Function at 0x10033f2b
Capabilities:
Accept command line arguments
Create directory
Create thread
Enumerate gui resources
Get disk information
Get file attributes
Identify system language via api
Parse pe header
Query environment variable
Query or enumerate registry value
Query service status
Read .ini file
Resume thread

Disassembly:
mov eax, 0x10083546
call fcn.10082230
mov eax, 0x14e4
call fcn.1007e9e0
push ebx
push esi
push edi
mov dword [ebp - 0x34], 0xfffffffa
xor eax, eax
mov dword [ebp - 0x24], eax
push 3
mov dword [ebp - 0x48], 0xa023703a
mov byte [ebp - 0x61], dl
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x1c], eax
pop ebx
jmp 0x10033f74
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1098], 0x600d5493
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10033f63
push 2
mov dword [ebp - 0x34], 0xffffffe2
mov ecx, 0xee1c
pop edi
mov esi, 0x4e6c
cmp dword [ebp - 0x34], edi
jne 0x1003403e
mov dword [ebp - 0x748], ecx
mov dword [ebp - 0x744], ecx
mov dword [ebp - 0x740], ecx
mov dword [ebp - 0x73c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x73c]
cmp eax, 0xb6fd
mov eax, dword [ebp - 0x73c]
mov edx, dword [ebp - 0x34]
setge cl
add eax, ecx
add edx, eax
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
imul eax, ecx, 0xfffe
xor ecx, ecx
test eax, eax
mov dword [ebp - 0x1094], eax
mov eax, dword [ebp - 0x73c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
sub edx, eax
xor eax, eax
add edx, dword [ebp - 0x73c]
cmp edx, esi
setg al
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10034025
cmp dword [ebp - 0x24], eax
jne 0x1003402b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jle 0x1003401d
inc dword [ebp - 0x34]
mov ecx, 0xee1c
cmp dword [ebp - 0x34], edi
je 0x10033f96
jmp 0x10034040
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10034060
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1098], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10034048
xor eax, eax
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x48], 0xa023703a
mov dword [ebp - 0x1c], eax
jmp 0x10034087
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x108c], 0x600d5493
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10034076
mov dword [ebp - 0x34], 0xffffffe2
cmp dword [ebp - 0x34], edi
jne 0x10034144
mov dword [ebp - 0x764], ecx
mov dword [ebp - 0x760], ecx
mov dword [ebp - 0x75c], ecx
mov dword [ebp - 0x758], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x758]
cmp eax, 0xb6fd
mov eax, dword [ebp - 0x758]
mov edx, dword [ebp - 0x34]
setge cl
add eax, ecx
add edx, eax
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
imul eax, ecx, 0xfffe
xor ecx, ecx
test eax, eax
mov dword [ebp - 0x1088], eax
mov eax, dword [ebp - 0x758]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
sub edx, eax
xor eax, eax
add edx, dword [ebp - 0x758]
cmp edx, esi
setg al
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1003412b
cmp dword [ebp - 0x24], eax
jne 0x10034131
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jle 0x10034123
inc dword [ebp - 0x34]
mov ecx, 0xee1c
cmp dword [ebp - 0x34], edi
je 0x1003409c
jmp 0x10034146
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10034166
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x108c], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1003414e
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_SetWindowLongW]
xor edi, edi
push 0xffffffffffffffff
inc edi
mov dword [ebp - 0x24], 0x42eb90da
pop esi
mov dword [ebp - 0x14], edi
push 5
pop ecx
cmp dword [ebp - 0x24], eax
je 0x1003420a
mov dword [ebp - 0x20], 0x6535
mov dword [ebp - 0x14], 0x218e9934
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x20], eax
je 0x100341b2
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jl 0x100341b0
mov ecx, edi
jmp 0x100341b4
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp eax, edi
setle cl
xor eax, eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x100342b2
push 0xa30
push 0x1cba
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
jmp 0x100342b2
mov dword [ebp - 0x38], 0xb09b
mov dword [ebp - 0x14], 0x258d0336
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff9
jne 0x100342b4
mov dword [ebp - 0x34], 0x5261fc42
mov dword [ebp - 0x34], 0xfffffff9
jmp 0x10034240
cmp dword [ebp - 0x38], eax
jne 0x10034245
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
je 0x10034238
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10034280
mov eax, dword [ebp - 0x34]
xor edx, edx
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
neg edx
cmp eax, edx
setne cl
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x52772010
jge 0x10034280
xor eax, eax
mov ecx, eax
jmp 0x10034282
mov ecx, edi
xor eax, eax
cmp ecx, 0x3ea3
push 0
setl al
xor ecx, ecx
sub eax, 0xfff8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, esi
pop eax
setl cl
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff9
je 0x10034228
xor eax, eax
mov esi, dword [sym.imp.GDI32.dll_PtInRegion]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100342d2
push 0xc35
push 0x1fde
push eax
call esi
xor eax, eax
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x48], 0xa023703a
mov dword [ebp - 0x1c], eax
jmp 0x100342f9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10a4], 0x600d5493
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100342e8
mov dword [ebp - 0x34], 0xffffffe2
cmp dword [ebp - 0x34], 2
jne 0x100343bd
xor ecx, ecx
mov eax, 0xee1c
mov dword [ebp - 0x780], eax
mov dword [ebp - 0x77c], eax
mov dword [ebp - 0x778], eax
mov dword [ebp - 0x774], eax
mov eax, dword [ebp - 0x774]
cmp eax, 0xb6fd
mov eax, dword [ebp - 0x774]
mov edx, dword [ebp - 0x34]
setge cl
add eax, ecx
add edx, eax
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
imul eax, ecx, 0xfffe
xor ecx, ecx
test eax, eax
mov dword [ebp - 0x10a0], eax
mov eax, dword [ebp - 0x774]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
sub edx, eax
xor eax, eax
add edx, dword [ebp - 0x774]
cmp edx, 0x4e6c
setg al
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100343a8
cmp dword [ebp - 0x24], eax
jne 0x100343ae
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jle 0x100343a0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
je 0x10034310
jmp 0x100343bf
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x100343e1
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x10a4], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x100343c8
xor eax, eax
mov dword [ebp - 0x3c], 0x9696
lea ecx, [ebp - 0x10b4]
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x38], 0xa756a336
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x48], eax
push 2
call fcn.10018cbc
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 0xfffa
mov dword [ebp - 0x14], 0x1eb64d0
mov dword [ebp - 0x1c], eax
jmp 0x10034438
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x10b4]
call fcn.10018d20
mov dword [eax], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10034421
dec dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x2c]
cmp eax, ecx
jge 0x10034452
mov ecx, edi
jmp 0x10034456
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
sub ecx, eax
add ecx, dword [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10034472
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10b4]
call fcn.10018d1b
mov dword [ebp - 0x24], 0x42eb90da
xor eax, eax
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x24], eax
je 0x100345bc
mov dword [ebp - 0x20], 0x6535
mov dword [ebp - 0x14], 0x218e9934
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x20], eax
je 0x100344c0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jl 0x100344be
mov ecx, edi
jmp 0x100344c2
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp eax, edi
setle cl
xor eax, eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1003450f
push 0xa30
push 0x1cba
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push 5
pop ebx
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003452c
push 0xc35
push 0x1fde
push eax
call esi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1003454f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6ec], 0xb457
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10034537
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10034561
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x11
push 3
pop esi
jl 0x10034701
push esi
lea ecx, [ebp - 0x510]
call fcn.10018cbc
xor eax, eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x100345a8
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x510]
call fcn.10018d20
mov dword [eax], 0xfebb6748
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003458a
xor eax, eax
push eax
lea ecx, [ebp - 0x510]
call fcn.10018d20
and dword [eax], 0
jmp 0x100346bd
mov dword [ebp - 0x38], 0xb09b
push 5
mov dword [ebp - 0x14], 0x258d0336
pop ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff9
jne 0x10034514
mov dword [ebp - 0x34], 0x5261fc42
mov dword [ebp - 0x34], 0xfffffff9
jmp 0x100345f5
cmp dword [ebp - 0x38], eax
jne 0x100345fb
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffff
je 0x100345ed
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x1003463a
mov eax, dword [ebp - 0x34]
xor edx, edx
mov dword [ebp - 0x14], 0xffffffff
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
neg edx
cmp eax, edx
setne cl
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x52772010
jge 0x1003463a
xor eax, eax
mov ecx, eax
jmp 0x1003463c
mov ecx, edi
xor eax, eax
cmp ecx, 0x3ea3
push 0
setl al
xor ecx, ecx
sub eax, 0xfff8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
pop eax
setl cl
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff9
je 0x100345dd
jmp 0x10034512
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1003469a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6ec], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10034682
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100346af
push eax
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
xor eax, eax
push eax
lea ecx, [ebp - 0x510]
call fcn.10018d20
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x510]
push eax
call fcn.10018d20
cmp dword [eax], 0
jge 0x10034672
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x100346e3
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x510]
call fcn.10018d1b
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x11
jge 0x10034571
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x1c], 0xf6af1124
mov dword [ebp - 0x1c], eax
jmp 0x1003473d
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10034728
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003473a
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffee
jle 0x10034714
mov dword [ebp - 0x34], 0x6579763
mov dword [ebp - 0x24], 0x94543beb
cmp dword [ebp - 0x34], eax
je 0x10034861
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x18
jle 0x100348a1
mov dword [ebp - 0x38], 0xd89e1771
lea ecx, [ebp - 0xf18]
push esi
call fcn.10018cbc
xor eax, eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x100347b0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xf18]
call fcn.10018d20
mov dword [eax], 9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10034792
xor eax, eax
mov dword [ebp - 0x24], 0x4696a485
mov dword [ebp - 0x24], eax
jmp 0x10034839
mov dword [ebp - 0x30], 0xa0734f09
mov dword [ebp - 0x30], eax
jmp 0x10034830
mov dword [ebp - 0x20], 0x6887e0
mov dword [ebp - 0x14], 0x888a
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1003482d
mov dword [ebp - 0x44], 0x12ef
cmp dword [ebp - 0x2c], eax
jne 0x1003482d
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xf18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
xor eax, eax
push eax
call fcn.10018d20
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, edi
push 0
setge dl
mov dword [eax], edx
dec dword [ebp - 0x20]
pop eax
jns 0x100347de
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff8
jne 0x100347c8
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff8
jle 0x100347bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf18]
call fcn.10018d1b
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x18
jg 0x1003476e
jmp 0x1003489f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10034881
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6f4], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10034869
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x100348a1
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6f4], 2
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10034889
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], eax
jmp 0x10034b89
push 2
lea ecx, [ebp - 0x460]
call fcn.10018cbc
push esi
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 4], esi
call fcn.10018cbc
xor eax, eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10034900
push dword [ebp - 0x24]
lea ecx, [ebp - 0x460]
call fcn.10018d20
mov dword [eax], 0x6d444182
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x100348e1
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10034919
push dword [ebp - 0x24]
lea ecx, [ebp - 0x5e8]
call fcn.10018d20
and dword [eax], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10034905
push edi
lea ecx, [ebp - 0x460]
call fcn.10018d20
and dword [eax], 0
jmp 0x10034b57
mov dword [ebp - 0x34], 0x9949dfcf
lea ecx, [ebp - 0x93c]
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x3c], edi
push esi
call fcn.10018cbc
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1003497a
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x93c]
call fcn.10018d20
mov dword [eax], 0x869e7721
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003495c
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003499a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xf
jge 0x10034b3a
mov dword [ebp - 0x10], 0x8abc106e
mov dword [ebp - 0x44], 0xffffffff
cmp dword [ebp - 0x34], eax
jne 0x10034b34
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x10034b27
mov dword [ebp - 0x2c], 0x1f3403ca
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 0x2c], 0xd574417f
mov eax, dword [ebp - 0x34]
sub eax, 0x192ab139
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
call fcn.10018d20
xor ecx, ecx
cmp dword [eax], 0xffffffff
sete cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x5e8]
push eax
call fcn.10018d20
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, 0x6689
setg dl
sub edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [eax]
jle 0x10034a31
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10034a3a
jmp 0x10034a33
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10034a3a
mov eax, edi
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x5e8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
push 2
call fcn.10018d20
mov edx, dword [ebp - 0x2c]
mov esi, eax
mov ecx, dword [ebp - 0x28]
xor eax, eax
cmp ecx, edx
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x10]
setne al
xor edx, edx
neg eax
cmp eax, ecx
lea ecx, [ebp - 0x5e8]
setl dl
add edx, dword [esi]
mov dword [ebp - 0x38], edx
call fcn.10018d20
xor ebx, ebx
lea ecx, [ebp - 0x93c]
push 2
mov eax, dword [eax]
neg eax
cmp eax, dword [ebp - 0x38]
setle bl
call fcn.10018d20
mov ecx, dword [ebp - 0x3c]
mov esi, eax
xor eax, eax
cmp ebx, ecx
mov ecx, dword [ebp - 0x10]
setle al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x460]
push edi
setne dl
add edx, dword [ebp - 0x34]
mov dword [esi], edx
call fcn.10018d20
cmp dword [eax], 0
jne 0x10034b0d
push 2
lea ecx, [ebp - 0x93c]
call fcn.10018d20
xor edx, edx
cmp dword [eax], 0x4f5c6f0d
mov eax, dword [ebp - 0x3c]
setle dl
imul eax, dword [ebp - 0x34]
neg edx
xor ecx, ecx
cmp eax, edx
setg cl
cmp ecx, dword [ebp - 0x28]
jle 0x10034b00
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x10034b02
mov eax, edi
cmp dword [ebp - 0x10], eax
jl 0x10034b0d
xor eax, eax
mov edx, eax
jmp 0x10034b0f
mov edx, edi
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x14], ecx
dec dword [ebp - 0x10]
jns 0x100349ce
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xf
jl 0x100349a7
push 3
pop esi
push 5
pop ebx
lea ecx, [ebp - 0x93c]
mov byte [ebp - 4], 4
call fcn.10018d1b
push edi
lea ecx, [ebp - 0x460]
call fcn.10018d20
inc dword [eax]
push edi
lea ecx, [ebp - 0x460]
call fcn.10018d20
cmp dword [eax], 4
jg 0x10034932
lea ecx, [ebp - 0x5e8]
call fcn.10018d1b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x460]
call fcn.10018d1b
dec dword [ebp - 0x28]
push 0xfffffffffffffffb
pop eax
cmp dword [ebp - 0x28], eax
jge 0x100348b6
mov dword [ebp - 0x48], 0xa023703a
lea ecx, [ebp - 0xaec]
mov dword [ebp - 0x14], 0x8e5ccc90
push esi
call fcn.10018cbc
mov dword [ebp - 4], 6
xor eax, eax
push 0xfffffffffffffffc
mov dword [ebp - 0x38], 0xa4bedcc5
pop ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10034beb
push dword [ebp - 0x24]
lea ecx, [ebp - 0xaec]
call fcn.10018d20
mov dword [eax], 0x15747814
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10034bcd
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10034c01
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x72c], 0xfffffffe
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10034bf0
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xaec]
xor eax, eax
push eax
call fcn.10018d20
cmp dword [eax], 0
jne 0x10034c35
xor eax, eax
lea ecx, [ebp - 0xaec]
push eax
call fcn.10018d20
cmp dword [eax], 0
jne 0x10034c35
xor eax, eax
mov edx, eax
jmp 0x10034c37
mov edx, edi
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0xaec]
setne dl
mov dword [ebp - 0x72c], edx
mov dword [ebp - 0x44], edx
or dword [ebp - 4], 0xffffffff
call fcn.10018d1b
mov dword [ebp - 0x34], ebx
xor eax, eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], eax
jmp 0x10034c81
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x21c], 0xe57ad95e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10034c70
mov dword [ebp - 0x21c], 0xc204e2db
mov ecx, 0xffff
mov eax, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x210]
xor eax, eax
cmp dword [ebp - 0x210], eax
jg 0x10034d5f
mov dword [ebp - 0x14], 0x361a
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0x6a5b5cf0
mov dword [ebp - 0x1c], eax
jmp 0x10034cd7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10dc], 0xcadfb1af
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10034cc6
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
add ecx, eax
mov dword [ebp - 0x10d8], ecx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x21c]
setne dl
xor ebx, ebx
imul edx, eax
mov eax, dword [ebp - 0x214]
cmp edx, eax
mov eax, dword [ebp - 0x21c]
setne bl
sub ebx, 0xb90f
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x21c]
cmp ecx, eax
mov eax, dword [ebp - 0x21c]
setne dl
imul eax, edx
cmp eax, 0xffff
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x21c], eax
jmp 0x10034e4c
mov dword [ebp - 0x14], 0xdee94ccb
xor ecx, ecx
mov dword [ebp - 0x30], 0x5e3970c0
mov dword [ebp - 0x2c], 0x744fa755
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x21c], edi
mov eax, dword [ebp - 0x34]
cmp eax, edi
setge cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setge dl
xor eax, eax
cmp eax, edx
mov eax, dword [ebp - 0x30]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne bl
xor ecx, ecx
sub ebx, 0xd0294e
cmp ebx, eax
setle cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10034e3c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10034e0a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf30], 0x6abe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10034df2
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10034e2d
mov eax, dword [ebp - 0xf28]
mov eax, dword [ebp - 0xf30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x21c]
imul eax, dword [ebp - 0xf30], 0xaf71
mov dword [ebp - 0x2c], eax
jmp 0x10034e4c
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10034e4e
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10034e6e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10c4], 0x600d5493
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10034e56
xor eax, eax
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0xc54]
mov dword [ebp - 0x48], 0xc07e17f7
push edi
call fcn.10018cbc
mov dword [ebp - 4], 7
lea ecx, [ebp - 0xf48]
mov dword [ebp - 0x44], edi
push 0xfffffffffffffffb
mov dword [ebp - 0x38], 0x47ad
pop eax
mov dword [ebp - 0x48], 0x3a6c
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x48], eax
push edi
call fcn.10018cbc
mov byte [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x2c], 0x212aeafd
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10034ee7
push dword [ebp - 0x24]
lea ecx, [ebp - 0xc54]
call fcn.10018d20
mov dword [eax], 0x3fbb4ebb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10034ec9
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10034f03
push dword [ebp - 0x24]
lea ecx, [ebp - 0xf48]
call fcn.10018d20
mov dword [eax], 0x870004dd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10034eec
dec dword [ebp - 0x2c]
jne 0x10034f3d
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edi
setg cl
xor eax, eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jne 0x10034f3d
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0xf48]
xor eax, eax
push eax
call fcn.10018d20
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x10034f3f
mov esi, eax
jmp 0x10034f41
xor eax, eax
mov esi, edi
push eax
lea ecx, [ebp - 0xc54]
call fcn.10018d20
neg esi
lea ecx, [ebp - 0xf48]
mov dword [eax], esi
call fcn.10018d1b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc54]
call fcn.10018d1b
push 2
mov dword [ebp - 0x20], 0xffffffe2
pop esi
cmp dword [ebp - 0x20], esi
jne 0x100357c2
push 3
pop ebx
push edi
lea ecx, [ebp - 0x1ac]
call fcn.10018cbc
mov dword [ebp - 4], 9
lea ecx, [ebp - 0xc90]
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x38], edi
push ebx
call fcn.10018cbc
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10034fcc
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x7d8], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10034fb8
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x10034ff2
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1ac]
call fcn.10018d20
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10034fd4
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10035012
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc14], 0xe24307a3
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10034ffa
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10035038
push dword [ebp - 0x28]
lea ecx, [ebp - 0xc90]
call fcn.10018d20
mov dword [eax], 0xb8ce
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1003501a
xor eax, eax
push eax
lea ecx, [ebp - 0x1ac]
call fcn.10018d20
lea ecx, [ebp - 0x1ac]
mov dword [eax], edi
xor eax, eax
push eax
call fcn.10018d20
cmp dword [eax], 0
jl 0x10035155
mov dword [ebp - 0x14], 0xffffffff
xor eax, eax
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x44], 0xb756fd8c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10035094
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf00], 9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003507c
xor eax, eax
push eax
lea ecx, [ebp - 0x1ac]
call fcn.10018d20
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x7d8]
mov dword [ebp - 0x14], eax
inc dword [ebp - 0xf00]
mov eax, dword [ebp - 0xf00]
jne 0x100350bd
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x7d4]
lea ecx, [ebp - 0x1ac]
mov eax, dword [ebp - 0xc10]
xor eax, eax
push eax
call fcn.10018d20
mov ecx, 0xf545
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x7d8]
sub ecx, eax
mov dword [ebp - 0xc14], ecx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x1ac]
mov eax, dword [ebp - 0x14]
sub eax, 0xff5ecce3
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
xor eax, eax
push eax
call fcn.10018d20
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x1ac]
add esi, dword [eax]
xor eax, eax
push eax
call fcn.10018d20
xor ecx, ecx
cmp esi, dword [eax]
setne cl
xor eax, eax
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x1ac]
push eax
call fcn.10018d20
lea ecx, [ebp - 0x1ac]
dec dword [eax]
xor eax, eax
push eax
call fcn.10018d20
cmp dword [eax], 0
jge 0x1003505d
push 2
pop esi
xor eax, eax
lea ecx, [ebp - 0xc90]
push eax
call fcn.10018d20
lea ecx, [ebp - 0xc90]
inc dword [eax]
call fcn.10018d1b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1ac]
call fcn.10018d1b
mov eax, 0xee1c
lea ecx, [ebp - 0x360]
mov dword [ebp - 0x794], eax
mov dword [ebp - 0x790], eax
mov dword [ebp - 0x78c], eax
mov dword [ebp - 0x788], eax
mov dword [ebp - 0x30], 0x62d5e48d
push esi
call fcn.10018cbc
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x38], 0x5c1f4aca
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100351e0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x360]
call fcn.10018d20
mov dword [eax], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100351cd
mov dword [ebp - 0x30], 0x14
cmp dword [ebp - 0x30], 0x15
jge 0x10035320
mov dword [ebp - 0x34], edi
xor edx, edx
mov dword [ebp - 0x48], 0x3d3abba7
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setle dl
xor eax, eax
test edx, edx
setg al
cmp eax, dword [ebp - 0x30]
jge 0x10035224
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10035226
mov esi, eax
jmp 0x10035228
xor eax, eax
mov esi, edi
push eax
lea ecx, [ebp - 0x360]
call fcn.10018d20
xor ecx, ecx
cmp esi, dword [eax]
sete cl
cmp ecx, dword [ebp - 0x34]
jne 0x10035243
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x1c], eax
jmp 0x10035265
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x115c], 0xfffffff8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10035254
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x360]
push edi
call fcn.10018d20
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x360]
setg bl
xor eax, eax
push eax
call fcn.10018d20
xor ecx, ecx
mov edx, dword [eax]
mov eax, dword [ebp - 0x10]
add edx, ebx
cmp edx, eax
setge cl
cmp ecx, 0xc9063832
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, esi
setg al
sub eax, 0x3b19
jne 0x100352cc
cmp dword [ebp - 0x115c], eax
je 0x100352ce
mov eax, edi
cmp eax, dword [ebp - 0x34]
je 0x100352d6
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x360]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
push eax
call fcn.10018d20
xor eax, eax
lea ecx, [ebp - 0x360]
push eax
call fcn.10018d20
push edi
lea ecx, [ebp - 0x360]
call fcn.10018d20
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x15
jl 0x100351f6
push 3
pop ebx
push 2
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x360]
call fcn.10018d1b
mov eax, dword [ebp - 0x788]
xor ecx, ecx
cmp eax, 0xb6fd
mov eax, dword [ebp - 0x788]
mov edx, dword [ebp - 0x20]
setge cl
add eax, ecx
add edx, eax
mov eax, dword [ebp - 0x20]
neg edx
push ebx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
imul eax, ecx, 0xfffe
xor ecx, ecx
test eax, eax
mov dword [ebp - 0x10c0], eax
mov eax, dword [ebp - 0x788]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x528]
setge dl
sub edx, eax
xor eax, eax
add edx, dword [ebp - 0x788]
cmp edx, 0x4e6c
setg al
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
call fcn.10018cbc
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x1c], eax
jmp 0x100353c6
push dword [ebp - 0x1c]
call fcn.10018d20
mov dword [eax], 0xf5540d7f
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x528]
cmp dword [ebp - 0x1c], ebx
jl 0x100353b5
push esi
call fcn.10018d20
mov dword [eax], 0xfffffff0
jmp 0x10035403
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x100353f5
push 0xeac
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push esi
lea ecx, [ebp - 0x528]
call fcn.10018d20
inc dword [eax]
push esi
lea ecx, [ebp - 0x528]
call fcn.10018d20
cmp dword [eax], 0x18
jge 0x100353df
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x528]
call fcn.10018d1b
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x100357aa
mov dword [ebp - 0x34], 0xc03342eb
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10035457
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb0], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003543f
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10035473
push 0x6de
push 0x1dec
push eax
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffea
jl 0x100357a2
mov dword [ebp - 0x2c], 0x263126ff
push 0xfffffffffffffffb
pop ecx
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov dword [ebp - 0x4c8], 0xf928d9ba
mov dword [ebp - 0x4c4], 0xf928d9ba
mov dword [ebp - 0x4c0], 0xf928d9ba
mov dword [ebp - 0x4bc], 0xf928d9ba
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
imul eax, dword [ebp - 0x34], 0xc218
sub eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
cmp eax, 0xfffffff9
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
add eax, 8
add eax, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0xd
jmp 0x10035788
mov dword [ebp - 0x44], 6
lea ecx, [ebp - 0x700]
mov dword [ebp - 0x86c], 0xf118c84b
mov dword [ebp - 0x868], 0xf118c84b
mov dword [ebp - 0x864], 0xf118c84b
mov dword [ebp - 0x860], 0xf118c84b
push ebx
call fcn.10018cbc
xor eax, eax
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x1c], eax
jmp 0x10035561
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x700]
call fcn.10018d20
mov dword [eax], 0xcc8af953
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003554a
dec dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x4c4], ecx
mov eax, dword [ebp - 0xb0]
add eax, ecx
je 0x100356eb
mov dword [ebp - 0x50], 0x1495dd68
xor eax, eax
mov dword [ebp - 0x14], 0x900
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x100355b3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa8], 0xfffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003559b
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x100355d3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6e8], 0x36403ac4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100355bb
xor eax, eax
cmp dword [ebp - 0x4c4], eax
jne 0x100355ea
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x700]
mov eax, dword [ebp - 0x34]
push esi
call fcn.10018d20
mov ecx, dword [ebp - 0x34]
xor edx, edx
sub ecx, 0x3ea3a722
cmp ecx, 0x28c040c8
push edi
setg dl
xor ecx, ecx
cmp edx, dword [eax]
setge cl
mov dword [ebp - 0x4c0], ecx
lea ecx, [ebp - 0x700]
call fcn.10018d20
mov edx, dword [ebp - 0x14]
mov esi, eax
mov ecx, dword [ebp - 0x4bc]
xor eax, eax
cmp ecx, edx
push 2
setle al
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0xa8]
setg cl
xor edx, edx
add ecx, 0xfffffff9
cmp ecx, eax
mov eax, dword [ebp - 0x4c0]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x860]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xa8]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
add ecx, 0xfffffff7
cmp ecx, eax
setge dl
add edx, dword [ebp - 0xb0]
imul edx, dword [esi]
pop esi
push esi
mov dword [ebp - 0x6e8], edx
xor edx, edx
mov eax, dword [ebp - 0x44]
cmp eax, 0xffffffff
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0xa8]
setg cl
xor ebx, ebx
cmp ecx, 0x39b9aa6b
lea ecx, [ebp - 0x700]
setge bl
sub ebx, eax
call fcn.10018d20
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x50]
push 3
setge dl
sub ecx, edx
mov dword [eax], ecx
pop ebx
jmp 0x10035776
xor eax, eax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x1c], eax
jmp 0x1003570a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x12f4], 0x7302
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100356f9
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x12ec], eax
mov ecx, dword [ebp - 0x44]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, edi
setg al
cmp eax, 0xffffffff
je 0x10035748
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1003574a
mov ecx, edi
jmp 0x1003574c
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0xfffffff7
setge al
mov dword [ebp - 0x868], eax
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10035776
push 0x183f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x700]
call fcn.10018d1b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x19
jge 0x10035501
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffea
push 0
pop eax
jge 0x10035480
cmp dword [ebp - 0x28], eax
jne 0x100357b4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jle 0x1003542d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
je 0x10034f81
jmp 0x100357c4
xor eax, eax
mov dword [ebp - 0x14], 0xfffc
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], 0x7a9413e4
mov dword [ebp - 0x14], 0x4177fd8b
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x100357fd
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5c], 0x10afbd13
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x100357e8
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1003581f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x13d8], 0x158f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10035806
xor eax, eax
push 3
mov dword [ebp - 0x28], eax
pop esi
jmp 0x10035838
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1354], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10035827
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setl dl
cmp edx, dword [ebp - 0x1c]
je 0x10035876
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], 7
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x13d0], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x5c]
cmp eax, 0xfffffff5
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
cmp eax, ecx
push 6
setne dl
sub edx, 0xc1cc
neg edx
pop ebx
sbb edx, edx
xor eax, eax
inc edx
add edx, ebx
mov dword [ebp - 0x1350], edx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x100358ea
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x10c4], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x100358d2
xor eax, eax
mov dword [ebp - 0x3c], 0x9696
lea ecx, [ebp - 0x10d4]
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x38], 0xa756a336
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x48], eax
push 2
call fcn.10018cbc
mov dword [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x2c], 0xfffa
mov dword [ebp - 0x14], 0x1eb64d0
mov dword [ebp - 0x1c], eax
jmp 0x10035941
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x10d4]
call fcn.10018d20
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1003592e
dec dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x2c]
cmp eax, ecx
jge 0x1003595b
mov ecx, edi
jmp 0x1003595f
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
sub ecx, eax
add ecx, dword [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1003597b
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10d4]
call fcn.10018d1b
mov ebx, dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
mov dword [ebp - 0x20], 0xe1757117
mov dword [ebp - 0x20], 0x14
cmp dword [ebp - 0x20], 0xfffffffa
jge 0x100359f2
xor eax, eax
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x38], 0xb363f9e9
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100359c8
push eax
push 0x15d2
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffffa
jl 0x100359e9
mov dword [ebp - 0x44], 0x9b79
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffa
jge 0x100359d1
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffa
jl 0x100359a6
mov dword [ebp - 0x24], 0x42eb90da
xor eax, eax
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x24], eax
je 0x10035a8d
mov dword [ebp - 0x20], 0x6535
mov dword [ebp - 0x14], 0x218e9934
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x20], eax
je 0x10035a31
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jl 0x10035a2f
mov ecx, edi
jmp 0x10035a33
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp eax, edi
setle cl
xor eax, eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10035b3f
push 0xa30
push 0x1cba
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x10035b3f
mov dword [ebp - 0x38], 0xb09b
mov dword [ebp - 0x14], 0x258d0336
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff9
jne 0x10035b41
mov dword [ebp - 0x34], 0x5261fc42
mov dword [ebp - 0x34], 0xfffffff9
jmp 0x10035ac7
cmp dword [ebp - 0x38], eax
jne 0x10035acd
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffff
je 0x10035abf
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10035b0c
mov eax, dword [ebp - 0x34]
xor edx, edx
mov dword [ebp - 0x14], 0xffffffff
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
neg edx
cmp eax, edx
setne cl
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x52772010
jge 0x10035b0c
xor eax, eax
mov ecx, eax
jmp 0x10035b0e
mov ecx, edi
xor eax, eax
cmp ecx, 0x3ea3
push 0
setl al
xor ecx, ecx
sub eax, 0xfff8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
pop eax
setl cl
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff9
je 0x10035aaf
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10035b5b
push 0xc35
push 0x1fde
push eax
call dword [sym.imp.GDI32.dll_PtInRegion]
push esi
lea ecx, [ebp - 0xb40]
call fcn.10018cbc
mov dword [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10035b9d
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb40]
call fcn.10018d20
mov dword [eax], 0x4a8c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10035b7f
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10035bb9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x954], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10035ba5
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jg 0x10035be1
mov dword [ebp - 0x14], 0x82a1836c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x950], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
push 0
pop eax
jle 0x10035bc2
push eax
lea ecx, [ebp - 0xb40]
call fcn.10018d20
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0xb40]
mov eax, dword [ebp - 0x950]
mov esi, 0x8a06
mov eax, dword [ebp - 0x34]
sub esi, eax
sub esi, dword [ebp - 0x94c]
neg esi
sbb esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x94c], esi
push eax
call fcn.10018d20
xor edx, edx
mov ecx, dword [eax]
mov eax, dword [ebp - 0x34]
add ecx, esi
cmp eax, ecx
lea ecx, [ebp - 0xb40]
setl dl
xor eax, eax
cmp edx, 0xe327
setne al
mov dword [ebp - 0x34], eax
or dword [ebp - 4], 0xffffffff
call fcn.10018d1b
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10035c6f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6b8], 0xb457
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10035c57
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10035c81
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x11
push 3
pop esi
jl 0x10035d6c
push esi
lea ecx, [ebp - 0x6a8]
call fcn.10018cbc
xor eax, eax
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10035ccc
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x6a8]
call fcn.10018d20
mov dword [eax], 0xfebb6748
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10035cae
xor eax, eax
push eax
lea ecx, [ebp - 0x6a8]
call fcn.10018d20
and dword [eax], 0
jmp 0x10035d28
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x10035d05
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6b8], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10035ced
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10035d1a
push eax
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
xor eax, eax
push eax
lea ecx, [ebp - 0x6a8]
call fcn.10018d20
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x6a8]
push eax
call fcn.10018d20
cmp dword [eax], 0
jge 0x10035cdd
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10035d4e
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6a8]
call fcn.10018d1b
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x11
jge 0x10035c91
xor eax, eax
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x14], 0xa61bf079
mov dword [ebp - 0x38], 0xb489f7a9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10035da3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8fc], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10035d8a
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10035dc5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10f0], 0x89d2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10035dac
xor eax, eax
mov dword [ebp - 0x34], eax
mov edx, 0x9beab1d6
cmp dword [ebp - 0x34], esi
jg 0x10035e35
mov eax, dword [ebp - 0x8f8]
mov ecx, 0xffff
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x8fc]
mov eax, dword [ebp - 0x10f0]
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x8fc]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x8fc]
cmp ecx, eax
sbb eax, eax
neg eax
cmp edx, eax
mov eax, dword [ebp - 0x34]
sbb ecx, ecx
inc ecx
mov eax, dword [ebp + eax*4 - 0x8fc]
imul eax, dword [ebp - 0x8f0]
imul eax, ecx
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x10035dd2
xor eax, eax
mov dword [ebp - 0x34], 0x24a8c6a5
push 0xfffffffffffffff6
pop ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x48], 0x7be9fb1c
mov dword [ebp - 0x48], 0x5739
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x48], 0xedd1edb6
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
jmp 0x10035e77
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x142c], 0x1078932
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10035e66
mov dword [ebp - 0x34], 0x17
cmp dword [ebp - 0x34], ecx
jle 0x10035f54
mov dword [ebp - 0x20], 2
lea ecx, [ebp - 0x918]
push 2
call fcn.10018cbc
xor eax, eax
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10035ece
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x918]
call fcn.10018d20
and dword [eax], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10035eb2
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10035f45
mov dword [ebp - 0x20], eax
jmp 0x10035f20
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x10035f1d
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10035f07
push 0x186e
push 0xc9a
push eax
push 0x21da
push eax
call dword [sym.imp.USER32.dll_GetMenuStringW]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x918]
call fcn.10018d20
dec dword [ebp - 0x1c]
push 0
pop eax
jns 0x10035ee7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x10035ed8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x918]
call fcn.10018d1b
dec dword [ebp - 0x34]
push 0xfffffffffffffff6
pop eax
cmp dword [ebp - 0x34], eax
jg 0x10035e8c
jmp 0x10035f54
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x918]
call fcn.10018d1b
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x10e8]
mov dword [ebp - 0x3c], 0x9696
xor eax, eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x38], 0xa756a336
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x48], eax
push 2
call fcn.10018cbc
mov dword [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x2c], 0xfffa
mov dword [ebp - 0x14], 0x1eb64d0
mov dword [ebp - 0x1c], eax
jmp 0x10035fb4
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x10e8]
call fcn.10018d20
mov dword [eax], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10035f9d
dec dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x2c]
cmp eax, ecx
jge 0x10035fce
mov ecx, edi
jmp 0x10035fd2
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
sub ecx, eax
add ecx, dword [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10035fee
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10e8]
call fcn.10018d1b
mov dword [ebp - 0x38], 0x97e780ca
xor eax, eax
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0x3631e19e
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003603a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x140], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10036022
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10036050
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x540], 0x58bdfadf
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003603f
mov eax, dword [ebp - 0x140]
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x140]
je 0x10036087
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x538]
inc eax
imul ecx, eax
test ecx, ecx
je 0x10036087
mov eax, edi
jmp 0x10036089
xor eax, eax
add eax, 0x2fc4eb
cmp dword [ebp - 0x140], eax
jge 0x1003609c
mov eax, dword [ebp - 0x53c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x138]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x53c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jg 0x1003617f
mov dword [ebp - 0x14], 0x289ed5b6
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100360e1
push 0x19f4
push 0x2499
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp - 0x28]
xor edx, edx
push 0
mov eax, dword [ebp + eax*4 - 0x140]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x140]
add ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x140]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp + eax*4 - 0x540]
cmp dword [ebp - 0x14], 7
sbb eax, eax
neg eax
add esi, eax
mov eax, dword [ebp - 0x28]
neg esi
sbb esi, esi
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x540]
neg esi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x140]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x140]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, esi
setl al
mov dword [ebp - 0x540], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
pop eax
jle 0x100360c0
push 0xfffffffffffffffa
mov dword [ebp - 0x20], 0xe1757117
mov dword [ebp - 0x20], 0x14
pop esi
jmp 0x100361d6
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x38], 0xb363f9e9
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100361b4
push eax
push 0x15d2
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jl 0x100361d3
mov dword [ebp - 0x44], 0x9b79
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jge 0x100361bc
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10036192
push 2
lea ecx, [ebp - 0x96c]
call fcn.10018cbc
mov dword [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x20], 0xdf2f4a8b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10036220
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x96c]
call fcn.10018d20
mov dword [eax], 0xf0ea75c9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10036201
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jg 0x10036256
xor ebx, ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x96c]
call fcn.10018d20
cmp dword [eax], ebx
jne 0x10036256
push dword [ebp - 0x20]
lea ecx, [ebp - 0x96c]
call fcn.10018d20
cmp dword [eax], ebx
jne 0x10036256
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x1003622a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x96c]
call fcn.10018d1b
xor eax, eax
mov dword [ebp - 0x34], 0xffffffff
push 0x1b
mov dword [ebp - 0x34], eax
pop ebx
jmp 0x100363ac
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x20], 0xffffffed
cmp dword [ebp - 0x20], ebx
jg 0x100363a9
mov dword [ebp - 0x1c], eax
jmp 0x100362a6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbc], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10036295
mov dword [ebp - 0xbc], 0xffffffeb
jmp 0x1003638e
push edi
lea ecx, [ebp - 0xdd4]
call fcn.10018cbc
xor eax, eax
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x100362ef
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x90], 0xd3f7bf48
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100362d7
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10036312
push dword [ebp - 0x10]
lea ecx, [ebp - 0xdd4]
call fcn.10018d20
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100362f7
xor eax, eax
mov dword [ebp - 0x90], 0xfffffff9
jmp 0x10036370
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x38], 0x83dc0e3e
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10036341
cmp dword [ebp - 0x90], 0x10
jg 0x1003631e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdd4]
call fcn.10018d1b
inc dword [ebp - 0xbc]
cmp dword [ebp - 0xbc], ebx
jle 0x100362ba
inc dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], ebx
jle 0x10036290
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xc
jl 0x10036279
push edi
lea ecx, [ebp - 0xec]
call fcn.10018cbc
push edi
lea ecx, [ebp - 0xc6c]
mov dword [ebp - 4], 0x15
call fcn.10018cbc
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x14], 0x5231fbf6
mov dword [ebp - 0x38], 0x193208af
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1003640f
push dword [ebp - 0x10]
lea ecx, [ebp - 0xec]
call fcn.10018d20
mov dword [eax], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100363f1
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10036435
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc6c]
call fcn.10018d20
mov dword [eax], 0x7ad4351c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10036417
xor eax, eax
push eax
lea ecx, [ebp - 0xec]
call fcn.10018d20
xor eax, eax
lea ecx, [ebp - 0xec]
push eax
call fcn.10018d20
xor eax, eax
lea ecx, [ebp - 0xec]
push eax
call fcn.10018d20
mov esi, eax
lea ecx, [ebp - 0xec]
xor eax, eax
push eax
call fcn.10018d20
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xec]
setg bl
xor eax, eax
push eax
call fcn.10018d20
cmp dword [eax], ebx
jl 0x1003649f
xor eax, eax
lea ecx, [ebp - 0xec]
push eax
call fcn.10018d20
cmp dword [eax], 0
je 0x1003649f
mov eax, edi
jmp 0x100364a1
xor eax, eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xec]
xor eax, eax
push eax
call fcn.10018d20
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0xec]
add esi, dword [eax]
xor eax, eax
push eax
call fcn.10018d20
cmp esi, dword [eax]
je 0x100364d7
xor eax, eax
lea ecx, [ebp - 0xec]
push eax
call fcn.10018d20
xor eax, eax
lea ecx, [ebp - 0xec]
push eax
call fcn.10018d20
xor eax, eax
lea ecx, [ebp - 0xc6c]
push eax
call fcn.10018d20
mov esi, eax
lea ecx, [ebp - 0xec]
xor eax, eax
push eax
call fcn.10018d20
mov ecx, dword [eax]
xor eax, eax
mov dword [esi], ecx
lea ecx, [ebp - 0xec]
push eax
call fcn.10018d20
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp dword [esi], ecx
setle dl
xor ecx, ecx
cmp dword [eax], edx
setge cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xc6c]
call fcn.10018d1b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec]
call fcn.10018d1b
mov dword [ebp - 0x24], 0x42eb90da
xor eax, eax
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10036573
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x11c4], 0x648261f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003655b
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10036585
mov dword [ebp - 0x38], 0xd9ba
mov dword [ebp - 0x38], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10036578
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003659a