Function at 0x1003068d
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Create thread
Delete registry value
Get common file path
Get geographical location
Get graphical window text
Get session user name
Parse pe header

Disassembly:
mov eax, 0x1007f5ba
call fcn.1007d980
mov eax, 0x1acc
call fcn.1007a130
push ebx
push esi
push edi
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x4c4]
push 2
mov byte [ebp - 0x59], dl
call fcn.10018602
xor eax, eax
lea ecx, [ebp - 0xea4]
mov dword [ebp - 4], eax
or edi, 0xffffffff
mov dword [ebp - 0x2c], 0x9bdba76a
mov dword [ebp - 0x38], edi
push 3
call fcn.10018602
xor eax, eax
lea ecx, [ebp - 0x180c]
inc eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x13c0]
movdqa xmm0, xmmword [0x100082b0]
push eax
lea eax, [ebp - 0x13d0]
push eax
movdqu xmmword [ebp - 0x13d0], xmm0
call fcn.100186af
lea ecx, [ebp - 0x1b6]
mov esi, eax
call fcn.10009273
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1248]
push dword [esi]
call fcn.1001865e
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10030751
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4c4]
call fcn.100186a0
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10030732
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10030775
push dword [ebp - 0x10]
lea ecx, [ebp - 0xea4]
call fcn.100186a0
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003075a
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10030a26
push 2
lea ecx, [ebp - 0xe8c]
call fcn.10018602
xor eax, eax
mov byte [ebp - 4], 3
xor ebx, ebx
mov dword [ebp - 0x10], eax
inc ebx
cmp dword [ebp - 0x10], ebx
jge 0x100307b6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x70], 0x7a888ada
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x1003079b
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100307de
push dword [ebp - 0x10]
lea ecx, [ebp - 0xe8c]
call fcn.100186a0
mov dword [eax], 0x25bb5a27
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100307bf
xor eax, eax
mov dword [ebp - 0x70], ebx
cmp dword [ebp - 0x70], eax
jl 0x10030a14
push 4
lea ecx, [ebp - 0x354]
call fcn.10018602
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x28], 0xf8278b7
mov dword [ebp - 0x28], 0x29efec1a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10030833
push 5
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x354]
call fcn.100186a0
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10030817
xor ebx, ebx
inc ebx
push dword [ebp - 0x70]
lea ecx, [ebp - 0x4c4]
call fcn.100186a0
cmp dword [eax], 0
je 0x10030854
push dword [ebp - 0x70]
lea ecx, [ebp - 0x4c4]
call fcn.100186a0
xor eax, eax
lea ecx, [ebp - 0x354]
push eax
call fcn.100186a0
cmp dword [eax], 0
jne 0x1003086a
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x4c4]
xor eax, eax
push eax
call fcn.100186a0
xor eax, eax
lea ecx, [ebp - 0x354]
push eax
call fcn.100186a0
xor edx, edx
cmp dword [eax], 0x5a83d87e
mov eax, dword [ebp - 0x70]
mov esi, dword [ebp - 0x70]
setle dl
push dword [ebp - 0x70]
xor ecx, ecx
cmp edx, eax
setne cl
add esi, ecx
lea ecx, [ebp - 0x4c4]
call fcn.100186a0
xor ecx, ecx
cmp dword [eax], esi
setle cl
cmp ecx, 0x446c
jle 0x1003093f
lea eax, [ebp - 0x15a0]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x15b0]
push eax
lea ecx, [ebp - 0x18a4]
movdqu xmmword [ebp - 0x15b0], xmm0
call fcn.100186af
lea ecx, [ebp - 0x196]
mov esi, eax
call fcn.10009273
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xe74]
push dword [esi]
call fcn.1001865e
push 5
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x354]
xor eax, eax
push eax
call fcn.100186a0
lea ecx, [ebp - 0xe74]
cmp dword [eax], 0
jne 0x10030a04
xor eax, eax
push eax
call fcn.100186a0
lea ecx, [ebp - 0xe74]
mov dword [eax], edi
call fcn.10018684
jmp 0x100309ea
mov dword [ebp - 0x48], edi
xor eax, eax
mov dword [ebp - 0x18], 0x82966b91
mov dword [ebp - 0x38], eax
jmp 0x1003097e
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x1003097b
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030976
push 0x1e34
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1003095f
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x10030950
push eax
lea ecx, [ebp - 0x1248]
call fcn.100186a0
lea ecx, [ebp - 0x354]
inc dword [eax]
xor eax, eax
push eax
call fcn.100186a0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xe8c]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], 0xffff
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x70]
push ebx
call fcn.100186a0
xor ebx, ebx
lea ecx, [ebp - 0xea4]
cmp dword [eax], 8
setl bl
xor eax, eax
push eax
call fcn.100186a0
mov ecx, dword [ebp - 0x48]
mov edx, 0xff40b36f
imul ecx, ebx
cmp edx, ecx
sbb ecx, ecx
xor ebx, ebx
neg ecx
inc ebx
mov dword [eax], ecx
lea ecx, [ebp - 0x354]
mov byte [ebp - 4], 3
call fcn.10018684
dec dword [ebp - 0x70]
jns 0x100307ea
jmp 0x10030a14
call fcn.10018684
lea ecx, [ebp - 0x354]
call fcn.10018684
lea ecx, [ebp - 0xe8c]
mov byte [ebp - 4], 2
call fcn.10018684
inc dword [ebp - 0x2c]
xor eax, eax
inc eax
cmp dword [ebp - 0x2c], eax
jle 0x1003077d
lea ecx, [ebp - 0x1248]
call fcn.10018684
lea ecx, [ebp - 0xea4]
call fcn.10018684
lea ecx, [ebp - 0x4c4]
mov dword [ebp - 4], edi
call fcn.10018684
push 2
lea ecx, [ebp - 0x5cc]
call fcn.10018602
push 6
pop ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0xf28]
mov dword [ebp - 0x2c], 0x9bdba76a
mov dword [ebp - 0x38], edi
push 3
call fcn.10018602
lea eax, [ebp - 0x1400]
mov byte [ebp - 4], 7
movdqa xmm0, xmmword [0x100082b0]
lea ecx, [ebp - 0x181c]
push eax
lea eax, [ebp - 0x1410]
push eax
movdqu xmmword [ebp - 0x1410], xmm0
call fcn.100186af
lea ecx, [ebp - 0x1d6]
mov esi, eax
call fcn.10009273
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x10a0]
push dword [esi]
call fcn.1001865e
xor eax, eax
mov byte [ebp - 4], 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10030af9
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5cc]
call fcn.100186a0
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10030ada
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10030b1d
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf28]
call fcn.100186a0
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10030b02
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x2c], eax
jg 0x10030de2
push 2
lea ecx, [ebp - 0xc70]
call fcn.10018602
xor eax, eax
mov byte [ebp - 4], 9
xor ebx, ebx
mov dword [ebp - 0x10], eax
inc ebx
cmp dword [ebp - 0x10], ebx
jge 0x10030b65
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x64], 0x7a888ada
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10030b4a
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10030b8d
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc70]
call fcn.100186a0
mov dword [eax], 0x25bb5a27
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10030b6e
xor eax, eax
mov dword [ebp - 0x64], ebx
cmp dword [ebp - 0x64], eax
jl 0x10030dc1
push 4
lea ecx, [ebp - 0x318]
call fcn.10018602
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x28], 0xf8278b7
mov dword [ebp - 0x28], 0x29efec1a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10030be2
push 5
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x318]
call fcn.100186a0
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10030bc6
xor ebx, ebx
inc ebx
push dword [ebp - 0x64]
lea ecx, [ebp - 0x5cc]
call fcn.100186a0
cmp dword [eax], 0
je 0x10030c03
push dword [ebp - 0x64]
lea ecx, [ebp - 0x5cc]
call fcn.100186a0
xor eax, eax
lea ecx, [ebp - 0x318]
push eax
call fcn.100186a0
cmp dword [eax], 0
jne 0x10030c19
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x5cc]
xor eax, eax
push eax
call fcn.100186a0
xor eax, eax
lea ecx, [ebp - 0x318]
push eax
call fcn.100186a0
xor edx, edx
cmp dword [eax], 0x5a83d87e
mov eax, dword [ebp - 0x64]
mov esi, dword [ebp - 0x64]
setle dl
push dword [ebp - 0x64]
xor ecx, ecx
cmp edx, eax
setne cl
add esi, ecx
lea ecx, [ebp - 0x5cc]
call fcn.100186a0
xor ecx, ecx
cmp dword [eax], esi
setle cl
cmp ecx, 0x446c
jle 0x10030cec
lea eax, [ebp - 0x1520]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x1530]
push eax
lea ecx, [ebp - 0x193c]
movdqu xmmword [ebp - 0x1530], xmm0
call fcn.100186af
lea ecx, [ebp - 0x198]
mov esi, eax
call fcn.10009273
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xebc]
push dword [esi]
call fcn.1001865e
xor eax, eax
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x318]
call fcn.100186a0
lea ecx, [ebp - 0xebc]
cmp dword [eax], 0
jne 0x10030db1
xor eax, eax
push eax
call fcn.100186a0
lea ecx, [ebp - 0xebc]
mov dword [eax], edi
call fcn.10018684
jmp 0x10030d97
mov dword [ebp - 0x48], edi
xor eax, eax
mov dword [ebp - 0x18], 0x82966b91
mov dword [ebp - 0x38], eax
jmp 0x10030d2b
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x10030d28
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030d23
push 0x1e34
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10030d0c
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x10030cfd
push eax
lea ecx, [ebp - 0x10a0]
call fcn.100186a0
lea ecx, [ebp - 0x318]
inc dword [eax]
xor eax, eax
push eax
call fcn.100186a0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xc70]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], 0xffff
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x64]
push ebx
call fcn.100186a0
xor ebx, ebx
lea ecx, [ebp - 0xf28]
cmp dword [eax], 8
setl bl
xor eax, eax
push eax
call fcn.100186a0
mov ecx, dword [ebp - 0x48]
mov edx, 0xff40b36f
imul ecx, ebx
cmp edx, ecx
sbb ecx, ecx
xor ebx, ebx
neg ecx
inc ebx
mov dword [eax], ecx
lea ecx, [ebp - 0x318]
mov byte [ebp - 4], 9
call fcn.10018684
dec dword [ebp - 0x64]
jns 0x10030b99
jmp 0x10030dc1
call fcn.10018684
lea ecx, [ebp - 0x318]
call fcn.10018684
lea ecx, [ebp - 0xc70]
mov byte [ebp - 4], 8
call fcn.10018684
inc dword [ebp - 0x2c]
xor eax, eax
inc eax
cmp dword [ebp - 0x2c], eax
jle 0x10030b2c
push 6
pop ebx
lea ecx, [ebp - 0x10a0]
call fcn.10018684
lea ecx, [ebp - 0xf28]
call fcn.10018684
lea ecx, [ebp - 0x5cc]
mov dword [ebp - 4], edi
call fcn.10018684
xor eax, eax
lea ecx, [ebp - 0x4dc]
mov dword [ebp - 0x10], eax
push 4
call fcn.10018602
xor eax, eax
mov dword [ebp - 4], 0xc
inc eax
lea ecx, [ebp - 0x1f4]
push eax
call fcn.10018602
mov byte [ebp - 4], 0xd
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
xor eax, eax
inc eax
mov dword [ebp - 0x24], 0x90ae7359
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10030e74
push dword [ebp - 0x20]
lea ecx, [ebp - 0x4dc]
call fcn.100186a0
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10030e59
xor eax, eax
xor edi, edi
mov dword [ebp - 0x20], eax
inc edi
cmp dword [ebp - 0x20], edi
jge 0x10030e9c
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1f4]
call fcn.100186a0
mov dword [eax], ebx
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x10030e7f
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10030ea5
mov edi, eax
jmp 0x10030eaa
xor eax, eax
lea edi, [eax + 1]
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x4dc]
push 3
call fcn.100186a0
lea ecx, [ebp - 0x1f4]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.100186a0
xor ecx, ecx
mov dword [eax], edi
mov eax, dword [ebp - 0x10]
cmp edi, eax
sete cl
xor eax, eax
cmp esi, ecx
setge al
xor ebx, ebx
inc ebx
cmp eax, ebx
mov eax, dword [ebp - 0x10]
sbb edx, edx
xor ecx, ecx
add edx, 0x82e77e82
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0xe524d43c
setle al
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
cmp eax, 0x225189d9
setne cl
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, dword [ebp - 0x24]
jne 0x10030f3b
cmp dword [ebp - 0x10], eax
je 0x10030f3b
mov eax, ebx
xor edx, edx
cmp eax, 0x8b15b45b
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffe3
jge 0x1003112f
xor edi, edi
inc edi
jmp 0x10030f6c
xor eax, eax
mov dword [ebp - 0x10], 0xfa4a
lea ecx, [ebp - 0x4dc]
push eax
call fcn.100186a0
xor ecx, ecx
mov dword [eax], 0xff8
mov eax, dword [ebp - 0x2c]
cmp eax, 0xff8
setne cl
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
je 0x10030fee
push 3
mov dword [ebp - 0x48], 0x7999
mov dword [ebp - 0x24], eax
pop ebx
jmp 0x10030fe4
mov dword [ebp - 0x28], 0x4d633c66
mov dword [ebp - 0x10], eax
jmp 0x10030fdc
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030fd6
push 0x495
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
dec dword [ebp - 0x48]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10030fb7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10030fab
jmp 0x1003111f
mov dword [ebp - 0x48], 0xc7f5175d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x100310d9
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1f4]
call fcn.100186a0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1f4]
call fcn.100186a0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1f4]
call fcn.100186a0
push 3
lea ecx, [ebp - 0x4dc]
mov esi, eax
call fcn.100186a0
push dword [ebp - 0x10]
xor ebx, ebx
lea ecx, [ebp - 0x1f4]
cmp dword [eax], 0xffffffff
sete bl
add ebx, dword [esi]
call fcn.100186a0
push dword [ebp - 0x10]
xor ecx, ecx
cmp dword [eax], ebx
setne cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x1f4]
call fcn.100186a0
mov ecx, dword [ebp - 0x48]
mov esi, eax
xor eax, eax
cmp ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x48]
setl al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x10]
setg dl
xor ebx, ebx
cmp edx, 0x11012106
setg bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor eax, eax
cmp ecx, edi
lea ecx, [ebp - 0x1f4]
setl al
imul eax, dword [esi]
imul esi, eax, 0x4484
call fcn.100186a0
push dword [ebp - 0x10]
xor ebx, ebx
lea ecx, [ebp - 0x1f4]
cmp esi, dword [eax]
setl bl
call fcn.100186a0
mov dword [eax], ebx
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x10031001
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], eax
jl 0x1003111f
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x4dc]
inc eax
push eax
call fcn.100186a0
cmp dword [eax], 0
jne 0x1003111f
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1003111a
push 0xad8
push 0x742
push 0x362
push 0x2140
call dword [sym.imp.GDI32.dll_CreateRectRgn]
dec dword [ebp - 0x4c]
jns 0x100310e1
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe3
jl 0x10030f6a
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x1f4]
call fcn.10018684
or esi, 0xffffffff
lea ecx, [ebp - 0x4dc]
mov dword [ebp - 4], esi
call fcn.10018684
push 2
pop edi
push edi
lea ecx, [ebp - 0x8c0]
call fcn.10018602
mov dword [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10031190
push dword [ebp - 0x18]
lea ecx, [ebp - 0x8c0]
call fcn.100186a0
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10031172
xor eax, eax
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], eax
jl 0x10031235
mov dword [ebp - 0x18], 0xa7275995
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100311c9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc4], 0xd05ba772
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100311ab
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], ebx
jg 0x10031201
push dword [ebp - 0x38]
lea ecx, [ebp - 0x8c0]
call fcn.100186a0
mov dword [eax], 0xfffffff9
xor eax, eax
inc dword [ebp - 0xc4]
inc eax
cmp dword [ebp - 0xc4], eax
jle 0x100311d7
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x1003122c
push dword [ebp - 0x38]
lea ecx, [ebp - 0x8c0]
call fcn.100186a0
cmp dword [eax], 0
jne 0x10031227
inc dword [ebp - 0x18]
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jle 0x10031209
xor ebx, ebx
xor eax, eax
inc ebx
dec dword [ebp - 0x38]
jns 0x1003119c
lea ecx, [ebp - 0x8c0]
mov dword [ebp - 4], esi
call fcn.10018684
push edi
lea ecx, [ebp - 0x4f4]
call fcn.10018602
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0x644]
mov dword [ebp - 0x4c], 0x9bdba76a
push 4
call fcn.10018602
xor eax, eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031292
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1988], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031279
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100312a8
push dword [ebp - 0x10]
call fcn.100186a0
mov dword [eax], 0xca4f833f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
lea ecx, [ebp - 0x644]
jl 0x10031297
push 3
call fcn.100186a0
and dword [eax], 0
jmp 0x10031356
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100312eb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa4], 0x7dd68876
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100312cd
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0xa4], eax
jmp 0x1003133f
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x10031339
mov dword [ebp - 0x30], 0x76e5
cmp dword [ebp - 0xa4], eax
je 0x10031315
mov eax, dword [ebp - 0xa4]
xor eax, eax
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10031334
push 0x1fa4
push 0x1883
push eax
call dword [sym.imp.GDI32.dll_PtInRegion]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x100312fe
inc dword [ebp - 0xa4]
cmp dword [ebp - 0xa4], edi
jle 0x100312f3
push 3
lea ecx, [ebp - 0x644]
call fcn.100186a0
inc dword [eax]
push 3
lea ecx, [ebp - 0x644]
call fcn.100186a0
cmp dword [eax], edi
jle 0x100312c3
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10031382
push eax
push 0x1a1e
push eax
call dword [sym.imp.GDI32.dll_GetRegionData]
lea ecx, [ebp - 0x644]
mov byte [ebp - 4], 0xf
call fcn.10018684
or ebx, 0xffffffff
lea ecx, [ebp - 0xf70]
mov dword [ebp - 0x38], ebx
push 3
call fcn.10018602
lea eax, [ebp - 0x1420]
mov byte [ebp - 4], 0x11
movdqa xmm0, xmmword [0x100082b0]
lea ecx, [ebp - 0x182c]
push eax
lea eax, [ebp - 0x1430]
push eax
movdqu xmmword [ebp - 0x1430], xmm0
call fcn.100186af
lea ecx, [ebp - 0x1b8]
mov esi, eax
call fcn.10009273
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1260]
push dword [esi]
call fcn.1001865e
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1003141b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4f4]
call fcn.100186a0
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100313fd
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1003143f
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf70]
call fcn.100186a0
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031424
xor eax, eax
mov dword [ebp - 0x4c], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x4c], eax
jg 0x10031ab7
mov dword [ebp - 0x24], 0xfffffff9
lea ecx, [ebp - 0xb18]
mov dword [ebp - 0x2c], 0xffff
push 4
call fcn.10018602
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
jge 0x10031496
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x158], 0xd8ef068c
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x1003147e
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x100314be
push dword [ebp - 0x34]
lea ecx, [ebp - 0xb18]
call fcn.100186a0
mov dword [eax], 0xee676845
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x1003149f
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x100314dc
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1670], ebx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x100314c7
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1003151d
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
sbb eax, eax
neg eax
cmp dword [ebp - 0x24], eax
jg 0x10031500
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x154]
xor eax, eax
cmp dword [ebp - 0x158], eax
jne 0x1003151d
mov esi, eax
jmp 0x10031522
xor eax, eax
lea esi, [eax + 1]
push edi
lea ecx, [ebp - 0xb18]
call fcn.100186a0
mov ecx, dword [ebp - 0x24]
sub ecx, esi
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [ebp - 0x158]
mov dword [eax], ecx
mov dword [ebp - 0x2c], 0xffffffe4
cmp dword [ebp - 0x2c], 0x3c
je 0x10031638
xor edi, edi
inc edi
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10031590
imul eax, dword [ebp - 0x1670], 0x2aec
test eax, eax
je 0x10031586
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10031588
xor edi, edi
inc eax
inc edi
jmp 0x10031588
xor eax, eax
cmp eax, dword [ebp - 0x10]
jl 0x10031590
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x154]
cmp ecx, eax
setl dl
xor eax, eax
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], eax
je 0x100315b1
mov esi, edi
cmp dword [ebp - 0x24], eax
jne 0x100315b3
mov esi, eax
push eax
lea ecx, [ebp - 0xb18]
call fcn.100186a0
cmp esi, 0x99e60473
sbb ecx, ecx
inc ecx
mov dword [eax], esi
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x154]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
add ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x158]
setne dl
sub edx, eax
mov eax, dword [ebp - 0x10]
imul eax, edx
neg eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
neg eax
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x3c
jne 0x10031554
push 2
pop edi
lea ecx, [ebp - 0xb18]
mov byte [ebp - 4], 0x12
call fcn.10018684
push edi
lea ecx, [ebp - 0x754]
call fcn.10018602
push edi
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], 0x14
call fcn.10018602
mov byte [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
jge 0x1003168f
push dword [ebp - 0x34]
lea ecx, [ebp - 0x754]
call fcn.100186a0
and dword [eax], 0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x10031674
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x34], eax
inc ebx
cmp dword [ebp - 0x34], ebx
jge 0x100316b8
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x90], 3
xor eax, eax
inc dword [ebp - 0x34]
inc eax
cmp dword [ebp - 0x34], eax
jl 0x1003169a
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
jge 0x100316de
push dword [ebp - 0x34]
lea ecx, [ebp - 0x8d8]
call fcn.100186a0
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x100316c0
xor eax, eax
mov dword [ebp - 0x90], ebx
cmp dword [ebp - 0x90], eax
jl 0x100317e7
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x1003173e
push dword [ebp - 0x90]
lea ecx, [ebp - 0x754]
call fcn.100186a0
push dword [ebp - 0x90]
lea ecx, [ebp - 0x754]
mov esi, eax
call fcn.100186a0
mov ecx, dword [esi]
mov dword [eax], ecx
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jle 0x10031706
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x100317db
mov dword [ebp - 0x1c], 0xfffffffc
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jne 0x1003175f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x754]
mov eax, dword [ebp - 0x20]
neg esi
sbb esi, esi
xor eax, eax
push eax
neg esi
call fcn.100186a0
xor ecx, ecx
cmp esi, dword [eax]
setle cl
xor eax, eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x8d8]
push eax
call fcn.100186a0
mov edx, dword [ebp - 0x1c]
mov esi, eax
mov ecx, dword [ebp - 0x48]
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0x8d8]
setge al
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x90]
xor eax, eax
push eax
call fcn.100186a0
mov ecx, dword [ebp - 0x90]
add ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
xor eax, eax
inc eax
cmp dword [ebp - 0x20], eax
jle 0x1003174a
xor ebx, ebx
xor eax, eax
inc ebx
dec dword [ebp - 0x90]
jns 0x100316f0
lea ecx, [ebp - 0x8d8]
call fcn.10018684
lea ecx, [ebp - 0x754]
mov byte [ebp - 4], 0x12
call fcn.10018684
push edi
lea ecx, [ebp - 0xf58]
call fcn.10018602
xor eax, eax
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10031836
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6c], 0x7a888ada
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x1003181b
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1003185c
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf58]
call fcn.100186a0
mov dword [eax], 0x25bb5a27
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003183e
xor eax, eax
mov dword [ebp - 0x6c], ebx
cmp dword [ebp - 0x6c], eax
jl 0x10031a94
push 4
lea ecx, [ebp - 0x2dc]
call fcn.10018602
mov byte [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x28], 0xf8278b7
mov dword [ebp - 0x28], 0x29efec1a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x100318b1
push 5
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2dc]
call fcn.100186a0
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10031895
xor ebx, ebx
inc ebx
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x4f4]
call fcn.100186a0
cmp dword [eax], 0
je 0x100318d2
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x4f4]
call fcn.100186a0
xor eax, eax
lea ecx, [ebp - 0x2dc]
push eax
call fcn.100186a0
cmp dword [eax], 0
jne 0x100318e8
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x4f4]
xor eax, eax
push eax
call fcn.100186a0
xor eax, eax
lea ecx, [ebp - 0x2dc]
push eax
call fcn.100186a0
xor edx, edx
cmp dword [eax], 0x5a83d87e
mov eax, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x6c]
setle dl
push dword [ebp - 0x6c]
xor ecx, ecx
cmp edx, eax
setne cl
add esi, ecx
lea ecx, [ebp - 0x4f4]
call fcn.100186a0
xor ecx, ecx
cmp dword [eax], esi
setle cl
cmp ecx, 0x446c
jle 0x100319bc
lea eax, [ebp - 0x1620]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x1630]
push eax
lea ecx, [ebp - 0x18b4]
movdqu xmmword [ebp - 0x1630], xmm0
call fcn.100186af
lea ecx, [ebp - 0x19a]
mov esi, eax
call fcn.10009273
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xf40]
push dword [esi]
call fcn.1001865e
xor eax, eax
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0x2dc]
call fcn.100186a0
lea ecx, [ebp - 0xf40]
cmp dword [eax], 0
jne 0x10031a84
xor eax, eax
push eax
call fcn.100186a0
lea ecx, [ebp - 0xf40]
or dword [eax], 0xffffffff
call fcn.10018684
jmp 0x10031a6a
or eax, 0xffffffff
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x18], 0x82966b91
mov dword [ebp - 0x38], eax
jmp 0x100319fe
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x100319fb
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100319f6
push 0x1e34
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x100319df
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x100319d0
push eax
lea ecx, [ebp - 0x1260]
call fcn.100186a0
lea ecx, [ebp - 0x2dc]
inc dword [eax]
xor eax, eax
push eax
call fcn.100186a0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xf58]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], 0xffff
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6c]
push ebx
call fcn.100186a0
xor ebx, ebx
lea ecx, [ebp - 0xf70]
cmp dword [eax], 8
setl bl
xor eax, eax
push eax
call fcn.100186a0
mov ecx, dword [ebp - 0x48]
mov edx, 0xff40b36f
imul ecx, ebx
cmp edx, ecx
sbb ecx, ecx
xor ebx, ebx
neg ecx
inc ebx
mov dword [eax], ecx
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0x16
call fcn.10018684
dec dword [ebp - 0x6c]
jns 0x10031868
jmp 0x10031a94
call fcn.10018684
lea ecx, [ebp - 0x2dc]
call fcn.10018684
lea ecx, [ebp - 0xf58]
mov byte [ebp - 4], 0x12
call fcn.10018684
inc dword [ebp - 0x4c]
xor eax, eax
inc eax
push 0xffffffffffffffff
pop ebx
cmp dword [ebp - 0x4c], eax
jle 0x1003144e
or ebx, ebx
lea ecx, [ebp - 0x1260]
call fcn.10018684
lea ecx, [ebp - 0xf70]
call fcn.10018684
lea ecx, [ebp - 0x4f4]
mov dword [ebp - 4], ebx
call fcn.10018684
xor eax, eax
lea ecx, [ebp - 0x5e4]
mov dword [ebp - 0x10], eax
push 4
call fcn.10018602
xor eax, eax
mov dword [ebp - 4], 0x19
inc eax
lea ecx, [ebp - 0x218]
push eax
call fcn.10018602
mov byte [ebp - 4], 0x1a
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
xor eax, eax
inc eax
mov dword [ebp - 0x24], 0x90ae7359
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10031b4d
push dword [ebp - 0x20]
lea ecx, [ebp - 0x5e4]
call fcn.100186a0
mov dword [eax], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10031b2e
xor eax, eax
xor edi, edi
mov dword [ebp - 0x20], eax
inc edi
cmp dword [ebp - 0x20], edi
jge 0x10031b79
push dword [ebp - 0x20]
lea ecx, [ebp - 0x218]
call fcn.100186a0
mov dword [eax], 6
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x10031b58
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10031b82
mov edi, eax
jmp 0x10031b87
xor eax, eax
lea edi, [eax + 1]
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x5e4]
push 3
call fcn.100186a0
lea ecx, [ebp - 0x218]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.100186a0
xor ecx, ecx
mov dword [eax], edi
mov eax, dword [ebp - 0x10]
cmp edi, eax
sete cl
xor eax, eax
cmp esi, ecx
setge al
xor ebx, ebx
inc ebx
cmp eax, ebx
mov eax, dword [ebp - 0x10]
sbb edx, edx
xor ecx, ecx
add edx, 0x82e77e82
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0xe524d43c
setle al
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
cmp eax, 0x225189d9
setne cl
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, dword [ebp - 0x24]
jne 0x10031c18
cmp dword [ebp - 0x10], eax
je 0x10031c18
mov eax, ebx
xor edx, edx
cmp eax, 0x8b15b45b
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffe3
jge 0x10031e0a
xor edi, edi
inc edi
jmp 0x10031c49
xor eax, eax
mov dword [ebp - 0x10], 0xfa4a
lea ecx, [ebp - 0x5e4]
push eax
call fcn.100186a0
mov edx, 0xff8
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x2c]
cmp eax, edx
setne cl
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
je 0x10031cc9
push 3
mov dword [ebp - 0x48], 0x7999
mov dword [ebp - 0x24], eax
pop ebx
jmp 0x10031cbf
mov dword [ebp - 0x28], 0x4d633c66
mov dword [ebp - 0x10], eax
jmp 0x10031cb7
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10031cb1
push 0x495
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
dec dword [ebp - 0x48]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10031c92
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10031c86
jmp 0x10031dfa
mov dword [ebp - 0x48], 0xc7f5175d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x10031db4
push dword [ebp - 0x10]
lea ecx, [ebp - 0x218]
call fcn.100186a0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x218]
call fcn.100186a0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x218]
call fcn.100186a0
push 3
lea ecx, [ebp - 0x5e4]
mov esi, eax
call fcn.100186a0
push dword [ebp - 0x10]
xor ebx, ebx
lea ecx, [ebp - 0x218]
cmp dword [eax], 0xffffffff
sete bl
add ebx, dword [esi]
call fcn.100186a0
push dword [ebp - 0x10]
xor ecx, ecx
cmp dword [eax], ebx
setne cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x218]
call fcn.100186a0
mov ecx, dword [ebp - 0x48]
mov esi, eax
xor eax, eax
cmp ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x48]
setl al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x10]
setg dl
xor ebx, ebx
cmp edx, 0x11012106
setg bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor eax, eax
cmp ecx, edi
lea ecx, [ebp - 0x218]
setl al
imul eax, dword [esi]
imul esi, eax, 0x4484
call fcn.100186a0
push dword [ebp - 0x10]
xor ebx, ebx
lea ecx, [ebp - 0x218]
cmp esi, dword [eax]
setl bl
call fcn.100186a0
mov dword [eax], ebx
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x10031cdc
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], eax
jl 0x10031dfa
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x5e4]
inc eax
push eax
call fcn.100186a0
cmp dword [eax], 0
jne 0x10031dfa
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10031df5
push 0xad8
push 0x742
push 0x362
push 0x2140
call dword [sym.imp.GDI32.dll_CreateRectRgn]
dec dword [ebp - 0x4c]
jns 0x10031dbc
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe3
jl 0x10031c47
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x218]
call fcn.10018684
or esi, 0xffffffff
lea ecx, [ebp - 0x5e4]
mov dword [ebp - 4], esi
call fcn.10018684
push 2
pop edi
push edi
lea ecx, [ebp - 0xa28]
call fcn.10018602
mov dword [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10031e6b
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa28]
call fcn.100186a0
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10031e4d
xor eax, eax
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], eax
jl 0x10031f10
mov dword [ebp - 0x18], 0xa7275995
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10031ea4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcc], 0xd05ba772
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10031e86
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], ebx
jg 0x10031edc
push dword [ebp - 0x38]
lea ecx, [ebp - 0xa28]
call fcn.100186a0
mov dword [eax], 0xfffffff9
xor eax, eax
inc dword [ebp - 0xcc]
inc eax
cmp dword [ebp - 0xcc], eax
jle 0x10031eb2
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x10031f07
push dword [ebp - 0x38]
lea ecx, [ebp - 0xa28]
call fcn.100186a0
cmp dword [eax], 0
jne 0x10031f02
inc dword [ebp - 0x18]
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jle 0x10031ee4
xor ebx, ebx
xor eax, eax
inc ebx
dec dword [ebp - 0x38]
jns 0x10031e77
lea ecx, [ebp - 0xa28]
mov dword [ebp - 4], esi
call fcn.10018684
push edi
lea ecx, [ebp - 0x53c]
call fcn.10018602
push 4
lea ecx, [ebp - 0x50c]
mov dword [ebp - 4], 0x1c
call fcn.10018602
xor eax, eax
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031f66
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x19a0], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031f4d
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10031f7c
push dword [ebp - 0x10]
call fcn.100186a0
mov dword [eax], 0xca4f833f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
lea ecx, [ebp - 0x50c]
jl 0x10031f6b
push 3
call fcn.100186a0
and dword [eax], 0
jmp 0x1003202a
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10031fbf
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9c], 0x7dd68876
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10031fa1
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x9c], eax
jmp 0x10032013
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x1003200d
mov dword [ebp - 0x30], 0x76e5
cmp dword [ebp - 0x9c], eax
je 0x10031fe9
mov eax, dword [ebp - 0x9c]
xor eax, eax
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10032008
push 0x1fa4
push 0x1883
push eax
call dword [sym.imp.GDI32.dll_PtInRegion]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10031fd2
inc dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], edi
jle 0x10031fc7
push 3
lea ecx, [ebp - 0x50c]
call fcn.100186a0
inc dword [eax]
push 3
lea ecx, [ebp - 0x50c]
call fcn.100186a0
cmp dword [eax], edi
jle 0x10031f97
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10032056
push eax
push 0x1a1e
push eax
call dword [sym.imp.GDI32.dll_GetRegionData]
lea ecx, [ebp - 0x50c]
mov byte [ebp - 4], 0x1c
call fcn.10018684
mov dword [ebp - 0x18], 0x9bdba76a
lea ecx, [ebp - 0x8f0]
or ebx, 0xffffffff
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x2c], 0xffff
push 4
call fcn.10018602
mov byte [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
jge 0x100320ba
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x150], 0xd8ef068c
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x100320a2
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x100320e2
push dword [ebp - 0x34]
lea ecx, [ebp - 0x8f0]
call fcn.100186a0
mov dword [eax], 0xee676845
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x100320c3
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x10032100
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1778], ebx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x100320eb
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10032141
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
sbb eax, eax
neg eax
cmp dword [ebp - 0x24], eax
jg 0x10032124
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x14c]
xor eax, eax
cmp dword [ebp - 0x150], eax
jne 0x10032141
mov esi, eax
jmp 0x10032146
xor eax, eax
lea esi, [eax + 1]
push edi
lea ecx, [ebp - 0x8f0]
call fcn.100186a0
mov ecx, dword [ebp - 0x24]
sub ecx, esi
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [ebp - 0x150]
mov dword [eax], ecx
mov dword [ebp - 0x2c], 0xffffffe4
cmp dword [ebp - 0x2c], 0x3c
je 0x1003225c
xor edi, edi
inc edi
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x100321b4
imul eax, dword [ebp - 0x1778], 0x2aec
test eax, eax
je 0x100321aa
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100321ac
xor edi, edi
inc eax
inc edi
jmp 0x100321ac
xor eax, eax
cmp eax, dword [ebp - 0x10]
jl 0x100321b4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x14c]
cmp ecx, eax
setl dl
xor eax, eax
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], eax
je 0x100321d5
mov esi, edi
cmp dword [ebp - 0x24], eax
jne 0x100321d7
mov esi, eax
push eax
lea ecx, [ebp - 0x8f0]
call fcn.100186a0
cmp esi, 0x99e60473
sbb ecx, ecx
inc ecx
mov dword [eax], esi
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14c]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
add ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x150]
setne dl
sub edx, eax
mov eax, dword [ebp - 0x10]
imul eax, edx
neg eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
neg eax
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x3c
jne 0x10032178
push 2
pop edi
lea ecx, [ebp - 0x8f0]
mov byte [ebp - 4], 0x1c
call fcn.10018684
push 3
lea ecx, [ebp - 0xf04]
call fcn.10018602
push edi
lea ecx, [ebp - 0x804]
mov byte [ebp - 4], 0x1f
call fcn.10018602
push edi
lea ecx, [ebp - 0xad0]
mov byte [ebp - 4], 0x20
call fcn.10018602
mov byte [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
jge 0x100322c4
push dword [ebp - 0x34]
lea ecx, [ebp - 0x804]
call fcn.100186a0
and dword [eax], 0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x100322a9
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x34], eax
inc ebx
cmp dword [ebp - 0x34], ebx
jge 0x100322ed
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x88], 3
xor eax, eax
inc dword [ebp - 0x34]
inc eax
cmp dword [ebp - 0x34], eax
jl 0x100322cf
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
jge 0x10032313
push dword [ebp - 0x34]
lea ecx, [ebp - 0xad0]
call fcn.100186a0
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x100322f5
xor eax, eax
mov dword [ebp - 0x88], ebx
cmp dword [ebp - 0x88], eax
jl 0x1003241c
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x10032373
push dword [ebp - 0x88]
lea ecx, [ebp - 0x804]
call fcn.100186a0
push dword [ebp - 0x88]
lea ecx, [ebp - 0x804]
mov esi, eax
call fcn.100186a0
mov ecx, dword [esi]
mov dword [eax], ecx
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jle 0x1003233b
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x10032410
mov dword [ebp - 0x1c], 0xfffffffc
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jne 0x10032394
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x804]
mov eax, dword [ebp - 0x20]
neg esi
sbb esi, esi
xor eax, eax
push eax
neg esi
call fcn.100186a0
xor ecx, ecx
cmp esi, dword [eax]
setle cl
xor eax, eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0xad0]
push eax
call fcn.100186a0
mov edx, dword [ebp - 0x1c]
mov esi, eax
mov ecx, dword [ebp - 0x48]
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0xad0]
setge al
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x88]
xor eax, eax
push eax
call fcn.100186a0
mov ecx, dword [ebp - 0x88]
add ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
xor eax, eax
inc eax
cmp dword [ebp - 0x20], eax
jle 0x1003237f
xor ebx, ebx
xor eax, eax
inc ebx
dec dword [ebp - 0x88]
jns 0x10032325
lea ecx, [ebp - 0xad0]
call fcn.10018684
lea ecx, [ebp - 0x804]
mov byte [ebp - 4], 0x1f
call fcn.10018684
movdqa xmm0, xmmword [0x100082b0]
lea eax, [ebp - 0x1440]
push eax
lea eax, [ebp - 0x1450]
push eax
lea ecx, [ebp - 0x183c]
movdqu xmmword [ebp - 0x1450], xmm0
call fcn.100186af
lea ecx, [ebp - 0x19c]
mov esi, eax
call fcn.10009273
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xfe4]
push dword [esi]
call fcn.1001865e
push 4
pop esi
push esi
lea ecx, [ebp - 0x6b0]
mov byte [ebp - 4], 0x22
call fcn.10018602
mov byte [ebp - 4], 0x23
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x18], eax
jmp 0x100324b3
push dword [ebp - 0x18]
call fcn.100186a0
mov dword [eax], 6
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x6b0]
cmp dword [ebp - 0x18], esi
jl 0x100324a2
push edi
call fcn.100186a0
and dword [eax], 0
jmp 0x100324fa
mov dword [ebp - 0x28], esi
lea ecx, [ebp - 0x6b0]
mov dword [ebp - 0x28], 0xfffffff8
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x48], 0x241203ac
mov eax, dword [ebp - 0x48]
push edi
mov dword [ebp - 0x30], eax
call fcn.100186a0
inc dword [eax]
push edi
lea ecx, [ebp - 0x6b0]
call fcn.100186a0
cmp dword [eax], 0x1d
jge 0x100324c9
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10032591
mov dword [ebp - 0x38], 0x9552053
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003252a
call dword [sym.imp.USER32.dll_EndMenu]
xor eax, eax
mov dword [ebp - 0x38], 0xffffffee
jmp 0x10032589
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x18], 0xfffffff8
jmp 0x1003255b
cmp byte [ebp - 0x3d], 0
je 0x10032558
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 8
mov byte [ebp - 0x3d], al
je 0x10032543
cmp byte [ebp - 0x3d], 0
je 0x10032586
push 0x403
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edi
je 0x10032533
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x13
jne 0x10032512
lea ecx, [ebp - 0x6b0]
mov byte [ebp - 4], 0x22
call fcn.10018684
mov edi, 0x25b9b55b
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
mov ebx, 0x689351f2
jge 0x100325d8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1050], ebx
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100325c1
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_SetCursor]
mov dword [ebp - 0x18], eax
jmp 0x1003260a
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 0x38], eax
jmp 0x10032600
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100325fd
push eax
call esi
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jle 0x100325ef
jne 0x1003260f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jg 0x100325e3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10032637
push dword [ebp - 0x10]
lea ecx, [ebp - 0x53c]
call fcn.100186a0
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10032618
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10032660
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x12f8], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10032647
xor eax, eax
push 0x1a
pop ecx
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], ecx
je 0x100326a6
xor ebx, ebx
inc ebx
mov dword [ebp - 0x38], 0xba772304
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jg 0x10032694
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x12f8], 0
jne 0x10032692
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x1003267d
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x100326a1
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jne 0x1003266e
mov ebx, 0x689351f2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100326cb
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf04]
call fcn.100186a0
or dword [eax], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100326af
xor eax, eax
mov dword [ebp - 0x18], edi
xor edi, edi
mov dword [ebp - 0x18], eax
inc edi
cmp dword [ebp - 0x18], edi
jge 0x100326f0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x138c], ebx
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100326d9
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1003271c
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 0x38], eax
jmp 0x10032712
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003270f
push eax
call esi
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jle 0x10032701
jne 0x10032721
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jg 0x100326f5
mov dword [ebp - 0x18], eax
mov ebx, 0x565e
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jg 0x100346e9
mov edi, dword [sym.imp.USER32.dll_SetClassLongA]
movdqa xmm0, xmmword [0x10008270]
lea eax, [ebp - 0x1540]
push eax
lea eax, [ebp - 0x1550]
mov dword [ebp - 0x1c], 0x6f1b
mov dword [ebp - 0x2c], 4
lea ecx, [ebp - 0x18f4]
mov dword [ebp - 0x38], 0xe5f36f6d
push eax
movdqu xmmword [ebp - 0x1550], xmm0
call fcn.100186af
lea ecx, [ebp - 0x1c5]
mov esi, eax
call fcn.10009273
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x524]
push dword [esi]
call fcn.1001865e
mov byte [ebp - 4], 0x24
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x30], 0xc43
mov dword [ebp - 0x10], eax
inc ecx
cmp dword [ebp - 0x10], ecx
jge 0x100327ce
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1dc], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100327b2
xor ecx, ecx
xor eax, eax
mov ebx, 0x565e
inc ecx
mov dword [ebp - 0x10], eax
jmp 0x100327e0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1904], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100327d3
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x1c], eax
jl 0x100327ff
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10032801
mov esi, ecx
jmp 0x10032803
xor eax, eax
mov esi, eax
push ecx
lea ecx, [ebp - 0x524]
call fcn.100186a0
lea ecx, [ebp - 0x524]
mov dword [eax], esi
xor esi, esi
inc esi
push esi
call fcn.100186a0
mov ecx, 0xc5b1510a
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x2c]
sbb ecx, ecx
neg ecx
add eax, ecx
je 0x1003283e
push esi
lea ecx, [ebp - 0x524]
call fcn.100186a0
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x524]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
push esi
call fcn.100186a0
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x524]
push esi
call fcn.100186a0
mov ecx, dword [ebp - 0x1dc]
xor edx, edx
mov eax, dword [ebp - 0x1dc]
cmp ecx, eax
mov eax, dword [ebp - 0x1dc]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x1900], ecx
lea ecx, [ebp - 0x524]
mov byte [ebp - 4], 0x22
call fcn.10018684
push 2
lea ecx, [ebp - 0x10b8]
call fcn.10018602
push 2
lea ecx, [ebp - 0x5fc]
mov byte [ebp - 4], 0x25
call fcn.10018602
mov byte [ebp - 4], 0x26
xor eax, eax
mov dword [ebp - 0x38], 0xed9ba07e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100328ea
push dword [ebp - 0x10]
lea ecx, [ebp - 0x10b8]
call fcn.100186a0
mov dword [eax], 0x6482
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100328cb
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100328fd
push dword [ebp - 0x10]
call fcn.100186a0
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
lea ecx, [ebp - 0x5fc]
jl 0x100328ef
push esi
call fcn.100186a0
and dword [eax], 0
jmp 0x1003292c
mov dword [ebp - 0x48], 0xb34e6d4f
lea ecx, [ebp - 0x5fc]
inc dword [ebp - 0x48]
push esi
call fcn.100186a0
inc dword [eax]
push esi
lea ecx, [ebp - 0x5fc]
call fcn.100186a0
cmp dword [eax], esi
jle 0x10032914
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffe5
jne 0x10032974
xor ebx, ebx
mov dword [ebp - 0x30], 0x7a5b7d8c
mov byte [ebp - 0x3d], bl
cmp byte [ebp - 0x3d], bl
je 0x1003295f
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 0x30], 0x9ee1c974
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe5
je 0x10032949
mov ebx, 0x565e
lea ecx, [ebp - 0x5fc]
call fcn.10018684
lea ecx, [ebp - 0x10b8]
mov byte [ebp - 4], 0x22
call fcn.10018684
push 2
lea ecx, [ebp - 0xcb8]
call fcn.10018602
mov byte [ebp - 4], 0x27
or eax, 0xffffffff
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x1c], 0xe7ed6f18
mov dword [ebp - 0x30], 0x9193c1de
mov dword [ebp - 0x38], 0xb441791e
mov dword [ebp - 0x48], 0x7ad11e75
mov dword [ebp - 0x44], 0xf171
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100329ed
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x294], 0xf55e00fe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100329d5
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10032a03
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7d4], 0xbfbd3aeb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100329f2
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x294]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x7d0]
setl cl
imul eax, ecx
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x30]
setge cl
imul eax, ecx
xor ecx, ecx
cmp eax, 0x25a95506
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
cmp ecx, eax
setge dl
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
cmp edx, eax
mov eax, dword [ebp - 0x44]
setg cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x294]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
shl ecx, 2
cmp eax, ecx
mov ecx, dword [ebp - 0x7d4]
mov eax, dword [ebp - 0x50]
setg dl
add ecx, 0xffff267d
add ecx, edx
xor edx, edx
cmp eax, ecx
setle dl
mov dword [ebp - 0x7d4], edx
mov dword [ebp - 0x2c], 0xffffffe9
cmp dword [ebp - 0x2c], 0x2d
jne 0x10032b0a
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10032adf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10032b01
push 0x1fdc
push 0xc10
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x2d
je 0x10032ac0
mov dword [ebp - 0x4c], 0xa115252c
lea ecx, [ebp - 0xf88]
push 3
call fcn.10018602
xor eax, eax
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10032b49
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1688], 0xc033
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10032b30
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10032b71
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf88]
call fcn.100186a0
mov dword [eax], 0x7222631
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10032b52
xor eax, eax
mov dword [ebp - 0x4c], eax
jmp 0x10032b84
mov dword [ebp + eax*4 - 0x1688], 0x3638
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 3
mov eax, dword [ebp - 0x4c]
jl 0x10032b76
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0xf88]
mov esi, dword [ebp - 0x4c]
xor eax, eax
push eax
call fcn.100186a0
lea ecx, [ebp - 0xf88]
mov dword [eax], esi
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 0x27
call fcn.10018684
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
jmp 0x10032bcd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x74], 0x7a888ada
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10032bbf
push ecx
lea ecx, [ebp - 0x1278]
call fcn.10018602
mov byte [ebp - 4], 0x29
xor eax, eax
xor esi, esi
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x38], eax
inc esi
cmp dword [ebp - 0x38], esi
jge 0x10032c11
xor esi, esi
inc esi
lea ecx, [ebp - 0xfe4]
call fcn.10018684
lea ecx, [ebp - 0xf04]
call fcn.10018684
or ebx, 0xffffffff
lea ecx, [ebp - 0x53c]
mov dword [ebp - 4], ebx
call fcn.10018684
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], 9
push 3
mov dword [ebp - 0x38], ebx
pop ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], 0xb108
mov dword [ebp - 0x18], eax
jmp 0x10034745
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x920], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10034734
mov edi, dword [sym.imp.GDI32.dll_StretchBlt]
push 0xfffffffffffffffe
pop edx
mov dword [ebp - 0x4c], edx
cmp dword [ebp - 0x4c], edx
jg 0x10034928
mov dword [ebp - 0x3c], 0x9c1464f1
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x48], ebx
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
xor edx, edx
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setle dl
xor ebx, ebx
cmp edx, eax
setl bl
xor ecx, ecx
imul ebx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
cmp ebx, eax
setge cl
cmp ecx, 0x3cd3
jg 0x100347bc
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x100347bc
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x100347c1
xor ebx, ebx
inc ebx
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jne 0x10034852
cmp dword [ebp - 0x4c], eax
je 0x100347e1
mov esi, ebx
cmp dword [ebp - 0x18], eax
jne 0x100347e3
mov esi, eax
mov eax, dword [ebp - 0x91c]
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0x46ac1dea
setne al
neg eax
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x91c]
sbb ecx, ecx
xor edx, edx
inc ecx
imul ecx, eax
mov eax, dword [ebp - 0x918]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setg dl
sub edx, eax
xor eax, eax
test edx, edx
setle al
xor ecx, ecx
sub esi, eax
mov eax, dword [ebp - 0x30]
cmp esi, eax
setg cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setl dl
cmp edx, dword [ebp - 0x48]
jle 0x10034852
xor eax, eax
mov edx, eax
jmp 0x10034854
mov edx, ebx
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x50]
jge 0x100348bd
or eax, 0xffffffff
mov ecx, 0x14707e7b
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0xe6d7
mov dword [ebp - 0x3c], 0xaa0e6852
mov eax, dword [ebp - 0x91c]
sub ecx, eax
mov eax, dword [ebp - 0x48]
add eax, ecx
cmp eax, dword [ebp - 0x44]
jg 0x10034895
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10034897
mov eax, ebx
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x48]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setge dl
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0x18]
mov dword [ebp - 0x3c], ecx
jmp 0x1003490e
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003490e
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x257
push 0xb7
push 0x8f6
push 0x1ec7
push 0x1d0
call ebx
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x21c6
push 0x8f0
push 0x6b4
push 0x1c96
call ebx
push eax
call esi
push eax
call edi
inc dword [ebp - 0x4c]
push 0xfffffffffffffffe
pop edx
push 1
pop esi
push 0xffffffffffffffff
pop ebx
cmp dword [ebp - 0x4c], edx
jle 0x1003475f
push 3
pop ecx
or ebx, ebx
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], 9
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], 0xb108
mov dword [ebp - 0x18], eax
jmp 0x10034957
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb48], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10034946
mov dword [ebp - 0x4c], edx
cmp dword [ebp - 0x4c], edx
jg 0x10034b31
xor eax, eax
mov dword [ebp - 0x3c], 0x9c1464f1
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x48], ebx
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
xor edx, edx
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setle dl
xor ebx, ebx
cmp edx, eax
setl bl
xor ecx, ecx
imul ebx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
cmp ebx, eax
setge cl
cmp ecx, 0x3cd3
jg 0x100349c8
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x100349c8
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x100349cd
xor ebx, ebx
inc ebx
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jne 0x10034a5e
cmp dword [ebp - 0x4c], eax
je 0x100349ed
mov esi, ebx
cmp dword [ebp - 0x18], eax
jne 0x100349ef
mov esi, eax
mov eax, dword [ebp - 0xb44]
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0x46ac1dea
setne al
neg eax
cmp eax, 0xffffffff
mov eax, dword [ebp - 0xb44]
sbb ecx, ecx
xor edx, edx
inc ecx
imul ecx, eax
mov eax, dword [ebp - 0xb40]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setg dl
sub edx, eax
xor eax, eax
test edx, edx
setle al
xor ecx, ecx
sub esi, eax
mov eax, dword [ebp - 0x30]
cmp esi, eax
setg cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setl dl
cmp edx, dword [ebp - 0x48]
jle 0x10034a5e
xor eax, eax
mov edx, eax
jmp 0x10034a60
mov edx, ebx
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x50]
jge 0x10034ac9
or eax, 0xffffffff
mov ecx, 0x14707e7b
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0xe6d7
mov dword [ebp - 0x3c], 0xaa0e6852
mov eax, dword [ebp - 0xb44]
sub ecx, eax
mov eax, dword [ebp - 0x48]
add eax, ecx
cmp eax, dword [ebp - 0x44]
jg 0x10034aa1
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10034aa3
mov eax, ebx
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x48]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setge dl
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0x18]
mov dword [ebp - 0x3c], ecx
jmp 0x10034b1a
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10034b1a
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x257
push 0xb7
push 0x8f6
push 0x1ec7
push 0x1d0
call ebx
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x21c6
push 0x8f0
push 0x6b4
push 0x1c96
call ebx
push eax
call esi
push eax
call edi
inc dword [ebp - 0x4c]
push 0xfffffffffffffffe
pop edx
push 0xffffffffffffffff
pop ebx
cmp dword [ebp - 0x4c], edx
jle 0x10034968
push 3
pop ecx
or ebx, ebx
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], 9
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], 0xb108
mov dword [ebp - 0x18], eax
jmp 0x10034b60
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x938], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10034b4f
mov dword [ebp - 0x4c], edx
cmp dword [ebp - 0x4c], edx
jg 0x10034d35
jmp 0x10034b76
or ebx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x3c], 0x9c1464f1
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x48], ebx
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
xor edx, edx
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setle dl
xor ebx, ebx
cmp edx, eax
setl bl
xor ecx, ecx
imul ebx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
cmp ebx, eax
setge cl
cmp ecx, 0x3cd3
jg 0x10034bd6
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10034bd6
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x10034bdb
xor ebx, ebx
inc ebx
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jne 0x10034c6c
cmp dword [ebp - 0x4c], eax
je 0x10034bfb
mov esi, ebx
cmp dword [ebp - 0x18], eax
jne 0x10034bfd
mov esi, eax
mov eax, dword [ebp - 0x934]
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0x46ac1dea
setne al
neg eax
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x934]
sbb ecx, ecx
xor edx, edx
inc ecx
imul ecx, eax
mov eax, dword [ebp - 0x930]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setg dl
sub edx, eax
xor eax, eax
test edx, edx
setle al
xor ecx, ecx
sub esi, eax
mov eax, dword [ebp - 0x30]
cmp esi, eax
setg cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setl dl
cmp edx, dword [ebp - 0x48]
jle 0x10034c6c
xor eax, eax
mov edx, eax
jmp 0x10034c6e
mov edx, ebx
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x50]
jge 0x10034cd7
or eax, 0xffffffff
mov ecx, 0x14707e7b
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0xe6d7
mov dword [ebp - 0x3c], 0xaa0e6852
mov eax, dword [ebp - 0x934]
sub ecx, eax
mov eax, dword [ebp - 0x48]
add eax, ecx
cmp eax, dword [ebp - 0x44]
jg 0x10034caf
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10034cb1
mov eax, ebx
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x48]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setge dl
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0x18]
mov dword [ebp - 0x3c], ecx
jmp 0x10034d28
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10034d28
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x257
push 0xb7
push 0x8f6
push 0x1ec7
push 0x1d0
call ebx
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x21c6
push 0x8f0
push 0x6b4
push 0x1c96
call ebx
push eax
call esi
push eax
call edi
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xfffffffe
jle 0x10034b73
movdqa xmm0, xmmword [0x10008320]
lea eax, [ebp - 0x1560]
push eax
lea eax, [ebp - 0x1570]
push eax
lea ecx, [ebp - 0x18c4]
movdqu xmmword [ebp - 0x1570], xmm0
call fcn.100186af
lea ecx, [ebp - 0x1ae]
mov esi, eax
call fcn.10009273
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x16a0]
push dword [esi]
call fcn.1001865e
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongA]
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x18], eax
jmp 0x10034dac
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10034da9
push 0x19cd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x10034d90
lea ecx, [ebp - 0x16a0]
call fcn.10018684
movdqa xmm0, xmmword [0x10008320]
lea eax, [ebp - 0x14a0]
push eax
lea eax, [ebp - 0x14b0]
push eax
lea ecx, [ebp - 0x185c]
movdqu xmmword [ebp - 0x14b0], xmm0
call fcn.100186af
lea ecx, [ebp - 0x1e6]
mov esi, eax
call fcn.10009273
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1760]
push dword [esi]
call fcn.1001865e
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x18], eax
jmp 0x10034e2e
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10034e2b
push 0x19cd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x10034e12
lea ecx, [ebp - 0x1760]
call fcn.10018684
xor ebx, ebx
lea ecx, [ebp - 0x554]
inc ebx
push ebx
call fcn.10018602
mov dword [ebp - 4], 0x3e
xor eax, eax
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x28], 0xa53fde75
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10034e8f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x554]
call fcn.100186a0
or dword [eax], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10034e74
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x10035088
mov dword [ebp - 0x2c], 0x905d09ea
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x10035076
push 4
lea ecx, [ebp - 0x668]
call fcn.10018602
xor eax, eax
mov byte [ebp - 4], 0x3f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10034ee1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb4], 0xd526d2e8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10034ec9
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10034f09
push dword [ebp - 0x10]
lea ecx, [ebp - 0x668]
call fcn.100186a0
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10034eea
xor eax, eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], eax
jl 0x10035013
xor edi, edi
mov dword [ebp - 0x48], 0x2c02a306
mov dword [ebp - 0x48], 0x3e997306
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10034f50
push eax
lea ecx, [ebp - 0x668]
call fcn.100186a0
and dword [eax], 0
jmp 0x10035046
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x10034e9b
mov edi, dword [sym.imp.GDI32.dll_StretchBlt]
inc dword [ebp - 0x44]
lea ecx, [ebp - 0x554]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10018684
mov dword [ebp - 0x1c], 0xdd1e1e87
lea ecx, [ebp - 0x12a8]
push 3
call fcn.10018602
mov dword [ebp - 4], 0x40
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100350e2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x19b8], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100350c9
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1003510a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x12a8]
call fcn.100186a0
mov dword [eax], 0x3281
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100350eb
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x10035240
push 4
lea ecx, [ebp - 0x614]
call fcn.10018602
or eax, 0xffffffff
mov byte [ebp - 4], 0x41
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1003515a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x614]
call fcn.100186a0
mov dword [eax], 0x1fc3eee
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003513b
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003517c
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10035262
push 0x163b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
or eax, 0xffffffff
lea ecx, [ebp - 0x12a8]
mov dword [ebp - 4], eax
call fcn.10018684
xor eax, eax
lea ecx, [ebp - 0xcd0]
mov dword [ebp - 0x2c], eax
push 3
call fcn.10018602
mov dword [ebp - 4], 0x43
or ecx, 0xffffffff
mov dword [ebp - 0x10], 4
xor eax, eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x30], 0xba5616d2
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100352cd