0x40c]
mov dword [eax], ebx
call fcn.10018f36
or eax, 0xffffffff
lea ecx, [ebp - 0x120]
mov dword [ebp - 4], eax
call fcn.10018f36
xor ebx, ebx
lea ecx, [ebp - 0x974]
inc ebx
push ebx
call fcn.10018ece
xor eax, eax
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10038966
push dword [ebp - 0x20]
lea ecx, [ebp - 0x974]
call fcn.10018f3b
mov dword [eax], 0x1713b910
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x10038942
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x100389ca
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003899d
push eax
push 0x25a3
push 0x503
push 0x5b2
push 0x229a
push 0x2138
push 0x258e
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x974]
call fcn.10018f3b
push dword [ebp - 0x24]
lea ecx, [ebp - 0x974]
mov esi, eax
call fcn.10018f3b
mov ecx, dword [esi]
push 0
mov dword [eax], ecx
dec dword [ebp - 0x24]
pop eax
jns 0x1003896e
push 2
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0x974]
mov dword [ebp - 4], eax
call fcn.10018f36
mov dword [ebp - 0x50], 0x8ef6
lea ecx, [ebp - 0x7a4]
mov dword [ebp - 0x20], 0xd8cb
or eax, 0xffffffff
mov dword [ebp - 0x10], 0xfffa
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x48], 0x6a71
push esi
call fcn.10018ece
push 4
lea ecx, [ebp - 0x8c8]
mov dword [ebp - 4], 0x18
call fcn.10018ece
mov byte [ebp - 4], 0x19
push 0xfffffffffffffff8
mov dword [ebp - 0x28], 4
pop eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10038a53
push dword [ebp - 0x18]
lea ecx, [ebp - 0x7a4]
call fcn.10018f3b
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10038a38
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10038a7b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x8c8]
call fcn.10018f3b
mov dword [eax], 0xb16aac89
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10038a5c
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10038a9b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x594], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10038a83
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10038aae
mov dword [ebp - 0x10], 6
cmp dword [ebp - 0x10], eax
je 0x10038aae
mov eax, ebx
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x10038b29
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0x4c20
setg cl
xor eax, eax
cmp ecx, 0x718e
setge al
sub eax, 0xa140
je 0x10038af2
push esi
lea ecx, [ebp - 0x8c8]
call fcn.10018f3b
cmp dword [eax], 0
je 0x10038af2
xor eax, eax
xor ebx, ebx
inc ebx
lea esi, [eax + 1]
jmp 0x10038af6
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x7a4]
push ebx
call fcn.10018f3b
mov dword [ebp - 0x40], esi
lea ecx, [ebp - 0x8c8]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
push 2
pop esi
push esi
call fcn.10018f3b
cmp dword [eax], 0
jne 0x10038b29
xor eax, eax
jmp 0x10038b2b
mov eax, ebx
imul eax, eax, 0x79a982ff
lea ecx, [ebp - 0x7a4]
push ebx
mov dword [ebp - 0x594], eax
mov dword [ebp - 0x40], 0xfff9
mov eax, dword [ebp - 0x594]
call fcn.10018f3b
mov eax, dword [ebp - 0x40]
xor ebx, ebx
xor eax, eax
mov ecx, 0xffff
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, ecx
push esi
setne bl
lea ecx, [ebp - 0x8c8]
sub ebx, 0xdb126295
neg ebx
sbb ebx, ebx
inc ebx
imul ebx, dword [ebp - 0x48]
neg ebx
sbb ebx, ebx
neg ebx
call fcn.10018f3b
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x594]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
xor ebx, ebx
inc ebx
cmp ecx, 4
jae 0x10038bba
push ebx
lea ecx, [ebp - 0x7a4]
call fcn.10018f3b
mov eax, dword [ebp - 0x594]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10038bd7
push eax
call dword [sym.imp.COMDLG32.dll_FindTextW]
lea ecx, [ebp - 0x8c8]
call fcn.10018f36
or eax, 0xffffffff
lea ecx, [ebp - 0x7a4]
mov dword [ebp - 4], eax
call fcn.10018f36
mov dword [ebp - 0x10], 0x210e164c
lea ecx, [ebp - 0x310]
push esi
call fcn.10018ece
mov dword [ebp - 4], 0x1a
lea eax, [ebp - 0x1384]
movdqa xmm0, xmmword [0x10007b50]
lea ecx, [ebp - 0x1578]
push eax
lea eax, [ebp - 0x1394]
mov dword [ebp - 0x38], 0xeaa32b1c
mov dword [ebp - 0x48], 6
push eax
movdqu xmmword [ebp - 0x1394], xmm0
call fcn.10018f4a
lea ecx, [ebp - 0x258]
mov esi, eax
call fcn.10008b23
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x98c]
push dword [esi]
call fcn.10018f10
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xa94]
mov dword [ebp - 0x10], 0x8770ce40
push ebx
call fcn.10018ece
mov byte [ebp - 4], 0x1c
xor eax, eax
mov dword [ebp - 0x34], 0x1265a1b
push 2
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x10038caf
push dword [ebp - 0x18]
lea ecx, [ebp - 0x310]
call fcn.10018f3b
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10038c91
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10038cda
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa94]
call fcn.10018f3b
or ecx, 0xffffffff
mov dword [eax], ecx
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10038cb7
xor ebx, ebx
xor eax, eax
inc ebx
push 3
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x10038cfd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc68], 0x57f02caa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10038ce5
xor eax, eax
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], eax
jl 0x10038fb7
mov dword [ebp - 0x28], 0x89a5a40f
lea ecx, [ebp - 0x4bc]
push esi
call fcn.10018ece
mov byte [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x40], eax
or ecx, 0xffffffff
mov dword [ebp - 0x1c], 0x5cab4306
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x20], eax
jmp 0x10038d51
push dword [ebp - 0x20]
lea ecx, [ebp - 0x4bc]
call fcn.10018f3b
mov dword [eax], 0x19d81479
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10038d3a
push ebx
lea ecx, [ebp - 0x310]
call fcn.10018f3b
cmp dword [eax], 0
je 0x10038e28
push esi
lea ecx, [ebp - 0x98c]
call fcn.10018f3b
mov esi, eax
lea ecx, [ebp - 0x310]
xor eax, eax
push eax
call fcn.10018f3b
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [esi]
test ecx, ecx
je 0x10038de4
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x310]
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x38]
call fcn.10018f3b
push 3
lea ecx, [ebp - 0x98c]
mov dword [eax], 0x99b9
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x48]
call fcn.10018f3b
push 2
pop eax
push eax
lea ecx, [ebp - 0x4bc]
call fcn.10018f3b
mov esi, eax
lea ecx, [ebp - 0x4bc]
xor eax, eax
push eax
call fcn.10018f3b
mov ecx, dword [eax]
mov eax, dword [ebp - 0x24]
mov dword [esi], ecx
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xa94]
xor eax, eax
push eax
call fcn.10018f3b
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10038e08
push ebx
lea ecx, [ebp - 0x4bc]
call fcn.10018f3b
push ebx
lea ecx, [ebp - 0x4bc]
call fcn.10018f3b
mov ecx, dword [ebp - 0x24]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x38]
jle 0x10038e28
xor eax, eax
xor ebx, ebx
inc ebx
lea esi, [eax + 1]
jmp 0x10038e2c
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xa94]
call fcn.10018f3b
cmp esi, dword [eax]
jle 0x10038f86
mov dword [ebp - 0x20], 0x3e0c
xor eax, eax
push 3
pop esi
mov dword [ebp - 0xb58], esi
mov dword [ebp - 0xb54], esi
mov dword [ebp - 0xb50], esi
mov dword [ebp - 0xb4c], esi
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ebx
jg 0x10038f99
mov dword [ebp - 0x2c], 0xfffffff7
lea ecx, [ebp - 0x310]
push dword [ebp - 0x38]
call fcn.10018f3b
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x310]
push dword [ebp - 0x40]
call fcn.10018f3b
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x310]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x34]
push dword [ebp - 0x40]
call fcn.10018f3b
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x310]
mov eax, dword [ebp - 0x20]
dec esi
push dword [ebp - 0x40]
neg esi
sbb esi, esi
neg esi
sub esi, eax
call fcn.10018f3b
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x2c]
cmp esi, eax
setg cl
xor eax, eax
mov dword [ebp - 0xc64], ecx
cmp dword [ebp - 0x20], eax
je 0x10038eed
mov esi, ebx
cmp dword [ebp - 0xb50], eax
jne 0x10038eef
mov esi, eax
push eax
lea ecx, [ebp - 0x98c]
call fcn.10018f3b
xor ecx, ecx
or edx, 0xffffffff
cmp esi, edx
setle cl
sub ecx, dword [eax]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
add eax, ecx
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0x49fec891
setle bl
xor eax, eax
push eax
call fcn.10018f3b
mov ecx, dword [ebp - 0xb50]
mov dword [eax], ebx
mov eax, dword [ebp - 0x24]
add eax, ebx
add ecx, eax
mov eax, 0xffff
neg ecx
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc64]
sub ecx, 0x4231
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xc64], eax
xor eax, eax
inc dword [ebp - 0x40]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x40], eax
jle 0x10038e70
jmp 0x10038f94
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
jne 0x100371aa
push 3
pop esi
xor eax, eax
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x4bc]
cmp dword [ebp - 0x3c], eax
call fcn.10018f36
dec dword [ebp - 0x38]
push 1
pop ebx
jns 0x10038d09
lea ecx, [ebp - 0xa94]
call fcn.10018f36
lea ecx, [ebp - 0x98c]
call fcn.10018f36
or esi, 0xffffffff
lea ecx, [ebp - 0x310]
mov dword [ebp - 4], esi
call fcn.10018f36
mov dword [ebp - 0x24], 0xe8cff0ea
mov dword [ebp - 0x48], 0x3a4c924b
mov dword [ebp - 0x24], 0xf
jmp 0x100390da
push 2
pop esi
push esi
lea ecx, [ebp - 0x1fc]
call fcn.10018ece
mov dword [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x28], 0x24b2
mov dword [ebp - 0x20], eax
jmp 0x1003902d
push dword [ebp - 0x20]
call fcn.10018f3b
mov dword [eax], 6
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x1fc]
cmp dword [ebp - 0x20], esi
jl 0x1003901c
push ebx
call fcn.10018f3b
push ebx
lea ecx, [ebp - 0x1fc]
call fcn.10018f3b
push ebx
lea ecx, [ebp - 0x1fc]
and dword [eax], 0
mov eax, dword [ebp - 0x24]
call fcn.10018f3b
push ebx
lea ecx, [ebp - 0x1fc]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
call fcn.10018f3b
push ebx
lea ecx, [ebp - 0x1fc]
call fcn.10018f3b
push ebx
lea ecx, [ebp - 0x1fc]
call fcn.10018f3b
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x1fc]
push ebx
call fcn.10018f3b
push ebx
lea ecx, [ebp - 0x1fc]
call fcn.10018f3b
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x1fc]
xor eax, eax
push eax
call fcn.10018f3b
push ebx
lea ecx, [ebp - 0x1fc]
mov esi, eax
call fcn.10018f3b
mov ecx, dword [esi]
or esi, 0xffffffff
mov dword [ebp - 4], esi
mov dword [eax], ecx
lea ecx, [ebp - 0x1fc]
call fcn.10018f36
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff2
jge 0x10038ff8
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100390fb
push 0x2668
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [ebp - 0x48], 0x90d29729
mov ecx, 0xffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x24], eax
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], 0xc902dafb
mov dword [ebp - 0x48], 0x53423637
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1003913c
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jne 0x1003913a
xor eax, eax
lea edx, [eax + 1]
jmp 0x1003913e
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp eax, esi
mov eax, dword [ebp - 0x3c]
setle dl
xor ecx, ecx
cmp eax, edx
setne cl
dec ecx
je 0x10039232
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10039187
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100391aa
push 0xe88
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 3
xor ebx, ebx
pop esi
inc ebx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
or eax, 0xffffffff
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x2c], 0x42bb
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x100391f8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8f4], 0x1f2c29a3
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x100391df
xor eax, eax
cmp dword [ebp - 0x8e8], eax
je 0x100394d5
mov dword [ebp - 0x24], 0x91df82
lea ecx, [ebp - 0xc80]
mov dword [ebp - 0x48], esi
push ebx
call fcn.10018ece
mov dword [ebp - 4], 0x20
xor eax, eax
mov dword [ebp - 0x28], 0xaedf47f2
mov dword [ebp - 0x20], eax
jmp 0x100393dc
xor ecx, ecx
mov dword [ebp - 0x38], 0x7c7a
xor ebx, ebx
inc ebx
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x38]
cmp eax, 0xa720
push 5
setg cl
pop eax
add ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
dec edx
neg edx
push 3
sbb edx, edx
xor ecx, ecx
add edx, 0xfffffff9
cmp edx, eax
mov eax, dword [ebp - 0x38]
pop esi
setge cl
xor edx, edx
cmp ecx, esi
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x38]
jne 0x1003931c
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x100392b8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xefc], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100392a7
mov eax, dword [ebp - 0xef4]
cmp dword [ebp - 0x18], eax
jle 0x100392e9
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp eax, 0xa81f
setg cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0xef4], eax
je 0x100392eb
mov eax, ebx
jmp 0x100392eb
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xef4]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
jmp 0x100391b0
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x100393b7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xe
jge 0x100393b4
push 2
pop eax
push eax
lea ecx, [ebp - 0x1054]
call fcn.10018ece
xor eax, eax
mov dword [ebp - 4], 0x1f
push 2
mov dword [ebp - 0x20], eax
pop edx
cmp dword [ebp - 0x20], edx
jge 0x10039379
push edx
pop ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1054]
call fcn.10018f3b
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10039358
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x24], eax
jmp 0x10039393
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10039390
push eax
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1003937e
or eax, 0xffffffff
lea ecx, [ebp - 0x1054]
mov dword [ebp - 4], eax
call fcn.10018f36
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xe
jl 0x10039333
xor eax, eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffec
jg 0x10039326
jmp 0x100391b0
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov dword [ebp - 0x34], 0xda4adcf8
mov eax, dword [ebp - 0x8f0]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
inc edx
cmp edx, eax
setg cl
cmp dword [ebp - 0x28], ecx
jle 0x10039506