Function at 0x10031af5
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check os version
Contain obfuscated stackstrings
Create directory
Create pipe
Create thread
Delete file
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get file attributes
Get file system object information
Get geographical location
Get graphical window text
Identify system language via api
Parse pe header
Query environment variable
Query or enumerate registry value
Read .ini file
Resume thread
Set registry value
Set thread local storage value
Start service

Disassembly:
mov eax, 0x10080f19
call fcn.1007fd5c
mov eax, 0x12ec
call fcn.1007be20
push ebx
push esi
push edi
push 7
mov dword [ebp - 0x1c], 0xa5d6c05b
xor eax, eax
mov dword [ebp - 0x38], 0xd535dd25
pop ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xd
push 0xffffffffffffffff
mov byte [ebp - 0x61], dl
mov dword [ebp - 0x60], ecx
pop edi
jge 0x10031e93
movdqa xmm0, xmmword [0x100080c0]
lea eax, [ebp - 0xe9c]
push eax
lea eax, [ebp - 0xeac]
push eax
lea ecx, [ebp - 0x1194]
movdqu xmmword [ebp - 0xeac], xmm0
call fcn.10016fc2
lea ecx, [ebp - 0x235]
mov esi, eax
call fcn.10008fe8
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xfc]
push dword [esi]
call fcn.10016f88
xor eax, eax
lea ecx, [ebp - 0xfc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0x79d62bfe
mov dword [ebp - 0x48], 0xcc425f8e
mov dword [ebp - 0x58], 0x9b5f814d
push eax
call fcn.10016fb3
push 3
lea ecx, [ebp - 0xfc]
call fcn.10016fb3
mov ecx, dword [ebp - 0x1c]
cmp ebx, ecx
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xfc]
setl bl
xor eax, eax
push eax
call fcn.10016fb3
lea ecx, [ebp - 0xfc]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, ebx
call fcn.10016fb3
push 5
pop ebx
lea ecx, [ebp - 0xfc]
mov eax, dword [eax]
imul eax, esi
cmp eax, ebx
sbb edi, edi
xor eax, eax
push eax
neg edi
call fcn.10016fb3
mov esi, eax
lea ecx, [ebp - 0xfc]
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [esi]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
imul eax, ecx
xor ecx, ecx
cmp eax, edi
setle cl
cmp ecx, dword [ebp - 0x1c]
jg 0x10031d72
xor eax, eax
mov dword [ebp - 0x44], 0xb0badcab
push eax
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0x28], ebx
call fcn.10016fb3
xor ebx, ebx
cmp dword [eax], ebx
je 0x10031ca6
cmp dword [ebp - 0x1c], 0x494dfd99
jle 0x10031c63
xor edi, edi
lea ecx, [ebp - 0xfc]
inc edi
push edi
call fcn.10016fb3
cmp dword [eax], ebx
je 0x10031c63
xor eax, eax
jmp 0x10031c67
xor eax, eax
mov edi, eax
push eax
lea ecx, [ebp - 0xfc]
call fcn.10016fb3
imul ecx, edi, 6
xor ebx, ebx
cmp ecx, 0x8ca8c98a
lea ecx, [ebp - 0xfc]
setne bl
sub ebx, dword [eax]
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, ebx
setge dl
cmp edx, dword [eax]
je 0x10031ca6
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x10031cad
xor eax, eax
xor ebx, ebx
mov edx, eax
inc ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xfc]
mov eax, dword [ebp - 0x38]
xor eax, eax
push eax
call fcn.10016fb3
mov eax, dword [ebp - 0x44]
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, 0x9bd12f8b
setl cl
cmp eax, ecx
sbb eax, eax
neg eax
cmp eax, 4
jbe 0x10031cfa
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x10031cfc
mov eax, ebx
jmp 0x10031cfc
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10031d1b
mov dword [ebp - 0x28], 0x9038
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
jmp 0x10031d4a
mov dword [ebp - 0x28], 0xf6679856
mov dword [ebp - 0x38], 5
cmp dword [ebp - 0x38], eax
jne 0x10031d3d
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x38], eax
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x10031d3d
mov ebx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, ebx
setg cl
mov dword [ebp - 0x28], ecx
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10031d67
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10031d64
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommState]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jle 0x10031d51
jmp 0x10031e70
xor ebx, ebx
lea ecx, [ebp - 0x8fc]
inc ebx
mov dword [ebp - 0x4c], ebx
push ebx
call fcn.10016f46
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10031daf
push dword [ebp - 0x10]
lea ecx, [ebp - 0x8fc]
call fcn.10016fb3
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10031d91
xor eax, eax
mov dword [ebp - 0x38], 9
jmp 0x10031dee
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x34], eax
jmp 0x10031ddb
push dword [ebp - 0x34]
lea ecx, [ebp - 0xfc]
call fcn.10016fb3
mov dword [eax], 0xf903a798
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x10031dc4
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x38]
push 0
pop eax
cmp dword [ebp - 0x38], 0x19
je 0x10031db8
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x8fc]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10016fb3
mov esi, eax
lea ecx, [ebp - 0xfc]
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [eax]
mov eax, dword [ebp - 0x34]
xor eax, eax
mov dword [esi], ecx
push eax
lea ecx, [ebp - 0xfc]
call fcn.10016fb3
xor eax, eax
lea ecx, [ebp - 0x8fc]
push eax
call fcn.10016fb3
xor eax, eax
lea ecx, [ebp - 0xfc]
push eax
call fcn.10016fb3
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10031e55
cmp dword [ebp - 0x58], eax
jne 0x10031e57
mov ebx, eax
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x8fc]
imul eax, ebx
sub eax, 0x633ef28f
mov dword [ebp - 0x38], eax
call fcn.10016fae
or edi, 0xffffffff
lea ecx, [ebp - 0xfc]
mov dword [ebp - 4], edi
call fcn.10016fae
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xd
push 7
pop ebx
jl 0x10031b35
xor eax, eax
mov dword [ebp - 0x1c], 0xa5d6c05b
mov dword [ebp - 0x38], 0xd535dd25
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xd
push 2
pop esi
jge 0x10032212
movdqa xmm0, xmmword [0x100080c0]
lea eax, [ebp - 0xf3c]
push eax
lea eax, [ebp - 0xf4c]
push eax
lea ecx, [ebp - 0x11a4]
movdqu xmmword [ebp - 0xf4c], xmm0
call fcn.10016fc2
lea ecx, [ebp - 0x24a]
mov esi, eax
call fcn.10008fe8
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x114]
push dword [esi]
call fcn.10016f88
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x114]
xor eax, eax
mov dword [ebp - 0x34], 0x79d62bfe
mov dword [ebp - 0x48], 0xcc425f8e
mov dword [ebp - 0x58], 0x9b5f814d
push eax
call fcn.10016fb3
push 3
lea ecx, [ebp - 0x114]
call fcn.10016fb3
mov ecx, dword [ebp - 0x1c]
cmp ebx, ecx
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x114]
setl bl
xor eax, eax
push eax
call fcn.10016fb3
lea ecx, [ebp - 0x114]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, ebx
call fcn.10016fb3
push 5
pop ebx
lea ecx, [ebp - 0x114]
mov eax, dword [eax]
imul eax, esi
cmp eax, ebx
sbb edi, edi
xor eax, eax
push eax
neg edi
call fcn.10016fb3
mov esi, eax
lea ecx, [ebp - 0x114]
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [esi]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
imul eax, ecx
xor ecx, ecx
cmp eax, edi
setle cl
cmp ecx, dword [ebp - 0x1c]
jg 0x100320f1
xor eax, eax
mov dword [ebp - 0x44], 0xb0badcab
push eax
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x28], ebx
call fcn.10016fb3
xor ebx, ebx
cmp dword [eax], ebx
je 0x10032025
xor edi, edi
inc edi
cmp dword [ebp - 0x1c], 0x494dfd99
jle 0x10031fe5
push edi
lea ecx, [ebp - 0x114]
call fcn.10016fb3
cmp dword [eax], ebx
je 0x10031fe5
mov esi, edi
xor eax, eax
jmp 0x10031fe9
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x114]
call fcn.10016fb3
imul ecx, esi, 6
xor ebx, ebx
cmp ecx, 0x8ca8c98a
lea ecx, [ebp - 0x114]
setne bl
sub ebx, dword [eax]
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, ebx
setge dl
cmp edx, dword [eax]
je 0x10032025
mov edx, edi
jmp 0x1003202c
xor eax, eax
xor edi, edi
mov edx, eax
inc edi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x114]
mov eax, dword [ebp - 0x38]
xor eax, eax
push eax
call fcn.10016fb3
mov eax, dword [ebp - 0x44]
xor edx, edx
cmp eax, edi
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, 0x9bd12f8b
setl cl
cmp eax, ecx
sbb eax, eax
neg eax
cmp eax, 4
jbe 0x10032079
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1003207b
mov eax, edi
jmp 0x1003207b
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1003209a
mov dword [ebp - 0x28], 0x9038
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
jmp 0x100320c9
mov dword [ebp - 0x28], 0xf6679856
mov dword [ebp - 0x38], 5
cmp dword [ebp - 0x38], eax
jne 0x100320bc
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x38], eax
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x100320bc
mov edi, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edi
setg cl
mov dword [ebp - 0x28], ecx
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x100320e6
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x100320e3
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommState]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jle 0x100320d0
jmp 0x100321ec
xor edi, edi
lea ecx, [ebp - 0x914]
inc edi
mov dword [ebp - 0x4c], edi
push edi
call fcn.10016f46
xor eax, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1003212f
push dword [ebp - 0x10]
lea ecx, [ebp - 0x914]
call fcn.10016fb3
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10032111
xor eax, eax
mov dword [ebp - 0x38], 9
jmp 0x1003216a
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], eax
jmp 0x10032157
push dword [ebp - 0x34]
lea ecx, [ebp - 0x114]
call fcn.10016fb3
mov dword [eax], 0xf903a798
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x10032140
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x38]
push 0
pop eax
cmp dword [ebp - 0x38], 0x19
je 0x10032138
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x914]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10016fb3
mov esi, eax
lea ecx, [ebp - 0x114]
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [eax]
mov eax, dword [ebp - 0x34]
xor eax, eax
mov dword [esi], ecx
push eax
lea ecx, [ebp - 0x114]
call fcn.10016fb3
xor eax, eax
lea ecx, [ebp - 0x914]
push eax
call fcn.10016fb3
xor eax, eax
lea ecx, [ebp - 0x114]
push eax
call fcn.10016fb3
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x100321d1
cmp dword [ebp - 0x58], eax
jne 0x100321d3
mov edi, eax
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x914]
imul eax, edi
sub eax, 0x633ef28f
mov dword [ebp - 0x38], eax
call fcn.10016fae
or edi, 0xffffffff
lea ecx, [ebp - 0x114]
mov dword [ebp - 4], edi
call fcn.10016fae
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xd
push 7
pop ebx
jl 0x10031eb1
push 2
xor eax, eax
pop esi
mov dword [ebp - 0x30], 0xc204e2db
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1003222b
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1003223e
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
xor eax, eax
mov dword [ebp - 0x1c], 0xa5d6c05b
xor ebx, ebx
inc ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x4c], 0x37400631
mov dword [ebp - 0x4c], 0xe8b0d193
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x2c], eax
je 0x10032274
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x10032272
mov eax, ebx
jmp 0x10032274
xor eax, eax
mov dword [ebp - 0x4c], eax
xor ecx, ecx
mov edx, dword [ebp - 0x4c]
imul edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x100322a9
push eax
push 0x1dd6
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x38], 0xd535dd25
lea ecx, [ebp - 0xc4c]
mov eax, 0xce9d05ba
mov dword [ebp - 0x38], 0xf5540d7f
mov dword [ebp - 0x698], eax
mov dword [ebp - 0x694], eax
mov dword [ebp - 0x690], eax
mov dword [ebp - 0x68c], eax
mov dword [ebp - 0x10], 0xf433c8a0
push esi
call fcn.10016f46
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x30], 0xeca74b80
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003231a
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc4c]
call fcn.10016fb3
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100322ff
xor eax, eax
push 6
pop ecx
push 3
mov dword [ebp - 0x38], 0x1c
mov edx, 0xffff
pop edi
cmp dword [ebp - 0x38], 0xffffffe7
jle 0x10032517
mov dword [ebp - 0x24], 0x3ff82ff4
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jg 0x1003250f
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1003236f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x340], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10032357
xor eax, eax
mov dword [ebp - 0x340], edi
cmp dword [ebp - 0x340], eax
jl 0x10032483
mov dword [ebp - 0x14], edx
xor edx, edx
mov dword [ebp - 0x28], 0xd28e487
mov dword [ebp - 0x14], 0xf084
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
push 6
setge dl
sub edx, dword [ebp - 0x698]
pop eax
cmp edx, eax
mov eax, dword [ebp - 0x340]
sbb ecx, ecx
neg ecx
mov eax, dword [ebp + eax*4 - 0x698]
inc eax
add eax, ecx
xor ecx, ecx
cmp eax, 0xfffffffc
mov eax, dword [ebp - 0x690]
setne cl
xor ebx, ebx
sub ecx, eax
mov eax, dword [ebp - 0x340]
mov eax, dword [ebp + eax*4 - 0x698]
cmp eax, ecx
mov eax, dword [ebp - 0x340]
setle bl
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x698]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
setl cl
xor eax, eax
cmp edx, ecx
jl 0x10032445
mov dword [ebp - 0x30], 0xc12f
mov dword [ebp - 0x14], eax
jmp 0x1003243d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10032428
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1264], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10032416
mov eax, dword [ebp - 0x338]
neg eax
push 0
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], 0x28
jne 0x1003240b
jmp 0x1003246a
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1003246a
push eax
push 0x1402
push 0x247c
push eax
push 0x28f
push 0x1a71
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
dec dword [ebp - 0x340]
mov edx, 0xffff
jns 0x10032381
xor ebx, ebx
push 6
inc ebx
xor eax, eax
pop ecx
mov dword [ebp - 0x10], 0x19
jmp 0x100324f2
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0xba309ce0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x44]
dec eax
neg eax
push 0
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0xfffffff6
mov eax, dword [ebp - 0x44]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, ebx
setl al
xor edx, edx
sub eax, dword [ebp - 0x44]
sub eax, 0x2a9
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
pop eax
setl dl
push 6
mov dword [ebp - 0x28], edx
dec dword [ebp - 0x10]
pop ecx
cmp dword [ebp - 0x10], 0xffffffee
je 0x1003248c
inc dword [ebp - 0x24]
mov edx, 0xffff
push 0
pop eax
push 6
pop ecx
cmp dword [ebp - 0x24], edi
jle 0x1003234c
dec dword [ebp - 0x38]
jmp 0x1003232c
or eax, 0xffffffff
lea ecx, [ebp - 0xc4c]
mov dword [ebp - 4], eax
call fcn.10016fae
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xd
jge 0x10032a2d
jmp 0x1003253b
xor eax, eax
mov dword [ebp - 0x30], 0xc204e2db
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10032554
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10032565
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
movdqa xmm0, xmmword [0x100080c0]
lea eax, [ebp - 0xebc]
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0x112c]
movdqu xmmword [ebp - 0xecc], xmm0
call fcn.10016fc2
lea ecx, [ebp - 0x259]
mov esi, eax
call fcn.10008fe8
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x108]
push dword [esi]
call fcn.10016f88
push 5
pop ecx
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [ebp - 0x34], 0x79d62bfe
mov dword [ebp - 0x48], 0xcc425f8e
mov dword [ebp - 0x58], 0x9b5f814d
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x358]
push 2
call fcn.10016f46
push 6
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003260f
push dword [ebp - 0x10]
lea ecx, [ebp - 0x358]
call fcn.10016fb3
mov dword [eax], 0x8530de9b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100325f0
xor eax, eax
mov dword [ebp - 0x14], 0xfffffff6
cmp dword [ebp - 0x14], 0x1a
jl 0x1003262e
xor eax, eax
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], eax
jl 0x10032713
jmp 0x10032664
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x38bea122
jle 0x10032641
mov edx, ebx
cmp dword [ebp - 0x14], eax
jne 0x10032643
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], eax
jne 0x1003261e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
jl 0x1003262c
jmp 0x1003261e
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1003267a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1090], 0xadfb1af9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10032669
push dword [ebp - 0x38]
lea ecx, [ebp - 0x358]
call fcn.10016fb3
push dword [ebp - 0x38]
lea ecx, [ebp - 0x358]
mov esi, eax
call fcn.10016fb3
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x100326fe
xor eax, eax
lea ecx, [ebp - 0x358]
push eax
call fcn.10016fb3
xor esi, esi
cmp dword [eax], esi
jne 0x100326c9
push dword [ebp - 0x38]
lea ecx, [ebp - 0x358]
call fcn.10016fb3
cmp dword [eax], esi
je 0x100326cb
mov esi, ebx
xor eax, eax
lea ecx, [ebp - 0x358]
push eax
call fcn.10016fb3
neg esi
cmp esi, dword [eax]
je 0x100326ed
push dword [ebp - 0x38]
lea ecx, [ebp - 0x358]
call fcn.10016fb3
push dword [ebp - 0x38]
lea ecx, [ebp - 0x358]
call fcn.10016fb3
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1090]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x38]
jns 0x10032662
lea ecx, [ebp - 0x358]
mov byte [ebp - 4], 5
call fcn.10016fae
xor eax, eax
lea ecx, [ebp - 0x108]
push eax
call fcn.10016fb3
push edi
lea ecx, [ebp - 0x108]
call fcn.10016fb3
mov ecx, dword [ebp - 0x1c]
push 7
pop edx
cmp edx, ecx
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x108]
setl bl
xor eax, eax
push eax
call fcn.10016fb3
lea ecx, [ebp - 0x108]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, ebx
call fcn.10016fb3
push 5
pop ebx
lea ecx, [ebp - 0x108]
mov eax, dword [eax]
imul eax, esi
cmp eax, ebx
sbb edi, edi
xor eax, eax
push eax
neg edi
call fcn.10016fb3
mov esi, eax
lea ecx, [ebp - 0x108]
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [esi]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
imul eax, ecx
xor ecx, ecx
cmp eax, edi
setle cl
cmp ecx, dword [ebp - 0x1c]
jg 0x10032906
xor eax, eax
mov dword [ebp - 0x44], 0xb0badcab
push eax
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x28], ebx
call fcn.10016fb3
xor ebx, ebx
cmp dword [eax], ebx
je 0x10032836
cmp dword [ebp - 0x1c], 0x494dfd99
jle 0x100327f3
xor edi, edi
lea ecx, [ebp - 0x108]
inc edi
push edi
call fcn.10016fb3
cmp dword [eax], ebx
je 0x100327f3
xor eax, eax
jmp 0x100327f7
xor eax, eax
mov edi, eax
push eax
lea ecx, [ebp - 0x108]
call fcn.10016fb3
imul ecx, edi, 6
xor ebx, ebx
cmp ecx, 0x8ca8c98a
lea ecx, [ebp - 0x108]
setne bl
sub ebx, dword [eax]
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, ebx
setge dl
cmp edx, dword [eax]
je 0x10032836
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x1003283d
xor eax, eax
xor ebx, ebx
mov edx, eax
inc ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x108]
mov eax, dword [ebp - 0x38]
xor eax, eax
push eax
call fcn.10016fb3
mov eax, dword [ebp - 0x44]
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, 0x9bd12f8b
setl cl
cmp eax, ecx
sbb eax, eax
neg eax
cmp eax, 4
jbe 0x1003288a
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1003288c
mov eax, ebx
jmp 0x1003288c
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x100328ab
mov dword [ebp - 0x28], 0x9038
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
jmp 0x100328dc
mov dword [ebp - 0x28], 0xf6679856
mov dword [ebp - 0x38], 5
cmp dword [ebp - 0x38], eax
jne 0x100328cd
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x38], eax
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x38], eax
je 0x100328cf
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x28], ecx
xor eax, eax
push 3
mov dword [ebp - 0x34], eax
pop edi
jmp 0x100328fc
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x100328f9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommState]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jle 0x100328e6
jmp 0x10032a0c
xor ebx, ebx
lea ecx, [ebp - 0x92c]
inc ebx
mov dword [ebp - 0x4c], ebx
push ebx
call fcn.10016f46
push 7
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10032946
push dword [ebp - 0x10]
lea ecx, [ebp - 0x92c]
call fcn.10016fb3
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032928
xor eax, eax
mov dword [ebp - 0x38], 9
jmp 0x10032985
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x34], eax
jmp 0x10032972
push dword [ebp - 0x34]
lea ecx, [ebp - 0x108]
call fcn.10016fb3
mov dword [eax], 0xf903a798
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x1003295b
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x38]
push 0
pop eax
cmp dword [ebp - 0x38], 0x19
je 0x1003294f
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x92c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10016fb3
mov esi, eax
lea ecx, [ebp - 0x108]
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [eax]
mov eax, dword [ebp - 0x34]
xor eax, eax
mov dword [esi], ecx
push eax
lea ecx, [ebp - 0x108]
call fcn.10016fb3
xor eax, eax
lea ecx, [ebp - 0x92c]
push eax
call fcn.10016fb3
xor eax, eax
lea ecx, [ebp - 0x108]
push eax
call fcn.10016fb3
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x100329ee
mov ecx, ebx
cmp dword [ebp - 0x58], eax
jne 0x100329f0
mov ecx, eax
mov eax, dword [ebp - 0x4c]
imul eax, ecx
lea ecx, [ebp - 0x92c]
sub eax, 0x633ef28f
mov dword [ebp - 0x38], eax
call fcn.10016fae
push 3
pop edi
or eax, 0xffffffff
lea ecx, [ebp - 0x108]
mov dword [ebp - 4], eax
call fcn.10016fae
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xd
jl 0x10032539
push 2
pop esi
mov dword [ebp - 0x3c], 0x399841b3
lea ecx, [ebp - 0x6c4]
push esi
call fcn.10016f46
mov dword [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x4c], 0x464f16ef
mov dword [ebp - 0x28], 0x6f8f9ed0
mov dword [ebp - 0x30], 0xec0021fb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10032a84
push dword [ebp - 0x10]
lea ecx, [ebp - 0x6c4]
call fcn.10016fb3
mov dword [eax], 0x46b6eb6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10032a66
xor eax, eax
mov dword [ebp - 0x3c], 0x18
cmp dword [ebp - 0x3c], edi
jle 0x10032b30
jmp 0x10032a98
xor eax, eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x6c4]
dec dword [ebp - 0x4c]
push eax
call fcn.10016fb3
cmp dword [eax], 0
jne 0x10032ac6
xor eax, eax
lea ecx, [ebp - 0x6c4]
push eax
call fcn.10016fb3
cmp dword [eax], 0
jne 0x10032ac6
xor eax, eax
jmp 0x10032ac8
mov eax, ebx
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x6c4]
push ebx
imul esi, eax
call fcn.10016fb3
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x2c]
cmp esi, eax
mov eax, dword [ebp - 0x3c]
setne cl
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
sub edx, dword [ebp - 0x2c]
cmp edx, 0x56ec7e43
setg al
xor ecx, ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp esi, eax
setg cl
add edx, ecx
mov dword [ebp - 0x28], edx
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jg 0x10032a96
push 2
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0x6c4]
mov dword [ebp - 4], eax
call fcn.10016fae
mov dword [ebp - 0x4c], 4
xor eax, eax
mov dword [ebp - 0x2c], 0x7cd95da2
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10032b8f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x11ec], 0x4e8fe752
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10032b77
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10032ba5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x464], 0x8d20
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10032b94
mov eax, dword [ebp - 0x4c]
dec dword [ebp - 0x464]
mov eax, dword [ebp - 0x464]
cmp dword [ebp - 0x4c], eax
je 0x10032be2
xor eax, eax
cmp dword [ebp - 0x28], 0x498b94be
je 0x10032bd0
mov ecx, ebx
cmp dword [ebp - 0x48], eax
jne 0x10032bd2
mov ecx, eax
mov eax, dword [ebp - 0x44]
sub ecx, eax
cmp ecx, dword [ebp - 0x40]
jge 0x10032be2
mov eax, dword [ebp - 0x464]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x464]
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x38], 0xa5d6c05b
mov dword [ebp - 0x30], 0xc204e2db
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10032c1d
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10032c30
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
xor eax, eax
mov dword [ebp - 0x34], 0xd535dd25
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x4c], 0x37400631
mov dword [ebp - 0x4c], 0xe8b0d193
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x2c], eax
je 0x10032c66
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x10032c64
mov eax, ebx
jmp 0x10032c66
xor eax, eax
mov dword [ebp - 0x4c], eax
xor ecx, ecx
mov edx, dword [ebp - 0x4c]
imul edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10032c9d
push eax
push 0x1dd6
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xd
jge 0x100350cf
mov eax, 0xce9d05ba
mov dword [ebp - 0x34], 0xf5540d7f
mov dword [ebp - 0x688], eax
lea ecx, [ebp - 0xcf4]
mov dword [ebp - 0x684], eax
mov dword [ebp - 0x680], eax
mov dword [ebp - 0x67c], eax
mov dword [ebp - 0x10], 0xf433c8a0
push esi
call fcn.10016f46
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x30], 0xeca74b80
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10032d14
push dword [ebp - 0x10]
lea ecx, [ebp - 0xcf4]
call fcn.10016fb3
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10032cf9
xor eax, eax
mov dword [ebp - 0x34], 0x1c
jmp 0x10032ef2
mov dword [ebp - 0x24], 0x3ff82ff4
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jg 0x10032eef
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10032d59
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x304], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10032d41
xor eax, eax
mov dword [ebp - 0x304], edi
cmp dword [ebp - 0x304], eax
jl 0x10032e6a
xor edx, edx
mov eax, 0xffff
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0xd28e487
mov dword [ebp - 0x14], 0xf084
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
push 6
setge dl
sub edx, dword [ebp - 0x688]
pop eax
cmp edx, eax
mov eax, dword [ebp - 0x304]
sbb ecx, ecx
neg ecx
mov eax, dword [ebp + eax*4 - 0x688]
inc eax
add eax, ecx
xor ecx, ecx
cmp eax, 0xfffffffc
mov eax, dword [ebp - 0x680]
setne cl
xor ebx, ebx
sub ecx, eax
mov eax, dword [ebp - 0x304]
mov eax, dword [ebp + eax*4 - 0x688]
cmp eax, ecx
mov eax, dword [ebp - 0x304]
setle bl
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x688]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
setl cl
xor eax, eax
cmp edx, ecx
jl 0x10032e34
mov dword [ebp - 0x30], 0xc12f
mov dword [ebp - 0x14], eax
jmp 0x10032e2c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10032e17
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11f8], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10032e05
mov eax, dword [ebp - 0x2fc]
neg eax
push 0
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], 0x28
jne 0x10032dfa
jmp 0x10032e59
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10032e59
push eax
push 0x1402
push 0x247c
push eax
push 0x28f
push 0x1a71
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
dec dword [ebp - 0x304]
jns 0x10032d6b
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x10], 0x19
jmp 0x10032eda
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0xba309ce0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x44]
dec eax
neg eax
push 0
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0xfffffff6
mov eax, dword [ebp - 0x44]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, ebx
setl al
xor edx, edx
sub eax, dword [ebp - 0x44]
sub eax, 0x2a9
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
pop eax
setl dl
mov dword [ebp - 0x28], edx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffee
je 0x10032e73
inc dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], edi
jle 0x10032d36
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe7
jg 0x10032d20
or eax, 0xffffffff
lea ecx, [ebp - 0xcf4]
mov dword [ebp - 4], eax
call fcn.10016fae
movdqa xmm0, xmmword [0x100080c0]
lea eax, [ebp - 0xfbc]
push eax
lea eax, [ebp - 0xfcc]
push eax
lea ecx, [ebp - 0x11ac]
movdqu xmmword [ebp - 0xfcc], xmm0
call fcn.10016fc2
lea ecx, [ebp - 0x25b]
mov esi, eax
call fcn.10008fe8
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xf0]
push dword [esi]
call fcn.10016f88
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x30], 0xc204e2db
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10032f75
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10032f88
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x1c], 0x79d62bfe
lea ecx, [ebp - 0x31c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x34], 5
push esi
call fcn.10016f46
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10032fd7
push dword [ebp - 0x10]
lea ecx, [ebp - 0x31c]
call fcn.10016fb3
mov dword [eax], 0x8530de9b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10032fb9
xor eax, eax
mov dword [ebp - 0x14], 0xfffffff6
cmp dword [ebp - 0x14], 0x1a
jl 0x10032ff6
xor eax, eax
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], eax
jl 0x100330de
jmp 0x1003302c
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x38bea122
jle 0x10033009
mov edx, ebx
cmp dword [ebp - 0x14], eax
jne 0x1003300b
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], eax
jne 0x10032fe6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
jl 0x10032ff4
jmp 0x10032fe6
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10033042
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xfe8], 0xadfb1af9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10033031
push dword [ebp - 0x34]
lea ecx, [ebp - 0x31c]
call fcn.10016fb3
push dword [ebp - 0x34]
lea ecx, [ebp - 0x31c]
mov esi, eax
call fcn.10016fb3
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x100330c6
xor eax, eax
lea ecx, [ebp - 0x31c]
push eax
call fcn.10016fb3
xor esi, esi
cmp dword [eax], esi
jne 0x10033091
push dword [ebp - 0x34]
lea ecx, [ebp - 0x31c]
call fcn.10016fb3
cmp dword [eax], esi
je 0x10033093
mov esi, ebx
xor eax, eax
lea ecx, [ebp - 0x31c]
push eax
call fcn.10016fb3
neg esi
cmp esi, dword [eax]
je 0x100330b5
push dword [ebp - 0x34]
lea ecx, [ebp - 0x31c]
call fcn.10016fb3
push dword [ebp - 0x34]
lea ecx, [ebp - 0x31c]
call fcn.10016fb3
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xfe8]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x34]
jns 0x1003302a
push 2
pop esi
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 0xa
call fcn.10016fae
mov dword [ebp - 0x58], 0xcc425f8e
push 7
pop eax
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10033115
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x15c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10033108
mov dword [ebp - 0x15c], ebx
xor edx, edx
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setg cl
xor edx, edx
cmp eax, ecx
setne dl
xor ecx, ecx
sub edx, dword [ebp - 0x34]
imul edx, dword [ebp - 0x34]
cmp edx, 0x46c2
setl cl
xor eax, eax
cmp ecx, ebx
setge al
cmp eax, 0xd5493e
je 0x1003316a
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x15c]
add ecx, eax
mov eax, dword [ebp - 0x34]
cmp ecx, eax
sete dl
cmp dword [ebp - 0x34], edx
je 0x10033194
xor eax, eax
cmp dword [ebp - 0x15c], eax
je 0x10033196
mov eax, ebx
cmp eax, dword [ebp - 0x34]
jge 0x100331c0
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x100331ae
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1003321c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x1003321a
or eax, 0xffffffff
mov dword [ebp - 0x10], 0x72737ae9
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x100331ea
push 0x2302
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setg dl
xor ebx, ebx
xor edi, edi
inc edi
cmp edx, edi
push 3
setl bl
xor ecx, ecx
cmp ebx, eax
pop edi
setge cl
xor ebx, ebx
mov dword [ebp - 0x28], ecx
inc ebx
xor eax, eax
mov dword [ebp - 0x5c], 0x9b5f814d
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x30], 0x525d2d91
mov dword [ebp - 0x30], 0xe13a6c9c
mov dword [ebp - 0x30], 0xb44cf592
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 0x1a7a81a8
mov dword [ebp - 0x30], 0xfffffffe
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x268], ebx
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xd06bde64
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x2c], eax
jl 0x10033348
push esi
lea ecx, [ebp - 0xa3c]
call fcn.10016f46
mov byte [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x100332d2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1018], 0xfffffffd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x100332ba
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x100332f8
push dword [ebp - 0x24]
lea ecx, [ebp - 0xa3c]
call fcn.10016fb3
mov dword [eax], 0x23371247
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100332da
xor eax, eax
cmp dword [ebp - 0x1018], eax
je 0x10033317
push eax
lea ecx, [ebp - 0xa3c]
call fcn.10016fb3
cmp dword [eax], 0
je 0x10033315
mov eax, ebx
jmp 0x10033317
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1003332e
push eax
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [ebp - 0xa3c]
mov byte [ebp - 4], 0xa
call fcn.10016fae
dec dword [ebp - 0x2c]
jns 0x10033299
xor eax, eax
dec dword [ebp - 0x4c]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xcdbe8e56
mov dword [ebp - 0x30], 0x318d5816
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0x5de05dae
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x30], 0xcf33
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10033394
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcd0], 0x585b7f3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003337c
xor eax, eax
inc dword [ebp - 0x4c]
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x100333ae
push 0x511
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
push eax
lea ecx, [ebp - 0xf0]
call fcn.10016fb3
push edi
lea ecx, [ebp - 0xf0]
call fcn.10016fb3
mov ecx, dword [ebp - 0x38]
push 7
pop edx
cmp edx, ecx
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xf0]
setl bl
xor eax, eax
push eax
call fcn.10016fb3
lea ecx, [ebp - 0xf0]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, ebx
call fcn.10016fb3
push 5
pop ebx
lea ecx, [ebp - 0xf0]
mov eax, dword [eax]
imul eax, esi
cmp eax, ebx
sbb edi, edi
xor eax, eax
push eax
neg edi
call fcn.10016fb3
mov esi, eax
lea ecx, [ebp - 0xf0]
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [esi]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x38]
imul eax, ecx
xor ecx, ecx
cmp eax, edi
setle cl
cmp ecx, dword [ebp - 0x38]
jg 0x10034118
mov dword [ebp - 0x34], ebx
xor ebx, ebx
push 7
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x10], eax
inc ebx
jmp 0x1003345f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x164], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10033452
mov dword [ebp - 0x164], ebx
xor edx, edx
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setg cl
xor edx, edx
cmp eax, ecx
setne dl
xor ecx, ecx
sub edx, dword [ebp - 0x34]
imul edx, dword [ebp - 0x34]
cmp edx, 0x46c2
setl cl
xor eax, eax
cmp ecx, ebx
setge al
cmp eax, 0xd5493e
je 0x100334b4
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x164]
add ecx, eax
mov eax, dword [ebp - 0x34]
cmp ecx, eax
sete dl
cmp dword [ebp - 0x34], edx
je 0x100334de
xor eax, eax
cmp dword [ebp - 0x164], eax
je 0x100334e0
mov eax, ebx
cmp eax, dword [ebp - 0x34]
jge 0x10033520
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x100334f8
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1003350a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xor eax, eax
or esi, 0xffffffff
mov dword [ebp - 0x3c], 0xb0badcab
mov dword [ebp - 0x10], 0x5d6c05ba
mov dword [ebp - 0x10], eax
jmp 0x1003358e
mov dword [ebp - 0x10], 0x72737ae9
or esi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x28], esi
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1003354a
push 0x2302
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setg dl
xor edi, edi
xor ebx, ebx
inc edi
cmp edx, edi
setl bl
xor ecx, ecx
cmp ebx, eax
setge cl
xor ebx, ebx
inc ebx
mov dword [ebp - 0x28], ecx
xor eax, eax
jmp 0x1003350d
cmp byte [ebp - 0x1d], 0
je 0x1003358b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffea
mov byte [ebp - 0x1d], al
jle 0x1003357b
cmp byte [ebp - 0x1d], 0
je 0x100335d0
push 0x1cff
push eax
push 0xea3
push 0x755
push 0x4a
push eax
push 0x858
push 0x49e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
xor eax, eax
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x14], 0xc692beaa
mov dword [ebp - 0x28], 0x47346880
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x4c], 0x7e434392
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x89ec0021
mov dword [ebp - 0x48], 0xd3624b67
cmp dword [ebp - 0x14], eax
je 0x10033681
mov dword [ebp - 0x28], 0x733c
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10033628
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor eax, eax
mov dword [ebp - 0x14], 0xffffffee
cmp dword [ebp - 0x14], eax
jne 0x10033640
mov dword [ebp - 0x28], 0x748f69f7
inc dword [ebp - 0x14]
je 0x10033634
push 3
pop edi
push eax
lea ecx, [ebp - 0xf0]
call fcn.10016fb3
xor esi, esi
cmp dword [eax], esi
je 0x10033796
cmp dword [ebp - 0x38], 0x494dfd99
jle 0x10033753
push ebx
lea ecx, [ebp - 0xf0]
call fcn.10016fb3
cmp dword [eax], esi
je 0x10033753
xor eax, eax
jmp 0x10033757
mov dword [ebp - 0x44], esi
lea ecx, [ebp - 0xb2c]
push 7
mov dword [ebp - 0x30], esi
pop eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], 0x65c829ed
mov dword [ebp - 0x10], eax
push ebx
call fcn.10016f46
xor eax, eax
mov byte [ebp - 4], 0xe
push 3
mov dword [ebp - 0x24], eax
pop edi
cmp dword [ebp - 0x24], edi
jge 0x100336c8
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1210], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x100336b4
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x100336ee
push dword [ebp - 0x24]
lea ecx, [ebp - 0xb2c]
call fcn.10016fb3
mov dword [eax], 0x11ca4b38
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x100336d0
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x10033738
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xb2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
xor eax, eax
push eax
call fcn.10016fb3
mov edx, dword [ebp - 0x10]
mov esi, eax
mov ecx, dword [ebp - 0x48]
xor eax, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x44]
setne al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [esi]
jl 0x10033738
xor eax, eax
jmp 0x1003373a
mov eax, ebx
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0xb2c]
mov byte [ebp - 4], 0xa
call fcn.10016fae
xor eax, eax
jmp 0x10033643
xor eax, eax
mov ebx, eax
push eax
lea ecx, [ebp - 0xf0]
call fcn.10016fb3
imul ecx, ebx, 6
xor ebx, ebx
cmp ecx, 0x8ca8c98a
lea ecx, [ebp - 0xf0]
setne bl
sub ebx, dword [eax]
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [ebp - 0x38]
xor edx, edx
cmp ecx, ebx
setge dl
cmp edx, dword [eax]
je 0x10033796
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x1003379d
xor eax, eax
xor ebx, ebx
mov edx, eax
inc ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0xf0]
mov eax, dword [ebp - 0x34]
xor eax, eax
push eax
call fcn.10016fb3
mov eax, dword [ebp - 0x3c]
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, 0x9bd12f8b
setl cl
cmp eax, ecx
sbb eax, eax
neg eax
cmp eax, 4
jbe 0x100337ea
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x100337ec
mov eax, ebx
jmp 0x100337ec
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10033995
mov dword [ebp - 0x14], 0xed9a
lea ecx, [ebp - 0x5fc]
push ebx
call fcn.10016f46
mov byte [ebp - 4], 0xf
push 6
pop eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 0xf093d7f2
mov dword [ebp - 0x10], eax
jmp 0x10033842
push dword [ebp - 0x10]
call fcn.10016fb3
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x5fc]
cmp dword [ebp - 0x10], ebx
jl 0x10033831
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.10016fb3
lea ecx, [ebp - 0x5fc]
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
xor eax, eax
push eax
call fcn.10016fb3
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x5fc]
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.10016fb3
xor edx, edx
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setg dl
mov dword [ebp - 0x3c], edx
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
lea ecx, [ebp - 0x5fc]
setl dl
xor eax, eax
mov dword [ebp - 0x28], edx
push eax
call fcn.10016fb3
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov eax, dword [ebp - 0x44]
setge cl
sub eax, ecx
sub eax, 0xc79ebef9
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xc8f
cmp dword [ebp - 0x10], eax
jle 0x100338f2
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x100338f4
mov edx, ebx
jmp 0x100338f6
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x5fc]
mov byte [ebp - 4], 0xa
call fcn.10016fae
mov dword [ebp - 0x48], 0x9038
lea ecx, [ebp - 0xc5c]
push 2
call fcn.10016f46
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x28], 0x485bf25c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10033961
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc5c]
call fcn.10016fb3
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10033942
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10033970
mov dword [ebp - 0x28], 0xcd795364
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10033966
lea ecx, [ebp - 0xc5c]
mov byte [ebp - 4], 0xa
call fcn.10016fae
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
jmp 0x10033c79
push edi
lea ecx, [ebp - 0xbb0]
call fcn.10016f46
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x944]
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x44], eax
push edi
call fcn.10016f46
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x100339e8
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbb0]
call fcn.10016fb3
mov dword [eax], 0x648
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100339ca
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10033a0a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a4], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100339f1
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10033a30
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x944]
call fcn.10016fb3
mov dword [eax], 0xa9f4f9a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10033a12
xor eax, eax
mov dword [ebp - 0x1a0], eax
jmp 0x10033a51
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10033a4b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor eax, eax
inc dword [ebp - 0x1a0]
cmp dword [ebp - 0x1a0], 2
jle 0x10033a38
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x10033ba9
jmp 0x10033a6a
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffb
lea ecx, [ebp - 0xa54]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x4c], 0xc13fe66
push edi
call fcn.10016f46
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x10], eax
jmp 0x10033aac
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa54]
call fcn.10016fb3
mov dword [eax], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10033a95
mov eax, dword [ebp - 0x44]
inc dword [ebp - 0x44]
test eax, eax
je 0x10033b16
xor eax, eax
lea ecx, [ebp - 0x944]
push eax
call fcn.10016fb3
mov esi, dword [ebp - 0x4c]
xor edx, edx
add esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x4c]
cmp esi, ecx
push ebx
setle dl
lea ecx, [ebp - 0xa54]
mov dword [eax], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp + eax*4 - 0x1a4]
call fcn.10016fb3
mov dword [eax], esi
lea eax, [esi + 0x623b4709]
cmp ebx, eax
mov dword [ebp - 0x1a0], eax
sbb eax, eax
inc eax
jns 0x10033b16
mov esi, ebx
jmp 0x10033b1a
xor eax, eax
mov esi, eax
push 2
lea ecx, [ebp - 0xbb0]
call fcn.10016fb3
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp esi, ecx
setge dl
xor ecx, ecx
cmp edx, dword [eax]
setle cl
imul eax, ecx, 0xafe3
cmp eax, dword [ebp - 0x48]
jne 0x10033b56
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10033b91
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x10033b91
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10033b8c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x10033b89
push dword [ebp - 0x14]
lea ecx, [ebp - 0x944]
call fcn.10016fb3
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp + ecx*4 - 0x1a4]
mov dword [eax], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10033b65
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10033b5d
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 0x12
call fcn.10016fae
dec dword [ebp - 0x2c]
jns 0x10033a68
lea ecx, [ebp - 0x944]
call fcn.10016fae
lea ecx, [ebp - 0xbb0]
mov byte [ebp - 4], 0xa
call fcn.10016fae
mov dword [ebp - 0x28], 0xf6679856
xor ecx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x4c], 0xeb382e58
mov dword [ebp - 0x4c], 0xfffffffb
mov dword [ebp - 0x28], 0xbb000e2e
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
mov eax, ebx
setge cl
sub eax, ecx
cmp eax, 2
je 0x10033c0a
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x10033c0c
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xe3f9
setle al
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x14]
imul eax, eax, 0x8425
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10033c4f
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor eax, eax
mov dword [ebp - 0x34], 5
cmp dword [ebp - 0x34], eax
jne 0x10033c6a
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x34], eax
je 0x10033c6c
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x28], ecx
push edi
lea ecx, [ebp - 0x524]
call fcn.10016f46
mov byte [ebp - 4], 0x14
or eax, 0xffffffff
mov dword [ebp - 0x34], 0xb13638ec
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10033cc1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x524]
call fcn.10016fb3
mov dword [eax], 0x3342eb90
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10033ca3
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jg 0x10033dd1
xor edi, edi
mov dword [ebp - 0x4c], 9
lea ecx, [ebp - 0x524]
mov dword [ebp - 0x4c], 0xfffffff9
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x34]
call fcn.10016fb3
mov ecx, dword [ebp - 0x4c]
xor ebx, ebx
push dword [ebp - 0x34]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x524]
setge bl
call fcn.10016fb3
push dword [ebp - 0x34]
xor ecx, ecx
cmp ebx, dword [eax]
setl cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x524]
call fcn.10016fb3
mov edx, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, dword [eax]
mov eax, 0x9884
setle cl
sub eax, ecx
jne 0x10033d42
cmp dword [ebp - 0x34], eax
je 0x10033d44
lea eax, [edi + 1]
jmp 0x10033d44
xor eax, eax
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x524]
mov eax, dword [ebp - 0x4c]
add eax, 0xff18
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x34]
call fcn.10016fb3
mov edx, dword [ebp - 0x4c]
mov esi, eax
mov ecx, dword [ebp - 0x34]
xor eax, eax
push dword [ebp - 0x34]
cmp edx, ecx
setl al
xor ecx, ecx
cmp dword [esi], eax
sete cl
sub ecx, 0x9b37
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
test ecx, ecx
lea ecx, [ebp - 0x524]
setg bl
call fcn.10016fb3
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
xor eax, eax
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10033dbe
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jle 0x10033cd0
xor ebx, ebx
push 3
inc ebx
pop edi
lea ecx, [ebp - 0x524]
mov byte [ebp - 4], 0xa
call fcn.10016fae
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1003410a
mov dword [ebp - 0x44], 0xb8114768
xor ecx, ecx
mov dword [ebp - 0x34], 0x91b68dee
mov dword [ebp - 0x2c], 4
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0x19f2
setge cl
xor edx, edx
imul ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
add edx, 0x120f8572
cmp eax, edx
setne cl
imul ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x10033e42
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10033e45
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0xd0c]
mov eax, dword [ebp - 0x34]
push 2
call fcn.10016f46
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10033e86
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd0c]
call fcn.10016fb3
mov dword [eax], 0x1ef9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10033e67
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10033ece
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x10033ecb
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10033eb3
push 0x7c6
push 0xc0b
push 0x1318
call dword [sym.imp.KERNEL32.dll_HeapCreate]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10033ec6
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x10033e93
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x10033e8b
lea ecx, [ebp - 0xd0c]
mov byte [ebp - 4], 0xa
call fcn.10016fae
xor eax, eax
lea ecx, [ebp - 0x95c]
mov byte [ebp - 0x1d], al
mov dword [ebp - 0x10], 0xfe7d
push edi
call fcn.10016f46
xor eax, eax
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10033f26
push dword [ebp - 0x24]
lea ecx, [ebp - 0x95c]
call fcn.10016fb3
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10033f08
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10033f46
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x3e0], 0xfff9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10033f2e
xor eax, eax
dec dword [ebp - 0x3e0]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x10033f7d
jmp 0x10033f58
xor eax, eax
push eax
lea ecx, [ebp - 0x95c]
call fcn.10016fb3
mov esi, eax
lea ecx, [ebp - 0x95c]
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x10]
jns 0x10033f56
lea ecx, [ebp - 0x95c]
mov byte [ebp - 4], 0xa
call fcn.10016fae
cmp byte [ebp - 0x1d], 0
je 0x10034107
push edi
lea ecx, [ebp - 0x5a8]
call fcn.10016f46
mov byte [ebp - 4], 0x17
or eax, 0xffffffff
mov dword [ebp - 0x34], 0xb13638ec
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10033fde
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5a8]
call fcn.10016fb3
mov dword [eax], 0x3342eb90
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10033fc0
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jg 0x100340ee
xor edi, edi
mov dword [ebp - 0x4c], 9
lea ecx, [ebp - 0x5a8]
mov dword [ebp - 0x4c], 0xfffffff9
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x34]
call fcn.10016fb3
mov ecx, dword [ebp - 0x4c]
xor ebx, ebx
push dword [ebp - 0x34]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x5a8]
setge bl
call fcn.10016fb3
push dword [ebp - 0x34]
xor ecx, ecx
cmp ebx, dword [eax]
setl cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x5a8]
call fcn.10016fb3
mov edx, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, dword [eax]
mov eax, 0x9884
setle cl
sub eax, ecx
jne 0x1003405f
cmp dword [ebp - 0x34], eax
je 0x10034061
lea eax, [edi + 1]
jmp 0x10034061
xor eax, eax
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x5a8]
mov eax, dword [ebp - 0x4c]
add eax, 0xff18
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x34]
call fcn.10016fb3
mov edx, dword [ebp - 0x4c]
mov esi, eax
mov ecx, dword [ebp - 0x34]
xor eax, eax
push dword [ebp - 0x34]
cmp edx, ecx
setl al
xor ecx, ecx
cmp dword [esi], eax
sete cl
sub ecx, 0x9b37
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
test ecx, ecx
lea ecx, [ebp - 0x5a8]
setg bl
call fcn.10016fb3
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
xor eax, eax
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x100340db
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jle 0x10033fed
xor ebx, ebx
push 3
inc ebx
pop edi
lea ecx, [ebp - 0x5a8]
mov byte [ebp - 4], 0xa
call fcn.10016fae
xor eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommState]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x10033dea
jmp 0x100350ac
xor eax, eax
mov ecx, 0xd24b5e49
mov dword [ebp - 0x4c], eax
xor ebx, ebx
mov dword [ebp - 0x48], 0x5c285ce9
inc ebx
mov dword [ebp - 0x7e4], ecx
mov dword [ebp - 0x7e0], ecx
mov dword [ebp - 0x7dc], ecx
mov dword [ebp - 0x7d8], ecx
lea ecx, [ebp - 0xc6c]
mov dword [ebp - 0x30], eax
or eax, 0xffffffff
push 2
mov dword [ebp - 0x30], ebx
pop esi
mov dword [ebp - 0x40], 0x65901810
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x4340421a
push esi
call fcn.10016f46
mov byte [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x2c], 0x2bb1342f
mov dword [ebp - 0x10], eax
jmp 0x10034192
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc6c]
call fcn.10016fb3
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003417f
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp eax, ebx
setge cl
add ecx, 0x5c96dd1e
je 0x100341cc
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10034352
push 0x23ff
push 0xcf7
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x10034350
push ebx
lea ecx, [ebp - 0x424]
call fcn.10016f46
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x28], 0xe48c0c84
mov ecx, 0x2dc1b2d8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x274], ecx
mov dword [ebp - 0x270], ecx
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003422b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x424]
call fcn.10016fb3
mov dword [eax], 0x40a9711f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003420d
xor eax, eax
push eax
lea ecx, [ebp - 0x424]
call fcn.10016fb3
xor eax, eax
lea ecx, [ebp - 0x424]
push eax
call fcn.10016fb3
xor eax, eax
lea ecx, [ebp - 0x424]
push eax
call fcn.10016fb3
mov edx, dword [ebp - 0x7dc]
xor ebx, ebx
mov ecx, dword [ebp - 0x4c]
cmp ecx, edx
lea ecx, [ebp - 0x424]
setg bl
sub ebx, dword [eax]
neg ebx
sbb ebx, ebx
xor eax, eax
push eax
inc ebx
call fcn.10016fb3
mov ecx, dword [ebp - 0x7dc]
xor edx, edx
cmp ebx, ecx
setne dl
imul edx, dword [eax]
test edx, edx
je 0x100342a6
xor eax, eax
lea ecx, [ebp - 0x424]
push eax
call fcn.10016fb3
cmp dword [eax], 0
je 0x100342a6
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x100342ab
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x424]
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [ebp - 0x7dc]
add ecx, dword [eax]
je 0x10034308
mov dword [ebp - 0x30], 0x76a447d0
xor eax, eax
mov dword [ebp - 0x30], 0x74f98987
mov dword [ebp - 0x30], 0x77acaec2
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x4c], 0xb058
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10034303
push 0x23ff
push 0xcf7
call dword [sym.imp.KERNEL32.dll_Beep]
dec dword [ebp - 0x4c]
jmp 0x10034345
xor eax, eax
mov ecx, 0x20c2888a
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], 0xb0335009
mov edx, dword [ebp - 0x40]
sub edx, 5
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
sub ecx, eax
imul edx, ecx
add edx, 0x35ac
sub edx, dword [ebp - 0x48]
neg edx
sbb edx, edx
add edx, 0xff39499c
mov dword [ebp - 0x2c], edx
lea ecx, [ebp - 0x424]
call fcn.10016fae
xor eax, eax
mov dword [ebp - 0x2c], 0xffffffea
jmp 0x1003436a
mov dword [ebp - 0x28], 0x6de3
cmp dword [ebp - 0x28], eax
jne 0x1003436f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jge 0x1003435b
lea ecx, [ebp - 0xc6c]
mov byte [ebp - 4], 0xa
call fcn.10016fae
mov dword [ebp - 0x54], ebx
xor eax, eax
mov dword [ebp - 0x14], 0x5c68ec0a
mov dword [ebp - 0x28], 0x51328f6c
push 7
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jg 0x100343f2
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100343bf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe4c], 0x51ad
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100343a7
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100343d9
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x100343d6
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x100343c4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x14]
push 7
pop eax
cmp dword [ebp - 0x14], eax
push 0
pop eax
jle 0x1003439c
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x800]
mov dword [ebp - 0x14], eax
push ebx
call fcn.10016f46
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x14], 0x97f6af11
mov dword [ebp - 0x44], 0x68993dd6
push 3
mov dword [ebp - 0x44], 0x3ee49ce5
mov dword [ebp - 0x14], 0xfffffffe
pop edi
cmp dword [ebp - 0x14], ebx
jge 0x10034504
mov dword [ebp - 0x10], 0xedfc3e8c
or eax, 0xffffffff
mov dword [ebp - 0x44], 0x3fc2f92e
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1003445c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x668], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003444b
mov dword [ebp - 0x10], ebx
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
cmp edx, dword [ebp - 0x44]
jge 0x10034479
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x660]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x668]
add ecx, eax
mov eax, dword [ebp - 0x660]
cmp ecx, eax
setge dl
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x668]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x2bb1
mov eax, dword [ebp - 0x660]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x660]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x14]
sub eax, 0x7063cd7f
jne 0x100344f7
cmp dword [ebp - 0x44], eax
je 0x100344f9
mov eax, ebx
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x14]
jmp 0x10034427
push 7
pop eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x14], 0x6fc2
mov dword [ebp - 0x4c], 0xfffffff7
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x10], eax
jmp 0x10034539
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5cc], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003452c
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
sub ecx, eax
add ecx, 8
mov dword [ebp - 0x5c8], ecx
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x44]
setle cl
xor edx, edx
cmp ecx, eax
setne dl
xor ecx, ecx
add edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setne cl
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x4c], 0x3fc2
je 0x10034595
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
dec eax
neg eax
sbb eax, eax
add eax, 0x8376fbfd
cmp eax, dword [ebp - 0x14]
je 0x100345b3
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x44], eax
je 0x100345b5
mov edx, ebx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x1003462a
mov dword [ebp - 0x28], 0xeaba4a2c
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x10034625
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x5cc]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x5cc]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setg dl
or ecx, 0xffffffff
imul eax, edx, 0xfffffffc
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5cc], ecx
dec dword [ebp - 0x14]
jns 0x100345ea
xor eax, eax
dec dword [ebp - 0x10]
jns 0x100345d8
mov dword [ebp - 0x10], eax
jmp 0x10034646
push dword [ebp - 0x10]
lea ecx, [ebp - 0x800]
call fcn.10016fb3
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003462f
mov dword [ebp - 0x34], 0x7e2799ac
mov dword [ebp - 0x14], 0xe7374489
mov dword [ebp - 0x4c], 0xfa607100
mov dword [ebp - 0x4c], 0xfffffffb
mov dword [ebp - 0x34], 0xffffffe2
cmp dword [ebp - 0x34], 0xffffffe3
jle 0x1003491d
push esi
lea ecx, [ebp - 0x98c]
call fcn.10016f46
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x974]
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x3c], 0x9a695768
push ebx
call fcn.10016f46
mov byte [ebp - 4], 0x1c
xor eax, eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x100346d2
push dword [ebp - 0x24]
lea ecx, [ebp - 0x98c]
call fcn.10016fb3
mov dword [eax], 0x72fd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100346b4
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x100346f8
push dword [ebp - 0x24]
lea ecx, [ebp - 0x974]
call fcn.10016fb3
mov dword [eax], 0xa50b5f0b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x100346da
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x10034816
or esi, 0xffffffff
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0xa6c]
mov dword [ebp - 0x30], 0x64b5c6f8
push 4
call fcn.10016f46
mov byte [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1003474b
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa6c]
call fcn.10016fb3
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10034730
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10034765
push eax
push eax
push 0x23bc
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x100347f3
mov dword [ebp - 0x10], 0x9c710427
mov dword [ebp - 0x4c], 0x1a88af16
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
dec dword [ebp - 0x44]
test eax, eax
jne 0x100347d0
cmp dword [ebp - 0x14], eax
je 0x100347c1
cmp dword [ebp - 0x34], 0x8a51
jle 0x10034799
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x98c]
xor eax, eax
push eax
call fcn.10016fb3
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0xa6c]
mov eax, dword [ebp - 0x4c]
push edi
call fcn.10016fb3
mov eax, dword [ebp - 0x4c]
xor eax, eax
push eax
lea ecx, [ebp - 0x98c]
call fcn.10016fb3
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
je 0x100347df
mov eax, ebx
mov ecx, dword [ebp - 0x3c]
imul ecx, eax
xor eax, eax
inc ecx
cmp ecx, ebx
setl al
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1003476d
lea ecx, [ebp - 0xa6c]
mov byte [ebp - 4], 0x1c
call fcn.10016fae
dec dword [ebp - 0x24]
jns 0x10034707
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10034872
push eax
lea ecx, [ebp - 0x974]
call fcn.10016fb3
mov esi, eax
lea ecx, [ebp - 0x974]
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [eax]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [esi], ecx
cmp eax, dword [ebp - 0x14]
jl 0x10034861
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x40], eax
je 0x10034863
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 0x34]
jge 0x10034875
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov ecx, 0xffff
cmp ecx, eax
mov eax, dword [ebp - 0x40]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setne cl
cmp ecx, 0xd9d76c13
sbb ecx, ecx
neg ecx
sub ecx, 0x15c25834
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
cmp eax, edx
setg cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x974]
mov eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x14], eax
call fcn.10016fae
lea ecx, [ebp - 0x98c]
mov byte [ebp - 4], 0x1a
call fcn.10016fae
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe3
push 2
pop esi
jg 0x10034678
mov dword [ebp - 0x34], 9
cmp dword [ebp - 0x34], 0x19
jne 0x10034f36
jmp 0x10034933
push 2
pop esi
push edi
lea ecx, [ebp - 0xa84]
call fcn.10016f46
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x9a4]
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x40], eax
push edi
call fcn.10016f46
xor eax, eax
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10034986
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa84]
call fcn.10016fb3
mov dword [eax], 0x648
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10034968
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x100349a6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1ac], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003498e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x100349cc
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9a4]
call fcn.10016fb3
mov dword [eax], 0xa9f4f9a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100349ae
xor eax, eax
mov dword [ebp - 0x1a8], eax
jmp 0x100349ed
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x100349e7
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor eax, eax
inc dword [ebp - 0x1a8]
cmp dword [ebp - 0x1a8], esi
jle 0x100349d4
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x10034b47
jmp 0x10034a05
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffb
lea ecx, [ebp - 0xb50]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x4c], 0xc13fe66
push edi
call fcn.10016f46
mov byte [ebp - 4], 0x20
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x10], eax
jmp 0x10034a47
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb50]
call fcn.10016fb3
mov dword [eax], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10034a30
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x40]
test eax, eax
je 0x10034ab1
xor eax, eax
lea ecx, [ebp - 0x9a4]
push eax
call fcn.10016fb3
mov esi, dword [ebp - 0x4c]
xor edx, edx
add esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x4c]
cmp esi, ecx
push ebx
setle dl
lea ecx, [ebp - 0xb50]
mov dword [eax], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp + eax*4 - 0x1ac]
call fcn.10016fb3
mov dword [eax], esi
lea eax, [esi + 0x623b4709]
cmp ebx, eax
mov dword [ebp - 0x1a8], eax
sbb eax, eax
inc eax
jns 0x10034ab1
mov esi, ebx
jmp 0x10034ab5
xor eax, eax
mov esi, eax
push 2
lea ecx, [ebp - 0xa84]
call fcn.10016fb3
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp esi, ecx
setge dl
xor ecx, ecx
cmp edx, dword [eax]
setle cl
imul eax, ecx, 0xafe3
cmp eax, dword [ebp - 0x48]
jne 0x10034af1
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10034b2c
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x10034b2c
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10034b27
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x10034b24
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9a4]
call fcn.10016fb3
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp + ecx*4 - 0x1ac]
mov dword [eax], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10034b00
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10034af8
lea ecx, [ebp - 0xb50]
mov byte [ebp - 4], 0x1f
call fcn.10016fae
dec dword [ebp - 0x2c]
jns 0x10034a03
push 2
pop esi
lea ecx, [ebp - 0x9a4]
call fcn.10016fae
lea ecx, [ebp - 0xa84]
mov byte [ebp - 4], 0x1a
call fcn.10016fae
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x2c], 0x3cdf98a5
mov dword [ebp - 0x28], 0xfffffff9
imul eax, dword [ebp - 0x2c], 0xfff8
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0x14
jmp 0x10034bad
xor eax, eax
mov dword [ebp - 0x28], 5
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10034ba7
push eax
push 0x179c
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x2c]
push 6
pop eax
cmp dword [ebp - 0x2c], eax
jge 0x10034b89
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10034df5
jmp 0x10034bc8
xor eax, eax
mov dword [ebp - 0x2c], 0x184c506d
or ecx, 0xffffffff
mov dword [ebp - 0x24], 0x6fb807cf
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x30], 0xa7bc41bb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10034c06
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x21c], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10034bee
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10034c18
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xeec], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10034c0b
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov dword [ebp - 0xee4], eax
mov eax, dword [ebp - 0x2c]
mov eax, 0x9abb2e79
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x2c]
cmp eax, esi
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setle cl
sub eax, ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2c], eax
jle 0x10034dab
push edi
lea ecx, [ebp - 0x744]
call fcn.10016f46
mov byte [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x10], eax
jmp 0x10034ca8
push dword [ebp - 0x10]
call fcn.10016fb3
and dword [eax], 0
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x744]
cmp dword [ebp - 0x10], edi
jl 0x10034c9a
push esi
call fcn.10016fb3
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x10034d9a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10034cec
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9dc], 0x3421ad7b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10034cd4
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jg 0x10034d91
mov dword [ebp - 0x4c], 0xfffffff9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x10034d71
cmp dword [ebp - 0x9dc], eax
jl 0x10034d16
mov esi, eax
cmp dword [ebp - 0x4c], eax
je 0x10034d18
mov esi, ebx
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x744]
mov dword [ebp + eax*4 - 0x21c], esi
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.10016fb3
xor ecx, ecx
test esi, esi
mov esi, dword [ebp - 0x9dc]
sets cl
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x744]
setl dl
imul esi, dword [ebp - 0xee4]
mov eax, dword [ebp - 0x14]
add esi, edx
inc eax
push eax
call fcn.10016fb3
mov eax, dword [eax]
imul eax, esi
mov dword [ebp - 0x4c], eax
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x10034d07
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10034d82
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jle 0x10034cf8
push 2
pop esi
dec dword [ebp - 0x24]
jns 0x10034ccc
lea ecx, [ebp - 0x744]
mov byte [ebp - 4], 0x1a
call fcn.10016fae
jmp 0x10034dd4
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10034dce
push 0xd52
push 0x1c2e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor eax, eax
mov dword [ebp - 0x21c], eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xf0]
call fcn.10016fb3
mov dword [eax], 0xf903a798
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10034bc6
or eax, 0xffffffff
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x6d4]
mov dword [ebp - 0x10], eax
push edi
call fcn.10016f46
push esi
lea ecx, [ebp - 0xc10]
mov byte [ebp - 4], 0x22
call fcn.10016f46
xor eax, eax
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10034e49
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6d4]
call fcn.10016fb3
mov dword [eax], 0xd8ff8cd3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10034e2b
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10034e65
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc10]
call fcn.10016fb3
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10034e4e
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], 0xf2ef51ae
cmp dword [ebp - 0x10], eax
jne 0x10034e85
mov esi, eax
cmp dword [ebp - 0x2c], eax
je 0x10034e87
mov esi, ebx
push 2
lea ecx, [ebp - 0x6d4]
call fcn.10016fb3
push 2
lea ecx, [ebp - 0x6d4]
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
call fcn.10016fb3
push 2
lea ecx, [ebp - 0x6d4]
call fcn.10016fb3
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xc10]
xor eax, eax
push eax
call fcn.10016fb3
mov esi, dword [ebp - 0x24]
mov edi, eax
imul esi, dword [ebp - 0x24]
sub esi, dword [ebp - 0x24]
neg esi
sbb esi, esi
xor edx, edx
inc esi
add esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
cmp ecx, esi
lea ecx, [ebp - 0xc10]
setle dl
imul eax, edx, 0xfe22
sub eax, dword [ebp - 0x2c]
mov dword [edi], eax
call fcn.10016fae
lea ecx, [ebp - 0x6d4]
mov byte [ebp - 4], 0x1a
call fcn.10016fae
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x54], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x19
push 3
pop edi
je 0x10034930
push 2
lea ecx, [ebp - 0x560]
call fcn.10016f46
xor eax, eax
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10034f77
push dword [ebp - 0x10]
lea ecx, [ebp - 0x560]
call fcn.10016fb3
mov dword [eax], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10034f58
xor eax, eax
push 3
mov dword [ebp - 0x24], eax
pop edi
lea ecx, [ebp - 0x560]
cmp dword [ebp - 0x24], ebx
jg 0x10035025
mov dword [ebp - 0x28], 0xfffffff8
push dword [ebp - 0x24]
call fcn.10016fb3
push dword [ebp - 0x24]
lea ecx, [ebp - 0x560]
call fcn.10016fb3
push ebx
lea ecx, [ebp - 0x560]
call fcn.10016fb3
push dword [ebp - 0x24]
lea ecx, [ebp - 0x560]
mov esi, dword [eax]
neg esi
call fcn.10016fb3
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
cmp ecx, 8
jae 0x10034ffd
push dword [ebp - 0x24]
lea ecx, [ebp - 0x560]
call fcn.10016fb3
cmp dword [eax], 0
jne 0x10034ffd
xor eax, eax
mov ecx, eax
jmp 0x10034fff
mov ecx, ebx
xor eax, eax
cmp ecx, edi
sete al
xor edx, edx
cmp eax, 0x27359b50
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x24]
jmp 0x10034f7d
mov byte [ebp - 4], 0x1a
call fcn.10016fae
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x800]
mov eax, dword [ebp - 0x38]
xor eax, eax
push eax
call fcn.10016fb3
mov esi, eax
lea ecx, [ebp - 0xf0]
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov dword [esi], ecx
push eax
lea ecx, [ebp - 0xf0]
call fcn.10016fb3
xor eax, eax
lea ecx, [ebp - 0x800]
push eax
call fcn.10016fb3
xor eax, eax
lea ecx, [ebp - 0xf0]
push eax
call fcn.10016fb3
xor eax, eax
cmp dword [ebp - 0x58], eax
je 0x10035091
mov ecx, ebx
cmp dword [ebp - 0x5c], eax
jne 0x10035093
mov ecx, eax
mov eax, dword [ebp - 0x54]
imul eax, ecx
lea ecx, [ebp - 0x800]
sub eax, 0x633ef28f
mov dword [ebp - 0x34], eax
call fcn.10016fae
or eax, 0xffffffff
lea ecx, [ebp - 0xf0]
mov dword [ebp - 4], eax
call fcn.10016fae
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xd
push 2
pop esi
jl 0x10032caa
xor eax, eax
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x10], 0x7cd95da2
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x4c], eax
push 0xfffffffffffffffc
pop edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1003511a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1228], 0x4e8fe752
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10035102
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10035130
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x470], 0x8d20
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003511f
mov eax, dword [ebp - 0x54]
dec dword [ebp - 0x470]
mov eax, dword [ebp - 0x470]
cmp dword [ebp - 0x54], eax
je 0x1003516d
xor eax, eax
cmp dword [ebp - 0x5c], 0x498b94be
je 0x1003515b
mov ecx, ebx
cmp dword [ebp - 0x28], eax
jne 0x1003515d
mov ecx, eax
mov eax, dword [ebp - 0x40]
sub ecx, eax
cmp ecx, dword [ebp - 0x4c]
jge 0x1003516d
mov eax, dword [ebp - 0x470]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x470]
sub ecx, eax
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov dword [ebp - 0x10], 0x251d69f4
mov dword [ebp - 0x3c], ebx
push 7
pop eax
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], 0x2a67f8b4
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x3c]
sub edx, eax
add edx, dword [ebp - 0x3c]
imul edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x44]
cmp ecx, 0xcaa8e55a
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
neg ecx
je 0x10035224
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10035288
push 0x25aa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
jmp 0x10035288
mov dword [ebp - 0x54], 0x2e4ed383
mov dword [ebp - 0x5c], 0x75e3aa9c
mov dword [ebp - 0x28], 0x5ab171c2
mov eax, dword [ebp - 0x54]
neg eax
je 0x10035270
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp eax, ebx
setge cl
xor eax, eax
cmp ecx, 0x2840
setle al
cmp eax, dword [ebp - 0x40]
jne 0x10035265
xor eax, eax
cmp dword [ebp - 0x5c], eax
je 0x10035267
mov eax, ebx
jmp 0x10035267
xor eax, eax
cmp eax, dword [ebp - 0x4c]
jg 0x10035270
mov eax, ebx
jmp 0x10035272
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10035288
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x10], 0x7cd95da2
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100352dc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1240], 0x4e8fe752
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100352c4
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100352f2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x47c], 0x8d20
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100352e1
mov eax, dword [ebp - 0x54]
dec dword [ebp - 0x47c]
mov eax, dword [ebp - 0x47c]
cmp dword [ebp - 0x54], eax
je 0x1003532f
xor eax, eax
cmp dword [ebp - 0x5c], 0x498b94be
je 0x1003531d
mov ecx, ebx
cmp dword [ebp - 0x28], eax
jne 0x1003531f
mov ecx, eax
mov eax, dword [ebp - 0x40]
sub ecx, eax
cmp ecx, dword [ebp - 0x4c]
jge 0x1003532f
mov eax, dword [ebp - 0x47c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x47c]
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], 0x9c3fbb4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003536f
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4d0], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003535d
mov ecx, dword [ebp - 0x1c]
xor edx, edx
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setg dl
xor ecx, ecx
sub edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
add eax, 0xffff4f3a
neg eax
sbb eax, eax
inc eax
cmp eax, edx
jge 0x1003540c
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1003540e
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x54], 0x3ed423cb
mov dword [ebp - 0x5c], 0xfffffff8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x5c], 0xffff3ba0
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10035449
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x10035449
xor eax, eax
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1003544b
mov dword [ebp - 0x54], 0xf4802d14
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4d0], 0xfffffffc
mov eax, dword [ebp - 0x54]
cmp eax, ebx
setl cl
xor eax, eax
mov dword [ebp - 0x54], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1003541d
xor eax, eax
push 7
pop ecx
mov dword [ebp - 0x5c], ecx
mov ecx, 0xffff
mov dword [ebp - 0x28], 0xc7730f94
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10035484
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcdc], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10035472
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x28], eax
xor eax, eax
dec dword [ebp - 0x54]
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x30], 0x525d2d91
mov dword [ebp - 0x30], 0xe13a6c9c
mov dword [ebp - 0x30], 0xb44cf592
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 0x1a7a81a8
mov dword [ebp - 0x30], 0xfffffffe
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x268], ebx
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xd06bde64
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x2c], eax
jl 0x100355c0
push esi
lea ecx, [ebp - 0xa9c]
call fcn.10016f46
mov dword [ebp - 4], 0x25
xor eax, eax
mov dword [ebp - 0x5c], 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10035548
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x10d8], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10035530
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1003556e
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa9c]
call fcn.10016fb3
mov dword [eax], 0x23371247
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10035550
xor eax, eax
cmp dword [ebp - 0x10d8], eax
je 0x1003558d
push eax
lea ecx, [ebp - 0xa9c]
call fcn.10016fb3
cmp dword [eax], 0
je 0x1003558b
mov eax, ebx
jmp 0x1003558d
xor eax, eax
mov dword [ebp - 0x5c], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x100355a4
push eax
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
or eax, 0xffffffff
lea ecx, [ebp - 0xa9c]
mov dword [ebp - 4], eax
call fcn.10016fae
dec dword [ebp - 0x2c]
jns 0x1003550c
xor eax, eax
dec dword [ebp - 0x54]
mov dword [ebp - 0x28], 0x7cd95da2
mov dword [ebp - 0x14], eax
push 7
pop ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x2c], 0x7d1afd06
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100355f7
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdfc], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100355e5
mov eax, dword [ebp - 0x14]
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x10035605
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x14]
jg 0x10035634
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10035636
mov eax, ebx
jmp 0x10035636
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10035660
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1003565d
push 0x1547
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x10035640
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], eax
jmp 0x100358f9
mov dword [ebp - 0x2c], 0x4a18885c
lea ecx, [ebp - 0x794]
push edi
call fcn.10016f46
mov dword [ebp - 4], 0x27
xor eax, eax
mov dword [ebp - 0x5c], 0xb3d925d3
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100356bc
push dword [ebp - 0x14]
lea ecx, [ebp - 0x794]
call fcn.10016fb3
mov dword [eax], 0x9d692360
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003569e
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x100356dc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa04], 0xf5a2f617
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100356c4
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffff1
jl 0x100358d4
push 7
pop ecx
mov dword [ebp - 0x14], 0xfe5f36f6
mov dword [ebp - 0x54], 0xdaafe497
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0xffffffe6
je 0x100358c7
push edi
lea ecx, [ebp - 0x488]
call fcn.10016f46
or eax, 0xffffffff
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10035748
push dword [ebp - 0x10]
lea ecx, [ebp - 0x488]
call fcn.10016fb3
mov dword [eax], 0xef054a20
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003572a
xor eax, eax
push eax
lea ecx, [ebp - 0x488]
call fcn.10016fb3
mov dword [eax], esi
jmp 0x100357e5
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10035777
push eax
push 0x1247
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], esi
jg 0x100357d7
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x794]
call fcn.10016fb3
push esi
lea ecx, [ebp - 0x794]
call fcn.10016fb3
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x794]
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x3c]
call fcn.10016fb3
mov ecx, dword [ebp - 0xa00]
mov edx, 0x8c458a92
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
sbb edx, edx
inc edx
imul ecx, edx
xor edx, edx
cmp ecx, dword [eax]
setg dl
mov dword [ebp - 0x4c], edx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jle 0x1003577f
xor eax, eax
push eax
lea ecx, [ebp - 0x488]
call fcn.10016fb3
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x488]
push eax
call fcn.10016fb3
cmp dword [eax], 0
jge 0x1003575b
xor eax, eax
cmp dword [ebp - 0x5c], eax
jne 0x10035888
imul eax, dword [ebp - 0x14], 0x9363
cmp eax, 0xda91e53b
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xb389
setl cl
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x488]
mov eax, dword [ebp - 0x54]
xor eax, eax
push eax
call fcn.10016fb3
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0xa04], eax
je 0x1003585b
push eax
lea ecx, [ebp - 0x488]
call fcn.10016fb3
cmp dword [eax], 0
je 0x10035859
mov edx, ebx
jmp 0x1003585d
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp eax, 0xfffffffc
setne cl
xor eax, eax
cmp ecx, edx
mov ecx, dword [ebp - 0x24]
setge al
sub ecx, eax
mov eax, 0xffff
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, eax
jne 0x10035888
xor eax, eax
mov ecx, eax
jmp 0x1003588a
mov ecx, ebx
mov eax, dword [ebp - 0x24]
imul eax, ecx
mov ecx, 0xfffe
cmp ecx, eax
lea ecx, [ebp - 0x488]
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 0x27
call fcn.10016fae
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe6
jne 0x1003570a
push 7
xor eax, eax
pop ecx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff1
jge 0x100356ec
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x100358e5
push eax
push eax
call dword [sym.imp.USER32.dll_EnumWindows]
or eax, 0xffffffff
lea ecx, [ebp - 0x794]
mov dword [ebp - 4], eax
call fcn.10016fae
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 5
jle 0x10035673
mov dword [ebp - 0x30], 0xfffffffb
lea ecx, [ebp - 0xb68]
mov dword [ebp - 0x14], 0x62fd41e5
mov dword [ebp - 0x40], 0xaf5bfb66
push ebx
call fcn.10016f46
xor eax, eax
mov dword [ebp - 4], 0x29
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003594f
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb68]
call fcn.10016fb3
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10035935
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100359cf
mov dword [ebp - 0x10], 5
xor edx, edx
mov dword [ebp - 0x54], 0x1bbb4f5a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setg dl
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0xfb2c41ac
neg ecx
sbb ecx, ecx
add ecx, 2
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
setg bl
xor edx, edx
cmp ecx, eax
lea ecx, [ebp - 0xb68]
setle dl
xor eax, eax
cmp edx, ebx
setle al
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [ebp - 0x40]
mov dword [eax], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xf
je 0x10035954
or eax, 0xffffffff
lea ecx, [ebp - 0xb68]
mov dword [ebp - 4], eax
call fcn.10016fae
mov dword [ebp - 0x58], 0xfffffff7
xor eax, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10035a16
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdc], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100359fe
xor eax, eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xfffffffd
jle 0x10035b41
mov eax, 0xfffe
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x54], 0x520f3038
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, 0x70f9e3d3
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xdc]
setge cl
sub edx, ecx
xor ebx, ebx
sub edx, eax
mov eax, dword [ebp - 0x14]
cmp edx, eax
setne bl
neg ebx
sub ebx, dword [ebp - 0xdc]
mov eax, dword [ebp - 0xd8]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp eax, 0x7bededb5
mov eax, dword [ebp - 0xdc]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, ebx
setne al
cmp eax, 0x1db6
je 0x10035afe
xor eax, eax
mov dword [ebp - 0x5c], 0xfffffffb
mov dword [ebp - 0x10], eax
or ecx, 0xffffffff
cmp dword [ebp - 0x10], esi
jge 0x10035ad9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe20], ecx
inc dword [ebp - 0x10]
jmp 0x10035ac5
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x2c]
add eax, 0xe1d327c
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [ebp - 0xe20], eax
jmp 0x10035b2c
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10035b26
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10035b1e
push 0x1944
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10035b2c
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x23
je 0x10035b05
dec dword [ebp - 0xdc]
cmp dword [ebp - 0xdc], 0xfffffffd
jg 0x10035a29
xor eax, eax
mov dword [ebp - 0x34], eax
xor ebx, ebx
mov dword [ebp - 0x14], 0x20f89b54
inc ebx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x24], 0x8905b8b7
mov dword [ebp - 0x2c], 0x7c7008b1
mov dword [ebp - 0x44], 0x21462ccd
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], 0xe2efaada
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10035b97
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x614], 0x85f70ad6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10035b7f
xor eax, eax
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x10035c76
or eax, 0xffffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10035bdd
cmp dword [ebp - 0x40], eax
jne 0x10035bd1
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x614], 0x3e86f8c7
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x614], ecx
jne 0x10035c15
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x614], ecx
jne 0x10035c15
xor eax, eax
jmp 0x10035c17
mov eax, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x614]
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x10035c37
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x614]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x614]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x5c], 0xfffffffa
dec dword [ebp - 0x14]
jns 0x10035ba3
push 6
pop eax
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0xd24]
mov dword [ebp - 0x50], 0xe52509e7
push esi
call fcn.10016f46
mov dword [ebp - 4], 0x2a
xor eax, eax
mov dword [ebp - 0x5c], 0x94951162
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10035cbf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1030], 0x58018d9d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10035ca7
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10035ce5
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xd24]
call fcn.10016fb3
mov dword [eax], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10035cc7
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10035cfb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7c4], 0x953e80c6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10035cea
cmp dword [ebp - 0x54], ebx
jge 0x10035d0b
mov eax, dword [ebp - 0x7c4]
mov eax, dword [ebp - 0x1030]
lea ecx, [ebp - 0xd24]
mov eax, dword [ebp - 0x54]
or edi, 0xffffffff
add eax, 0xae85
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], edi
call fcn.10016fae
mov dword [ebp - 0x50], 0xfffffffc
lea ecx, [ebp - 0x1d8]
push esi
call fcn.10016f46
mov dword [ebp - 4], 0x2b
xor eax, eax
mov dword [ebp - 0x54], 0xecf04b06
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10035d72
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1d8]
call fcn.10016fb3
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10035d58
xor eax, eax
push eax
lea ecx, [ebp - 0x1d8]
call fcn.10016fb3
and dword [eax], 0
jmp 0x10035f01
push esi
lea ecx, [ebp - 0x438]
call fcn.10016f46
xor eax, eax
mov byte [ebp - 4], 0x2c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10035dbe
push dword [ebp - 0x10]
lea ecx, [ebp - 0x438]
call fcn.10016fb3
mov dword [eax], 0x162c9cc1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10035da0
xor eax, eax
push eax
lea ecx, [ebp - 0x1d8]
call fcn.10016fb3
push ebx
lea ecx, [ebp - 0x438]
call fcn.10016fb3
cmp dword [eax], 0
je 0x10035e06
push ebx
lea ecx, [ebp - 0x1d8]
call fcn.10016fb3
mov esi, eax
lea ecx, [ebp - 0x1d8]
xor eax, eax
push eax
call fcn.10016fb3
xor edx, edx
push 2
mov ecx, dword [eax]
cmp ecx, dword [esi]
pop esi
setg dl
mov dword [ebp - 0x54], edx
push ebx
lea ecx, [ebp - 0x438]
call fcn.10016fb3
push ebx
lea ecx, [ebp - 0x438]
call fcn.10016fb3
push ebx
lea ecx, [ebp - 0x438]
call fcn.10016fb3
xor eax, eax
lea ecx, [ebp - 0x438]
push eax
call fcn.10016fb3
xor eax, eax
lea ecx, [ebp - 0x1d8]
push eax
call fcn.10016fb3
xor eax, eax
lea ecx, [ebp - 0x1d8]
push eax
call fcn.10016fb3
push ebx
lea ecx, [ebp - 0x438]
call fcn.10016fb3
xor ecx, ecx
cmp dword [eax], ecx
setge cl
test ecx, ecx
jg 0x10035e80
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10035eb1
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
jmp 0x10035eaf
mov dword [ebp - 0x54], 0xbbb66efe
lea ecx, [ebp - 0x1d8]
push ebx
call fcn.10016fb3
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x54], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10035eaf
push eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10035ee2
push 0x1855
push 0x1ff4
push 0x23ee
push 0x2019
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x2b
call fcn.10016fae
xor eax, eax
lea ecx, [ebp - 0x1d8]
push eax
call fcn.10016fb3
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x1d8]
push eax
call fcn.10016fb3
cmp dword [eax], 0xffffffe2
jge 0x10035d86
lea ecx, [ebp - 0x1d8]
mov dword [ebp - 4], edi
call fcn.10016fae
push 7
pop ecx
mov dword [ebp - 0x3c], ecx
xor eax, eax
mov dword [ebp - 0x5c], 0xa969
mov dword [ebp - 0x54], 0xa61bf079
mov dword [ebp - 0x50], 0xfffffff9
mov dword [ebp - 0x4c], 0x935cb514
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
push 6
pop edx
jge 0x10035f6b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xab4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10035f56
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10035f8b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe0c], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10035f73
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x10036102
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], 0x51bb35b6
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x50], 0x16d21b18
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x50], 0xff1eb7e5
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10035fda
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1c0], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10035fc1
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10035ffc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x12b8], 0x88fe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10035fe3
xor eax, eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], esi
jg 0x100360e6
mov dword [ebp - 0x50], 0xf08e2294
lea ecx, [ebp - 0xc7c]
push esi
call fcn.10016f46
xor eax, eax
mov dword [ebp - 4], 0x2d
mov dword [ebp - 0x10], eax
jmp 0x10036046
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc7c]
call fcn.10016fb3
mov dword [eax], 0x19d3388a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003602f
mov eax, dword [ebp - 0x1b8]
mov eax, dword [ebp + eax*4 - 0xab4]
mov eax, dword [ebp - 0x1b8]
mov eax, dword [ebp + eax*4 - 0xab4]
mov eax, dword [ebp - 0x1b8]
mov eax, dword [ebp - 0x1b8]
mov eax, dword [ebp + eax*4 - 0xab4]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x54], ebx
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x1003608c
mov ecx, ebx
cmp dword [ebp - 0x3c], eax
jne 0x1003608e
mov ecx, eax
mov eax, dword [ebp - 0x1b8]
add eax, ecx
mov ecx, dword [ebp - 0x3c]
imul ecx, eax
test ecx, ecx
jne 0x100360ac
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x1b8], eax
je 0x100360ae
mov edx, ebx
mov eax, dword [ebp - 0x1b8]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0xc7c]
dec dword [ebp - 0x4c]
mov dword [ebp - 4], edi
call fcn.10016fae
inc dword [ebp - 0x1b8]
cmp dword [ebp - 0x1b8], esi
jle 0x1003600e
push 7
xor eax, eax
pop ecx
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x100360fc
push eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 7
xor eax, eax
pop ecx
inc dword [ebp - 0x3c]
push 6
pop edx
cmp dword [ebp - 0x3c], ecx
jle 0x10035f93
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x54], edi
cmp dword [ebp - 0x1c], eax
je 0x10036123
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10036149
mov dword [ebp - 0x1c], 0xfffffffe
jmp 0x10036141
cmp dword [ebp - 0x1c], eax
jne 0x10036198
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffb
jle 0x10036139
jmp 0x10036198
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x4c], 0x3a3dbc56
mov dword [ebp - 0x1c], eax
jmp 0x10036175
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10036172
push 0x173b
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 7
xor eax, eax
pop ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jg 0x10036158
mov eax, dword [ebp - 0x40]
mov ecx, 0xffff0001
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
sub ecx, eax
add ecx, dword [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x590]
push 3
call fcn.10016f46
mov dword [ebp - 4], 0x2e
lea ecx, [ebp - 0x9bc]
mov dword [ebp - 0x2c], 0xee56
mov dword [ebp - 0x40], 0xe467
mov dword [ebp - 0x14], 0xb7be2d3d
push esi
call fcn.10016f46
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0xbc8]
mov dword [ebp - 0x10], 0x6aee34d1
mov dword [ebp - 0x54], 0xa861d8d4
push esi
call fcn.10016f46
xor eax, eax
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10036214
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x16c], 0xfffa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100361fc
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1003623c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x590]
call fcn.10016fb3
mov dword [eax], 8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1003621d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10036262
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9bc]
call fcn.10016fb3
mov dword [eax], 0xadf8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10036244
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10036288
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbc8]
call fcn.10016fb3
mov dword [eax], 0x70b7b20
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003626a
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10036290
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x590]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x14]
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x16c], eax
push esi
call fcn.10016fb3
push ebx
lea ecx, [ebp - 0x590]
call fcn.10016fb3
push esi
lea ecx, [ebp - 0x590]
call fcn.10016fb3
push 0
mov ecx, 0xdbfb1ab9
sub ecx, dword [eax]
pop eax
setns al
lea ecx, [ebp - 0x9bc]
inc eax
mov dword [ebp - 0x5c], eax
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [ebp - 0x5c]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x590]
setle bl
xor edi, edi
inc edi
push edi
call fcn.10016fb3
mov dword [eax], ebx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1003631b
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], 0x76a1
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10036358
push eax
lea ecx, [ebp - 0x9bc]
call fcn.10016fb3
cmp dword [eax], 0
je 0x10036356
xor ebx, ebx
inc ebx
mov edi, ebx
jmp 0x1003635d
xor eax, eax
xor ebx, ebx
mov edi, eax
inc ebx
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x590]
push ebx
call fcn.10016fb3
mov dword [eax], esi
xor eax, eax
cmp esi, edi
jl 0x1003637b
cmp dword [ebp - 0x10], eax
je 0x1003637b
mov eax, ebx
cmp eax, dword [ebp - 0x16c]
jl 0x10036391
xor eax, eax
cmp dword [ebp - 0x16c], eax
jne 0x10036393
mov esi, eax
jmp 0x10036395
xor eax, eax
mov esi, ebx
push eax
lea ecx, [ebp - 0xbc8]
call fcn.10016fb3
lea ecx, [ebp - 0xbc8]
mov dword [eax], esi
call fcn.10016fae
lea ecx, [ebp - 0x9bc]
call fcn.10016fae
or eax, 0xffffffff
lea ecx, [ebp - 0x590]
mov dword [ebp - 4], eax
call fcn.10016fae
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop edi
jmp 0x100363e5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1204], 0x4e8fe752
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100363d4
lea eax, [ebp - 0xf5c]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0xf6c]
push eax
lea ecx, [ebp - 0x113c]
movdqu xmmword [ebp - 0xf6c], xmm0
call fcn.10016fc2
lea ecx, [ebp - 0x27d]
mov esi, eax
call fcn.10008fe8
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x920]
push dword [esi]
call fcn.10016f88
mov dword [ebp - 4], 0x31
xor eax, eax
mov dword [ebp - 0x3c], 0x84c506d4
mov dword [ebp - 0x5c], 0x17ca4e8
mov dword [ebp - 0x40], 0xf3817d1d
mov dword [ebp - 0x5c], 5
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], edi
jg 0x10036520
jmp 0x10036461
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x920]
mov dword [ebp - 0x54], 2
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], 0x4795ed7c
mov dword [ebp - 0x54], 0x81f3403c
mov dword [ebp - 0x5c], 8
mov dword [ebp - 0x54], edi
push dword [ebp - 0x3c]
call fcn.10016fb3
xor esi, esi
cmp dword [eax], esi
je 0x100364b1
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x920]
call fcn.10016fb3
cmp dword [eax], esi
je 0x100364b1
mov esi, ebx
xor eax, eax
lea ecx, [ebp - 0x920]
push eax
call fcn.10016fb3
cmp dword [eax], 0
jne 0x100364d2
mov eax, dword [ebp - 0x40]
dec dword [ebp - 0x40]
test eax, eax
jne 0x100364d2
mov ecx, eax
jmp 0x100364d4
mov ecx, ebx
mov dword [ebp - 0x54], esi
xor edx, edx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x4c], 0x63a7
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], 0xfffffffe
mov eax, dword [ebp - 0x54]
cmp eax, ebx
mov eax, dword [ebp - 0x5c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jle 0x1003645f
or eax, 0xffffffff
lea ecx, [ebp - 0x920]
mov dword [ebp - 4], eax
call fcn.10016fae
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop esi
jmp 0x1003654c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x490], 0x8d20
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003653b
push edi
lea ecx, [ebp - 0xb80]
call fcn.10016f46
mov dword [ebp - 4], 0x32
lea ecx, [ebp - 0x878]
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x40], eax
push edi
call fcn.10016f46
xor eax, eax
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x100365a7
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xb80]
call fcn.10016fb3
mov dword [eax], 0x648
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10036589
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x100365c7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1b4], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100365af
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x100365ed
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x878]
call fcn.10016fb3
mov dword [eax], 0xa9f4f9a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100365cf
xor eax, eax
mov dword [ebp - 0x1b0], eax
jmp 0x1003660e
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10036608
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor eax, eax
inc dword [ebp - 0x1b0]
cmp dword [ebp - 0x1b0], esi
jle 0x100365f5
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x10036768
jmp 0x10036626
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffb
lea ecx, [ebp - 0xacc]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x54], 0xc13fe66
push edi
call fcn.10016f46
mov byte [ebp - 4], 0x34
xor eax, eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x10], eax
jmp 0x10036668
push dword [ebp - 0x10]
lea ecx, [ebp - 0xacc]
call fcn.10016fb3
mov dword [eax], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10036651
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x40]
test eax, eax
je 0x100366d2
xor eax, eax
lea ecx, [ebp - 0x878]
push eax
call fcn.10016fb3
mov esi, dword [ebp - 0x54]
xor edx, edx
add esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x54]
cmp esi, ecx
push ebx
setle dl
lea ecx, [ebp - 0xacc]
mov dword [eax], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp + eax*4 - 0x1b4]
call fcn.10016fb3
mov dword [eax], esi
lea eax, [esi + 0x623b4709]
cmp ebx, eax
mov dword [ebp - 0x1b0], eax
sbb eax, eax
inc eax
jns 0x100366d2
mov esi, ebx
jmp 0x100366d6
xor eax, eax
mov esi, eax
push 2
lea ecx, [ebp - 0xb80]
call fcn.10016fb3
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp esi, ecx
setge dl
xor ecx, ecx
cmp edx, dword [eax]
setle cl
imul eax, ecx, 0xafe3
cmp eax, dword [ebp - 0x4c]
jne 0x10036712
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1003674d
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1003674d
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10036748
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x10036745
push dword [ebp - 0x14]
lea ecx, [ebp - 0x878]
call fcn.10016fb3
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp + ecx*4 - 0x1b4]
mov dword [eax], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10036721
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10036719
lea ecx, [ebp - 0xacc]
mov byte [ebp - 4], 0x33
call fcn.10016fae
dec dword [ebp - 0x2c]
jns 0x10036624
push 2
pop esi
lea ecx, [ebp - 0x878]
call fcn.10016fae
or eax, 0xffffffff
lea ecx, [ebp - 0xb80]
mov dword [ebp - 4], eax
call fcn.10016fae
mov eax, dword [ebp - 0x38]
dec dword [ebp - 0x490]
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0x38], eax
je 0x100367bc
xor eax, eax
cmp dword [ebp - 0x50], 0x498b94be
je 0x100367aa
mov ecx, ebx
cmp dword [ebp - 0x30], eax
jne 0x100367ac
mov ecx, eax
mov eax, dword [ebp - 0x58]
sub ecx, eax
cmp ecx, dword [ebp - 0x34]
jge 0x100367bc
mov eax, dword [ebp - 0x490]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x490]
sub ecx, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 0xfffffffb
mov dword [ebp - 0x58], 0xfffffff7
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10036820
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x127c], 0x4e8fe752
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10036808
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10036836
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4a4], 0x8d20
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10036825
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x4a4]
mov eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x28], eax
je 0x10036873
xor eax, eax
cmp dword [ebp - 0x30], 0x498b94be
je 0x10036861
mov ecx, ebx
cmp dword [ebp - 0x50], eax
jne 0x10036863
mov ecx, eax
mov eax, dword [ebp - 0x58]
sub ecx, eax
cmp ecx, dword [ebp - 0x48]
jge 0x10036873
mov eax, dword [ebp - 0x4a4]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4a4]
sub ecx, eax
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x10], 0xfe7d
push edi
call fcn.10016f46
xor eax, eax
mov dword [ebp - 4], 0x35
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100368cf
push dword [ebp - 0x14]
lea ecx, [ebp - 0x824]
call fcn.10016fb3
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100368b1
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100368ef
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x468], 0xfff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100368d7
xor eax, eax
dec dword [ebp - 0x468]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x10036926
jmp 0x10036901
xor eax, eax
push eax
lea ecx, [ebp - 0x824]
call fcn.10016fb3
mov esi, eax
lea ecx, [ebp - 0x824]
xor eax, eax
push eax
call fcn.10016fb3
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x10]
jns 0x100368ff
or esi, 0xffffffff
lea ecx, [ebp - 0x824]
mov dword [ebp - 4], esi
call fcn.10016fae
mov dword [ebp - 0x10], 0x251d69f4
xor ecx, ecx
mov dword [ebp - 0x3c], ebx
push 7
pop eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x58], 0xfffffffc
mov dword [ebp - 0x40], 0x2a67f8b4
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x3c]
sub edx, eax
add edx, dword [ebp - 0x3c]
imul edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x58]
cmp ecx, 0xcaa8e55a
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
neg ecx
je 0x100369d5
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10036a39
push 0x25aa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
jmp 0x10036a39
mov dword [ebp - 0x28], 0x2e4ed383
mov dword [ebp - 0x30], 0x75e3aa9c
mov dword [ebp - 0x50], 0x5ab171c2
mov eax, dword [ebp - 0x28]
neg eax
je 0x10036a21
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, ebx
setge cl
xor eax, eax
cmp ecx, 0x2840
setle al
cmp eax, dword [ebp - 0x40]
jne 0x10036a16
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10036a18
mov eax, ebx
jmp 0x10036a18
xor eax, eax
cmp eax, dword [ebp - 0x48]
jg 0x10036a21
mov eax, ebx
jmp 0x10036a23
xor eax, eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10036a39
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x884]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], 0xfe7d
push edi
call fcn.10016f46
xor eax, eax
mov dword [ebp - 4], 0x36
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10036a81
push dword [ebp - 0x14]
lea ecx, [ebp - 0x884]
call fcn.10016fb3
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10036a63
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10036aa1