Function at 0x1002fe41
Capabilities:
Create directory
Create process on windows
Delete directory
Delete file
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file attributes
Get session user name
Query or enumerate registry key
Read .ini file

Disassembly:
mov eax, 0x10084470
call fcn.10083dfc
mov eax, 0x148c
call fcn.1007ffd0
mov dword [ebp - 0x20], 0x8d4081c2
xor eax, eax
push ebx
mov dword [ebp - 0x1c], 0xb6b0e1b1
xor ebx, ebx
mov dword [ebp - 0x3c], 0x60b4ffb8
inc ebx
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x10], eax
push esi
push edi
mov byte [ebp - 0x6d], dl
mov dword [ebp - 0x78], ecx
cmp dword [ebp - 0x10], ebx
jge 0x1002fe9f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x90], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002fe87
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002febf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcc], 0xbdae4f9d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002fea7
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x3c], eax
push 0xfffffffffffffffe
pop edi
cmp dword [ebp - 0x3c], eax
jl 0x10030031
mov dword [ebp - 0x38], 0xb2f14481
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002fef7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x17c], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002fee3
xor eax, eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], eax
jl 0x10030028
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], eax
jmp 0x1002ff29
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xce4], 0x91d0b6bd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002ff18
mov eax, dword [ebp - 0x17c]
mov eax, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x90]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
sub eax, 0xdef9
je 0x1002ff6d
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x90], 0
je 0x1002ff6d
xor eax, eax
cmp dword [ebp - 0x17c], eax
je 0x1002ff6f
mov ecx, ebx
jmp 0x1002ff71
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x17c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x90]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
setne dl
sub edx, dword [ebp - 0xcc]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x38], edx
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x17c]
sub ecx, eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [ebp + eax*4 - 0x90]
cmp ecx, eax
mov eax, dword [ebp - 0xcc]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xbefa
setl al
cmp edi, eax
sbb eax, eax
inc eax
mov dword [ebp - 0xce4], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x10030019
push 0x174
push 0x26
push eax
call dword [sym.imp.USER32.dll_RemoveMenu]
dec dword [ebp - 0x17c]
push 0
pop eax
jns 0x1002ff09
dec dword [ebp - 0x3c]
jns 0x1002fed1
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jg 0x10030116
mov dword [ebp - 0x10], 0x8ef34ea8
mov dword [ebp - 0x30], 0xd693ce85
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x48], 0xfffffff8
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x90]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x100300ca
mov dword [ebp - 0x10], eax
jmp 0x100300c3
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0xcc], 0
je 0x10030096
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xcc]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0xcc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcc], 0x6a83cd0
inc dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
jle 0x10030072
jmp 0x100300d0
mov dword [ebp - 0x38], ebx
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
neg eax
je 0x100300fc
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x100300fe
mov eax, dword [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x48]
jne 0x100300fc
mov eax, dword [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0xcc], 0xdfaf
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jle 0x1003003d
xor eax, eax
mov dword [ebp - 0x48], 0xcd3860a4
mov dword [ebp - 0x24], 0xe76f5020
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x54], 0xef874acc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1003014c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x578], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10030137
xor eax, eax
mov dword [ebp - 0x24], 3
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x24], eax
jl 0x10030258
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x578], 0
jne 0x10030258
mov dword [ebp - 0x34], 3
xor eax, eax
cmp dword [ebp - 0x34], eax
jl 0x1003024f
jmp 0x10030189
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], eax
jmp 0x100301a2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x454], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10030191
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x578], 0
jne 0x1003024f
mov eax, dword [ebp - 0x574]
xor eax, eax
cmp dword [ebp - 0x578], eax
jne 0x100301ce
mov eax, dword [ebp - 0x570]
mov eax, dword [ebp - 0x34]
inc eax
je 0x100301db
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x100301e5
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x578]
mov eax, dword [ebp - 0x38]
xor ebx, ebx
mov eax, dword [ebp - 0x454]
mov edx, dword [ebp - 0x454]
mov eax, dword [ebp - 0x454]
mov ecx, dword [ebp - 0x34]
imul edx, eax
mov eax, dword [ebp - 0x34]
push 0xffffffffffffffff
add ecx, edx
cmp ecx, eax
setle bl
xor edx, edx
sub ebx, dword [ebp - 0x2c]
imul ebx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x450]
neg ebx
cmp ebx, eax
mov eax, dword [ebp - 0x54]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x578]
setge cl
add eax, 0x3e86
add ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x578], ecx
dec dword [ebp - 0x34]
pop ecx
jns 0x10030187
dec dword [ebp - 0x24]
jns 0x1003015f
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [sym.imp.USER32.dll_MonitorFromWindow]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp eax, dword [ebp - 0x20]
jle 0x10030373
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10030375
xor ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x48], eax
je 0x10030296
mov edx, ecx
cmp dword [ebp - 0x1c], eax
jne 0x10030298
mov edx, eax
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
inc eax
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setg dl
sub eax, edx
mov dword [ebp - 0x1c], eax
xor edx, edx
inc edx
mov dword [ebp - 0x20], 0x8d4081c2
mov dword [ebp - 0x50], 0xb6b0e1b1
mov dword [ebp - 0x2c], 0xcd3860a4
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jle 0x10030431
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10030433
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x2c], eax
je 0x100302f3
cmp dword [ebp - 0x50], eax
jne 0x100302f5
mov edx, eax
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
inc eax
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setg dl
sub eax, edx
mov dword [ebp - 0x50], eax
xor edx, edx
inc edx
mov dword [ebp - 0x20], 0x8d4081c2
mov dword [ebp - 0x50], 0xb6b0e1b1
mov dword [ebp - 0x2c], 0xcd3860a4
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jle 0x100304f2
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x100304f4
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x2c], eax
je 0x10030350
cmp dword [ebp - 0x50], eax
jne 0x10030352
mov edx, eax
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
inc eax
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setg dl
sub eax, edx
mov dword [ebp - 0x50], eax
jmp 0x100305a5
xor eax, eax
mov dword [ebp - 0x40], 0x3421
mov dword [ebp - 0x38], 0x2ba8d7d2
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x2c], 0x3271
mov dword [ebp - 0x54], 0x2452a2c7
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100303ab
push 0x1af1
push eax
push 0x5a5
push eax
call ebx
mov eax, dword [ebp - 0x20]
xor edx, edx
inc edx
mov ecx, edx
sub ecx, eax
je 0x10030424
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
mov edx, dword [ebp - 0x4c]
setns cl
sub edx, ecx
add edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
mov eax, dword [ebp - 0x40]
setne cl
xor edx, edx
imul ecx, ecx, 0xfffa
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x100302b4
push 0xfd5
call edi
push eax
call esi
jmp 0x100302b4
mov eax, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x4c], eax
jmp 0x100302b7
xor eax, eax
mov dword [ebp - 0x40], 0x3421
or ecx, 0xffffffff
mov dword [ebp - 0x38], 0x2ba8d7d2
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x2c], 0x3271
mov dword [ebp - 0x54], 0x2452a2c7
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003046c
push 0x1af1
push eax
push 0x5a5
push eax
call ebx
mov eax, dword [ebp - 0x20]
xor edx, edx
inc edx
mov ecx, edx
sub ecx, eax
je 0x100304e5
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
mov edx, dword [ebp - 0x4c]
setns cl
sub edx, ecx
add edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
cmp eax, edx
mov eax, dword [ebp - 0x40]
setne cl
xor edx, edx
imul ecx, ecx, 0xfffa
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x50], ecx
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x10030311
push 0xfd5
call edi
push eax
call esi
jmp 0x10030311
mov eax, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x4c], eax
jmp 0x10030314
xor eax, eax
mov dword [ebp - 0x40], 0x3421
or ecx, 0xffffffff
mov dword [ebp - 0x38], 0x2ba8d7d2
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x2c], 0x3271
mov dword [ebp - 0x54], 0x2452a2c7
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003052d
push 0x1af1
push eax
push 0x5a5
push eax
call ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
inc ecx
sub ecx, eax
je 0x1003059d
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
mov edx, dword [ebp - 0x4c]
setns cl
sub edx, ecx
add edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
cmp eax, edx
mov eax, dword [ebp - 0x40]
setne cl
xor edx, edx
imul ecx, ecx, 0xfffa
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x50], ecx
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x100305a7
push 0xfd5
call edi
push eax
call esi
jmp 0x100305a5
mov eax, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetMenu]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], 0x6893
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100305ce
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 6
push 0xfffffffffffffff9
pop ecx
jne 0x10030741
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x24], 0x44198d72
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x10]
neg edx
sbb edx, edx
inc edx
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
setge al
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10030725
mov dword [ebp - 0x38], 0x53d2
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x17
jg 0x10030722
xor edx, edx
inc edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x10030656
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x298], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003063e
xor eax, eax
mov dword [ebp - 0x34], 3
jmp 0x10030708
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10030684
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9c0], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10030671
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10030697
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100306a4
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x9c0], 0x23fa
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp eax, 0x23fa
setge cl
xor eax, eax
mov dword [ebp - 0x298], ecx
cmp dword [ebp - 0x24], eax
je 0x100306fc
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x298]
mov eax, dword [ebp - 0x34]
sub ecx, eax
cmp dword [ebp - 0x9bc], ecx
je 0x100306eb
xor eax, eax
cmp dword [ebp - 0x9bc], eax
je 0x100306ed
mov eax, edx
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x34]
push 0
pop eax
cmp dword [ebp - 0x34], 9
je 0x10030662
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x17
push 0
pop eax
jle 0x10030633
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff1
jg 0x1003061c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
push 0xfffffffffffffff9
pop ecx
je 0x100305de
xor eax, eax
mov dword [ebp - 0x1c], 0xb26bdde0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1003076a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1354], 0xb6318d58
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10030751
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], 0xffffffe2
jl 0x10030837
mov dword [ebp - 0x50], 0xfffffff6
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100307b1
push eax
push eax
push eax
push 0xe49
push 0x16a8
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
push 2
xor eax, eax
pop edx
mov dword [ebp - 0x50], edx
cmp dword [ebp - 0x50], eax
jl 0x1003082f
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x728], ecx
mov dword [ebp - 0x724], ecx
mov dword [ebp - 0x720], ecx
mov dword [ebp - 0x71c], ecx
mov dword [ebp - 0x728], edx
cmp dword [ebp - 0x728], eax
jl 0x1003082a
mov dword [ebp - 0x14], 0xad9bacc5
mov dword [ebp - 0x14], eax
jmp 0x1003081a
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10030817
push eax
push 0x17b3
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
push 2
xor eax, eax
pop edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x100307ee
dec dword [ebp - 0x728]
jns 0x100307e2
push 0xfffffffffffffffe
pop ecx
dec dword [ebp - 0x50]
jns 0x100307bc
dec dword [ebp - 0x1c]
jmp 0x10030770
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0xffffffe9
jmp 0x10030891
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 0xf
jl 0x1003088e
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10030882
push 0xd23
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xf
jge 0x1003085e
push 2
pop edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xe
jg 0x10030853
mov dword [ebp - 0x20], 0x8d4081c2
xor ecx, ecx
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x64], eax
inc ecx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x30], 0xb8f3d421
mov dword [ebp - 0x30], 0xf14c90d2
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0xf0415773
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100308ef
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1388], 0x1dfd9475
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100308d6
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10030911
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xda0], 0xc9d94031
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100308f8
xor eax, eax
mov dword [ebp - 0x50], 3
cmp dword [ebp - 0x50], eax
jl 0x1003096b
mov dword [ebp - 0x64], 0xdd68
mov dword [ebp - 0x60], 0xdd68
mov dword [ebp - 0x5c], 0xdd68
mov dword [ebp - 0x58], 0xdd68
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10030963
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe90], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003094b
xor eax, eax
inc dword [ebp - 0x38]
dec dword [ebp - 0x50]
jns 0x1003091d
dec dword [ebp - 0xda0]
mov dword [ebp - 0x28], 0xb6b0e1b1
mov dword [ebp - 0x3c], 0x60b4ffb8
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x100309a6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8c], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003098e
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x100309c6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc8], 0xbdae4f9d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100309ae
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jl 0x10030b39
mov dword [ebp - 0x38], 0xb2f14481
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x100309f8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x164], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100309e4
xor eax, eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], eax
jl 0x10030b30
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], eax
jmp 0x10030a2a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbd8], 0x91d0b6bd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10030a19
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp + eax*4 - 0x8c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x8c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
sub eax, 0xdef9
je 0x10030a6c
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x8c], 0
je 0x10030a6c
xor eax, eax
cmp dword [ebp - 0x164], eax
je 0x10030a6e
jmp 0x10030a70
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x164]
xor edx, edx
push 0xfffffffffffffffe
mov eax, dword [ebp + eax*4 - 0x8c]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
setne dl
sub edx, dword [ebp - 0xc8]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x38], edx
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x8c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x8c]
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x164]
mov eax, dword [ebp - 0x164]
sub ecx, eax
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp + eax*4 - 0x8c]
cmp ecx, eax
mov eax, dword [ebp - 0xc8]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xbefa
pop ecx
setl al
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0xbd8], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x10030b1b
push 0x174
push 0x26
push eax
call dword [sym.imp.USER32.dll_RemoveMenu]
dec dword [ebp - 0x164]
push 0
pop eax
push 1
pop ecx
push 2
pop edx
jns 0x10030a0a
dec dword [ebp - 0x3c]
jns 0x100309d2
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jg 0x10030c21
mov dword [ebp - 0x10], 0x8ef34ea8
mov dword [ebp - 0x30], 0xd693ce85
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x48], 0xfffffff8
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x8c]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10030bd2
mov dword [ebp - 0x10], eax
jmp 0x10030bcb
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0xc8], 0
je 0x10030b9e
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x8c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x8c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xc8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0xc8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc8], 0x6a83cd0
inc dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
jle 0x10030b7a
jmp 0x10030bd8
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
neg eax
je 0x10030c04
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10030c06
mov eax, dword [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x48]
jne 0x10030c04
mov eax, dword [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0xc8], 0xdfaf
inc dword [ebp - 0x3c]
push 1
pop ecx
cmp dword [ebp - 0x3c], eax
jle 0x10030b45
xor eax, eax
mov dword [ebp - 0x40], 0xcd3860a4
mov dword [ebp - 0x24], 0xe76f5020
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x54], 0xef874acc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10030c5a
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5b8], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10030c45
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x10030d6d
or edx, 0xffffffff
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x5b8], 0
jne 0x10030d67
mov dword [ebp - 0x34], ecx
xor eax, eax
cmp dword [ebp - 0x34], eax
jl 0x10030d5e
jmp 0x10030c92
xor eax, eax
push 2
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x10030cae
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x46c], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10030c9d
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x5b8], 0
jne 0x10030d5b
mov eax, dword [ebp - 0x5b4]
xor eax, eax
cmp dword [ebp - 0x5b8], eax
jne 0x10030cda
mov eax, dword [ebp - 0x5b0]
mov eax, dword [ebp - 0x34]
inc eax
je 0x10030ce7
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x10030cf1
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x5b8]
mov eax, dword [ebp - 0x38]
xor ebx, ebx
mov eax, dword [ebp - 0x46c]
mov edx, dword [ebp - 0x46c]
mov eax, dword [ebp - 0x46c]
mov ecx, dword [ebp - 0x34]
imul edx, eax
mov eax, dword [ebp - 0x34]
push 0xffffffffffffffff
add ecx, edx
cmp ecx, eax
setle bl
xor edx, edx
sub ebx, dword [ebp - 0x2c]
imul ebx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x468]
neg ebx
cmp ebx, eax
mov eax, dword [ebp - 0x54]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x5b8]
pop edx
setge cl
add eax, 0x3e86
add ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x5b8], ecx
dec dword [ebp - 0x34]
jns 0x10030c90
push 3
pop ecx
dec dword [ebp - 0x24]
jns 0x10030c6c
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jle 0x100313e6
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x100313e8
mov dword [ebp - 0x3c], 8
xor edx, edx
mov dword [ebp - 0x38], 0xeb382e58
inc edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], eax
jmp 0x10030dad
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x204], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10030da0
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x3c]
test eax, eax
je 0x10030dc0
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp eax, edx
mov eax, dword [ebp - 0x3c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setne dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x3c]
setne bl
xor ecx, ecx
cmp eax, ebx
setle cl
xor eax, eax
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], eax
je 0x10030e10
cmp dword [ebp - 0x3c], eax
je 0x10030e10
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x10030e13
xor ebx, ebx
inc ebx
mov ecx, 0xf3938425
cmp ecx, eax
mov eax, dword [ebp - 0x204]
push 2
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
pop esi
setl cl
xor eax, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2b
jne 0x10030f1c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x38], 0x4045
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10030e6a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x89c], 0x78c6aee3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10030e52
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jg 0x10030ea1
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jne 0x10030ea1
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10030e99
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
xor eax, eax
or ecx, 0xffffffff
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jle 0x10030e75
cmp dword [ebp - 0x204], eax
je 0x10030f06
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 9
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
cmp ecx, 0x69a
setg al
xor edx, edx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x204], ebx
mov ecx, dword [ebp - 0x898]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setge dl
cmp edx, dword [ebp - 0x20]
jl 0x10030f04
mov eax, ebx
jmp 0x10030f06
xor eax, eax
mov dword [ebp - 0x898], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x2b
push 0
pop eax
je 0x10030e40
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x3c], 0x2cb13638
mov dword [ebp - 0x38], 0x5ebae88b
mov dword [ebp - 0x10], 0x3dcdcbd5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10030f51
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6c], 0x3342eb9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10030f3c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10030f71
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6cc], 0x9980a6f8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10030f59
xor eax, eax
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
jl 0x10031018
or ecx, 0xffffffff
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], eax
jmp 0x10030f99
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x684], 0xa7b7e80d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030f88
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x6c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp eax, 7
setne cl
cmp ecx, dword [ebp - 0x38]
jge 0x10030fd0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x3c]
cmp ecx, dword [ebp + eax*4 - 0x6c]
je 0x10030fd0
mov edx, ebx
jmp 0x10030fd4
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x3c]
xor ebx, ebx
push 0
mov ecx, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x6c]
imul ecx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setle bl
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x3c]
add edx, ebx
cmp edx, eax
setl cl
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x684], eax
dec dword [ebp - 0x3c]
pop eax
push 1
pop ebx
jns 0x10030f7d
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jg 0x10031244
xor esi, esi
mov ebx, 0x9aa6b35e
inc esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], 0xc2878486
mov dword [ebp - 0x9e8], ebx
mov dword [ebp - 0x9e4], ebx
mov dword [ebp - 0x9e0], ebx
mov dword [ebp - 0x9dc], ebx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x14], eax
jmp 0x1003106a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe8], 0x9b37d022
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10031059
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x3c]
sub ecx, dword [ebp + eax*4 - 0x6c]
cmp ecx, 0x6f77d900
jl 0x100310a0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x6c], 0
jne 0x100310a3
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp eax, 0xda828c04
setne cl
xor eax, eax
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], eax
je 0x100310d0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x6c], 0
je 0x100310ce
mov ecx, esi
jmp 0x100310d2
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0x47d02c9a
mov ecx, 0xfffb
setle al
cmp ecx, eax
mov eax, dword [ebp - 0x68]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov ecx, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x3c]
setl dl
sub ecx, edx
mov eax, dword [ebp + eax*4 - 0x6c]
inc dword [ebp - 0xe8]
cmp ecx, eax
jle 0x10031111
mov dword [ebp - 0x68], esi
mov eax, esi
jmp 0x10031116
xor eax, eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
neg edx
cmp edx, eax
setle cl
mov dword [ebp - 0x6cc], ecx
or ecx, 0xffffffff
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x6c], ecx
xor eax, eax
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], eax
je 0x1003114a
mov ecx, dword [ebp - 0x2c]
jmp 0x1003122b
mov dword [ebp - 0x2c], 0x9d02
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x10031228
xor ebx, ebx
inc ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jg 0x100311ff
jmp 0x10031173
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10031184
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x6c], ecx
cmp ecx, 0xc46406cc
je 0x100311cf
mov eax, dword [ebp - 0x10]
push 2
pop ecx
mov eax, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0x6cc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0x9e8]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
inc ecx
mov dword [ebp + eax*4 - 0x6c], ecx
je 0x100311cf
mov esi, ebx
jmp 0x100311d3
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
test esi, esi
setne cl
mov edx, dword [ebp + eax*4 - 0xe8]
xor eax, eax
cmp edx, ecx
setle al
mov dword [ebp - 0x6cc], eax
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jle 0x10031171
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xe8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2c], eax
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x10031160
xor esi, esi
mov ebx, 0x9aa6b35e
inc esi
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x3c]
push 0
mov dword [ebp + eax*4 - 0x6c], ecx
inc dword [ebp - 0x3c]
pop eax
cmp dword [ebp - 0x3c], esi
jle 0x1003102c
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x40], eax
je 0x10031250
mov edx, ebx
cmp dword [ebp - 0x28], eax
jne 0x10031252
mov edx, eax
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setle cl
xor edx, edx
cmp ecx, ebx
setg dl
sub eax, edx
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x792891f4
mov ecx, 0x35a60c4
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x2c], 0xa5575278
mov dword [ebp - 0xaf8], ecx
mov dword [ebp - 0xaf4], ecx
mov dword [ebp - 0xaf0], ecx
mov dword [ebp - 0xaec], ecx
push 3
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x100312c2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x214], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100312aa
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x100312e5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc30], 0x5654a137
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100312cd
xor eax, eax
cmp dword [ebp - 0x20c], eax
je 0x100322ac
or edx, 0xffffffff
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x48], 0xc8490231
mov dword [ebp - 0x40], 0x2b79dc86
mov dword [ebp - 0x4c], 0xfffffffb
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x10032326
mov dword [ebp - 0x38], 0x52b4b5a9
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x214]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x214]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x214]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x214]
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x48]
sub edx, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x214]
cmp eax, edx
setl cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setne dl
xor eax, eax
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x40], eax
jne 0x100313c4
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x214], ebx
jge 0x10032286
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x214]
mov dword [ebp - 0x2c], eax
jmp 0x10032298
xor eax, eax
mov dword [ebp - 0x4c], 0x3421
push 0xfffffffffffffff9
pop edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1003141e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb58], 0xc64a6847
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10031405
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x10031486
xor edx, edx
inc edx
push 2
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x10031442
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbe0], 0x86fd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10031431
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xb58]
cmp eax, edx
setge cl
or eax, 0xffffffff
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xb58]
mov eax, dword [ebp - 0xb58]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xb58]
xor eax, eax
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x1c]
jns 0x10031429
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100314b2
push 0xf67
push eax
push eax
push 0xfb6
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
xor eax, eax
mov dword [ebp - 0x38], 0x2ba8d7d2
or ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x2c], 0xe8e56f9b
push 2
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x14], eax
pop edx
jmp 0x100314e2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x194], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100314d5
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
inc ecx
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jg 0x10031600
mov eax, 0x8a2b8ea2
or edx, 0xffffffff
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x97c], eax
mov dword [ebp - 0x978], eax
mov dword [ebp - 0x974], eax
mov dword [ebp - 0x970], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x194]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x194]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x194], ecx
xor ecx, ecx
mov dword [ebp - 0x978], 0xfffffffb
mov eax, dword [ebp - 0x50]
cmp eax, 0x6b86
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
mov eax, dword [ebp - 0x978]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
imul eax, ecx, 0x86a6
or ecx, 0xffffffff
inc eax
cmp eax, ecx
jne 0x100315bf
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x194], 0
je 0x100315bf
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x100315c1
lea edx, [eax + 1]
jmp 0x100315c3
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x10]
cmp edx, 0xfff6
mov ecx, dword [ebp + eax*4 - 0x194]
sbb eax, eax
neg eax
add ecx, eax
xor eax, eax
cmp ecx, 0x324015fb
setg al
xor ecx, ecx
mov dword [ebp - 0x2c], eax
inc ecx
inc dword [ebp - 0x10]
mov eax, 0x8a2b8ea2
cmp dword [ebp - 0x10], ecx
jle 0x10031503
push 2
xor eax, eax
pop edx
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031633
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x610], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003161a
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x10031653
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbf4], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003163b
xor eax, eax
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x100317cf
mov dword [ebp - 0x24], 0xa9ef72d4
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x30], 0x1be360de
mov dword [ebp - 0x30], 0xf39c
mov dword [ebp - 0x30], 0x881dda8d
mov dword [ebp - 0x30], 0xef2f37fc
mov dword [ebp - 0x30], 0x2e4a6b2c
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100316b5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf98], 0x717b38e5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1003169c
xor eax, eax
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], eax
jl 0x100317c6
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x30], 0xcff29c21
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x610]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
mov eax, dword [ebp + eax*4 - 0x610]
sub eax, ecx
xor ecx, ecx
add eax, dword [ebp - 0x24]
cmp eax, 0x7c7
setne cl
sub ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x608]
mov eax, dword [ebp - 0x608]
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
mov eax, dword [ebp + eax*4 - 0x610]
sub eax, ecx
je 0x10031800
or eax, 0xffffffff
mov dword [ebp - 0x14], 0x74579933
mov dword [ebp - 0x30], eax
xor eax, eax
inc eax
mov dword [ebp - 0x30], 0xbbd4856c
mov dword [ebp - 0x30], eax
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10031763
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x113c], 0x7bdd4840
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10031752
dec dword [ebp - 0x38]
mov dword [ebp - 0x14], 0xfffffffa
jmp 0x10031784
mov eax, dword [ebp - 0x1130]
mov dword [ebp - 0xf94], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xb
jle 0x10031775
xor eax, eax
push 2
pop edx
mov dword [ebp - 0x50], edx
cmp dword [ebp - 0x50], eax
jl 0x100317b2
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100317aa
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor eax, eax
dec dword [ebp - 0x50]
jns 0x10031797
push 2
pop edx
dec dword [ebp - 0x24]
push 1
pop ecx
jns 0x100316c1
xor ecx, ecx
xor eax, eax
push 2
inc ecx
pop edx
dec dword [ebp - 0x1c]
jns 0x1003165f
mov dword [ebp - 0x50], 0x3271
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100317f8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x620], 0x75b57fd5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100317df
xor eax, eax
mov dword [ebp - 0x620], eax
jmp 0x10031838
xor eax, eax
cmp dword [ebp - 0xbf0], eax
jne 0x100317be
jmp 0x1003178c
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10031832
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
xor eax, eax
inc dword [ebp - 0x620]
cmp dword [ebp - 0x620], 0x1b
jl 0x1003180c
mov dword [ebp - 0x24], 0x2452a2c7
mov dword [ebp - 0x30], 0x5baf43b7
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10031867
push 0x8e5
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003187f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
xor eax, eax
mov byte [ebp - 0x41], al
xor ecx, ecx
mov dword [ebp - 0x34], 0xe8cff0ea
inc ecx
mov dword [ebp - 0x38], 0x924b5411
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x100318b3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x108], 0xf72d4ea6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003189b
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x100318c5
mov dword [ebp - 0x108], 0xa8b108f8
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffeb
je 0x100318b8
cmp dword [ebp - 0x108], eax
je 0x100318f3
mov eax, dword [ebp - 0x108]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x108]
imul eax, dword [ebp - 0x38]
test eax, eax
je 0x100318f1
mov edx, ecx
jmp 0x100318f5
xor eax, eax
mov edx, eax
mov ecx, dword [ebp - 0x108]
mov eax, dword [ebp - 0x108]
add eax, ecx
mov ecx, dword [ebp - 0x34]
add ecx, edx
add ecx, eax
je 0x1003191a
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1003191c
xor edx, edx
inc edx
mov eax, edx
jmp 0x1003191f
xor eax, eax
xor edx, edx
inc edx
add eax, 0x81d2
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 0xc7d24b5e
setne al
cmp eax, 0xe360de57
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
cmp byte [ebp - 0x41], 0
je 0x10031b3e
mov eax, 0xde9
mov dword [ebp - 0x3dc], eax
mov dword [ebp - 0x3d8], eax
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x3d0], eax
xor eax, eax
mov dword [ebp - 0x38], 0x815898f0
mov dword [ebp - 0x48], 0x6cef3cf6
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x40], 0xfffa
mov dword [ebp - 0x54], 0x1ec8e12b
mov dword [ebp - 0x1c], edx
push 3
mov dword [ebp - 0x3c], eax
pop ecx
cmp dword [ebp - 0x3c], ecx
jge 0x100319b0
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x630], 0x5fdc8dfb
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ecx
jl 0x10031998
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ecx
jge 0x100319d0
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xdb0], 0xb1af9d66
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ecx
jl 0x100319b8
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x100319f2
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1154], 0xa0c844fc
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 4
jl 0x100319d9
xor eax, eax
push 2
mov dword [ebp - 0x3c], eax
pop ecx
jmp 0x10031a07
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xc08], edx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ecx
jl 0x100319fa
mov eax, dword [ebp - 0x3d4]
mov ecx, 0x6dd2cc91
sub ecx, eax
je 0x10031a21
mov eax, dword [ebp - 0x3dc]
mov eax, dword [ebp - 0x3d0]
xor ecx, ecx
mov eax, dword [ebp - 0x3d0]
mov eax, dword [ebp - 0x3d8]
mov eax, dword [ebp - 0x3dc]
cmp eax, 0x7b1b
setge cl
mov dword [ebp - 0xda8], ecx
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x630], 0xea38
imul edx, dword [ebp - 0x38], 0xea38
mov eax, dword [ebp - 0x48]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, 1
setge cl
lea eax, [ecx + 0x38bea122]
add eax, edx
jne 0x10031a8c
cmp dword [ebp - 0x62c], eax
je 0x10031a8e
xor edx, edx
inc edx
mov eax, edx
jmp 0x10031a91
xor eax, eax
xor edx, edx
inc edx
add eax, 0x36c14a2e
neg eax
push 2
sbb eax, eax
xor ecx, ecx
inc eax
add eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x630]
cmp eax, 0xbc79
pop eax
setl cl
sub ecx, eax
cmp ecx, 0xfffffff6
je 0x10031ac4
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x630]
xor ecx, ecx
mov eax, dword [ebp - 0x1154]
mov dword [ebp - 0xda8], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x62c]
cmp eax, edx
mov eax, dword [ebp - 0x40]
setl cl
inc dword [ebp - 0x40]
cmp eax, ecx
jle 0x10031afa
xor eax, eax
mov dword [ebp - 0xc04], eax
jmp 0x10031b30
mov dword [ebp - 0x1c], 3
xor eax, eax
cmp dword [ebp - 0x1c], 0x26
jg 0x10031b30
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10031b25
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
xor edx, edx
xor eax, eax
inc edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x26
jle 0x10031b09
xor eax, eax
push 0x1af1
push eax
push 0x5a5
push eax
call ebx
or eax, 0xffffffff
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 0x5540fff0
mov dword [ebp - 0x30], 0x332e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10031b79
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xeb4], 0x9841
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10031b60
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], eax
inc ebx
cmp dword [ebp - 0x10], ebx
jge 0x10031b9c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe4], 0xa32b1cec
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10031b84
xor eax, eax
push 3
pop edx
mov dword [ebp - 0xe4], edx
cmp dword [ebp - 0xe4], eax
jl 0x10031cdd
jmp 0x10031bb5
xor eax, eax
mov dword [ebp - 0x30], 0x9cf7d164
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], eax
jmp 0x10031bd5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xdc0], 0x43046b6e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10031bc4
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp + eax*4 - 0xeb4]
sub eax, dword [ebp - 0xdc0]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jg 0x10031cd1
jmp 0x10031c02
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10031c21
push 2
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x208], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10031c0d
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10031c37
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdd8], 0x430688cd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10031c26
mov eax, dword [ebp - 0xea8]
mov eax, dword [ebp - 0x208]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x208]
mov eax, dword [ebp - 0xdd8]
neg eax
jne 0x10031c7b
mov eax, dword [ebp - 0xe4]
cmp dword [ebp + eax*4 - 0xeb4], 0
jne 0x10031c7b
xor eax, eax
mov edx, eax
jmp 0x10031c7d
mov edx, ebx
mov eax, dword [ebp - 0xdc0]
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0xe4]
jg 0x10031c9e
mov ecx, ebx
cmp dword [ebp - 0x208], eax
jne 0x10031ca0
mov ecx, eax
mov eax, dword [ebp - 0xdd8]
xor edx, edx
add eax, ecx
cmp eax, 0x4d4
mov eax, dword [ebp - 0x2c]
push 3
setl dl
xor ecx, ecx
cmp edx, eax
pop edx
setle cl
mov dword [ebp - 0x208], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x10031c00
dec dword [ebp - 0xe4]
jns 0x10031bb3
mov eax, dword [ebp - 0x20]
mov ecx, ebx
sub ecx, eax
je 0x10032279
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], 0xfffd
mov byte [ebp - 0x41], al
jbe 0x10031d12
cmp byte [ebp - 0x41], al
je 0x10031d25
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
jmp 0x10031d25
cmp byte [ebp - 0x41], al
je 0x10031d25
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x50]
test eax, eax
mov edx, dword [ebp - 0x40]
setns cl
sub edx, ecx
add edx, dword [ebp - 0x4c]
sub edx, dword [ebp - 0x20]
neg edx
push 2
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
cmp eax, edx
mov eax, dword [ebp - 0x4c]
setne cl
xor edx, edx
imul ecx, ecx, 0xfffa
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
or eax, 0xffffffff
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x50], 0x38ec
mov dword [ebp - 0x8d4], eax
mov dword [ebp - 0x8d0], eax
mov dword [ebp - 0x8cc], eax
mov dword [ebp - 0x8c8], eax
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x54], 0xb37d0226
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x10031dbc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8a4], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10031dab
mov edx, dword [ebp - 0x50]
xor ecx, ecx
mov eax, dword [ebp - 0x8c8]
add edx, 0x6c902db0
cmp edx, eax
setge cl
cmp ecx, 0xba7b
jle 0x10031de5
mov eax, dword [ebp - 0x8a0]
mov eax, dword [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x8a4]
cmp ecx, eax
setg dl
mov dword [ebp - 0x8c8], edx
mov eax, dword [ebp - 0x50]
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x10031e1b
mov dword [ebp - 0x2c], 0x1966
mov dword [ebp - 0x2c], 0xf8e3bf11
jmp 0x10031e37
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x10031e37
push 0x25c5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10031e57
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x4c], 9
mov dword [ebp - 0x40], 0xa37b187b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031e8d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x640], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031e74
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10031ea3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa18], 0x11521faf
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10031e92
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x24]
test eax, eax
jne 0x10031f1b
cmp dword [ebp - 0x24], eax
je 0x10031ebb
mov eax, dword [ebp - 0x4c]
inc dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0xa14]
cmp eax, ebx
mov eax, dword [ebp - 0xa14]
setge cl
cmp ecx, ebx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x63c]
sete dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x640]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x638]
cmp eax, dword [ebp - 0x63c]
jl 0x10031f10
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10031f1d
mov eax, ebx
jmp 0x10031f1d
xor eax, eax
xor edx, edx
cmp eax, ebx
push 2
sete dl
xor ecx, ecx
mov dword [ebp - 0x640], edx
mov eax, dword [ebp - 0xa14]
cmp edx, eax
pop edx
setle cl
xor eax, eax
mov dword [ebp - 0xa14], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x24], eax
jmp 0x10031fab
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], 0x767dbf12
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
jg 0x10031fa8
or ecx, 0xffffffff
mov dword [ebp - 0x8ec], ecx
mov dword [ebp - 0x8e8], ecx
mov dword [ebp - 0x8e4], ecx
mov dword [ebp - 0x8e0], ecx
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10031f9a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 2
xor eax, eax
or ecx, 0xffffffff
pop edx
inc dword [ebp - 0x8ec]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jle 0x10031f63
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jle 0x10031f4a
mov byte [ebp - 0x15], al
or ecx, 0xffffffff
mov dword [ebp - 0x20], 0x8901f2c
mov dword [ebp - 0x2c], 0xd19fa553
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x10031fe7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6c4], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10031fd3
xor eax, eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1003214c
mov dword [ebp - 0x10], ecx
mov ecx, 0x13ce
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x7e0], ecx
mov dword [ebp - 0x7dc], ecx
mov dword [ebp - 0x7d8], ecx
mov dword [ebp - 0x7d4], ecx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x100320f4
mov dword [ebp - 0x50], 0x12fbb6bc
mov dword [ebp - 0x2c], 0x3e8ce6fc
mov dword [ebp - 0x30], 0x593f6a08
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
sub ecx, 0xe76d238e
neg ecx
sbb ecx, ecx
xor edx, edx
add ecx, 0xaeba4d3f
mov dword [ebp + eax*4 - 0x6c4], ecx
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setg dl
xor ebx, ebx
cmp edx, 0xf7cc
setl bl
xor ecx, ecx
cmp eax, ebx
setne cl
xor eax, eax
cmp ecx, 0xee49
setne al
mov dword [ebp - 0x38], eax
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x100320c1
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x6c4], 0
jne 0x100320c1
xor eax, eax
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x100320c6
xor ebx, ebx
inc ebx
mov edx, ebx
inc dword [ebp - 0x7d8]
xor ecx, ecx
mov eax, dword [ebp - 0x7d8]
cmp eax, edx
mov eax, dword [ebp - 0x6c4]
sete cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x10]
jns 0x10032029
xor eax, eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x1003213d
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003210e
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10032138
push 0xc1b
push 0x96c
push 0xa76
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x100320fc
dec dword [ebp - 0x20]
push 2
pop edx
push 0xffffffffffffffff
pop ecx
jns 0x10031ff3
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp eax, 0xfffffff7
setne cl
mov dword [ebp - 0x2c], ecx
cmp byte [ebp - 0x15], 0
je 0x1003126b
mov eax, 0xffff
mov dword [ebp - 0x10], eax
or eax, 0xffffffff
mov dword [ebp - 0x50], 8
mov dword [ebp - 0x38], 0x28abf8b2
mov dword [ebp - 0x2c], 0x35211521
mov dword [ebp - 0x30], 0x698d
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x38], 0x9f41af53
mov dword [ebp - 0x14], eax
jmp 0x100321ad
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc1c], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003219c
mov eax, dword [ebp - 0x2c]
mov ecx, 0xeb927eed
mov eax, dword [ebp - 0x50]
sub ecx, eax
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ebx, ebx
cmp edx, 0x4f5f
setne bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor eax, eax
cmp ecx, 0x66941fc9
setle al
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
xor edx, edx
inc eax
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setl dl
xor ebx, ebx
cmp edx, eax
setge bl
sub ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp eax, ebx
setl cl
xor eax, eax
mov dword [ebp - 0xc1c], ecx
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10032261
push 0x116a
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0xfd5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
xor ebx, ebx
xor eax, eax
inc ebx
jmp 0x1003126d
mov eax, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x1003126d
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10032298
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x10]
jns 0x1003131b
jmp 0x10032324
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], 0xd5d57d38
mov dword [ebp - 0x30], 0x81002a95
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x100322dd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf5c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100322c5
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100322fd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc80], 0xe1d67a3d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100322e5
xor eax, eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0xc2c], eax
je 0x1003230f
mov edx, ebx
cmp dword [ebp - 0x2c], eax
jne 0x10032311
mov edx, eax
mov eax, dword [ebp - 0xaf8]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0xf58], ecx
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], 0x6893
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10032346
call esi
push eax
call edi
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 6
jne 0x100324b6
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0x44198d72
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x10]
neg edx
sbb edx, edx
inc edx
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
setge al
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1003249d
mov dword [ebp - 0x38], 0x53d2
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x17
jg 0x1003249a
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100323cb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x290], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100323b3
xor eax, eax
mov dword [ebp - 0x34], 3
cmp dword [ebp - 0x34], 9
jne 0x1003248a
mov edx, 0x23fa
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10032403
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x990], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100323f0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10032416
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10032423
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x990], edx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x290], ecx
cmp dword [ebp - 0x24], eax
je 0x10032474
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x290]
mov eax, dword [ebp - 0x34]
sub ecx, eax
cmp dword [ebp - 0x98c], ecx
je 0x10032463
xor eax, eax
cmp dword [ebp - 0x98c], eax
je 0x10032465
mov eax, ebx
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 9
push 0
pop eax
je 0x100323e1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x17
push 0
pop eax
jle 0x100323a8
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff1
jg 0x10032394
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
je 0x10032353
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100324d8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4cc], 0x20624039
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100324bf
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100324f8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6ec], 0xfe1ca296
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100324e0
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1003250e
push 0x585
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
mov dword [ebp - 0x4c8], eax
cmp dword [ebp - 0x4c8], 0xffffffea
jg 0x1003253a
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x6ec], eax
dec dword [ebp - 0x4c8]
cmp dword [ebp - 0x4c8], 0xffffffea
jle 0x1003251d
xor eax, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], 0x6893
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10032554
call esi
push eax
call edi
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100326b3
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0x44198d72
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x10]
neg edx
sbb edx, edx
inc edx
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
setge al
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100326a6
mov dword [ebp - 0x38], 0x53d2
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x17
jg 0x100326a3
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100325d4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2a4], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100325bc
xor eax, eax
mov dword [ebp - 0x34], 3
cmp dword [ebp - 0x34], 9
jne 0x10032693
mov edx, 0x23fa
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1003260c
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9d8], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100325f9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1003261f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1003262c
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x9d8], edx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x2a4], ecx
cmp dword [ebp - 0x24], eax
je 0x1003267d
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2a4]
mov eax, dword [ebp - 0x34]
sub ecx, eax
cmp dword [ebp - 0x9d4], ecx
je 0x1003266c
xor eax, eax
cmp dword [ebp - 0x9d4], eax
je 0x1003266e
mov eax, ebx
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 9
push 0
pop eax
je 0x100325ea
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x17
push 0
pop eax
jle 0x100325b1
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff1
jg 0x1003259d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
je 0x1003255c
push 2
mov dword [ebp - 0x24], 0xc3099cf
pop edx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jle 0x100326dc
mov dword [ebp - 0x24], 0x9f845d81
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, 0x566a927
setle cl
cmp ecx, dword [ebp - 0x24]
jne 0x100326f1
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10032703
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
jmp 0x1003276f
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], 0x6711db60
mov dword [ebp - 0x2c], 0x3c8d3fd9
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10032733
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
neg edx
cmp edx, eax
push 2
setge cl
mov dword [ebp - 0x10], ecx
pop edx
mov dword [ebp - 0x2c], 0x792891f4
mov eax, 0x35a60c4
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x2c], 0xa5575278
mov dword [ebp - 0xa38], eax
mov dword [ebp - 0xa34], eax
mov dword [ebp - 0xa30], eax
mov dword [ebp - 0xa2c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100327c5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x224], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100327ac
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x100327e5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc44], 0x5654a137
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100327cd
xor eax, eax
cmp dword [ebp - 0x21c], eax
je 0x10032905
or ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x48], 0xc8490231
mov dword [ebp - 0x40], 0x2b79dc86
mov dword [ebp - 0x4c], 0xfffffffb
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], eax
jl 0x10032987
mov dword [ebp - 0x38], 0x52b4b5a9
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x224]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x224]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x224]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x224]
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x48]
sub edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x21c]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x224]
cmp eax, edx
setl cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x21c]
cmp ecx, eax
setne dl
xor eax, eax
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x40], eax
jne 0x100328c4
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x224], ebx
jge 0x100328df
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x224]
mov dword [ebp - 0x2c], eax
jmp 0x100328f1
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x100328f1
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x10]
jns 0x1003281b
jmp 0x1003297f
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], 0xd5d57d38
mov dword [ebp - 0x30], 0x81002a95
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10032938
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1040], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003291f
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10032958
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd88], 0xe1d67a3d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032940
xor eax, eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0xc40], eax
je 0x1003296a
mov edx, ebx
cmp dword [ebp - 0x2c], eax
jne 0x1003296c
mov edx, eax
mov eax, dword [ebp - 0xa38]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x103c], ecx
push 2
xor eax, eax
or ecx, 0xffffffff
pop edx
mov dword [ebp - 0x28], 0x24a8c6a5
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x100329bb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1124], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100329a3
xor eax, eax
mov dword [ebp - 0x28], 3
jmp 0x10032a77
mov dword [ebp - 0x20], 0xd69f4288
mov dword [ebp - 0x30], 0x1edb6b7b
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe7
je 0x10032a71
mov dword [ebp - 0x38], 0xfffffff7
xor ebx, ebx
mov dword [ebp - 0x40], 0xfffffffa
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setg bl
xor edx, edx
dec ebx
cmp ebx, eax
mov eax, dword [ebp - 0x40]
push 2
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xfff9
setl cl
cmp eax, ecx
sbb eax, eax
xor ebx, ebx
neg eax
inc ebx
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x28]
cmp ebx, eax
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
pop ecx
setl dl
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, ecx
setl al
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe7
jne 0x100329e5
push ecx
xor eax, eax
pop edx
dec dword [ebp - 0x34]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff6
jg 0x100329c7
mov dword [ebp - 0x28], eax
jmp 0x10032ab1
mov dword [ebp - 0x34], eax
jmp 0x10032aa9
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10032aa6
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x10032a8b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x10032a86
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10032ad8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4d8], 0x20624039
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10032abf
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10032af8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x634], 0xfe1ca296
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032ae0
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10032b0e
push 0x585
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 0xffffffea
jg 0x10032b3a
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x634], eax
dec dword [ebp - 0x4d4]
cmp dword [ebp - 0x4d4], 0xffffffea
jle 0x10032b1d
xor eax, eax
mov dword [ebp - 0x2c], 0x792891f4
mov ecx, 0x35a60c4
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x2c], 0xa5575278
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xb94], ecx
mov dword [ebp - 0xb90], ecx
mov dword [ebp - 0xb8c], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10032b8e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x234], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10032b75
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10032bb1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd1c], 0x5654a137
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10032b99
xor eax, eax
cmp dword [ebp - 0x22c], eax
je 0x10032cd1
or edx, 0xffffffff
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x48], 0xc8490231
mov dword [ebp - 0x40], 0x2b79dc86
mov dword [ebp - 0x4c], 0xfffffffb
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x10032d50
mov dword [ebp - 0x38], 0x52b4b5a9
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x234]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x234]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x234]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x234]
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x48]
sub edx, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x22c]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x234]
cmp eax, edx
setl cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x22c]
cmp ecx, eax
setne dl
xor eax, eax
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x40], eax
jne 0x10032c90
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x234], ebx
jge 0x10032cab
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x234]
mov dword [ebp - 0x2c], eax
jmp 0x10032cbd
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10032cbd
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x10]
jns 0x10032be7
jmp 0x10032d4b
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], 0xd5d57d38
mov dword [ebp - 0x30], 0x81002a95
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10032d04
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xfe0], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10032ceb
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10032d24
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc8c], 0xe1d67a3d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032d0c
xor eax, eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0xd18], eax
je 0x10032d36
mov edx, ebx
cmp dword [ebp - 0x2c], eax
jne 0x10032d38
mov edx, eax
mov eax, dword [ebp - 0xb98]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0xfdc], ecx
push 2
pop ecx
xor eax, eax
mov dword [ebp - 0x3c], 0x60b4ffb8
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10032d7e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x94], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032d66
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10032d9e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc0], 0xbdae4f9d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032d86
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jl 0x10032f10
mov dword [ebp - 0x38], 0xb2f14481
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10032dd0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x18c], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10032dbc
xor eax, eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], eax
jl 0x10032f07
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], eax
jmp 0x10032e02
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xebc], 0x91d0b6bd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10032df1
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp + eax*4 - 0x94]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x94]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
sub eax, 0xdef9
je 0x10032e46
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x94], 0
je 0x10032e46
xor eax, eax
cmp dword [ebp - 0x18c], eax
je 0x10032e48
mov ecx, ebx
jmp 0x10032e4a
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x18c]
xor edx, edx
push 0xfffffffffffffffe
mov eax, dword [ebp + eax*4 - 0x94]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
setne dl
sub edx, dword [ebp - 0xc0]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x38], edx
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x94]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x94]
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x18c]
sub ecx, eax
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp + eax*4 - 0x94]
cmp ecx, eax
mov eax, dword [ebp - 0xc0]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xbefa
pop ecx
setl al
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0xebc], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10032ef5
push 0x174
push 0x26
push eax
call dword [sym.imp.USER32.dll_RemoveMenu]
dec dword [ebp - 0x18c]
push 0
pop eax
push 2
pop ecx
jns 0x10032de2
dec dword [ebp - 0x3c]
jns 0x10032daa
mov dword [ebp - 0x3c], eax
jmp 0x10032fe6
mov dword [ebp - 0x10], 0x8ef34ea8
mov dword [ebp - 0x30], 0xd693ce85
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x48], 0xfffffff8
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x94]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10032fa5
mov dword [ebp - 0x10], eax
jmp 0x10032f9e
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0xc0], 0
je 0x10032f71
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x94]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x94]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xc0]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0xc0]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc0], 0x6a83cd0
inc dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
jle 0x10032f4d
jmp 0x10032fab
mov dword [ebp - 0x38], ebx
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
neg eax
je 0x10032fd7
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10032fd9
mov eax, dword [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x48]
jne 0x10032fd7
mov eax, dword [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0xc0], 0xdfaf
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jle 0x10032f18
push 2
mov dword [ebp - 0x24], 0xc3099cf
pop edx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jle 0x1003300e
mov dword [ebp - 0x24], 0x9f845d81
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, 0x566a927
setle cl
cmp ecx, dword [ebp - 0x24]
jne 0x10033023
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10033035
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
jmp 0x100330a1
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], 0x6711db60
mov dword [ebp - 0x2c], 0x3c8d3fd9
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10033065
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
neg edx
cmp edx, eax
push 2
setge cl
mov dword [ebp - 0x10], ecx
pop edx
mov dword [ebp - 0x40], 0x20d7
xor eax, eax
mov dword [ebp - 0x14], 0x1c234ac0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x100330d4