Function at 0x10033adc
Capabilities:
Clear file content
Create thread
Enumerate gui resources
Get common file path
Get graphical window text
Set registry value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10083f9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1178
call fcn.1007e890
push esi
push edi
mov dword [ebp - 0x1cc], 0xffffffff
mov dword [ebp - 0x388], 0x25062d7b
mov dword [ebp - 0xf48], 0
mov dword [ebp - 0x109c], 0xfce06dfe
mov dword [ebp - 0x10a4], 1
mov dword [ebp - 0x974], 0x5f5dda30
mov dword [ebp - 0x1cc], 0xffffffff
jmp 0x10033b55
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0xfffffff3
jg 0x10033dd0
mov dword [ebp - 0x198], 0x888a
push 4
lea ecx, [ebp - 0xefc]
call fcn.10027b4a
and dword [ebp - 4], 0
mov dword [ebp - 0xaa4], 0xe3bc4aee
mov dword [ebp - 0x10ac], 0xc0e42606
mov dword [ebp - 0x218], 0
jmp 0x10033baa
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 4
jge 0x10033bcc
push dword [ebp - 0x218]
lea ecx, [ebp - 0xefc]
call fcn.10027bb7
mov dword [eax], 0x20bd
jmp 0x10033b9d
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x198], eax
je 0x10033d3f
mov dword [ebp - 0x9f0], 0x105a
mov dword [ebp - 0x198], 0xfffffff5
jmp 0x10033c01
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0xffffffe5
jle 0x10033d3d
mov dword [ebp - 0x94], 0x4b7834d8
mov dword [ebp - 0x94], 0
jmp 0x10033c31
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jg 0x10033c75
mov byte [ebp - 0xda], 0
movzx eax, byte [ebp - 0xda]
test eax, eax
je 0x10033c5b
push 0x104c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push dword [ebp - 0x94]
lea ecx, [ebp - 0xefc]
call fcn.10027bb7
cmp dword [eax], 0
je 0x10033c73
jmp 0x10033c75
jmp 0x10033c24
mov dword [ebp - 0x388], 0xc6076fda
cmp dword [ebp - 0x388], 0
je 0x10033cc1
cmp dword [ebp - 0x94], 0x15fb
jne 0x10033ca0
mov dword [ebp - 0x830], 1
jmp 0x10033ca7
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x830], eax
jge 0x10033cc1
mov dword [ebp - 0x954], 1
jmp 0x10033cc8
and dword [ebp - 0x954], 0
cmp dword [ebp - 0x954], 0
jne 0x10033cdd
mov dword [ebp - 0x95c], 1
jmp 0x10033ce4
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x9f0]
cmp dword [ebp - 0x95c], eax
jl 0x10033cfe
mov dword [ebp - 0x964], 1
jmp 0x10033d05
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x964]
cmp dword [ebp - 0x198], eax
jge 0x10033d25
mov dword [ebp - 0x96c], 1
jmp 0x10033d2c
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0x96c]
mov dword [ebp - 0xaa4], eax
jmp 0x10033bf4
jmp 0x10033daf
mov dword [ebp - 0x1060], 1
mov dword [ebp - 0x2ac], 0
jmp 0x10033d62
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 3
jge 0x10033d7e
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0x1184], 0xefec
jmp 0x10033d55
mov byte [ebp - 0xe8], 0
movzx eax, byte [ebp - 0xe8]
test eax, eax
je 0x10033da5
push 0x57f
push 0x2581
push 0x65f
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [ebp - 0x388], 1
mov eax, dword [ebp - 0x974]
inc eax
mov dword [ebp - 0x974], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xefc]
call fcn.10027bb2
jmp 0x10033b48
mov dword [ebp - 0x1f4], 0xffffffff
mov dword [ebp - 0x3fc], 0x25062d7b
mov dword [ebp - 0x1024], 0
mov dword [ebp - 0xf1c], 0xfce06dfe
mov dword [ebp - 0x1018], 1
mov dword [ebp - 0x44c], 0x5f5dda30
mov dword [ebp - 0x1f4], 0xffffffff
jmp 0x10033e25
mov eax, dword [ebp - 0x1f4]
dec eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0xfffffff3
jg 0x100340a3
mov dword [ebp - 0x1bc], 0x888a
push 4
lea ecx, [ebp - 0xe54]
call fcn.10027b4a
mov dword [ebp - 4], 1
mov dword [ebp - 0xab4], 0xe3bc4aee
mov dword [ebp - 0xf24], 0xc0e42606
mov dword [ebp - 0x220], 0
jmp 0x10033e7d
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 4
jge 0x10033e9f
push dword [ebp - 0x220]
lea ecx, [ebp - 0xe54]
call fcn.10027bb7
mov dword [eax], 0x20bd
jmp 0x10033e70
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0x1bc], eax
je 0x10034012
mov dword [ebp - 0x9f4], 0x105a
mov dword [ebp - 0x1bc], 0xfffffff5
jmp 0x10033ed4
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0xffffffe5
jle 0x10034010
mov dword [ebp - 0xa0], 0x4b7834d8
mov dword [ebp - 0xa0], 0
jmp 0x10033f04
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jg 0x10033f48
mov byte [ebp - 0x194], 0
movzx eax, byte [ebp - 0x194]
test eax, eax
je 0x10033f2e
push 0x104c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push dword [ebp - 0xa0]
lea ecx, [ebp - 0xe54]
call fcn.10027bb7
cmp dword [eax], 0
je 0x10033f46
jmp 0x10033f48
jmp 0x10033ef7
mov dword [ebp - 0x3fc], 0xc6076fda
cmp dword [ebp - 0x3fc], 0
je 0x10033f94
cmp dword [ebp - 0xa0], 0x15fb
jne 0x10033f73
mov dword [ebp - 0x86c], 1
jmp 0x10033f7a
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x86c], eax
jge 0x10033f94
mov dword [ebp - 0x43c], 1
jmp 0x10033f9b
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 0
jne 0x10033fb0
mov dword [ebp - 0x874], 1
jmp 0x10033fb7
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x9f4]
cmp dword [ebp - 0x874], eax
jl 0x10033fd1
mov dword [ebp - 0x444], 1
jmp 0x10033fd8
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0xa0]
add eax, dword [ebp - 0x444]
cmp dword [ebp - 0x1bc], eax
jge 0x10033ff8
mov dword [ebp - 0x884], 1
jmp 0x10033fff
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0xab4], eax
jmp 0x10033ec7
jmp 0x10034082
mov dword [ebp - 0x1088], 1
mov dword [ebp - 0x2b0], 0
jmp 0x10034035
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 3
jge 0x10034051
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0x1178], 0xefec
jmp 0x10034028
mov byte [ebp - 0xea], 0
movzx eax, byte [ebp - 0xea]
test eax, eax
je 0x10034078
push 0x57f
push 0x2581
push 0x65f
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [ebp - 0x3fc], 1
mov eax, dword [ebp - 0x44c]
inc eax
mov dword [ebp - 0x44c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe54]
call fcn.10027bb2
jmp 0x10033e18
mov dword [ebp - 0x1d4], 0xfffffff9
mov dword [ebp - 0xd0c], 5
mov dword [ebp - 0xd08], 5
mov dword [ebp - 0xd04], 5
mov dword [ebp - 0xd00], 5
lea ecx, [ebp - 0x405]
call fcn.1000927a
push eax
lea eax, [ebp - 0xcfc]
push eax
lea eax, [ebp - 0xd0c]
push eax
lea ecx, [ebp - 0x1150]
call fcn.10027bc6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe24]
call fcn.10027b8c
mov dword [ebp - 4], 2
push 1
lea ecx, [ebp - 0xecc]
call fcn.10027b4a
mov byte [ebp - 4], 3
mov dword [ebp - 0x228], 0
jmp 0x1003413b
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jge 0x1003415d
push dword [ebp - 0x228]
lea ecx, [ebp - 0xecc]
call fcn.10027bb7
mov dword [eax], 1
jmp 0x1003412e
cmp dword [ebp - 0x1d4], 0
je 0x1003419e
mov esi, dword [ebp - 0x1d4]
push 1
lea ecx, [ebp - 0xe24]
call fcn.10027bb7
mov dword [eax], esi
mov esi, dword [ebp - 0x1d4]
push 0
lea ecx, [ebp - 0xe24]
call fcn.10027bb7
cmp esi, dword [eax]
jg 0x1003419e
mov dword [ebp - 0x88c], 1
jmp 0x100341a5
and dword [ebp - 0x88c], 0
cmp dword [ebp - 0x88c], 0xfe04
jle 0x100341bd
mov dword [ebp - 0x454], 1
jmp 0x100341c4
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x1d4]
add eax, dword [ebp - 0x454]
je 0x100341e7
cmp dword [ebp - 0x1d4], 0
je 0x100341e7
mov dword [ebp - 0x894], 1
jmp 0x100341ee
and dword [ebp - 0x894], 0
push 0
lea ecx, [ebp - 0xecc]
call fcn.10027bb7
mov ecx, dword [ebp - 0x894]
mov dword [eax], ecx
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x10034224
push 0
push 0xd98
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xecc]
call fcn.10027bb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe24]
call fcn.10027bb2
mov dword [ebp - 0x1a0], 0xf8067e30
mov dword [ebp - 0x45c], 0
push 3
lea ecx, [ebp - 0xe9c]
call fcn.10027b4a
mov dword [ebp - 4], 4
mov dword [ebp - 0x330], 0
jmp 0x10034283
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 3
jge 0x100342a5
push dword [ebp - 0x330]
lea ecx, [ebp - 0xe9c]
call fcn.10027bb7
mov dword [eax], 0x60d2f38d
jmp 0x10034276
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x100342bf
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x1a0], eax
jne 0x100342d9
mov dword [ebp - 0x89c], 1
jmp 0x100342e0
and dword [ebp - 0x89c], 0
mov dword [ebp - 0x45c], 0x9ec4279c
mov eax, dword [ebp - 0x45c]
cmp dword [ebp - 0x89c], eax
jl 0x10034304
mov dword [ebp - 0x46c], 1
jmp 0x1003430b
and dword [ebp - 0x46c], 0
cmp dword [ebp - 0x1a0], 1
jle 0x10034320
mov dword [ebp - 0x464], 1
jmp 0x10034327
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
add eax, 4
cmp dword [ebp - 0x1a0], eax
jle 0x10034344
mov dword [ebp - 0x8a4], 1
jmp 0x1003434b
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x8a4], eax
jle 0x10034365
mov dword [ebp - 0x8ac], 1
jmp 0x1003436c
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x46c]
cmp eax, dword [ebp - 0x8ac]
je 0x10034386
mov dword [ebp - 0x474], 1
jmp 0x1003438d
and dword [ebp - 0x474], 0
mov esi, dword [ebp - 0x474]
sub esi, dword [ebp - 0x1a0]
push 2
lea ecx, [ebp - 0xe9c]
call fcn.10027bb7
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe9c]
call fcn.10027bb2
mov dword [ebp - 0x1ec], 0xffffffff
mov dword [ebp - 0x3e0], 0x25062d7b
mov dword [ebp - 0xf2c], 0
mov dword [ebp - 0x1020], 0xfce06dfe
push 1
lea ecx, [ebp - 0xf78]
call fcn.10027b4a
mov dword [ebp - 4], 5
mov dword [ebp - 0x230], 0
jmp 0x1003440c
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x1003442b
push dword [ebp - 0x230]
lea ecx, [ebp - 0xf78]
call fcn.10027bb7
and dword [eax], 0
jmp 0x100343ff
mov byte [ebp - 0x193], 0
movzx eax, byte [ebp - 0x193]
test eax, eax
je 0x10034447
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x10034465
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf78]
call fcn.10027bb2
mov dword [ebp - 0xf34], 1
mov dword [ebp - 0x80], 0xa48bbca6
mov dword [ebp - 0x80], 3
jmp 0x10034495
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x16
je 0x100346c1
push 1
lea ecx, [ebp - 0x984]
call fcn.10027b4a
mov dword [ebp - 4], 6
mov dword [ebp - 0x100], 0xf6085e07
mov dword [ebp - 0xabc], 0x9031ea06
mov dword [ebp - 0x2b8], 0
jmp 0x100344e0
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 1
jge 0x10034502
push dword [ebp - 0x2b8]
lea ecx, [ebp - 0x984]
call fcn.10027bb7
mov dword [eax], 0x82f80c34
jmp 0x100344d3
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x100], eax
je 0x1003451c
mov dword [ebp - 0x8b4], 1
jmp 0x10034523
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x8b4], eax
jl 0x10034551
push 0
lea ecx, [ebp - 0x984]
call fcn.10027bb7
mov ecx, dword [ebp - 0x100]
cmp dword [eax], ecx
jge 0x10034551
and dword [ebp - 0x47c], 0
jmp 0x1003455b
mov dword [ebp - 0x47c], 1
push 0
lea ecx, [ebp - 0x984]
call fcn.10027bb7
mov ecx, dword [ebp - 0x47c]
sub ecx, 0x2d7a
cmp dword [eax], ecx
jle 0x1003458a
cmp dword [ebp - 0x100], 0
jne 0x1003458a
and dword [ebp - 0x8bc], 0
jmp 0x10034594
mov dword [ebp - 0x8bc], 1
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x8bc], eax
jle 0x100345ae
mov dword [ebp - 0x484], 1
jmp 0x100345b5
and dword [ebp - 0x484], 0
cmp dword [ebp - 0x484], 0
je 0x100345dc
push 0
lea ecx, [ebp - 0x984]
call fcn.10027bb7
cmp dword [eax], 0
je 0x100345dc
mov dword [ebp - 0x8c4], 1
jmp 0x100345e3
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x8c4], eax
jg 0x100345fa
mov dword [ebp - 0x48c], 1
jmp 0x10034601
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x48c], eax
jge 0x10034618
mov dword [ebp - 0x8cc], 1
jmp 0x1003461f
and dword [ebp - 0x8cc], 0
imul eax, dword [ebp - 0x8cc], 0x13bf
cmp eax, dword [ebp - 0x80]
je 0x1003463a
mov dword [ebp - 0x494], 1
jmp 0x10034641
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0x6b37990
jl 0x1003465c
cmp dword [ebp - 0x80], 0
jne 0x1003465c
and dword [ebp - 0x8d4], 0
jmp 0x10034666
mov dword [ebp - 0x8d4], 1
push 0
lea ecx, [ebp - 0x984]
call fcn.10027bb7
mov ecx, dword [ebp - 0x8d4]
mov dword [eax], ecx
cmp dword [ebp - 0x80], 0
je 0x10034698
push 0
lea ecx, [ebp - 0x984]
call fcn.10027bb7
mov eax, dword [eax]
mov dword [ebp - 0x100], eax
jmp 0x100346ad
push 0
lea ecx, [ebp - 0x984]
call fcn.10027bb7
mov eax, dword [eax]
mov dword [ebp - 0xabc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x984]
call fcn.10027bb2
jmp 0x1003448e
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x100346eb
push 0
push 0x184d
push 0
push 0
push 0x20f5
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x528], 0x5f5dda30
mov dword [ebp - 0x1ec], 0xffffffff
jmp 0x1003470e
mov eax, dword [ebp - 0x1ec]
dec eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0xfffffff3
jg 0x10035325
mov dword [ebp - 0x1b0], 0xf8067e30
mov dword [ebp - 0x49c], 0
push 3
lea ecx, [ebp - 0xe3c]
call fcn.10027b4a
mov dword [ebp - 4], 7
mov dword [ebp - 0x238], 0
jmp 0x1003475c
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jge 0x1003477e
push dword [ebp - 0x238]
lea ecx, [ebp - 0xe3c]
call fcn.10027bb7
mov dword [eax], 0x60d2f38d
jmp 0x1003474f
mov byte [ebp - 0xf0], 0
movzx eax, byte [ebp - 0xf0]
test eax, eax
je 0x10034798
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x1b0], eax
jne 0x100347b2
mov dword [ebp - 0x8dc], 1
jmp 0x100347b9
and dword [ebp - 0x8dc], 0
mov dword [ebp - 0x49c], 0x9ec4279c
mov eax, dword [ebp - 0x49c]
cmp dword [ebp - 0x8dc], eax
jl 0x100347dd
mov dword [ebp - 0x4ac], 1
jmp 0x100347e4
and dword [ebp - 0x4ac], 0
cmp dword [ebp - 0x1b0], 1
jle 0x100347f9
mov dword [ebp - 0x4a4], 1
jmp 0x10034800
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
add eax, 4
cmp dword [ebp - 0x1b0], eax
jle 0x1003481d
mov dword [ebp - 0x8e4], 1
jmp 0x10034824
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x8e4], eax
jle 0x1003483e
mov dword [ebp - 0x8ec], 1
jmp 0x10034845
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x4ac]
cmp eax, dword [ebp - 0x8ec]
je 0x1003485f
mov dword [ebp - 0x4b4], 1
jmp 0x10034866
and dword [ebp - 0x4b4], 0
mov esi, dword [ebp - 0x4b4]
sub esi, dword [ebp - 0x1b0]
push 2
lea ecx, [ebp - 0xe3c]
call fcn.10027bb7
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe3c]
call fcn.10027bb2
mov dword [ebp - 0x1a8], 0x888a
push 2
lea ecx, [ebp - 0x994]
call fcn.10027b4a
mov dword [ebp - 4], 8
mov dword [ebp - 0x240], 0xffffffff
mov dword [ebp - 0x2f8], 0
jmp 0x100348d1
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 2
jge 0x100348f3
push dword [ebp - 0x2f8]
lea ecx, [ebp - 0x994]
call fcn.10027bb7
mov dword [eax], 3
jmp 0x100348c4
push 1
lea ecx, [ebp - 0x994]
call fcn.10027bb7
and dword [eax], 0
jmp 0x10034929
push 1
lea ecx, [ebp - 0x994]
call fcn.10027bb7
mov dword [ebp - 0x8f4], eax
mov eax, dword [ebp - 0x8f4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x8f4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x994]
call fcn.10027bb7
cmp dword [eax], 0xfffffff6
jne 0x10034a2b
mov dword [ebp - 0x4bc], 1
mov dword [ebp - 0xac4], 0x189f42c6
mov eax, 0x4bedcc59
test eax, eax
je 0x1003499a
mov eax, dword [ebp - 0x240]
cmp dword [ebp - 0x4bc], eax
jle 0x10034976
mov dword [ebp - 0x8fc], 1
jmp 0x1003497d
and dword [ebp - 0x8fc], 0
mov esi, dword [ebp - 0x4bc]
push 1
lea ecx, [ebp - 0x994]
call fcn.10027bb7
add esi, dword [eax]
cmp esi, dword [ebp - 0x8fc]
jl 0x100349ac
cmp dword [ebp - 0x240], 0
jne 0x100349ac
and dword [ebp - 0x4c4], 0
jmp 0x100349b6
mov dword [ebp - 0x4c4], 1
mov esi, dword [ebp - 0x240]
imul esi, dword [ebp - 0x4c4]
push 1
lea ecx, [ebp - 0x994]
call fcn.10027bb7
cmp esi, dword [eax]
jne 0x100349e6
cmp dword [ebp - 0x240], 0
jne 0x100349e6
and dword [ebp - 0x904], 0
jmp 0x100349f0
mov dword [ebp - 0x904], 1
push 1
lea ecx, [ebp - 0x994]
call fcn.10027bb7
mov ecx, dword [ebp - 0x904]
cmp ecx, dword [eax]
jge 0x10034a13
mov dword [ebp - 0x4cc], 1
jmp 0x10034a1a
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0xac4], eax
jmp 0x10034905
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x994]
call fcn.10027bb2
push 4
lea ecx, [ebp - 0xe6c]
call fcn.10027b4a
mov dword [ebp - 4], 9
mov dword [ebp - 0xa9c], 0xe3bc4aee
mov dword [ebp - 0x2c0], 0xd5e48d32
mov dword [ebp - 0xad4], 0
push 1
lea ecx, [ebp - 0xf88]
call fcn.10027b4a
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x1068], 0xfffffffc
mov dword [ebp - 0xf3c], 7
mov dword [ebp - 0x1028], 0xffffffff
mov dword [ebp - 0xf44], 0xffffffff
push 1
lea ecx, [ebp - 0xeb4]
call fcn.10027b4a
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x50], 0
jmp 0x10034ac6
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x10034ae2
push dword [ebp - 0x50]
lea ecx, [ebp - 0xf88]
call fcn.10027bb7
mov dword [eax], 0x194ddbc3
jmp 0x10034abf
mov dword [ebp - 0x50], 0
jmp 0x10034af2
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x10034b0e
push dword [ebp - 0x50]
lea ecx, [ebp - 0xeb4]
call fcn.10027bb7
mov dword [eax], 0xfffffff6
jmp 0x10034aeb
mov dword [ebp - 0x2c0], 0xe
jmp 0x10034b27
mov eax, dword [ebp - 0x2c0]
dec eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 9
je 0x10034b48
mov dword [ebp - 0xacc], 0xffff
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0xad4], eax
jmp 0x10034b1a
push 0
lea ecx, [ebp - 0xeb4]
call fcn.10027bb7
mov dword [ebp - 0x90c], eax
mov eax, dword [ebp - 0x90c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x90c]
mov dword [ecx], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xeb4]
call fcn.10027bb2
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xf88]
call fcn.10027bb2
mov dword [ebp - 0x10a8], 0xc0e42606
mov dword [ebp - 0x4dc], 2
mov dword [ebp - 0x4d4], 0xe2bbef7d
mov dword [ebp - 0xadc], 0x21f1
mov dword [ebp - 0x92c], 0x890c5440
mov dword [ebp - 0xbf0], 0x8ed4a55f
mov dword [ebp - 0xbec], 0x8ed4a55f
mov dword [ebp - 0xbe8], 0x8ed4a55f
mov dword [ebp - 0xbe4], 0x8ed4a55f
mov dword [ebp - 0x4fc], 0
push 2
lea ecx, [ebp - 0x9a4]
call fcn.10027b4a
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x30], 0
mov dword [ebp - 0xb0c], 1
mov dword [ebp - 0xf4c], 0
mov dword [ebp - 0x88], 0
jmp 0x10034c33
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x10034c4f
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x9e4], 0x1145714f
jmp 0x10034c26
mov dword [ebp - 0x88], 0
jmp 0x10034c68
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x10034c8a
push dword [ebp - 0x88]
lea ecx, [ebp - 0x9a4]
call fcn.10027bb7
mov dword [eax], 0x4eb0
jmp 0x10034c5b
mov eax, dword [ebp - 0x4d4]
cmp dword [ebp - 0x4d4], eax
jge 0x10034ca4
mov dword [ebp - 0x914], 1
jmp 0x10034cab
and dword [ebp - 0x914], 0
cmp dword [ebp - 0x914], 0xfffc
jae 0x10034cc3
mov dword [ebp - 0x91c], 1
jmp 0x10034cca
and dword [ebp - 0x91c], 0
cmp dword [ebp - 0xadc], 0
jle 0x10034cdf
mov dword [ebp - 0x4e4], 1
jmp 0x10034ce6
and dword [ebp - 0x4e4], 0
mov dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x4dc]
imul eax, dword [ebp - 0x91c]
cmp eax, dword [ebp - 0x4e4]
jge 0x10034d96
mov dword [ebp - 0x390], 0xffff
mov dword [ebp - 0xaf4], 0xfffffff9
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0xae4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9e4]
mov dword [ebp - 0xaec], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9e4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x9e4], eax
mov eax, dword [ebp - 0x390]
dec eax
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0xae4]
cmp eax, dword [ebp - 0xaec]
jle 0x10034d7e
mov dword [ebp - 0x924], 1
jmp 0x10034d85
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x924]
mov dword [ebp - 0xaf4], eax
jmp 0x100350d7
mov dword [ebp - 0x108], 0xdd48
mov dword [ebp - 0x3a0], 0x336a
mov dword [ebp - 0xb04], 0xffff
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9e4]
mov dword [ebp - 0x1030], eax
cmp dword [ebp - 0x3a0], 0
je 0x10034de5
cmp dword [ebp - 0x108], 0
je 0x10034de5
mov dword [ebp - 0x3d8], 1
jmp 0x10034dec
and dword [ebp - 0x3d8], 0
push 0
lea ecx, [ebp - 0x9a4]
call fcn.10027bb7
mov ecx, dword [ebp - 0x3d8]
mov dword [eax], ecx
cmp dword [ebp - 0x3d8], 0
jne 0x10034e1c
cmp dword [ebp - 0x108], 0
jne 0x10034e1c
and dword [ebp - 0x4ec], 0
jmp 0x10034e26
mov dword [ebp - 0x4ec], 1
mov eax, dword [ebp - 0x4ec]
sub eax, dword [ebp - 0x30]
cmp dword [ebp - 0x108], eax
jg 0x10034e43
mov dword [ebp - 0x398], 1
jmp 0x10034e4a
and dword [ebp - 0x398], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x398]
mov dword [ebp + eax - 0xbf0], ecx
mov eax, dword [ebp - 0x4fc]
cmp eax, dword [ebp - 0x398]
jge 0x10034e80
mov eax, 0xdc0f
test eax, eax
je 0x10034e80
mov dword [ebp - 0xafc], 1
jmp 0x10034e87
and dword [ebp - 0xafc], 0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xf54], eax
mov eax, dword [ebp - 0x92c]
sub eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x92c], eax
mov dword [ebp - 0x30], 0
jmp 0x10034eb5
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jg 0x100350d7
mov dword [ebp - 0x248], 0
jmp 0x10034ed8
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x10034ef4
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0x3f4], 8
jmp 0x10034ecb
mov byte [ebp - 0x18d], 0
movzx eax, byte [ebp - 0x18d]
test eax, eax
je 0x10034f1d
push 0
push 0x4eb
push 0x1812
push 0x12a
call dword [sym.imp.KERNEL32.dll_RaiseException]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x9a4]
call fcn.10027bb7
cmp dword [eax], 0
jne 0x1003505c
push dword [ebp - 0x30]
lea ecx, [ebp - 0x9a4]
call fcn.10027bb7
mov dword [eax], 0xfffffffe
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x10035053
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f4]
mov dword [ebp - 0x1070], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x3f4]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x9a4]
call fcn.10027bb7
cmp esi, dword [eax]
jne 0x10034f9e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3f4], 0
jne 0x10034f9e
and dword [ebp - 0x4f4], 0
jmp 0x10034fa8
mov dword [ebp - 0x4f4], 1
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x4f4], eax
jl 0x10034fc2
mov dword [ebp - 0x934], 1
jmp 0x10034fc9
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x934]
sub eax, dword [ebp - 0x4fc]
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0xbf0]
jge 0x10034ff0
mov dword [ebp - 0x93c], 1
jmp 0x10034ff7
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x108]
add eax, dword [ebp - 0x93c]
je 0x10035024
push dword [ebp - 0x30]
lea ecx, [ebp - 0x9a4]
call fcn.10027bb7
cmp dword [eax], 0
je 0x10035024
mov dword [ebp - 0x504], 1
jmp 0x1003502b
and dword [ebp - 0x504], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xbf0]
mov ecx, dword [ebp - 0x108]
add ecx, dword [ebp - 0x504]
sub eax, ecx
sub eax, dword [ebp - 0x3a0]
add eax, 0x16590181
jne 0x1003505c
and dword [ebp - 0x944], 0
jmp 0x10035066
mov dword [ebp - 0x944], 1
mov eax, dword [ebp - 0x944]
sub eax, dword [ebp - 0xb04]
je 0x10035093
push dword [ebp - 0x30]
lea ecx, [ebp - 0x9a4]
call fcn.10027bb7
cmp dword [eax], 0
je 0x10035093
mov dword [ebp - 0x94c], 1
jmp 0x1003509a
and dword [ebp - 0x94c], 0
imul eax, dword [ebp - 0x94c], 0xaec2
cmp eax, dword [ebp - 0xb0c]
jge 0x100350b8
mov dword [ebp - 0x510], 1
jmp 0x100350bf
and dword [ebp - 0x510], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x510]
mov dword [ebp + eax - 0xbf0], ecx
jmp 0x10034eae
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x9a4]
call fcn.10027bb2
mov dword [ebp - 0x318], 0
jmp 0x100350ff
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 4
jge 0x10035121
push dword [ebp - 0x318]
lea ecx, [ebp - 0xe6c]
call fcn.10027bb7
mov dword [eax], 0x20bd
jmp 0x100350f2
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x1a8], eax
je 0x10035294
mov dword [ebp - 0xb14], 0x105a
mov dword [ebp - 0x1a8], 0xfffffff5
jmp 0x10035156
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0xffffffe5
jle 0x10035292
mov dword [ebp - 0xc8], 0x4b7834d8
mov dword [ebp - 0xc8], 0
jmp 0x10035186
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jg 0x100351ca
mov byte [ebp - 0xf2], 0
movzx eax, byte [ebp - 0xf2]
test eax, eax
je 0x100351b0
push 0x104c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xe6c]
call fcn.10027bb7
cmp dword [eax], 0
je 0x100351c8
jmp 0x100351ca
jmp 0x10035179
mov dword [ebp - 0x3e0], 0xc6076fda
cmp dword [ebp - 0x3e0], 0
je 0x10035216
cmp dword [ebp - 0xc8], 0x15fb
jne 0x100351f5
mov dword [ebp - 0x764], 1
jmp 0x100351fc
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x764], eax
jge 0x10035216
mov dword [ebp - 0x518], 1
jmp 0x1003521d
and dword [ebp - 0x518], 0
cmp dword [ebp - 0x518], 0
jne 0x10035232
mov dword [ebp - 0x760], 1
jmp 0x10035239
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0xb14]
cmp dword [ebp - 0x760], eax
jl 0x10035253
mov dword [ebp - 0x520], 1
jmp 0x1003525a
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0xc8]
add eax, dword [ebp - 0x520]
cmp dword [ebp - 0x1a8], eax
jge 0x1003527a
mov dword [ebp - 0x910], 1
jmp 0x10035281
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0xa9c], eax
jmp 0x10035149
jmp 0x10035304
mov dword [ebp - 0xf5c], 1
mov dword [ebp - 0x250], 0
jmp 0x100352b7
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jge 0x100352d3
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x116c], 0xefec
jmp 0x100352aa
mov byte [ebp - 0x159], 0
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x100352fa
push 0x57f
push 0x2581
push 0x65f
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [ebp - 0x3e0], 1
mov eax, dword [ebp - 0x528]
inc eax
mov dword [ebp - 0x528], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe6c]
call fcn.10027bb2
jmp 0x10034701
mov dword [ebp - 0xd84], 3
mov dword [ebp - 0xd80], 3
mov dword [ebp - 0xd7c], 3
mov dword [ebp - 0xd78], 3
lea ecx, [ebp - 0x3ed]
call fcn.1000927a
push eax
lea eax, [ebp - 0xd74]
push eax
lea eax, [ebp - 0xd84]
push eax
lea ecx, [ebp - 0x1160]
call fcn.10027bc6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xee4]
call fcn.10027b8c
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xa8], 0x951e
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0x404], 0x919c44d4
push 1
lea ecx, [ebp - 0xb24]
call fcn.10027b4a
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x3b0], 4
mov dword [ebp - 0x2c8], 0
jmp 0x100353db
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 1
jge 0x100353fd
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0xb24]
call fcn.10027bb7
mov dword [eax], 0x36572186
jmp 0x100353ce
push 1
lea ecx, [ebp - 0xee4]
call fcn.10027bb7
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp - 0x3a8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3a8]
mov ecx, dword [ecx]
dec ecx
mov edx, dword [ebp - 0x3a8]
mov dword [edx], ecx
test eax, eax
jne 0x1003543f
cmp dword [ebp - 0xa8], 0
jne 0x1003543f
and dword [ebp - 0x958], 0
jmp 0x10035449
mov dword [ebp - 0x958], 1
mov eax, dword [ebp - 0xa8]
neg eax
cmp eax, 0x244c3f4
jg 0x10035464
mov dword [ebp - 0x768], 1
jmp 0x1003546b
and dword [ebp - 0x768], 0
imul eax, dword [ebp - 0x768], 0xffffffff
test eax, eax
jne 0x10035488
cmp dword [ebp - 0xa8], 0
jne 0x10035488
and dword [ebp - 0x530], 0
jmp 0x10035492
mov dword [ebp - 0x530], 1
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xbec5ec62
ja 0x100354b6
mov dword [ebp - 0x888], 1
jmp 0x100354bd
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x888], eax
je 0x100354e2
push 3
pop eax
test eax, eax
jne 0x100354e2
push 3
pop eax
test eax, eax
jne 0x100354e2
and dword [ebp - 0x538], 0
jmp 0x100354ec
mov dword [ebp - 0x538], 1
cmp dword [ebp - 0x538], 0xb5a9
jle 0x10035504
mov dword [ebp - 0x770], 1
jmp 0x1003550b
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0xa8]
add eax, dword [ebp - 0x770]
cmp eax, dword [ebp - 0xa8]
jl 0x1003552b
mov dword [ebp - 0x540], 1
jmp 0x10035532
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0xa8]
imul eax, dword [ebp - 0x540]
cmp dword [ebp - 0x958], eax
jge 0x10035553
mov dword [ebp - 0x548], 1
jmp 0x1003555a
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0xa8]
add eax, dword [ebp - 0x548]
cmp eax, 0x39d20578
jge 0x10035579
mov dword [ebp - 0x778], 1
jmp 0x10035580
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x778]
mov dword [ebp - 0x404], eax
push 1
lea ecx, [ebp - 0xee4]
call fcn.10027bb7
mov eax, dword [eax]
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0xc0]
dec eax
cmp dword [ebp - 0x404], eax
jne 0x100355b7
cmp dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0xc0], eax
jle 0x100355d1
mov dword [ebp - 0x550], 1
jmp 0x100355d8
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0
jne 0x100355ff
mov eax, 0xdda259c4
test eax, eax
jne 0x100355ff
and dword [ebp - 0x890], 0
jmp 0x10035609
mov dword [ebp - 0x890], 1
imul eax, dword [ebp - 0x890], 0xd860
cmp eax, 1
ja 0x10035624
mov dword [ebp - 0x558], 1
jmp 0x1003562b
and dword [ebp - 0x558], 0
push 0
lea ecx, [ebp - 0xb24]
call fcn.10027bb7
mov eax, dword [eax]
cmp eax, dword [ebp - 0x558]
jle 0x1003564e
mov dword [ebp - 0x780], 1
jmp 0x10035655
and dword [ebp - 0x780], 0
mov esi, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x780]
sub eax, dword [ebp - 0xc0]
add eax, 0x1e2985c3
sub esi, eax
push 0
lea ecx, [ebp - 0xb24]
call fcn.10027bb7
cmp esi, dword [eax]
jle 0x1003568b
mov dword [ebp - 0x560], 1
jmp 0x10035692
and dword [ebp - 0x560], 0
push 0
lea ecx, [ebp - 0xb24]
call fcn.10027bb7
mov ecx, dword [ebp - 0x560]
cmp ecx, dword [eax]
je 0x100356b5
mov dword [ebp - 0x918], 1
jmp 0x100356bc
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0xc0], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xb24]
call fcn.10027bb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xee4]
call fcn.10027bb2
mov dword [ebp - 0x1dc], 0xfffffff9
mov dword [ebp - 0xd34], 5
mov dword [ebp - 0xd30], 5
mov dword [ebp - 0xd2c], 5
mov dword [ebp - 0xd28], 5
lea ecx, [ebp - 0x3bd]
call fcn.1000927a
push eax
lea eax, [ebp - 0xd24]
push eax
lea eax, [ebp - 0xd34]
push eax
lea ecx, [ebp - 0x1148]
call fcn.10027bc6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe00]
call fcn.10027b8c
mov dword [ebp - 4], 0xf
push 1
lea ecx, [ebp - 0xe84]
call fcn.10027b4a
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x258], 0
jmp 0x1003577e
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
jge 0x100357a0
push dword [ebp - 0x258]
lea ecx, [ebp - 0xe84]
call fcn.10027bb7
mov dword [eax], 1
jmp 0x10035771
cmp dword [ebp - 0x1dc], 0
je 0x100357e1
mov esi, dword [ebp - 0x1dc]
push 1
lea ecx, [ebp - 0xe00]
call fcn.10027bb7
mov dword [eax], esi
mov esi, dword [ebp - 0x1dc]
push 0
lea ecx, [ebp - 0xe00]
call fcn.10027bb7
cmp esi, dword [eax]
jg 0x100357e1
mov dword [ebp - 0x568], 1
jmp 0x100357e8
and dword [ebp - 0x568], 0
cmp dword [ebp - 0x568], 0xfe04
jle 0x10035800
mov dword [ebp - 0x788], 1
jmp 0x10035807
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x1dc]
add eax, dword [ebp - 0x788]
je 0x1003582a
cmp dword [ebp - 0x1dc], 0
je 0x1003582a
mov dword [ebp - 0x570], 1
jmp 0x10035831
and dword [ebp - 0x570], 0
push 0
lea ecx, [ebp - 0xe84]
call fcn.10027bb7
mov ecx, dword [ebp - 0x570]
mov dword [eax], ecx
mov byte [ebp - 0xf4], 0
movzx eax, byte [ebp - 0xf4]
test eax, eax
je 0x10035867
push 0
push 0xd98
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xe84]
call fcn.10027bb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe00]
call fcn.10027bb2
mov dword [ebp - 0xcd0], 3
mov dword [ebp - 0xccc], 3
mov dword [ebp - 0xcc8], 3
mov dword [ebp - 0xcc4], 3
lea ecx, [ebp - 0x35d]
call fcn.1000927a
push eax
lea eax, [ebp - 0xcc0]
push eax
lea eax, [ebp - 0xcd0]
push eax
lea ecx, [ebp - 0x10f0]
call fcn.10027bc6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe18]
call fcn.10027b8c
mov dword [ebp - 4], 0x11
mov dword [ebp - 0xb0], 0x951e
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0x3b8], 0x919c44d4
push 1
lea ecx, [ebp - 0xb34]
call fcn.10027b4a
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x354], 4
mov dword [ebp - 0x300], 0
jmp 0x1003593b
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 1
jge 0x1003595d
push dword [ebp - 0x300]
lea ecx, [ebp - 0xb34]
call fcn.10027bb7
mov dword [eax], 0x36572186
jmp 0x1003592e
push 1
lea ecx, [ebp - 0xe18]
call fcn.10027bb7
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0x3e8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3e8]
mov ecx, dword [ecx]
dec ecx
mov edx, dword [ebp - 0x3e8]
mov dword [edx], ecx
test eax, eax
jne 0x1003599f
cmp dword [ebp - 0xb0], 0
jne 0x1003599f
and dword [ebp - 0x798], 0
jmp 0x100359a9
mov dword [ebp - 0x798], 1
mov eax, dword [ebp - 0xb0]
neg eax
cmp eax, 0x244c3f4
jg 0x100359c4
mov dword [ebp - 0x898], 1
jmp 0x100359cb
and dword [ebp - 0x898], 0
imul eax, dword [ebp - 0x898], 0xffffffff
test eax, eax
jne 0x100359e8
cmp dword [ebp - 0xb0], 0
jne 0x100359e8
and dword [ebp - 0x578], 0
jmp 0x100359f2
mov dword [ebp - 0x578], 1
mov eax, dword [ebp - 0x578]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xbec5ec62
ja 0x10035a16
mov dword [ebp - 0x790], 1
jmp 0x10035a1d
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x790], eax
je 0x10035a42
push 3
pop eax
test eax, eax
jne 0x10035a42
push 3
pop eax
test eax, eax
jne 0x10035a42
and dword [ebp - 0x580], 0
jmp 0x10035a4c
mov dword [ebp - 0x580], 1
cmp dword [ebp - 0x580], 0xb5a9
jle 0x10035a64
mov dword [ebp - 0x9b8], 1
jmp 0x10035a6b
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0x9b8]
cmp eax, dword [ebp - 0xb0]
jl 0x10035a8b
mov dword [ebp - 0x588], 1
jmp 0x10035a92
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0xb0]
imul eax, dword [ebp - 0x588]
cmp dword [ebp - 0x798], eax
jge 0x10035ab3
mov dword [ebp - 0x590], 1
jmp 0x10035aba
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0x590]
cmp eax, 0x39d20578
jge 0x10035ad9
mov dword [ebp - 0x8a0], 1
jmp 0x10035ae0
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x3b8], eax
push 1
lea ecx, [ebp - 0xe18]
call fcn.10027bb7
mov eax, dword [eax]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0xd0]
dec eax
cmp dword [ebp - 0x3b8], eax
jne 0x10035b17
cmp dword [ebp - 0x354], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0xd0], eax
jle 0x10035b31
mov dword [ebp - 0x598], 1
jmp 0x10035b38
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0
jne 0x10035b5f
mov eax, 0xdda259c4
test eax, eax
jne 0x10035b5f
and dword [ebp - 0x7a0], 0
jmp 0x10035b69
mov dword [ebp - 0x7a0], 1
imul eax, dword [ebp - 0x7a0], 0xd860
cmp eax, 1
ja 0x10035b84
mov dword [ebp - 0x5a0], 1
jmp 0x10035b8b
and dword [ebp - 0x5a0], 0
push 0
lea ecx, [ebp - 0xb34]
call fcn.10027bb7
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5a0]
jle 0x10035bae
mov dword [ebp - 0x920], 1
jmp 0x10035bb5
and dword [ebp - 0x920], 0
mov esi, dword [ebp - 0xd0]
mov eax, dword [ebp - 0x920]
sub eax, dword [ebp - 0xd0]
add eax, 0x1e2985c3
sub esi, eax
push 0
lea ecx, [ebp - 0xb34]
call fcn.10027bb7
cmp esi, dword [eax]
jle 0x10035beb
mov dword [ebp - 0x5a8], 1
jmp 0x10035bf2
and dword [ebp - 0x5a8], 0
push 0
lea ecx, [ebp - 0xb34]
call fcn.10027bb7
mov ecx, dword [ebp - 0x5a8]
cmp ecx, dword [eax]
je 0x10035c15
mov dword [ebp - 0x7a8], 1
jmp 0x10035c1c
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x7a8]
mov dword [ebp - 0xd0], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xb34]
call fcn.10027bb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe18]
call fcn.10027bb2
mov dword [ebp - 0x98], 0x1928c176
mov dword [ebp - 0x9c], 0x515466bc
mov dword [ebp - 0x35c], 0x18bd8502
mov byte [ebp - 0x191], 0
movzx eax, byte [ebp - 0x191]
test eax, eax
je 0x10035c81
push 0x2595
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x98], 0x16
jmp 0x10035c9a
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x19
jg 0x10036036
mov dword [ebp - 0x34], 0xfc3938dd
mov dword [ebp - 0x24], 0
push 3
lea ecx, [ebp - 0xc24]
call fcn.10027b4a
mov dword [ebp - 4], 0x13
push 3
lea ecx, [ebp - 0xe30]
call fcn.10027b4a
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x58], 0
jmp 0x10035cea
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x10035d06
push dword [ebp - 0x58]
lea ecx, [ebp - 0xc24]
call fcn.10027bb7
mov dword [eax], 0x105807c
jmp 0x10035ce3
mov dword [ebp - 0x58], 0
jmp 0x10035d16
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x10035d32
push dword [ebp - 0x58]
lea ecx, [ebp - 0xe30]
call fcn.10027bb7
mov dword [eax], 0xfffffffe
jmp 0x10035d0f
cmp dword [ebp - 0x34], 0
je 0x10035e10
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x34]
sub ecx, 0x496e854a
sub eax, ecx
cmp eax, dword [ebp - 0x98]
jne 0x10035d6a
mov dword [ebp - 0x5b0], 1
jmp 0x10035d71
and dword [ebp - 0x5b0], 0
cmp dword [ebp - 0x5b0], 0xef6e229e
jae 0x10035d89
mov dword [ebp - 0x8a8], 1
jmp 0x10035d90
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x35c], eax
jle 0x10035db3
mov dword [ebp - 0x5b8], 1
jmp 0x10035dba
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x5b8], eax
jg 0x10035dd1
mov dword [ebp - 0x7b0], 1
jmp 0x10035dd8
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x7b0], eax
jle 0x10035def
mov dword [ebp - 0x5c0], 1
jmp 0x10035df6
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x5c0]
jl 0x10035e10
mov dword [ebp - 0x960], 1
jmp 0x10035e17
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x960], eax
jne 0x10035e31
mov dword [ebp - 0x5c8], 1
jmp 0x10035e38
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x5c8], eax
jne 0x10035e52
mov dword [ebp - 0x7b8], 1
jmp 0x10035e59
and dword [ebp - 0x7b8], 0
imul eax, dword [ebp - 0x7b8], 3
cmp eax, 1
jg 0x10035fca
cmp dword [ebp - 0x24], 0
je 0x10035fca
mov dword [ebp - 0x24], 0x1d
jmp 0x10035e83
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1c
jge 0x10035f19
mov dword [ebp - 0xaac], 0x5d06
mov eax, dword [ebp - 0x9c]
neg eax
cmp eax, 0x54668dac
jne 0x10035eb2
mov dword [ebp - 0x5d0], 1
jmp 0x10035eb9
and dword [ebp - 0x5d0], 0
cmp dword [ebp - 0x5d0], 7
jae 0x10035ece
mov dword [ebp - 0x8b0], 1
jmp 0x10035ed5
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x35c]
sub eax, 0x5d9f20c7
sub eax, dword [ebp - 0x8b0]
cmp eax, dword [ebp - 0x9c]
jge 0x10035efe
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10035efe
and dword [ebp - 0x5d8], 0
jmp 0x10035f08
mov dword [ebp - 0x5d8], 1
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0xaac], eax
jmp 0x10035e7c
mov dword [ebp - 0x24], 0
jmp 0x10035f29
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x10035fc8
mov dword [ebp - 0x34], 0
jmp 0x10035f43
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jg 0x10035fa1
mov dword [ebp - 0x9c], 2
jmp 0x10035f62
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x10035f9f
push 2
lea ecx, [ebp - 0xe30]
call fcn.10027bb7
mov dword [eax], 2
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x10035f9d
push 0x584
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x10035f55
jmp 0x10035f3c
push dword [ebp - 0x24]
lea ecx, [ebp - 0xc24]
call fcn.10027bb7
mov esi, eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0xc24]
call fcn.10027bb7
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10035f22
jmp 0x10036013
mov byte [ebp - 0x161], 0
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x10035fe9
push 0x1f58
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov byte [ebp - 0xf8], 0
movzx eax, byte [ebp - 0xf8]
test eax, eax
je 0x10036013
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xe30]
call fcn.10027bb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc24]
call fcn.10027bb2
jmp 0x10035c8d
mov dword [ebp - 0x1fc], 0xfffffff9
mov dword [ebp - 0xd5c], 5
mov dword [ebp - 0xd58], 5
mov dword [ebp - 0xd54], 5
mov dword [ebp - 0xd50], 5
lea ecx, [ebp - 0x3fd]
call fcn.1000927a
push eax
lea eax, [ebp - 0xd4c]
push eax
lea eax, [ebp - 0xd5c]
push eax
lea ecx, [ebp - 0x1140]
call fcn.10027bc6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe60]
call fcn.10027b8c
mov dword [ebp - 4], 0x15
push 1
lea ecx, [ebp - 0xe48]
call fcn.10027b4a
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x260], 0
jmp 0x100360ce
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 1
jge 0x100360f0
push dword [ebp - 0x260]
lea ecx, [ebp - 0xe48]
call fcn.10027bb7
mov dword [eax], 1
jmp 0x100360c1
cmp dword [ebp - 0x1fc], 0
je 0x10036131
mov esi, dword [ebp - 0x1fc]
push 1
lea ecx, [ebp - 0xe60]
call fcn.10027bb7
mov dword [eax], esi
mov esi, dword [ebp - 0x1fc]
push 0
lea ecx, [ebp - 0xe60]
call fcn.10027bb7
cmp esi, dword [eax]
jg 0x10036131
mov dword [ebp - 0x7c0], 1
jmp 0x10036138
and dword [ebp - 0x7c0], 0
cmp dword [ebp - 0x7c0], 0xfe04
jle 0x10036150
mov dword [ebp - 0x5e0], 1
jmp 0x10036157
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x1fc]
add eax, dword [ebp - 0x5e0]
je 0x1003617a
cmp dword [ebp - 0x1fc], 0
je 0x1003617a
mov dword [ebp - 0x928], 1
jmp 0x10036181
and dword [ebp - 0x928], 0
push 0
lea ecx, [ebp - 0xe48]
call fcn.10027bb7
mov ecx, dword [ebp - 0x928]
mov dword [eax], ecx
mov byte [ebp - 0x18f], 0
movzx eax, byte [ebp - 0x18f]
test eax, eax
je 0x100361b7
push 0
push 0xd98
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xe48]
call fcn.10027bb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe60]
call fcn.10027bb2
mov dword [ebp - 0xce4], 8
mov dword [ebp - 0xce0], 8
mov dword [ebp - 0xcdc], 8
mov dword [ebp - 0xcd8], 8
lea ecx, [ebp - 0x365]
call fcn.1000927a
push eax
lea eax, [ebp - 0xcd4]
push eax
lea eax, [ebp - 0xce4]
push eax
lea ecx, [ebp - 0x1130]
call fcn.10027bc6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf98]
call fcn.10027b8c
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x1c4], 6
mov dword [ebp - 0x1038], 0x3fa75c1
mov dword [ebp - 0x1c4], 0
jmp 0x10036266
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 4
jge 0x10036285
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0xf98]
call fcn.10027bb7
and dword [eax], 0
jmp 0x10036259
mov byte [ebp - 0xfa], 0
movzx eax, byte [ebp - 0xfa]
test eax, eax
je 0x1003629f
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf98]
call fcn.10027bb2
mov dword [ebp - 0xcf8], 3
mov dword [ebp - 0xcf4], 3
mov dword [ebp - 0xcf0], 3
mov dword [ebp - 0xcec], 3
lea ecx, [ebp - 0x36d]
call fcn.1000927a
push eax
lea eax, [ebp - 0xce8]
push eax
lea eax, [ebp - 0xcf8]
push eax
lea ecx, [ebp - 0x10f8]
call fcn.10027bc6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe78]
call fcn.10027b8c
mov dword [ebp - 4], 0x18
mov dword [ebp - 0xa4], 0x951e
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x36c], 0x919c44d4
push 1
lea ecx, [ebp - 0xb44]
call fcn.10027b4a
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x374], 4
mov dword [ebp - 0x2d0], 0
jmp 0x10036364
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 1
jge 0x10036386
push dword [ebp - 0x2d0]
lea ecx, [ebp - 0xb44]
call fcn.10027bb7
mov dword [eax], 0x36572186
jmp 0x10036357
push 1
lea ecx, [ebp - 0xe78]
call fcn.10027bb7
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x364]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x364]
mov ecx, dword [ecx]
dec ecx
mov edx, dword [ebp - 0x364]
mov dword [edx], ecx
test eax, eax
jne 0x100363c8
cmp dword [ebp - 0xa4], 0
jne 0x100363c8
and dword [ebp - 0x600], 0
jmp 0x100363d2
mov dword [ebp - 0x600], 1
mov eax, dword [ebp - 0xa4]
neg eax
cmp eax, 0x244c3f4
jg 0x100363ed
mov dword [ebp - 0x5e8], 1
jmp 0x100363f4
and dword [ebp - 0x5e8], 0
imul eax, dword [ebp - 0x5e8], 0xffffffff
test eax, eax
jne 0x10036411
cmp dword [ebp - 0xa4], 0
jne 0x10036411
and dword [ebp - 0x7c8], 0
jmp 0x1003641b
mov dword [ebp - 0x7c8], 1
mov eax, dword [ebp - 0x7c8]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xbec5ec62
ja 0x1003643f
mov dword [ebp - 0x5f0], 1
jmp 0x10036446
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x5f0], eax
je 0x1003646b
push 3
pop eax
test eax, eax
jne 0x1003646b
push 3
pop eax
test eax, eax
jne 0x1003646b
and dword [ebp - 0x8b8], 0
jmp 0x10036475
mov dword [ebp - 0x8b8], 1
cmp dword [ebp - 0x8b8], 0xb5a9
jle 0x1003648d
mov dword [ebp - 0x5f8], 1
jmp 0x10036494
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0x5f8]
cmp eax, dword [ebp - 0xa4]
jl 0x100364b4
mov dword [ebp - 0x7d0], 1
jmp 0x100364bb
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0xa4]
imul eax, dword [ebp - 0x7d0]
cmp dword [ebp - 0x600], eax
jge 0x100364dc
mov dword [ebp - 0x988], 1
jmp 0x100364e3
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0x988]
cmp eax, 0x39d20578
jge 0x10036502
mov dword [ebp - 0x608], 1
jmp 0x10036509
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x36c], eax
push 1
lea ecx, [ebp - 0xe78]
call fcn.10027bb7
mov eax, dword [eax]
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0xac]
dec eax
cmp dword [ebp - 0x36c], eax
jne 0x10036540
cmp dword [ebp - 0x374], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0xac], eax
jle 0x1003655a
mov dword [ebp - 0x7d8], 1
jmp 0x10036561
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0
jne 0x10036588
mov eax, 0xdda259c4
test eax, eax
jne 0x10036588
and dword [ebp - 0x610], 0
jmp 0x10036592
mov dword [ebp - 0x610], 1
imul eax, dword [ebp - 0x610], 0xd860
cmp eax, 1
ja 0x100365ad
mov dword [ebp - 0x8c0], 1
jmp 0x100365b4
and dword [ebp - 0x8c0], 0
push 0
lea ecx, [ebp - 0xb44]
call fcn.10027bb7
mov eax, dword [eax]
cmp eax, dword [ebp - 0x8c0]
jle 0x100365d7
mov dword [ebp - 0x618], 1
jmp 0x100365de
and dword [ebp - 0x618], 0
mov esi, dword [ebp - 0xac]
mov eax, dword [ebp - 0x618]
sub eax, dword [ebp - 0xac]
add eax, 0x1e2985c3
sub esi, eax
push 0
lea ecx, [ebp - 0xb44]
call fcn.10027bb7
cmp esi, dword [eax]
jle 0x10036614
mov dword [ebp - 0x7e0], 1
jmp 0x1003661b
and dword [ebp - 0x7e0], 0
push 0
lea ecx, [ebp - 0xb44]
call fcn.10027bb7
mov ecx, dword [ebp - 0x7e0]
cmp ecx, dword [eax]
je 0x1003663e
mov dword [ebp - 0x620], 1
jmp 0x10036645
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xb44]
call fcn.10027bb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe78]
call fcn.10027bb2
mov dword [ebp - 0xb4], 0x1928c176
mov dword [ebp - 0xbc], 0x515466bc
mov dword [ebp - 0x37c], 0x18bd8502
mov byte [ebp - 0x169], 0
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x100366aa
push 0x2595
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0xb4], 0x16
jmp 0x100366c3
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x19
jg 0x10036a7d
mov dword [ebp - 0x38], 0xfc3938dd
mov dword [ebp - 0x2c], 0
push 3
lea ecx, [ebp - 0xc3c]
call fcn.10027b4a
mov dword [ebp - 4], 0x1a
push 3
lea ecx, [ebp - 0xe90]
call fcn.10027b4a
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x90], 0
jmp 0x1003671c
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x1003673e
push dword [ebp - 0x90]
lea ecx, [ebp - 0xc3c]
call fcn.10027bb7
mov dword [eax], 0x105807c
jmp 0x1003670f
mov dword [ebp - 0x90], 0
jmp 0x10036757
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x10036779
push dword [ebp - 0x90]
lea ecx, [ebp - 0xe90]
call fcn.10027bb7
mov dword [eax], 0xfffffffe
jmp 0x1003674a
cmp dword [ebp - 0x38], 0
je 0x10036857
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x38]
sub ecx, 0x496e854a
sub eax, ecx
cmp eax, dword [ebp - 0xb4]
jne 0x100367b1
mov dword [ebp - 0x930], 1
jmp 0x100367b8
and dword [ebp - 0x930], 0
cmp dword [ebp - 0x930], 0xef6e229e
jae 0x100367d0
mov dword [ebp - 0x628], 1
jmp 0x100367d7
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x37c], eax
jle 0x100367fa
mov dword [ebp - 0x7e8], 1
jmp 0x10036801
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x7e8], eax
jg 0x10036818
mov dword [ebp - 0x630], 1
jmp 0x1003681f
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x630], eax
jle 0x10036836
mov dword [ebp - 0x8c8], 1
jmp 0x1003683d
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x8c8]
jl 0x10036857
mov dword [ebp - 0x638], 1
jmp 0x1003685e
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x638], eax
jne 0x10036878
mov dword [ebp - 0x7f0], 1
jmp 0x1003687f
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x7f0], eax
jne 0x10036899
mov dword [ebp - 0x640], 1
jmp 0x100368a0
and dword [ebp - 0x640], 0
imul eax, dword [ebp - 0x640], 3
cmp eax, 1
jg 0x10036a11
cmp dword [ebp - 0x2c], 0
je 0x10036a11
mov dword [ebp - 0x2c], 0x1d
jmp 0x100368ca
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1c
jge 0x10036960
mov dword [ebp - 0xae8], 0x5d06
mov eax, dword [ebp - 0xbc]
neg eax
cmp eax, 0x54668dac
jne 0x100368f9
mov dword [ebp - 0x968], 1
jmp 0x10036900
and dword [ebp - 0x968], 0
cmp dword [ebp - 0x968], 7
jae 0x10036915
mov dword [ebp - 0x648], 1
jmp 0x1003691c
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x37c]
sub eax, 0x5d9f20c7
sub eax, dword [ebp - 0x648]
cmp eax, dword [ebp - 0xbc]
jge 0x10036945
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10036945
and dword [ebp - 0x7f8], 0
jmp 0x1003694f
mov dword [ebp - 0x7f8], 1
mov eax, dword [ebp - 0x7f8]
mov dword [ebp - 0xae8], eax
jmp 0x100368c3
mov dword [ebp - 0x2c], 0
jmp 0x10036970
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x10036a0f
mov dword [ebp - 0x38], 0
jmp 0x1003698a
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jg 0x100369e8
mov dword [ebp - 0xbc], 2
jmp 0x100369a9
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x100369e6
push 2
lea ecx, [ebp - 0xe90]
call fcn.10027bb7
mov dword [eax], 2
mov byte [ebp - 0xfc], 0
movzx eax, byte [ebp - 0xfc]
test eax, eax
je 0x100369e4
push 0x584
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x1003699c
jmp 0x10036983
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc3c]
call fcn.10027bb7
mov esi, eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc3c]
call fcn.10027bb7
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10036969
jmp 0x10036a5a
mov byte [ebp - 0x18a], 0
movzx eax, byte [ebp - 0x18a]
test eax, eax
je 0x10036a30
push 0x1f58
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x10036a5a
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xe90]
call fcn.10027bb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc3c]
call fcn.10027bb2
jmp 0x100366b6
push 1
lea ecx, [ebp - 0xea8]
call fcn.10027b4a
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x328], 0x5ccc90a3
mov dword [ebp - 0x268], 0
jmp 0x10036ab4
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 1
jge 0x10036ad6
push dword [ebp - 0x268]
lea ecx, [ebp - 0xea8]
call fcn.10027bb7
mov dword [eax], 0x5dcec3d7
jmp 0x10036aa7
mov dword [ebp - 0x328], 0
jmp 0x10036aef
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jg 0x10036b3f
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x1c8], 0
jmp 0x10036b1b
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
jl 0x10036b3d
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0xea8]
call fcn.10027bb7
mov dword [eax], 1
jmp 0x10036b0e
jmp 0x10036ae2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xea8]
call fcn.10027bb2
mov dword [ebp - 0xd20], 8
mov dword [ebp - 0xd1c], 8
mov dword [ebp - 0xd18], 8
mov dword [ebp - 0xd14], 8
lea ecx, [ebp - 0x3c5]
call fcn.1000927a
push eax
lea eax, [ebp - 0xd10]
push eax
lea eax, [ebp - 0xd20]
push eax
lea ecx, [ebp - 0x1108]
call fcn.10027bc6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xfa8]
call fcn.10027b8c
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x1d0], 6
mov dword [ebp - 0xf64], 0x3fa75c1
mov dword [ebp - 0x1d0], 0
jmp 0x10036bdf
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 4
jge 0x10036bfe
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0xfa8]
call fcn.10027bb7
and dword [eax], 0
jmp 0x10036bd2
mov byte [ebp - 0x171], 0
movzx eax, byte [ebp - 0x171]
test eax, eax
je 0x10036c18
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfa8]
call fcn.10027bb2
mov dword [ebp - 0xc4], 0x1928c176
mov dword [ebp - 0xcc], 0x515466bc
mov dword [ebp - 0x384], 0x18bd8502
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x10036c62
push 0x2595
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0xc4], 0x16
jmp 0x10036c7b
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x19
jg 0x10037035
mov dword [ebp - 0x40], 0xfc3938dd
mov dword [ebp - 0x28], 0
push 3
lea ecx, [ebp - 0xc54]
call fcn.10027b4a
mov dword [ebp - 4], 0x1e
push 3
lea ecx, [ebp - 0xec0]
call fcn.10027b4a
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x84], 0
jmp 0x10036cd4
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x10036cf6
push dword [ebp - 0x84]
lea ecx, [ebp - 0xc54]
call fcn.10027bb7
mov dword [eax], 0x105807c
jmp 0x10036cc7
mov dword [ebp - 0x84], 0
jmp 0x10036d0f
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x10036d31
push dword [ebp - 0x84]
lea ecx, [ebp - 0xec0]
call fcn.10027bb7
mov dword [eax], 0xfffffffe
jmp 0x10036d02
cmp dword [ebp - 0x40], 0
je 0x10036e0f
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0x40]
sub ecx, 0x496e854a
sub eax, ecx
cmp eax, dword [ebp - 0xc4]
jne 0x10036d69
mov dword [ebp - 0x650], 1
jmp 0x10036d70
and dword [ebp - 0x650], 0
cmp dword [ebp - 0x650], 0xef6e229e
jae 0x10036d88
mov dword [ebp - 0x8d0], 1
jmp 0x10036d8f
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x384], eax
jle 0x10036db2
mov dword [ebp - 0x658], 1
jmp 0x10036db9
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x658], eax
jg 0x10036dd0
mov dword [ebp - 0x800], 1
jmp 0x10036dd7
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x800], eax
jle 0x10036dee
mov dword [ebp - 0x660], 1
jmp 0x10036df5
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x660]
jl 0x10036e0f
mov dword [ebp - 0x938], 1
jmp 0x10036e16
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x938], eax
jne 0x10036e30
mov dword [ebp - 0x668], 1
jmp 0x10036e37
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x668], eax
jne 0x10036e51
mov dword [ebp - 0x808], 1
jmp 0x10036e58
and dword [ebp - 0x808], 0
imul eax, dword [ebp - 0x808], 3
cmp eax, 1
jg 0x10036fc9
cmp dword [ebp - 0x28], 0
je 0x10036fc9
mov dword [ebp - 0x28], 0x1d
jmp 0x10036e82
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x1c
jge 0x10036f18
mov dword [ebp - 0xa10], 0x5d06
mov eax, dword [ebp - 0xcc]
neg eax
cmp eax, 0x54668dac
jne 0x10036eb1
mov dword [ebp - 0x670], 1
jmp 0x10036eb8
and dword [ebp - 0x670], 0
cmp dword [ebp - 0x670], 7
jae 0x10036ecd
mov dword [ebp - 0x8d8], 1
jmp 0x10036ed4
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x384]
sub eax, 0x5d9f20c7
sub eax, dword [ebp - 0x8d8]
cmp eax, dword [ebp - 0xcc]
jge 0x10036efd
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10036efd
and dword [ebp - 0x678], 0
jmp 0x10036f07
mov dword [ebp - 0x678], 1
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0xa10], eax
jmp 0x10036e7b
mov dword [ebp - 0x28], 0
jmp 0x10036f28
cmp dword [ebp - 0x28], 2
jg 0x10036fc7
mov dword [ebp - 0x40], 0
jmp 0x10036f42
cmp dword [ebp - 0x40], 2
jg 0x10036fa0
mov dword [ebp - 0xcc], 2
jmp 0x10036f61
push dword [ebp - 0x28]
lea ecx, [ebp - 0xc54]
call fcn.10027bb7
mov esi, eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0xc54]
call fcn.10027bb7
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10036f21
jmp 0x10037012
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x10036fe8
push 0x1f58
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov byte [ebp - 0x179], 0
movzx eax, byte [ebp - 0x179]
test eax, eax
je 0x10037012
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xec0]
call fcn.10027bb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc54]
call fcn.10027bb2
jmp 0x10036c6e
movzx eax, byte [0x10676238]
test eax, eax
je 0x10037053
mov esi, 0x10674830
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x1003bbbc
mov dword [ebp - 0x110], 0xffff
mov dword [ebp - 0x688], 0xfffd
mov dword [ebp - 0x6a0], 1
mov dword [ebp - 0x6b8], 9
cmp dword [ebp - 0x110], 0x1a9565e0
jle 0x10037093
mov dword [ebp - 0x810], 1
jmp 0x1003709a
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x810]
sub eax, dword [ebp - 0x110]
cmp eax, 0x6c516535
jle 0x100370b9
mov dword [ebp - 0xb98], 1
jmp 0x100370c0
and dword [ebp - 0xb98], 0
push 8
pop eax
test eax, eax
je 0x100370ce
cmp dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x110], eax
jl 0x100370e8
mov dword [ebp - 0x680], 1
jmp 0x100370ef
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x688]
imul eax, dword [ebp - 0x680]
test eax, eax
je 0x10037478
mov dword [ebp - 0xbc0], 0xd2964071
mov dword [ebp - 0x270], 0
jmp 0x10037127
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x10037143
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0x1b8], 0x9884cb8f
jmp 0x1003711a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1b8], 0
je 0x1003718e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1b8], 1
jl 0x1003716f
mov dword [ebp - 0x9a8], 1
jmp 0x10037176
and dword [ebp - 0x9a8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9a8]
mov dword [ebp + eax - 0x1b8], ecx
jmp 0x10037476
push 1
lea ecx, [ebp - 0xb54]
call fcn.10027b4a
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x698], 0x27720104
mov dword [ebp - 0xd48], 0xa7221ebc
mov dword [ebp - 0xd44], 0xa7221ebc
mov dword [ebp - 0xd40], 0xa7221ebc
mov dword [ebp - 0xd3c], 0xa7221ebc
lea ecx, [ebp - 0x3ee]
call fcn.1000927a
push eax
lea eax, [ebp - 0xd38]
push eax
lea eax, [ebp - 0xd48]
push eax
lea ecx, [ebp - 0x1138]
call fcn.10027bc6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xfb8]
call fcn.10027b8c
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x828], 0x3709e8e5
mov dword [ebp - 0x2d8], 0
jmp 0x10037230
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 1
jge 0x10037252
push dword [ebp - 0x2d8]
lea ecx, [ebp - 0xb54]
call fcn.10027bb7
mov dword [eax], 0x44f4
jmp 0x10037223
push 0
lea ecx, [ebp - 0xb54]
call fcn.10027bb7
cmp dword [eax], 0
je 0x10037279
cmp dword [ebp - 0x688], 0
je 0x10037279
mov dword [ebp - 0xa18], 1
jmp 0x10037280
and dword [ebp - 0xa18], 0
push 0
lea ecx, [ebp - 0xb54]
call fcn.10027bb7
cmp dword [eax], 0
je 0x100372d6
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x6a0], eax
je 0x100372ac
mov dword [ebp - 0x818], 1
jmp 0x100372b3
and dword [ebp - 0x818], 0
push 0
lea ecx, [ebp - 0xb54]
call fcn.10027bb7
mov ecx, dword [ebp - 0x818]
add ecx, dword [eax]
je 0x100372d6
mov dword [ebp - 0x690], 1
jmp 0x100372dd
and dword [ebp - 0x690], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b8]
cmp dword [ebp - 0x690], eax
jg 0x100372fe
mov dword [ebp - 0x8e0], 1
jmp 0x10037305
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0x698], eax
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0xaf0], eax
push 1
lea ecx, [ebp - 0xfb8]
call fcn.10027bb7
mov ecx, dword [ebp - 0xaf0]
mov dword [eax], ecx
mov eax, 0xce7aebb1
test eax, eax
je 0x10037350
cmp dword [ebp - 0x828], 0
je 0x10037350
and dword [ebp - 0x820], 0
cmp dword [ebp - 0x820], 0x9c3997b
jge 0x1003736f
jmp 0x10037490
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x10037490
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 1
lea ecx, [ebp - 0xed8]
call fcn.10027b4a
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x308], 0x5ccc90a3
mov dword [ebp - 0x278], 0
jmp 0x100374c7
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 1
jge 0x100374e9
push dword [ebp - 0x278]
lea ecx, [ebp - 0xed8]
call fcn.10027bb7
mov dword [eax], 0x5dcec3d7
jmp 0x100374ba
mov dword [ebp - 0x308], 0
jmp 0x10037502
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
jg 0x10037552
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0x1d8], 0
jmp 0x1003752e
mov eax, dword [ebp - 0x1d8]
dec eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0
jl 0x10037550
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0xed8]
call fcn.10027bb7
mov dword [eax], 1
jmp 0x10037521
jmp 0x100374f5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xed8]
call fcn.10027bb2
mov dword [ebp - 0x2e0], 1
mov dword [ebp - 0x280], 0
jmp 0x10037584
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 3
jge 0x100375a0
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0x10b8], 0
jmp 0x10037577
mov dword [ebp - 0x2e0], 0x15
jmp 0x100375b9
cmp dword [ebp - 0x2e0], 0xffffffe3
je 0x10037633
mov dword [ebp - 0x1e0], 9
mov byte [ebp - 0x18e], 0
movzx eax, byte [ebp - 0x18e]
test eax, eax
je 0x100375f9
mov dword [ebp - 0xd70], 8
mov dword [ebp - 0xd6c], 8
mov dword [ebp - 0xd68], 8
mov dword [ebp - 0xd64], 8
lea ecx, [ebp - 0x34d]
call fcn.1000927a
push eax
lea eax, [ebp - 0xd60]
push eax
lea eax, [ebp - 0xd70]
push eax
lea ecx, [ebp - 0x1118]
call fcn.10027bc6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xfc8]
call fcn.10027b8c
mov dword [ebp - 4], 0x23
mov dword [ebp - 0x1e8], 6
mov dword [ebp - 0x1090], 0x3fa75c1
mov dword [ebp - 0x1e8], 0
jmp 0x100376c4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret