Function at 0x100328ce
Capabilities:
Check os version
Compare security identifiers
Create directory
Create process on windows
Delete directory
Delete file
Enumerate gui resources
Get common file path
Get disk information
Get graphical window text
Get keyboard layout
Get session user name
Identify system language via api
Modify service
Parse pe header

Disassembly:
mov eax, 0x100828f0
call fcn.10081628
mov eax, 0x1224
call fcn.1007cd50
push ebx
push esi
push edi
push 8
pop edi
mov dword [ebp - 0x54], edi
mov ebx, 0x96673e7e
mov dword [ebp - 0x2c], 0xfff8
mov esi, 0xf1fdbd01
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
push 0xfffffffffffffffd
mov dword [ebp - 0x64], ecx
mov ecx, dword [ebp - 0x14]
pop eax
mov byte [ebp - 0x85], dl
sub eax, ecx
jne 0x1003292b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
cmp eax, ecx
setl dl
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov byte [ebp - 0x45], cl
cmp byte [ebp - 0x45], cl
je 0x1003295a
push 0x1098
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0x54], edi
mov eax, 0xfff8
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x2c]
push 0xfffffffffffffffd
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
pop ecx
sub ecx, eax
jne 0x1003298b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
cmp eax, ecx
setl dl
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov byte [ebp - 0x45], cl
cmp byte [ebp - 0x45], cl
je 0x100329ba
push 0x1098
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x14], eax
push 3
mov dword [ebp - 0x1c], 0
pop edi
cmp dword [ebp - 0x1c], edi
jge 0x100329e4
push 8
pop edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a8], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100329d2
mov ecx, dword [ebp - 0x1a8]
xor edx, edx
mov eax, dword [ebp - 0x1a4]
cmp eax, ecx
push 1
setg dl
pop esi
add edx, 0xc57e
je 0x10032a0f
cmp dword [ebp - 0x1a8], 0
je 0x10032a0f
mov eax, esi
jmp 0x10032a11
xor eax, eax
add eax, 4
imul eax, dword [ebp - 0x1a4]
test eax, eax
jne 0x10032a2b
cmp dword [ebp - 0x1a4], eax
jne 0x10032a2d
mov ecx, eax
jmp 0x10032a2f
xor eax, eax
mov ecx, esi
cmp ecx, dword [ebp - 0x1a4]
je 0x10032a41
mov ecx, esi
cmp dword [ebp - 0x1a8], eax
jne 0x10032a43
mov ecx, eax
mov eax, dword [ebp - 0x1a8]
xor edx, edx
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
add ecx, eax
mov eax, dword [ebp - 0x1a4]
cmp eax, ecx
push 0xffffffffffffffff
setle dl
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x1a0]
sub ecx, eax
pop ecx
je 0x10032a91
mov byte [ebp - 0x45], 0
cmp byte [ebp - 0x45], 0
je 0x10032ad5
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
or ecx, 0xffffffff
jmp 0x10032ad5
mov dword [ebp - 0x3c], 0xfffffffd
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x54], 0x294b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10032ac0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1080], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10032aac
xor eax, eax
inc dword [ebp - 0x54]
cmp dword [ebp - 0x14], eax
jne 0x10032ad0
cmp dword [ebp - 0x1078], eax
je 0x10032ad2
mov eax, esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0x4aa0d722
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x54], ecx
push 8
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0x51ebf0d
mov dword [ebp - 0x2c], 0xfff9
push 4
mov dword [ebp - 0x20], 0x5943e2f7
mov dword [ebp - 0x1c], 0
pop ecx
jmp 0x10032b1a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1200], 0x6171
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10032b09
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10032b30
inc dword [ebp - 0x2c]
je 0x10032b30
mov eax, esi
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x54]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
push 8
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x54]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x54]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x1c], ecx
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x38], 0x364fef53
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10032bb4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x98], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10032b9c
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10032bd4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x118], 0x925b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10032bbc
xor eax, eax
mov dword [ebp - 0x98], ecx
jmp 0x10032d82
mov dword [ebp - 0x30], 0x45db34e6
mov dword [ebp - 0x20], 0x75b167d3
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10032c03
push eax
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
xor eax, eax
mov dword [ebp - 0x30], 2
cmp dword [ebp - 0x30], eax
jl 0x10032d7c
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x118]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x118]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x118]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0
je 0x10032c52
mov eax, dword [ebp - 0x30]
xor edi, edi
cmp dword [ebp + eax*4 - 0x118], edi
je 0x10032c52
mov ecx, esi
jmp 0x10032c54
xor ecx, ecx
xor eax, eax
cmp ecx, 0x77cccaea
setg al
cmp eax, 9
sbb eax, eax
neg eax
add eax, dword [ebp - 0x98]
jne 0x10032c78
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x118]
mov eax, dword [ebp - 0x114]
xor ecx, ecx
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp + eax*4 - 0x118]
mov eax, dword [ebp - 0x98]
sub edx, 0xfad0
cmp edx, eax
setl cl
lea eax, [ecx + 0x52bf]
cmp eax, dword [ebp - 0x30]
jle 0x10032cb9
cmp dword [ebp - 0x30], 0
je 0x10032cb9
mov ecx, esi
jmp 0x10032cbb
xor ecx, ecx
mov eax, dword [ebp - 0x98]
imul eax, ecx
test eax, eax
je 0x10032cda
mov eax, dword [ebp - 0x30]
xor edi, edi
cmp dword [ebp + eax*4 - 0x118], edi
je 0x10032cda
mov ecx, esi
jmp 0x10032cdc
xor ecx, ecx
mov eax, dword [ebp - 0x30]
add eax, ecx
cmp eax, 0xac116e07
je 0x10032cfa
mov ecx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x118], ecx
jmp 0x10032d71
mov dword [ebp - 0x20], 0
xor edx, edx
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x98]
add ecx, eax
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setg dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x118]
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x38], 0xffffffe3
jmp 0x10032d6b
mov dword [ebp - 0x20], 0xbde8aff6
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x118]
mov dword [ebp - 0x20], eax
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10032d68
push eax
push 0x205a
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 6
jl 0x10032d3b
dec dword [ebp - 0x30]
jns 0x10032c13
xor eax, eax
dec dword [ebp - 0x98]
cmp dword [ebp - 0x98], 0xfffffff8
jge 0x10032bdf
cmp dword [ebp - 0x118], eax
je 0x10032da1
mov ecx, esi
cmp dword [ebp - 0x98], eax
jne 0x10032da3
mov ecx, eax
mov dword [ebp - 0x38], ecx
mov ecx, 0xfff8
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], 0x7a4a12b5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10032dd5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe8c], 0x2799ac78
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10032dbd
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x10032dfd
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10032df8
push 0x22c7
call ebx
push eax
call edi
xor eax, eax
dec dword [ebp - 0x14]
jns 0x10032de3
mov dword [ebp - 0x14], 0x96673e7e
mov dword [ebp - 0x24], 0xe4b28306
mov dword [ebp - 0x38], 0x2250db85
mov dword [ebp - 0x30], 0x8a062b00
mov dword [ebp - 0x34], 0xa3187110
mov dword [ebp - 0x1c], 0xfffffffd
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10032e47
push 0x21be
push 0x1cc0
push eax
push 0x163e
push eax
call dword [sym.imp.USER32.dll_GetMenuStringW]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setge dl
imul edx, dword [ebp - 0x24]
cmp edx, esi
je 0x10032e66
cmp dword [ebp - 0x24], 0
je 0x10032e66
mov eax, esi
jmp 0x10032e68
xor eax, eax
or ecx, 0xffffffff
cmp ecx, eax
push 3
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
pop edx
cmp eax, edx
setne cl
imul eax, ecx, 0xfffffffc
test eax, eax
je 0x10033131
push 4
pop ebx
mov dword [ebp - 0x18], 0xfff7
lea ecx, [ebp - 0x3e4]
push ebx
call fcn.100188f1
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x3c], 0xfffb
mov dword [ebp - 0x3c], 0x77dd35ab
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x4c], 0xf0f4353c
mov dword [ebp - 0x1c], eax
jmp 0x10032ede
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3e4]
call fcn.1001898f
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10032ecb
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x34], 0
jne 0x1003303d
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, 0xfffffff6
mov eax, dword [ebp - 0x18]
setl dl
sub edx, 0xc23cea2f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setge cl
xor edx, edx
cmp ecx, 0x1bd53d2a
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setge bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setl cl
imul edx, ecx, 0xb834
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
cmp ecx, dword [ebp - 0x34]
jne 0x1003303d
mov dword [ebp - 0x2c], 0xfffffff7
lea ecx, [ebp - 0x3e4]
mov dword [ebp - 0x54], 0xfffffff9
push esi
mov dword [ebp - 0x4c], 0xfffffff6
call fcn.1001898f
push 3
pop eax
push eax
lea ecx, [ebp - 0x3e4]
call fcn.1001898f
push 0
lea ecx, [ebp - 0x3e4]
mov esi, eax
call fcn.1001898f
mov ecx, dword [eax]
cmp ecx, dword [esi]
jne 0x10032fe2
xor esi, esi
lea ecx, [ebp - 0x3e4]
inc esi
push esi
call fcn.1001898f
jmp 0x10032fe5
xor esi, esi
inc esi
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
cmp eax, 0x715c
push esi
setl cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x3e4]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
call fcn.1001898f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
jmp 0x1003310f
mov dword [ebp - 0x14], 0x5156be82
mov dword [ebp - 0x30], 0x17
cmp dword [ebp - 0x30], 0x12
je 0x1003310f
push 3
pop ecx
mov dword [ebp - 0x20], 0xfffb
mov dword [ebp - 0x4c], 0xfffffffb
mov dword [ebp - 0x1c], 0
jmp 0x10033080
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xda0], 0xb254
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003306f
cmp dword [ebp - 0x14], 0
je 0x100330f6
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x100330f0
mov eax, dword [ebp - 0xda0]
lea ecx, [ebp - 0x3e4]
mov eax, dword [ebp - 0x14]
push esi
call fcn.1001898f
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, esi
push 3
setl dl
xor ecx, ecx
or ebx, 0xffffffff
cmp edx, ebx
setle cl
xor edx, edx
cmp ecx, 0xfffffffe
pop ecx
setg dl
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
inc edx
mov dword [eax], edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x24], 0
jne 0x100330f0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xda0]
mov eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x12
jne 0x10033058
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x3e4]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10018973
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
jmp 0x1003314b
mov eax, 0xfff8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x4c], 0x77089988
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
mov dword [ebp - 0x4c], ecx
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 0xf1fdbd01
mov dword [ebp - 0x14], 0x7a4a12b5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1003317e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xea8], 0x2799ac78
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10033166
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x100331a0
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1003319b
push 0x22c7
call ebx
push eax
call edi
xor eax, eax
dec dword [ebp - 0x14]
jns 0x10033186
mov eax, dword [ebp - 0x28]
push 0xfffffffffffffffd
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
pop ecx
sub ecx, eax
jne 0x100331b9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, 0x1a04
setl dl
add edx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0xc38], eax
mov dword [ebp - 0xc34], eax
mov dword [ebp - 0xc30], eax
mov dword [ebp - 0xc2c], eax
xor eax, eax
mov dword [ebp - 0x24], 0x971c1ec2
push 4
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1003321e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc38], 0x2212
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10033206
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1003323b
push 0x5cd
push eax
push eax
push eax
push eax
call ebx
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10033251
push 0x1098
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
xor eax, eax
mov dword [ebp - 0x38], 0x364fef53
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10033278
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x94], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10033260
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1003329b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x100], 0x925b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10033283
xor eax, eax
push 8
pop edx
mov dword [ebp - 0x94], edx
cmp dword [ebp - 0x94], 0xfffffff8
jl 0x10033467
mov dword [ebp - 0x30], 0x45db34e6
mov dword [ebp - 0x20], 0x75b167d3
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100332d5
push eax
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
xor eax, eax
mov dword [ebp - 0x30], 2
cmp dword [ebp - 0x30], eax
jl 0x1003344e
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x100]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x100]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x100]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0
je 0x10033324
mov eax, dword [ebp - 0x30]
xor edi, edi
cmp dword [ebp + eax*4 - 0x100], edi
je 0x10033324
mov ecx, esi
jmp 0x10033326
xor ecx, ecx
xor eax, eax
cmp ecx, 0x77cccaea
setg al
cmp eax, 9
sbb eax, eax
neg eax
add eax, dword [ebp - 0x94]
jne 0x1003334a
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x100]
mov eax, dword [ebp - 0xfc]
xor ecx, ecx
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp + eax*4 - 0x100]
mov eax, dword [ebp - 0x94]
sub edx, 0xfad0
cmp edx, eax
setl cl
lea eax, [ecx + 0x52bf]
cmp eax, dword [ebp - 0x30]
jle 0x1003338b
cmp dword [ebp - 0x30], 0
je 0x1003338b
mov ecx, esi
jmp 0x1003338d
xor ecx, ecx
mov eax, dword [ebp - 0x94]
imul eax, ecx
test eax, eax
je 0x100333ac
mov eax, dword [ebp - 0x30]
xor edi, edi
cmp dword [ebp + eax*4 - 0x100], edi
je 0x100333ac
mov ecx, esi
jmp 0x100333ae
xor ecx, ecx
mov eax, dword [ebp - 0x30]
add eax, ecx
cmp eax, 0xac116e07
je 0x100333cc
mov ecx, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x100], ecx
jmp 0x10033443
mov dword [ebp - 0x20], 0
xor edx, edx
mov ecx, dword [ebp - 0x94]
mov eax, dword [ebp - 0xf8]
add ecx, eax
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setg dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x100]
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x38], 0xffffffe3
jmp 0x1003343d
mov dword [ebp - 0x20], 0xbde8aff6
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x100]
mov dword [ebp - 0x20], eax
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1003343a
push eax
push 0x205a
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 6
jl 0x1003340d
dec dword [ebp - 0x30]
jns 0x100332e5
xor eax, eax
dec dword [ebp - 0x94]
cmp dword [ebp - 0x94], 0xfffffff8
jge 0x100332b1
mov edi, dword [sym.imp.USER32.dll_GetWindowLongA]
cmp dword [ebp - 0x100], eax
je 0x10033479
mov ecx, esi
cmp dword [ebp - 0x94], eax
jne 0x1003347b
mov ecx, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], 0x7a4a12b5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x100334a5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd10], 0x2799ac78
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003348d
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x100334c7
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100334c2
push 0x22c7
call ebx
push eax
call edi
xor eax, eax
dec dword [ebp - 0x14]
jns 0x100334ad
push 8
pop ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x24], 0xe4b28306
mov dword [ebp - 0x38], 0x2250db85
mov dword [ebp - 0x30], 0x8a062b00
mov dword [ebp - 0x34], 0xa3187110
mov dword [ebp - 0x1c], 0xfffffffd
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10033510
push 0x21be
push 0x1cc0
push eax
push 0x163e
push eax
call dword [sym.imp.USER32.dll_GetMenuStringW]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setge dl
imul edx, dword [ebp - 0x24]
cmp edx, esi
je 0x1003352f
cmp dword [ebp - 0x24], 0
je 0x1003352f
mov eax, esi
jmp 0x10033531
xor eax, eax
or ecx, 0xffffffff
cmp ecx, eax
push 3
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
pop ebx
cmp eax, ebx
setne cl
imul eax, ecx, 0xfffffffc
test eax, eax
je 0x100337f7
push 4
pop eax
mov dword [ebp - 0x18], 0xfff7
lea ecx, [ebp - 0x4ac]
push eax
call fcn.100188f1
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x3c], 0xfffb
mov dword [ebp - 0x3c], 0x77dd35ab
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x4c], 0xf0f4353c
push 4
mov dword [ebp - 0x1c], 0
pop eax
cmp dword [ebp - 0x1c], eax
jge 0x100335b9
push eax
pop ebx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x4ac]
call fcn.1001898f
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003359e
push 3
pop ebx
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x34], 0
jne 0x10033716
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, 0xfffffff6
mov eax, dword [ebp - 0x18]
setl dl
sub edx, 0xc23cea2f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setge cl
xor edx, edx
cmp ecx, 0x1bd53d2a
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setge bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setl cl
imul edx, ecx, 0xb834
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
cmp ecx, dword [ebp - 0x34]
jne 0x10033713
mov dword [ebp - 0x2c], 0xfffffff7
lea ecx, [ebp - 0x4ac]
mov dword [ebp - 0x54], 0xfffffff9
push esi
mov dword [ebp - 0x4c], 0xfffffff6
call fcn.1001898f
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x4ac]
call fcn.1001898f
push 0
lea ecx, [ebp - 0x4ac]
mov esi, eax
call fcn.1001898f
mov ecx, dword [eax]
cmp ecx, dword [esi]
jne 0x100336b8
xor esi, esi
lea ecx, [ebp - 0x4ac]
inc esi
push esi
call fcn.1001898f
jmp 0x100336bb
xor esi, esi
inc esi
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
cmp eax, 0x715c
push esi
setl cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x4ac]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
call fcn.1001898f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
jmp 0x100337db
push 3
pop ebx
mov dword [ebp - 0x14], 0x5156be82
mov dword [ebp - 0x30], 0x17
jmp 0x100337d1
mov dword [ebp - 0x20], 0xfffb
mov dword [ebp - 0x4c], 0xfffffffb
mov dword [ebp - 0x1c], 0
jmp 0x10033751
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcf8], 0xb254
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10033740
cmp dword [ebp - 0x14], 0
je 0x100337c2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x100337bc
mov eax, dword [ebp - 0xcf8]
lea ecx, [ebp - 0x4ac]
mov eax, dword [ebp - 0x14]
push esi
call fcn.1001898f
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, esi
setl dl
xor ecx, ecx
cmp edx, 0xffffffff
setle cl
xor edx, edx
cmp ecx, 0xfffffffe
setg dl
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
inc edx
mov dword [eax], edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x24], 0
jne 0x100337bc
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xcf8]
mov eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x12
jne 0x10033729
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x4ac]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10018973
jmp 0x10033811
mov eax, 0xfff8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x4c], 0x77089988
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
mov dword [ebp - 0x4c], ecx
mov eax, 0xfff8
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], 0x7a4a12b5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10033842
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe04], 0x2799ac78
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003382a
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x10033868
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10033863
push 0x22c7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1003384a
mov dword [ebp - 0x14], 0x96673e7e
mov ecx, 0x1a04
mov dword [ebp - 0xc68], ecx
mov dword [ebp - 0xc64], ecx
mov dword [ebp - 0xc60], ecx
mov dword [ebp - 0xc5c], ecx
mov dword [ebp - 0x24], 0x971c1ec2
push 4
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x100338b6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc68], 0x2212
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1003389e
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100338da
push 0x5cd
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 4
xor eax, eax
pop ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], 6
cmp dword [ebp - 0x1c], 0xe
jg 0x1003392c
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10033914
push eax
push 0x2b7
push 0x1450
call dword [sym.imp.GDI32.dll_CreatePen]
push 4
pop ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xe
push 0
pop eax
jle 0x100338ed
mov dword [ebp - 0x20], 0xf1fdbd01
or ecx, 0xffffffff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10033958
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3fc], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10033944
xor eax, eax
mov dword [ebp - 0x24], 0xffffffef
cmp dword [ebp - 0x24], 0xd
je 0x10033ba9
push 2
pop edi
mov dword [ebp - 0x28], 0xd97a888a
mov dword [ebp - 0x34], 0xcd5fec46
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x54], ecx
mov ecx, 0x7220b739
mov dword [ebp - 0x80c], ecx
mov dword [ebp - 0x808], ecx
mov dword [ebp - 0x804], ecx
mov dword [ebp - 0x800], ecx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jg 0x10033b40
or ebx, 0xffffffff
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x8c4]
push esi
call fcn.100188f1
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], esi
jge 0x100339ef
push 4
pop ebx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x8c4]
call fcn.1001898f
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100339d4
or ebx, 0xffffffff
mov eax, dword [ebp - 0x28]
xor edi, edi
cmp dword [ebp + eax*4 - 0x3fc], edi
jne 0x10033abc
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x3fc], edi
je 0x10033a1c
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x3fc], edi
jne 0x10033a1c
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
neg ecx
push 7
sbb ecx, ecx
neg ecx
mov eax, dword [ebp + eax*4 - 0x3fc]
imul eax, ecx
cmp eax, 0xffff
pop eax
sbb ecx, ecx
inc ecx
add ecx, eax
xor eax, eax
cmp ecx, ebx
lea ecx, [ebp - 0x8c4]
push 0
setl al
cmp eax, 0xfffffff6
sbb esi, esi
neg esi
call fcn.1001898f
xor edx, edx
cmp esi, 0x2d29ed7d
setge dl
inc edx
mov dword [eax], esi
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xccce
setge al
add eax, 0xe42
cmp eax, dword [ebp - 0x34]
je 0x10033a9d
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10033a9d
xor esi, esi
mov edx, eax
inc esi
jmp 0x10033aa2
xor esi, esi
inc esi
mov edx, esi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x54], eax
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x10033abe
mov eax, esi
mov edx, dword [ebp - 0x3f8]
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x28]
cmp edx, eax
setle cl
mov dword [ebp - 0x804], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3f8]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x38], edi
je 0x10033aeb
mov eax, dword [ebp - 0x38]
push 0
lea ecx, [ebp - 0x8c4]
call fcn.1001898f
cmp dword [eax], 6
jg 0x10033b03
mov eax, dword [ebp - 0x804]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x8c4]
mov eax, dword [ebp - 0x804]
mov eax, dword [ebp - 0x3f4]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
call fcn.10018973
inc dword [ebp - 0x28]
push 2
pop edi
cmp dword [ebp - 0x28], edi
jle 0x100339b3
push 3
xor eax, eax
pop ebx
mov dword [ebp - 0x38], eax
jmp 0x10033b94
mov dword [ebp - 0x54], 0x9fe2
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], eax
jl 0x10033b7e
mov dword [ebp - 0x800], edi
xor ecx, ecx
mov dword [ebp - 0x1c], 0x13e9
mov eax, dword [ebp - 0x1c]
cmp eax, edi
setge cl
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x28]
jns 0x10033b57
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10033b91
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x10033b45
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xd
push 0xffffffffffffffff
pop ecx
jne 0x1003396c
mov eax, dword [ebp - 0x18]
push 0xfffffffffffffffd
pop edi
mov dword [ebp - 0x14], eax
mov ecx, edi
mov eax, dword [ebp - 0x14]
sub ecx, eax
jne 0x10033bc4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
push 2
setl dl
lea ecx, [ebp - 0xdb8]
add edx, dword [ebp - 0x40]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x50], 0x2a30a4cc
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x2c], 0x6d8bc0d
pop esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x24], 0xb780f885
mov dword [ebp - 0x20], 0x4491d0b
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], 0xdabac8ef
mov dword [ebp - 0x3c], 0x82f744ed
mov dword [ebp - 0x3c], 0x6ed55c59
mov dword [ebp - 0x3c], 0x254f8d3
push ebx
call fcn.100188f1
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], 0
jmp 0x10033c5a
push dword [ebp - 0x28]
lea ecx, [ebp - 0xdb8]
call fcn.1001898f
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10033c43
mov dword [ebp - 0x28], 0
jmp 0x10033c79
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa20], 0xfffffffa
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10033c68
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, 0xa17d0b0a
setge dl
cmp eax, edx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
add eax, 0x26f3
inc ecx
xor edx, edx
add eax, ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x18]
jg 0x10033d2a
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10033d22
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10033d16
push eax
push 0x9c3
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], 0xffffffee
jle 0x10033d00
jmp 0x10033d3c
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10033d3c
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
inc dword [ebp - 0xa1c]
lea ecx, [ebp - 0xdb8]
or edi, 0xffffffff
mov dword [ebp - 4], edi
call fcn.10018973
mov ecx, 0x1a04
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0xca8], ecx
mov dword [ebp - 0xca4], ecx
mov dword [ebp - 0xca0], ecx
mov dword [ebp - 0xc9c], ecx
mov dword [ebp - 0x24], 0x971c1ec2
push 4
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x10033d9f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xca8], 0x2212
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10033d87
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10033dbe
push 0x5cd
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp byte [ebp - 0xd], 0
je 0x10033ee7
push ebx
lea ecx, [ebp - 0x544]
call fcn.100188f1
push 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0x51d69f42
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0
jmp 0x10033e04
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x544]
call fcn.1001898f
mov dword [eax], 0xa53d06ce
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10033ded
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], esi
jg 0x10033ece
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x544]
push dword [ebp - 0x18]
call fcn.1001898f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x544]
call fcn.1001898f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x544]
call fcn.1001898f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x544]
call fcn.1001898f
push esi
lea ecx, [ebp - 0x544]
call fcn.1001898f
push dword [ebp - 0x18]
xor ebx, ebx
lea ecx, [ebp - 0x544]
cmp dword [eax], 0x2d34
setge bl
call fcn.1001898f
mov eax, dword [eax]
imul eax, ebx
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x10033ebf
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10033ea4
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10033eba
push 0x20a2
call dword [sym.imp.USER32.dll_GetKeyboardType]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10033e8b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10033e19
push 3
pop ebx
lea ecx, [ebp - 0x544]
mov dword [ebp - 4], edi
call fcn.10018973
push 0x1098
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movdqa xmm0, xmmword [0x10007c70]
lea eax, [ebp - 0xec8]
push eax
lea eax, [ebp - 0xed8]
push eax
lea ecx, [ebp - 0x1108]
movdqu xmmword [ebp - 0xed8], xmm0
call fcn.1001899e
lea ecx, [ebp - 0x287]
mov esi, eax
call fcn.10008d28
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xc8]
push dword [esi]
call fcn.1001894d
mov dword [ebp - 4], 5
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x40], 0x2b08f18e
mov dword [ebp - 0x50], 0x7d4e8587
push 0
mov dword [ebp - 0x2c], 0x2eb57571
call fcn.1001898f
xor edi, edi
cmp dword [eax], edi
jne 0x10033ffd
xor eax, eax
lea ecx, [ebp - 0xc8]
inc eax
push eax
call fcn.1001898f
mov eax, dword [eax]
add eax, 0x3cc9
je 0x10033f88
push edi
lea ecx, [ebp - 0xc8]
call fcn.1001898f
push 0
lea ecx, [ebp - 0xc8]
call fcn.1001898f
push 2
lea ecx, [ebp - 0xc8]
call fcn.1001898f
push 0
lea ecx, [ebp - 0xc8]
call fcn.1001898f
push 0
lea ecx, [ebp - 0xc8]
call fcn.1001898f
push 0
lea ecx, [ebp - 0xc8]
call fcn.1001898f
xor edi, edi
cmp dword [eax], edi
je 0x10033fd2
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xc8]
push ebx
call fcn.1001898f
push 0
lea ecx, [ebp - 0xc8]
mov esi, eax
call fcn.1001898f
mov ecx, dword [eax]
cmp ecx, dword [esi]
je 0x10033ffd
xor edi, edi
xor ecx, ecx
inc edi
jmp 0x10034002
xor edi, edi
inc edi
mov ecx, edi
mov eax, dword [ebp - 0x28]
mov ebx, dword [sym.imp.GDI32.dll_ExtTextOutA]
sub ecx, eax
je 0x100342d8
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], 0xb70f7348
mov dword [ebp - 0x2c], 0xfffffff8
cmp dword [ebp - 0x28], eax
je 0x10034106
push 8
mov dword [ebp - 0x2c], 0x97a0b891
lea ecx, [ebp - 0xc8]
pop eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
push 0
call fcn.1001898f
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xc8]
push 0
call fcn.1001898f
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10034090
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001898f
xor edi, edi
cmp dword [eax], edi
je 0x1003408e
inc edi
xor eax, eax
mov ecx, edi
jmp 0x10034095
xor eax, eax
xor edi, edi
mov ecx, eax
inc edi
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0xc8]
push eax
call fcn.1001898f
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0xc8]
mov esi, dword [ebp - 0x50]
push edi
sub edx, dword [eax]
mov eax, dword [ebp - 0x2c]
imul esi, edx
add esi, eax
call fcn.1001898f
mov dword [eax], esi
cmp esi, 0x7b12
jne 0x100340d4
cmp dword [ebp - 0x28], 0
je 0x100340d4
mov ecx, edi
jmp 0x100340d6
xor ecx, ecx
mov eax, dword [ebp - 0x28]
imul eax, ecx
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10034313
push eax
push eax
push 0x2d2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x10034313
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xbaae
mov dword [ebp - 0x50], 0xfffffff9
mov dword [ebp - 0x54], 0x4004
mov dword [ebp - 0x1c], 0x16a80d17
mov dword [ebp - 0x20], 0x5b8c0b7b
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x28]
je 0x10034143
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x10034145
mov ecx, edi
xor eax, eax
cmp ecx, 0x9d2a
setg al
add eax, dword [ebp - 0x28]
je 0x10034158
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xc8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov esi, dword [ebp - 0x24]
push 0
call fcn.1001898f
xor ecx, ecx
push 2
mov dword [eax], esi
mov eax, dword [ebp - 0x38]
cmp eax, esi
setge cl
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xc8]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
call fcn.1001898f
push 3
pop edx
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x34], esi
je 0x100341eb
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setle dl
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x100341e2
cmp dword [ebp - 0x54], eax
je 0x100341e4
mov eax, edi
inc eax
je 0x100341eb
mov edx, edi
jmp 0x100341ed
xor edx, edx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setle cl
imul eax, ecx, 0x8674
test eax, eax
je 0x1003420a
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x10034213
jmp 0x1003420c
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x28], eax
je 0x10034215
mov edx, edi
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
add ecx, dword [ebp - 0x40]
imul ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x24]
jne 0x10034234
cmp dword [ebp - 0x34], eax
jne 0x10034234
mov edi, eax
mov esi, dword [ebp - 0x38]
lea ecx, [ebp - 0xc8]
push eax
call fcn.1001898f
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x2c]
imul eax, edi
sub esi, eax
mov eax, dword [ebp - 0x40]
cmp esi, eax
setg cl
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
setge al
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x10034284
push 2
lea ecx, [ebp - 0xc8]
call fcn.1001898f
xor edi, edi
cmp dword [eax], edi
jne 0x10034284
xor esi, esi
xor ecx, ecx
inc esi
jmp 0x10034289
xor esi, esi
inc esi
mov ecx, esi
xor eax, eax
cmp ecx, 0xfffffffd
setle al
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setle cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x40]
sub ecx, eax
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x40], ecx
jne 0x100342c5
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x100342cc
jmp 0x100342c7
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x100342d1
cmp dword [ebp - 0x1c], eax
je 0x100342d3
mov eax, esi
mov dword [ebp - 0x20], eax
jmp 0x10034313
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x78fb111d
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10034313
push eax
push 0x1abb
push eax
push eax
push 0x1578
push 0x2425
push 0x1c8b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
or edi, 0xffffffff
lea ecx, [ebp - 0xc8]
mov dword [ebp - 4], edi
call fcn.10018973
movdqa xmm0, xmmword [0x10007c70]
lea eax, [ebp - 0xf68]
push eax
lea eax, [ebp - 0xf78]
push eax
lea ecx, [ebp - 0x1110]
movdqu xmmword [ebp - 0xf78], xmm0
call fcn.1001899e
lea ecx, [ebp - 0x259]
mov esi, eax
call fcn.10008d28
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xac]
push dword [esi]
call fcn.1001894d
mov dword [ebp - 4], 6
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x40], 0x2b08f18e
mov dword [ebp - 0x50], 0x7d4e8587
push 0
mov dword [ebp - 0x2c], 0x2eb57571
call fcn.1001898f
xor edi, edi
cmp dword [eax], edi
jne 0x1003443a
xor eax, eax
lea ecx, [ebp - 0xac]
inc eax
push eax
call fcn.1001898f
mov eax, dword [eax]
add eax, 0x3cc9
je 0x100343c5
push edi
lea ecx, [ebp - 0xac]
call fcn.1001898f
push 0
lea ecx, [ebp - 0xac]
call fcn.1001898f
push 2
lea ecx, [ebp - 0xac]
call fcn.1001898f
push 0
lea ecx, [ebp - 0xac]
call fcn.1001898f
push 0
lea ecx, [ebp - 0xac]
call fcn.1001898f
push 0
lea ecx, [ebp - 0xac]
call fcn.1001898f
xor edi, edi
cmp dword [eax], edi
je 0x1003440f
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xac]
push 3
pop edi
push edi
call fcn.1001898f
push 0
lea ecx, [ebp - 0xac]
mov esi, eax
call fcn.1001898f
mov ecx, dword [eax]
cmp ecx, dword [esi]
je 0x1003443d
xor ecx, ecx
jmp 0x10034442
push 3
pop edi
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x28]
sub ecx, eax
je 0x10034715
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], 0xb70f7348
mov dword [ebp - 0x2c], 0xfffffff8
cmp dword [ebp - 0x28], eax
je 0x10034542
push 8
mov dword [ebp - 0x2c], 0x97a0b891
lea ecx, [ebp - 0xac]
pop eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
push 0
call fcn.1001898f
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xac]
push 0
call fcn.1001898f
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x100344cc
push eax
lea ecx, [ebp - 0xac]
call fcn.1001898f
xor edi, edi
cmp dword [eax], edi
je 0x100344ca
xor ebx, ebx
inc ebx
xor eax, eax
mov ecx, ebx
jmp 0x100344d1
xor eax, eax
xor ebx, ebx
mov ecx, eax
inc ebx
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0xac]
push eax
call fcn.1001898f
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0xac]
mov esi, dword [ebp - 0x50]
push ebx
sub edx, dword [eax]
mov eax, dword [ebp - 0x2c]
imul esi, edx
add esi, eax
call fcn.1001898f
mov dword [eax], esi
cmp esi, 0x7b12
jne 0x10034510
cmp dword [ebp - 0x28], 0
je 0x10034510
mov ecx, ebx
jmp 0x10034512
xor ecx, ecx
mov eax, dword [ebp - 0x28]
imul eax, ecx
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10034753
push eax
push eax
push 0x2d2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x10034753
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xbaae
mov dword [ebp - 0x50], 0xfffffff9
mov dword [ebp - 0x54], 0x4004
mov dword [ebp - 0x1c], 0x16a80d17
mov dword [ebp - 0x20], 0x5b8c0b7b
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x28]
je 0x10034584
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10034584
xor ebx, ebx
mov ecx, eax
inc ebx
jmp 0x10034589
xor ebx, ebx
inc ebx
mov ecx, ebx
xor eax, eax
cmp ecx, 0x9d2a
setg al
add eax, dword [ebp - 0x28]
je 0x1003459c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xac]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov esi, dword [ebp - 0x24]
push 0
call fcn.1001898f
xor ecx, ecx
push 2
mov dword [eax], esi
mov eax, dword [ebp - 0x38]
cmp eax, esi
setge cl
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xac]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
call fcn.1001898f
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x34], esi
je 0x1003462c
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setle dl
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10034623
cmp dword [ebp - 0x54], eax
je 0x10034625
mov eax, ebx
inc eax
je 0x1003462c
mov edx, ebx
jmp 0x1003462e
xor edx, edx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setle cl
imul eax, ecx, 0x8674
test eax, eax
je 0x1003464b
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x10034654
jmp 0x1003464d
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x28], eax
je 0x10034656
mov edx, ebx
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
add ecx, dword [ebp - 0x40]
imul ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x24]
jne 0x10034675
mov edi, eax
cmp dword [ebp - 0x34], eax
je 0x10034677
mov edi, ebx
mov esi, dword [ebp - 0x38]
lea ecx, [ebp - 0xac]
push eax
call fcn.1001898f
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x2c]
imul eax, edi
sub esi, eax
mov eax, dword [ebp - 0x40]
cmp esi, eax
setg cl
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
setge al
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x100346c4
push 2
lea ecx, [ebp - 0xac]
call fcn.1001898f
xor edi, edi
cmp dword [eax], edi
jne 0x100346c4
xor ecx, ecx
jmp 0x100346c6
mov ecx, ebx
xor eax, eax
cmp ecx, 0xfffffffd
setle al
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setle cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x40]
sub ecx, eax
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x40], ecx
jne 0x10034702
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10034709
jmp 0x10034704
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1003470e
cmp dword [ebp - 0x1c], eax
je 0x10034710
mov eax, ebx
mov dword [ebp - 0x20], eax
jmp 0x10034753
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x78fb111d
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10034750
push eax
push 0x1abb
push eax
push eax
push 0x1578
push 0x2425
push 0x1c8b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor ebx, ebx
inc ebx
or edi, 0xffffffff
lea ecx, [ebp - 0xac]
mov dword [ebp - 4], edi
call fcn.10018973
push 7
pop eax
push 3
pop esi
mov dword [ebp - 0x30], 0x4182bd7b
lea ecx, [ebp - 0x5fc]
mov dword [ebp - 0x24], eax
push 4
pop eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x40], 0xf321248c
push eax
call fcn.100188f1
push 7
pop eax
mov dword [ebp - 4], eax
xor eax, eax
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x100347bf
push ecx
pop esi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x5fc]
call fcn.1001898f
mov dword [eax], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100347a2
push 3
xor eax, eax
pop esi
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
je 0x10034841
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, ebx
setl cl
xor ebx, ebx
sub ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setle bl
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x30]
jne 0x10034810
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
neg ecx
push 4
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xb2d3
pop ecx
setg al
sub eax, 0xffff
cmp eax, ecx
je 0x10034836
cmp dword [ebp - 0x30], 0
je 0x1003483f
xor ebx, ebx
inc ebx
xor eax, eax
mov ecx, ebx
jmp 0x10034846
xor eax, eax
xor ebx, ebx
mov ecx, eax
inc ebx
cmp ecx, dword [ebp - 0x18]
jle 0x100348fd
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 0xa323
mov dword [ebp - 0x20], 0x2ff7a2d4
mov dword [ebp - 0x4c], 0x41ac
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x30]
neg edx
push 7
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x50]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x13251f81
pop ecx
setle al
imul eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x30]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x4c], 0x3c09
jne 0x100348d0
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x5fc]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
push esi
call fcn.1001898f
xor ecx, ecx
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, 0xfffffff6
setge cl
mov dword [ebp - 0x54], ecx
jmp 0x100349a7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jle 0x100349a7
push 4
pop edi
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x5fc]
push esi
call fcn.1001898f
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], 0x15
jmp 0x10034991
mov dword [ebp - 0x4c], 0x9eed
mov dword [ebp - 0x40], 0
jmp 0x10034950
push dword [ebp - 0x40]
lea ecx, [ebp - 0x5fc]
call fcn.1001898f
mov dword [eax], 0x99626dac
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edi
jl 0x10034939
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x40], 0
jl 0x1003498e
push dword [ebp - 0x40]
lea ecx, [ebp - 0x5fc]
call fcn.1001898f
push dword [ebp - 0x40]
lea ecx, [ebp - 0x5fc]
mov esi, eax
call fcn.1001898f
mov ecx, dword [eax]
mov dword [esi], ecx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x4c]
dec dword [ebp - 0x40]
jns 0x1003495e
push 3
pop esi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x39
jl 0x10034929
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0
jg 0x1003490c
or edi, 0xffffffff
lea ecx, [ebp - 0x5fc]
mov dword [ebp - 4], edi
call fcn.10018973
movdqa xmm0, xmmword [0x10007c70]
lea eax, [ebp - 0xee8]
push eax
lea eax, [ebp - 0xef8]
push eax
lea ecx, [ebp - 0x1120]
movdqu xmmword [ebp - 0xef8], xmm0
call fcn.1001899e
lea ecx, [ebp - 0x1d9]
mov esi, eax
call fcn.10008d28
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xbc]
push dword [esi]
call fcn.1001894d
push 8
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x40], 0x2b08f18e
mov dword [ebp - 0x50], 0x7d4e8587
push 0
mov dword [ebp - 0x2c], 0x2eb57571
call fcn.1001898f
xor edi, edi
cmp dword [eax], edi
jne 0x10034ac7
push ebx
lea ecx, [ebp - 0xbc]
call fcn.1001898f
mov eax, dword [eax]
add eax, 0x3cc9
je 0x10034a52
push edi
lea ecx, [ebp - 0xbc]
call fcn.1001898f
push 0
lea ecx, [ebp - 0xbc]
call fcn.1001898f
push 2
lea ecx, [ebp - 0xbc]
call fcn.1001898f
push 0
lea ecx, [ebp - 0xbc]
call fcn.1001898f
push 0
lea ecx, [ebp - 0xbc]
call fcn.1001898f
push 0
lea ecx, [ebp - 0xbc]
call fcn.1001898f
xor edi, edi
cmp dword [eax], edi
je 0x10034a9c
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xbc]
push 3
pop edi
push edi
call fcn.1001898f
push 0
lea ecx, [ebp - 0xbc]
mov esi, eax
call fcn.1001898f
mov ecx, dword [eax]
cmp ecx, dword [esi]
je 0x10034aca
xor ecx, ecx
jmp 0x10034acc
push 3
pop edi
mov ecx, ebx
mov eax, dword [ebp - 0x28]
sub ecx, eax
je 0x10034d91
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], 0xb70f7348
mov dword [ebp - 0x2c], 0xfffffff8
cmp dword [ebp - 0x28], eax
je 0x10034bc6
push 8
mov dword [ebp - 0x2c], 0x97a0b891
lea ecx, [ebp - 0xbc]
pop eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
push 0
call fcn.1001898f
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xbc]
push 0
call fcn.1001898f
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10034b53
push eax
lea ecx, [ebp - 0xbc]
call fcn.1001898f
xor edi, edi
cmp dword [eax], edi
je 0x10034b51
mov ecx, ebx
xor eax, eax
jmp 0x10034b55
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0xbc]
push eax
call fcn.1001898f
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0xbc]
mov esi, dword [ebp - 0x50]
push ebx
sub edx, dword [eax]
mov eax, dword [ebp - 0x2c]
imul esi, edx
add esi, eax
call fcn.1001898f
mov dword [eax], esi
cmp esi, 0x7b12
jne 0x10034b94
cmp dword [ebp - 0x28], 0
je 0x10034b94
mov ecx, ebx
jmp 0x10034b96
xor ecx, ecx
mov eax, dword [ebp - 0x28]
imul eax, ecx
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10034dd0
push eax
push eax
push 0x2d2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x10034dd0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xbaae
mov dword [ebp - 0x50], 0xfffffff9
mov dword [ebp - 0x54], 0x4004
mov dword [ebp - 0x1c], 0x16a80d17
mov dword [ebp - 0x20], 0x5b8c0b7b
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x28]
je 0x10034c03
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x10034c05
mov ecx, ebx
xor eax, eax
cmp ecx, 0x9d2a
setg al
add eax, dword [ebp - 0x28]
je 0x10034c18
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xbc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov esi, dword [ebp - 0x24]
push 0
call fcn.1001898f
xor ecx, ecx
push 2
mov dword [eax], esi
mov eax, dword [ebp - 0x38]
cmp eax, esi
setge cl
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xbc]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
call fcn.1001898f
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x34], esi
je 0x10034ca8
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setle dl
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10034c9f
cmp dword [ebp - 0x54], eax
je 0x10034ca1
mov eax, ebx
inc eax
je 0x10034ca8
mov edx, ebx
jmp 0x10034caa
xor edx, edx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setle cl
imul eax, ecx, 0x8674
test eax, eax
je 0x10034cc7
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x10034cd0
jmp 0x10034cc9
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x28], eax
je 0x10034cd2
mov edx, ebx
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
add ecx, dword [ebp - 0x40]
imul ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x24]
jne 0x10034cf1
mov edi, eax
cmp dword [ebp - 0x34], eax
je 0x10034cf3
mov edi, ebx
mov esi, dword [ebp - 0x38]
lea ecx, [ebp - 0xbc]
push eax
call fcn.1001898f
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x2c]
imul eax, edi
sub esi, eax
mov eax, dword [ebp - 0x40]
cmp esi, eax
setg cl
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
setge al
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x10034d40
push 2
lea ecx, [ebp - 0xbc]
call fcn.1001898f
xor edi, edi
cmp dword [eax], edi
jne 0x10034d40
xor ecx, ecx
jmp 0x10034d42
mov ecx, ebx
xor eax, eax
cmp ecx, 0xfffffffd
setle al
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setle cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x40]
sub ecx, eax
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x40], ecx
jne 0x10034d7e
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10034d85
jmp 0x10034d80
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10034d8a
cmp dword [ebp - 0x1c], eax
je 0x10034d8c
mov eax, ebx
mov dword [ebp - 0x20], eax
jmp 0x10034dd0
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x78fb111d
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10034dd0
push eax
push 0x1abb
push eax
push eax
push 0x1578
push 0x2425
push 0x1c8b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
or edi, 0xffffffff
lea ecx, [ebp - 0xbc]
mov dword [ebp - 4], edi
call fcn.10018973
push 7
pop eax
push 3
pop esi
mov dword [ebp - 0x30], 0x4182bd7b
lea ecx, [ebp - 0x554]
mov dword [ebp - 0x24], eax
push 4
pop eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x40], 0xf321248c
push eax
call fcn.100188f1
xor eax, eax
mov dword [ebp - 4], 9
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10034e3d
push ecx
pop esi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x554]
call fcn.1001898f
mov dword [eax], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10034e20
push 3
xor eax, eax
pop esi
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
je 0x10034ec2
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, ebx
setl cl
xor ebx, ebx
sub ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setle bl
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x30]
jne 0x10034e8e
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
neg ecx
push 4
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xb2d3
pop ecx
setg al
sub eax, 0xffff
cmp eax, ecx
je 0x10034eb4
cmp dword [ebp - 0x30], 0
je 0x10034ebd
xor ebx, ebx
inc ebx
xor eax, eax
mov ecx, ebx
jmp 0x10034ec4
xor ebx, ebx
xor eax, eax
inc ebx
mov ecx, eax
cmp ecx, dword [ebp - 0x18]
jle 0x10034f7b
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 0xa323
mov dword [ebp - 0x20], 0x2ff7a2d4
mov dword [ebp - 0x4c], 0x41ac
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x30]
neg edx
push 7
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x50]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x13251f81
pop ecx
setle al
imul eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x30]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x4c], 0x3c09
jne 0x10034f4e
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x554]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
push esi
call fcn.1001898f
xor ecx, ecx
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, 0xfffffff6
setge cl
mov dword [ebp - 0x54], ecx
jmp 0x10035025
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jle 0x10035025
push 4
pop edi
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x554]
push esi
call fcn.1001898f
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], 0x15
jmp 0x1003500f
mov dword [ebp - 0x4c], 0x9eed
mov dword [ebp - 0x40], 0
jmp 0x10034fce
push dword [ebp - 0x40]
lea ecx, [ebp - 0x554]
call fcn.1001898f
mov dword [eax], 0x99626dac
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edi
jl 0x10034fb7
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x40], 0
jl 0x1003500c
push dword [ebp - 0x40]
lea ecx, [ebp - 0x554]
call fcn.1001898f
push dword [ebp - 0x40]
lea ecx, [ebp - 0x554]
mov esi, eax
call fcn.1001898f
mov ecx, dword [eax]
mov dword [esi], ecx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x4c]
dec dword [ebp - 0x40]
jns 0x10034fdc
push 3
pop esi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x39
jl 0x10034fa7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0
jg 0x10034f8a
or edi, 0xffffffff
lea ecx, [ebp - 0x554]
mov dword [ebp - 4], edi
call fcn.10018973
push ebx
lea ecx, [ebp - 0x2b4]
call fcn.100188f1
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10035071
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2b4]
call fcn.1001898f
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10035053
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x100351f6
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2b4]
call fcn.1001898f
xor edi, edi
cmp dword [eax], edi
jne 0x100350c3
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2b4]
call fcn.1001898f
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2b4]
call fcn.1001898f
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2b4]
call fcn.1001898f
cmp dword [eax], ebx
jl 0x100350c3
xor esi, esi
jmp 0x100350c5
mov esi, ebx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2b4]
call fcn.1001898f
mov eax, dword [eax]
add eax, esi
je 0x100350e7
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2b4]
call fcn.1001898f
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2b4]
call fcn.1001898f
push 0xfffffffffffffffa
pop ecx
push dword [ebp - 0x28]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x2b4]
sbb esi, esi
inc esi
call fcn.1001898f
cmp esi, dword [eax]
jl 0x100351c9
push 3
mov dword [ebp - 0x24], 0xf906d8bc
mov dword [ebp - 0x1c], edi
pop esi
jmp 0x10035133
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x690], 5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10035122
mov dword [ebp - 0x688], edi
cmp dword [ebp - 0x688], edi
jl 0x1003516f
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x10035167
push 0x5b4
push 0x125d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
dec dword [ebp - 0x688]
jns 0x10035146
push 2
mov dword [ebp - 0x24], edi
pop edi
jmp 0x100351c2
mov dword [ebp - 0x14], 0x1dbdae4f
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x688]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x690], ecx
xor eax, eax
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], eax
jl 0x100351bf
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100351ba
push 0xb37
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1003519c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x10035177
jmp 0x100351e6
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x100351e3
push 0x1ef5
push 0x15da
call dword [sym.imp.USER32.dll_SetCaretPos]
push 3
pop esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0
jle 0x1003507d
or edi, 0xffffffff
lea ecx, [ebp - 0x2b4]
mov dword [ebp - 4], edi
call fcn.10018973
push 7
pop eax
mov dword [ebp - 0x30], 0x4182bd7b
lea ecx, [ebp - 0x59c]
mov dword [ebp - 0x24], eax
push 4
pop eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x40], 0xf321248c
push eax
call fcn.100188f1
xor eax, eax
mov dword [ebp - 4], 0xb
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1003525d
push ecx
pop esi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x59c]
call fcn.1001898f
mov dword [eax], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10035240
push 3
xor eax, eax
pop esi
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
je 0x100352e2
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, ebx
setl cl
xor ebx, ebx
sub ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setle bl
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x30]
jne 0x100352ae
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
neg ecx
push 4
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xb2d3
pop ecx
setg al
sub eax, 0xffff
cmp eax, ecx
je 0x100352d4
cmp dword [ebp - 0x30], 0
je 0x100352dd
xor ebx, ebx
inc ebx
xor eax, eax
mov ecx, ebx
jmp 0x100352e4
xor ebx, ebx
xor eax, eax
inc ebx
mov ecx, eax
cmp ecx, dword [ebp - 0x18]
jle 0x1003539b
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 0xa323
mov dword [ebp - 0x20], 0x2ff7a2d4
mov dword [ebp - 0x4c], 0x41ac
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x30]
neg edx
push 7
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x50]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x13251f81
pop ecx
setle al
imul eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x30]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x4c], 0x3c09
jne 0x1003536e
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x59c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
push esi
call fcn.1001898f
xor ecx, ecx
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, 0xfffffff6
setge cl
mov dword [ebp - 0x54], ecx
jmp 0x10035445
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jle 0x10035445
push 4
pop edi
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x59c]
push esi
call fcn.1001898f
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], 0x15
jmp 0x1003542f
mov dword [ebp - 0x4c], 0x9eed
mov dword [ebp - 0x40], 0
jmp 0x100353ee
push dword [ebp - 0x40]
lea ecx, [ebp - 0x59c]
call fcn.1001898f
mov dword [eax], 0x99626dac
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edi
jl 0x100353d7
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x40], 0
jl 0x1003542c
push dword [ebp - 0x40]
lea ecx, [ebp - 0x59c]
call fcn.1001898f
push dword [ebp - 0x40]
lea ecx, [ebp - 0x59c]
mov esi, eax
call fcn.1001898f
mov ecx, dword [eax]
mov dword [esi], ecx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x4c]
dec dword [ebp - 0x40]
jns 0x100353fc
push 3
pop esi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x39
jl 0x100353c7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0
jg 0x100353aa
or edi, 0xffffffff
lea ecx, [ebp - 0x59c]
mov dword [ebp - 4], edi
call fcn.10018973
push 2
lea ecx, [ebp - 0x414]
call fcn.100188f1
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x3c], 0x8c66f5a9
mov dword [ebp - 0x1c], 0
jmp 0x10035488
push dword [ebp - 0x1c]
call fcn.1001898f
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
lea ecx, [ebp - 0x414]
jl 0x10035477
push 0
call fcn.1001898f
xor edi, edi
mov dword [eax], edi
jmp 0x100354da
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100354cc
push eax
push 0xd92
push 0x975
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
xor eax, eax
push eax
lea ecx, [ebp - 0x414]
call fcn.1001898f
dec dword [eax]
push 0
lea ecx, [ebp - 0x414]
call fcn.1001898f
cmp dword [eax], 0xfffffff7
jge 0x100354a1
push 0
lea ecx, [ebp - 0x414]
call fcn.1001898f
push ebx
lea ecx, [ebp - 0x414]
mov esi, eax
call fcn.1001898f
mov ecx, dword [esi]
or edi, 0xffffffff
mov dword [ebp - 4], edi
mov dword [eax], ecx
lea ecx, [ebp - 0x414]
call fcn.10018973
mov dword [ebp - 0x24], 0x9e57ad95
xor eax, eax
mov dword [ebp - 0x20], 0x66bafcb1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003554c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6e0], 0xc204e2db
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10035534
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035575
push 0xdfd
push 0x3f5
push 0x136e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x100355a3
mov eax, dword [ebp - 0x24]
xor edi, edi
cmp dword [ebp + eax*4 - 0x6e0], edi
je 0x10035594
cmp dword [ebp - 0x24], edi
je 0x10035594
mov eax, ebx
jmp 0x10035596
xor eax, eax
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x24]
jns 0x1003557d
xor eax, eax
or edi, 0xffffffff
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100355b8
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100355c8
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
movdqa xmm0, xmmword [0x10007c70]
lea eax, [ebp - 0xfe8]
push eax
lea eax, [ebp - 0xff8]
push eax
lea ecx, [ebp - 0x1168]
movdqu xmmword [ebp - 0xff8], xmm0
call fcn.1001899e
lea ecx, [ebp - 0x28a]
mov esi, eax
call fcn.10008d28
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xd4]
push dword [esi]
call fcn.1001894d
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0x4c0]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x34], 0x2b08f18e
push 2
call fcn.100188f1
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x3c], 0x8c66f5a9
mov dword [ebp - 0x1c], 0
jmp 0x10035652
push dword [ebp - 0x1c]
call fcn.1001898f
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
lea ecx, [ebp - 0x4c0]
jl 0x10035641
push 0
call fcn.1001898f
xor edi, edi
mov dword [eax], edi
jmp 0x100356a4
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10035696
push eax
push 0xd92
push 0x975
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
xor eax, eax
push eax
lea ecx, [ebp - 0x4c0]
call fcn.1001898f
dec dword [eax]
push 0
lea ecx, [ebp - 0x4c0]
call fcn.1001898f
cmp dword [eax], 0xfffffff7
jge 0x1003566b
push 0
lea ecx, [ebp - 0x4c0]
call fcn.1001898f
push ebx
lea ecx, [ebp - 0x4c0]
mov esi, eax
call fcn.1001898f
mov ecx, dword [esi]
mov byte [ebp - 4], 0xd
mov dword [eax], ecx
lea ecx, [ebp - 0x4c0]
call fcn.10018973
mov dword [ebp - 0x4c], 0x7d4e8587
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x1c], 0x18
jmp 0x10035718
mov dword [ebp - 0x20], 0xb72f
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10035712
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x20]
dec dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], ebx
jle 0x100356fb
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10035742
push 0x180f
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
mov dword [ebp - 0x2c], 0x2eb57571
mov dword [ebp - 0x40], 0xc4d8e5c
mov dword [ebp - 0x34], 0xfffffff8
push 3
mov dword [ebp - 0x38], 0xa7b09f59
pop esi
mov dword [ebp - 0x2c], 0x1afc
push ebx
cmp dword [ebp - 0x40], esi
jle 0x10035880
lea ecx, [ebp - 0x5e4]
call fcn.100188f1
push 4
pop esi
push esi
lea ecx, [ebp - 0x960]
mov byte [ebp - 4], 0xf
call fcn.100188f1
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x28], 0
jmp 0x100357b4
push dword [ebp - 0x28]
lea ecx, [ebp - 0x5e4]
call fcn.1001898f
mov dword [eax], 0xffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1003579d
mov dword [ebp - 0x28], 0
jmp 0x100357d9
push dword [ebp - 0x28]
lea ecx, [ebp - 0x960]
call fcn.1001898f
mov dword [eax], 0xa278c007
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x100357c2
push 0
lea ecx, [ebp - 0x5e4]
call fcn.1001898f
push 0
lea ecx, [ebp - 0x5e4]
call fcn.1001898f
push 0
lea ecx, [ebp - 0x960]
call fcn.1001898f
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x5e4]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
push 0
call fcn.1001898f
xor ecx, ecx
xor edi, edi
push edi
cmp dword [eax], edi
sete cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x5e4]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
call fcn.1001898f
push edi
lea ecx, [ebp - 0x5e4]
call fcn.1001898f
push 2
lea ecx, [ebp - 0x960]
call fcn.1001898f
mov ecx, dword [ebp - 0x34]
mov edx, 0x4f402e31
sub edx, ecx
lea ecx, [ebp - 0x960]
mov dword [eax], edx
call fcn.10018973
lea ecx, [ebp - 0x5e4]
mov byte [ebp - 4], 0xd
call fcn.10018973
jmp 0x100359cf
or eax, 0xffffffff
lea ecx, [ebp - 0xb08]
mov dword [ebp - 0x24], eax
call fcn.100188f1
mov byte [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x20], 0xa629
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100358c2
xor edi, edi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xb08]
call fcn.1001898f
mov dword [eax], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100358a8
xor eax, eax
mov dword [ebp - 0x34], 0xfffffff9
cmp dword [ebp - 0x34], 0xfffffffd
jle 0x1003595c
jmp 0x100358d7
xor eax, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x50], 0xcb085bb3
cmp dword [ebp - 0x1c], eax
jne 0x100358ed
mov ecx, eax
cmp dword [ebp - 0x24], eax
je 0x100358ef
mov ecx, ebx
cmp ecx, dword [ebp - 0x40]
jle 0x100358fb
mov ecx, eax
cmp dword [ebp - 0x40], eax
je 0x100358fd
mov ecx, ebx
mov eax, dword [ebp - 0x40]
xor edx, edx
sub eax, ecx
imul eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
imul eax, eax, 7
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], eax
jl 0x1003594f
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003594a
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor eax, eax
dec dword [ebp - 0x38]
jns 0x10035936
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffffd
jg 0x100358d5
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1003597f
cmp dword [ebp - 0x38], eax
jle 0x1003596d
cmp dword [ebp - 0x2c], eax
je 0x10035970
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x40]
test eax, eax
jne 0x1003597f
xor edi, edi
jmp 0x10035981
mov edi, ebx
mov esi, dword [ebp - 0x34]
lea ecx, [ebp - 0xb08]
push 0
call fcn.1001898f
xor edx, edx
lea ecx, [edi + esi]
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setg dl
xor ebx, ebx
cmp edx, 6
setne bl
sub ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setle cl
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0xb08]
mov byte [ebp - 4], 0xd
call fcn.10018973
xor ebx, ebx
inc ebx
lea eax, [ebp - 0xf08]
mov dword [ebp - 0x38], 0x42c70bb7
push eax
lea eax, [ebp - 0xf18]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x1178]
movdqu xmmword [ebp - 0xf18], xmm0
call fcn.1001899e
lea ecx, [ebp - 0x1e9]
mov esi, eax
call fcn.10008d28
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xd0c]
push dword [esi]
call fcn.1001894d
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x14], 0xcb441791
mov dword [ebp - 0x2c], 0xdc6d0f06
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], eax
push 3
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jge 0x10035a54
push 8
pop ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x42c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10035a40
xor eax, eax
mov dword [ebp - 0x38], 2
cmp dword [ebp - 0x38], eax
jl 0x10035a6f
mov dword [ebp - 0x50], 0x55e00fe1
inc dword [ebp - 0x50]
dec dword [ebp - 0x38]
jns 0x10035a60
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff7
jae 0x10035ad7
mov eax, dword [ebp - 0x428]
lea ecx, [ebp - 0xd0c]
mov dword [ebp - 0x38], eax
mov esi, dword [ebp - 0x424]
push 2
call fcn.1001898f
xor edx, edx
push 3
mov dword [eax], esi
or eax, 0xffffffff
cmp esi, eax
mov eax, dword [ebp - 0x38]
pop esi
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp eax, 6
mov eax, dword [ebp - 0x42c]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x428]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, 0x7279
setl cl
neg ecx
mov dword [ebp - 0x20], ecx
jne 0x10035af1
mov eax, dword [ebp - 0x424]
mov eax, dword [ebp - 0x42c]
lea ecx, [ebp - 0xd0c]
mov eax, dword [ebp - 0x428]
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 0xd
call fcn.10018973
push 0
lea ecx, [ebp - 0xd4]
call fcn.1001898f
xor edi, edi
cmp dword [eax], edi
jne 0x10035bbf
push ebx
lea ecx, [ebp - 0xd4]
call fcn.1001898f
mov eax, dword [eax]
add eax, 0x3cc9
je 0x10035b4d
push edi
lea ecx, [ebp - 0xd4]
call fcn.1001898f
push 0
lea ecx, [ebp - 0xd4]
call fcn.1001898f
push 2
lea ecx, [ebp - 0xd4]
call fcn.1001898f
push 0
lea ecx, [ebp - 0xd4]
call fcn.1001898f
push 0
lea ecx, [ebp - 0xd4]
call fcn.1001898f
push 0
lea ecx, [ebp - 0xd4]
call fcn.1001898f
xor edi, edi
cmp dword [eax], edi
je 0x10035b97
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xd4]
push esi
call fcn.1001898f
push 0
lea ecx, [ebp - 0xd4]
mov esi, eax
call fcn.1001898f
mov ecx, dword [eax]
cmp ecx, dword [esi]
je 0x10035bbf
xor ecx, ecx
jmp 0x10035bc1
mov ecx, ebx
mov eax, dword [ebp - 0x18]
sub ecx, eax
je 0x100372c8
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0xab39e224
push 4
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x10035bfb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x338], 0xc64a6847
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10035be3
xor eax, eax
push 3
pop esi
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x30], eax
jl 0x10035e1d
push 7
pop eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x35ff5744
mov dword [ebp - 0x2c], 0x9cbadbef
mov dword [ebp - 0x50], 0xdc28bf2f
mov dword [ebp - 0x50], 0x6f6066fa
mov dword [ebp - 0x20], 0x89736453
mov eax, dword [ebp - 0x30]
push 0xfffffffffffffff7
pop ecx
mov eax, dword [ebp + eax*4 - 0x338]
sub ecx, eax
je 0x10035c9e
mov eax, dword [ebp - 0x32c]
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x338], 0xdef9
jl 0x10035c61
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10035c63
mov eax, ebx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x334]
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x30]
imul eax, eax, 0x4348f2d8
cmp eax, dword [ebp - 0x32c]
jle 0x10035c91
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x338]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x338]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov ecx, ebx
mov eax, dword [ebp + eax*4 - 0x338]
mov eax, dword [ebp - 0x330]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x338]
mov dword [ebp - 0x24], 0x772679f1
mov dword [ebp - 0x54], 0xc7a8f60f
mov eax, dword [ebp - 0x14]
sub ecx, eax
je 0x10035d11
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
add eax, edx
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x10035e0c
mov dword [ebp - 0x24], eax
jmp 0x10035d02
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035cff
push eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10035ced
dec dword [ebp - 0x28]
jns 0x10035ce8
push ebx
lea ecx, [ebp - 0x8a0]
call fcn.100188f1
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], ebx
jge 0x10035d4b
or esi, 0xffffffff
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x8a0]
call fcn.1001898f
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10035d30
push 3
pop esi
push 0
lea ecx, [ebp - 0x8a0]
call fcn.1001898f
xor edi, edi
xor ebx, ebx
push 4
cmp dword [eax], edi
mov eax, dword [ebp - 0x14]
setne bl
xor ecx, ecx
or edx, 0xffffffff
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, 0x4d18
pop ecx
setge al
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
neg eax
push edi
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x338]
cmp edx, eax
setl cl
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x8a0]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x2c], 0xfffffff6
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
call fcn.1001898f
mov eax, dword [ebp - 0x334]
xor edx, edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
inc edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x338]
cmp eax, edx
setg cl
xor eax, eax
cmp ebx, ecx
lea ecx, [ebp - 0x8a0]
setg al
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0xd
call fcn.10018973
xor ebx, ebx
inc ebx
push 4
pop edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x30]
jns 0x10035c0a
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10035e44
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035e41
push ebx
push eax
push 0x7fd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
xor eax, eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff8
jg 0x10035e22
mov dword [ebp - 0x30], eax
or edi, 0xffffffff
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10035e75
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x508], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10035e61
xor eax, eax
mov dword [ebp - 0x24], 0xffffffef
jmp 0x100360b3
mov dword [ebp - 0x28], 0xd97a888a
mov ecx, 0x7220b739
mov dword [ebp - 0x34], 0xcd5fec46
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x820], ecx
mov dword [ebp - 0x81c], ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jg 0x1003604e
cmp dword [ebp - 0x24], 0xd
jne 0x10035e81
mov dword [ebp - 0x40], 0xb70f7348
mov dword [ebp - 0x24], 0x9e57ad95
mov dword [ebp - 0x20], 0x66bafcb1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100360f2
mov dword [ebp - 0x28], 0xbe39e3cf
xor edx, edx
mov dword [ebp - 0x2c], 0xdc6d0f06
mov dword [ebp - 0x40], 0x7ab6
mov dword [ebp - 0x1c], ebx
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xab7a3ebe
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], 0xf60
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp edx, eax
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
jne 0x10037335
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x40], 0x3de3
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x28], 0x9462
je 0x10037386
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov edx, dword [ebp - 0x40]
sub edx, eax
mov eax, dword [ebp - 0x18]
cmp edx, eax
setne cl
cmp ecx, 0xfffffffe
mov ecx, 0xfff8
sbb eax, eax
neg eax
cmp ecx, eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x2c]
jne 0x10037382
cmp dword [ebp - 0x2c], eax
je 0x10037386
mov eax, ebx
jmp 0x10037388
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x100373bf
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x1003750a
push 0x34f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
jmp 0x1003750a
push 2
lea ecx, [ebp - 0x444]
call fcn.100188f1
xor eax, eax
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x100373f8
xor edi, edi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x444]
call fcn.1001898f
mov dword [eax], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100373dd
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x100374fb
push 7
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x58], eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10037426
push eax
call dword [sym.imp.COMDLG32.dll_FindTextW]
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jg 0x100374f2
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x444]
push ebx
call fcn.1001898f
mov eax, dword [eax]
neg eax
je 0x10037477
push 4
pop eax
cmp dword [ebp - 0x14], eax
je 0x10037452
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x444]
call fcn.1001898f
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x444]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x18]
call fcn.1001898f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x444]
call fcn.1001898f
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x444]
mov eax, dword [ebp - 0x14]
push 0
call fcn.1001898f
xor edi, edi
cmp dword [eax], edi
je 0x100374a1
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x444]
push dword [ebp - 0x18]
call fcn.1001898f
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x58], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100374e4
dec dword [ebp - 0x18]
jns 0x10037404
lea ecx, [ebp - 0x444]
mov byte [ebp - 4], 0xd
call fcn.10018973
push 3
pop edi
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x9cc]
mov dword [ebp - 0x1c], 0x8fc558ba
mov dword [ebp - 0x14], edi
push ebx
call fcn.100188f1
mov byte [ebp - 4], 0x22
or esi, 0xffffffff
mov dword [ebp - 0x44], 0x166c1932
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], 0
jmp 0x10037555
push dword [ebp - 0x24]
call fcn.1001898f
mov dword [eax], 0xdb959c4
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x9cc]
cmp dword [ebp - 0x24], ebx
jl 0x10037544
push 0
call fcn.1001898f
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x1c]
cmp eax, esi
setg cl
cmp ecx, 0x725d3672
jg 0x1003757e
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x9cc]
push 0
call fcn.1001898f
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, 0x23dd972c
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setg bl
xor ecx, ecx
cmp eax, 0xfffffffe
setge cl
xor eax, eax
add ebx, ecx
lea ecx, [ebp - 0x9cc]
add ebx, dword [ebp - 0x1c]
cmp ebx, 0x2e26
setge al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0xd
call fcn.10018973
movdqa xmm0, xmmword [0x10007c30]
lea eax, [ebp - 0xf88]
push eax
lea eax, [ebp - 0xf98]
mov dword [ebp - 0x44], 0x78fb111d
push eax
lea ecx, [ebp - 0x1198]
movdqu xmmword [ebp - 0xf98], xmm0
call fcn.1001899e
lea ecx, [ebp - 0x1f9]
mov esi, eax
call fcn.10008d28
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x798]
push dword [esi]
call fcn.1001894d
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x798]
mov dword [ebp - 0x3c], 0x37c04ccb
xor ebx, ebx
mov dword [ebp - 0x20], 0x1b88146c
inc ebx
mov dword [ebp - 0x3c], ebx
or esi, 0xffffffff
mov dword [ebp - 0x14], 0x49f4ffcf
mov dword [ebp - 0x3c], 0xb0d69b45
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x3c], 0x4bae914
mov dword [ebp - 0x3c], 0x497c3167
mov dword [ebp - 0x3c], esi
push 0
mov dword [ebp - 0x4c], 0xfffe
call fcn.1001898f
push 0
lea ecx, [ebp - 0x798]
mov dword [eax], 0x19
call fcn.1001898f
cmp dword [eax], 0xffffffec
jge 0x100378a2