Function at 0x10035ed4
Capabilities:
Accept command line arguments
Check os version
Delete registry value
Encrypt data using speck
Get file size
Identify system language via api

Disassembly:
mov eax, 0x1005ecde
call fcn.1005dc70
sub esp, 0x78c
push ebx
mov dword [ebp - 0x40], 8
xor ebx, ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
inc edi
mov byte [ebp - 0x58], dl
mov dword [ebp - 0x1c8], edi
mov dword [ebp - 0x1c4], edi
mov dword [ebp - 0x1c0], edi
mov dword [ebp - 0x1bc], edi
mov dword [ebp - 0x14], 0xa772304b
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x14], eax
push 3
mov dword [ebp - 0x14], ebx
pop esi
mov dword [ebp - 0x54], ecx
cmp dword [ebp - 0x14], esi
jg 0x10035f70
mov dword [ebp - 0x24], 0xfffffff9
xor edx, edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x1c8]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
neg edx
mov dword [ebp + eax*4 - 0x1c8], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c4], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10035f32
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x104], edi
mov dword [ebp - 0x100], edi
mov dword [ebp - 0xfc], edi
mov dword [ebp - 0xf8], edi
mov dword [ebp - 0x14], 0xa772304b
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], ebx
jmp 0x10035fe0
mov dword [ebp - 0x24], 0xfffffff9
xor edx, edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x104]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
neg edx
mov dword [ebp + eax*4 - 0x104], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x100], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10035fa7
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], ebx
jmp 0x1003600c
mov dword [ebp - 0x24], 0x57102d14
cmp dword [ebp - 0x24], ebx
jne 0x10036012
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], bl
je 0x10036009
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff6
jg 0x10035fed
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x40], 0xb15
cmp dword [ebp - 0x40], 0xbf3
jle 0x10036055
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x10606d98
cdq
push edx
push eax
call fcn.10011b50
inc edi
cmp edi, 0x467
jl 0x1003602d
inc esi
cmp esi, 0x1964
jl 0x1003602b
xor edi, edi
inc edi
mov dword [ebp - 0x1c], 0xf2c2
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x40], 0x81f
jge 0x10036077
mov edx, 0x1000ab94
mov ecx, 0x10606d98
call fcn.10014461
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x40], 0xffff
mov dword [ebp - 0x24], 0xc3ec3d4e
mov dword [ebp - 0x38], 0x6d8d3833
mov dword [ebp - 0x18], ebx
jmp 0x100360cb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2c8], 0x82d83d78
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100360ba
cmp dword [ebp - 0x1c], ebx
je 0x100360fc
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov esi, edi
cmp ecx, eax
setg dl
xor eax, eax
cmp esi, 0xfffffff6
mov dword [ebp - 0x2c8], edx
setl al
add eax, edx
cmp eax, dword [ebp - 0x24]
mov eax, edi
jle 0x100360fe
mov eax, ebx
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x56c]
mov dword [ebp - 0x2c8], edi
mov dword [ebp - 0x16c], edi
mov dword [ebp - 0x168], edi
mov dword [ebp - 0x164], edi
mov dword [ebp - 0x160], edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x24], 0x99740826
push 3
call fcn.10011d78
push 2
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x14], ebx
pop esi
jmp 0x10036156
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x74], 0xaa81
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10036148
push 3
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x10036176
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x56c]
mov dword [eax + ecx*4], 0xbb000e2e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10036163
mov eax, dword [ebp - 0x70]
xor edx, edx
mov eax, dword [ebp - 0x70]
cmp eax, 0xcd9d754
mov eax, dword [ebp - 0x74]
setg dl
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x74]
setge cl
add eax, ecx
je 0x100361a1
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
or edx, 0xffffffff
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0x70]
test eax, eax
je 0x100361f1
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x24], 0xbe92e3f9
mov dword [ebp - 0x24], 0x25739271
mov dword [ebp - 0x38], 0xfffffffa
dec dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
jmp 0x1003620e
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x1003620e
push ebx
push ebx
push ebx
push ebx
push 0x11db
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x10036221
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea ecx, [ebp - 0x56c]
call fcn.10011dfa
mov dword [ebp - 0x14], 0xa772304b
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x34], 0xf378
push edi
call fcn.10011d78
push esi
lea ecx, [ebp - 0x204]
mov dword [ebp - 4], esi
call fcn.10011d78
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], ebx
jmp 0x10036271
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x140]
mov dword [eax + ecx*4], 0x532bb11a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003625e
mov dword [ebp - 0x14], ebx
jmp 0x1003628e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x204]
mov dword [eax + ecx*4], 0x82bdb979
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003627b
mov ecx, edi
cmp dword [ebp - 0x34], ebx
jne 0x1003629c
mov ecx, ebx
mov eax, dword [ebp - 0x140]
mov dword [eax], ecx
test ecx, ecx
je 0x100363c3
mov dword [ebp - 0x1c], 0x5cc4
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x34], 0xe
cmp dword [ebp - 0x34], 9
jge 0x100363d0
mov dword [ebp - 0x38], 0x72ba
lea ecx, [ebp - 0x1d4]
mov dword [ebp - 0x24], 0x82c4475e
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x44], 0xfffffffd
push esi
call fcn.10011d78
mov dword [ebp - 0x18], ebx
jmp 0x1003630e
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1d4]
mov dword [eax + ecx*4], 0x3b16aac8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100362fb
mov eax, dword [ebp - 0x140]
cmp dword [eax], ebx
jne 0x10036379
mov eax, dword [ebp - 0x1d4]
mov ecx, edi
mov esi, dword [eax]
mov eax, dword [ebp - 0x40]
sub ecx, eax
add ecx, dword [ebp - 0x24]
xor eax, eax
cmp ecx, 0x52570e81
lea ecx, [esi - 1]
setg al
xor edx, edx
cmp eax, 0x64de
mov eax, dword [ebp - 0x1d4]
setge dl
cmp esi, edx
mov dword [eax], ecx
mov ecx, edi
mov eax, dword [ebp - 0x1c]
cmove ecx, ebx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x44]
test ecx, ecx
jne 0x10036379
mov ecx, ebx
cmp dword [ebp - 0x40], ebx
je 0x1003637b
mov ecx, edi
mov eax, dword [ebp - 0x140]
cmp ecx, dword [eax]
jne 0x1003638c
mov ecx, edi
cmp dword [ebp - 0x38], ebx
jne 0x1003638e
mov ecx, ebx
mov eax, dword [ebp - 0x204]
mov dword [eax], ecx
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x100363a6
push ebx
call dword [sym.imp.KERNEL32.dll_EncodePointer]
lea ecx, [ebp - 0x1d4]
call fcn.10011dfa
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 9
push 2
pop esi
jl 0x100362ce
jmp 0x100363d0
mov eax, dword [ebp - 0x204]
mov dword [eax + 4], 0xfffffffb
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x100363ec
push ebx
push ebx
push 0x2d5
push 0x1d9b
push ebx
call dword [sym.imp.USER32.dll_InsertMenuW]
lea ecx, [ebp - 0x204]
call fcn.10011dfa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call fcn.10011dfa
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x50], 0x717be9fb
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xfaeb382
mov dword [ebp - 0x44], 0x6e31bb00
mov dword [ebp - 0x34], 0x83de467b
push 4
call fcn.10011d78
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x40], 0x5e3aa9c1
mov dword [ebp - 0x3c], 0xcc74
mov dword [ebp - 0x40], 0x397b
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x30], 0x3bc5f263
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 4
jge 0x10036493
or edx, 0xffffffff
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x264]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1003647e
mov dword [ebp - 0x14], ebx
jmp 0x100364a9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x560], 0x861d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10036498
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
je 0x100364c9
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, edi
jmp 0x100364cb
mov eax, ebx
mov dword [ebp - 0x44], eax
xor edx, edx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
imul ecx, dword [ebp - 0x50], 6
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x34]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x264]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x50], eax
jle 0x10036532
mov eax, dword [ebp - 0x560]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x34], ebx
je 0x10036546
cmp dword [ebp - 0x44], ebx
je 0x10036546
mov edx, edi
cmp dword [ebp - 0x30], ebx
jne 0x10036548
mov edx, ebx
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, edx
mov eax, dword [ebp - 0x264]
setle cl
add ecx, dword [eax + 8]
xor eax, eax
cmp ecx, dword [esi + 0xc]
lea ecx, [ebp - 0x264]
setne al
mov dword [ebp - 0x44], eax
call fcn.10011dfa
mov dword [ebp - 0x14], ebx
jmp 0x100366ff
mov dword [ebp - 0x1c], 2
lea ecx, [ebp - 0x2f4]
mov dword [ebp - 0x24], 0x62a96950
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x40], 0x1fbf
push eax
call fcn.10011d78
push 3
mov dword [ebp - 0x24], 0x88a01932
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x100365c5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2f4]
mov dword [eax + ecx*4], 0x94bb489f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100365b2
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
mov edx, dword [ebp - 0x1c]
setg cl
sub edx, ecx
lea ecx, [ebp - 0x2f4]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2f4]
neg edx
sbb edx, edx
inc edx
mov dword [eax + 4], edx
call fcn.10011dfa
mov dword [ebp - 0x24], 0xfffffff9
lea ecx, [ebp - 0x21c]
push edi
call fcn.10011d78
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x24], 0xc0c7fd57
mov dword [ebp - 0x18], ebx
jmp 0x10036643
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x21c]
mov dword [eax + ecx*4], 0x6192
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10036630
mov dword [ebp - 0x50], ebx
jmp 0x1003666f
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x1003666c
push ebx
push 0x12bd
push 0x2ba
push 0x160f
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], ebx
jle 0x1003664d
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x21c]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x40]
add ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x21c]
add ecx, dword [eax]
cmp ecx, 0xfffffffc
jle 0x100366bd
mov eax, ebx
cmp dword [ebp - 0x34], ebx
je 0x100366bf
mov eax, edi
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x21c]
call fcn.10011dfa
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x16c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
neg edx
mov dword [ebp + eax*4 - 0x16c], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x168], eax
inc dword [ebp - 0x14]
push 3
pop eax
cmp dword [ebp - 0x14], eax
jle 0x1003657f
push 2
lea ecx, [ebp - 0x414]
call fcn.10011d78
mov dword [ebp - 0x34], 0x4cd4536
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x18], ebx
jmp 0x1003673e
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x414]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1003672b
mov dword [ebp - 0x34], ebx
jmp 0x10036771
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x1003675f
push ebx
push ebx
push 0x2597
call dword [sym.imp.ADVAPI32.dll_CopySid]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x414]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jle 0x10036749
lea ecx, [ebp - 0x414]
call fcn.10011dfa
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xfffffff6
jle 0x10036841
mov dword [ebp - 0x24], 0x57102d14
cmp dword [ebp - 0x24], ebx
jne 0x10036841
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x10036839
mov dword [ebp - 0x40], 0x68ad
cmp dword [ebp - 0x40], 0x69f3
jle 0x10036819
mov eax, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov esi, ebx
lea ecx, [esi + edi]
sar eax, cl
lea ecx, [ebp - 0x66c]
cdq
push edx
push eax
call fcn.1000d3ae
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100367e4
mov eax, dword [eax]
push eax
call fcn.100489bf
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x66c]
call fcn.100122f8
mov eax, dword [ebp - 0x1c]
inc esi
cmp esi, 0x435e
jl 0x100367c7
inc edi
cmp edi, 0x6994
jl 0x100367c5
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0xf92
jl 0x100367c3
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp - 0x40], 0x6751
jge 0x10036835
push 0x1000abd0
call fcn.100489bf
pop ecx
or dword [ebp - 4], 0xffffffff
dec dword [ebp - 0x18]
jmp 0x10036787
movdqa xmm0, xmmword [0x1000bf40]
lea ecx, [ebp - 0x590]
push ecx
lea eax, [ebp - 0x580]
push eax
push ecx
lea ecx, [ebp - 0x1b0]
movdqu xmmword [ebp - 0x590], xmm0
call fcn.10011dd4
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x1c], 0xfffffffd
push 3
mov dword [ebp - 0x24], 0x132d683a
mov dword [ebp - 0x18], ebx
pop ecx
jmp 0x10036899
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x624], 0x2668451f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10036888
mov dword [ebp - 0x34], ebx
jmp 0x100368b6
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1b0]
mov dword [eax + ecx*4], 0x4fda0e60
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x100368a3
mov ebx, dword [ebp - 0x1b0]
xor eax, eax
cmp dword [ebx + 0xc], eax
setle al
cmp dword [ebx], 0xf63588c5
mov dword [ebp - 0x34], eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, dword [ebx + 4]
mov eax, dword [ebp - 0x1c]
setg cl
mov esi, dword [ebp - 0x1b0]
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [ebp - 0x624], edx
mov eax, dword [ebp - 0x1c]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle cl
mov edi, dword [ebx + 4]
xor edx, edx
cmp dword [esi + 8], ecx
mov esi, dword [esi + 8]
sete dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, esi
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0xfffe
xor ecx, ecx
cmp eax, dword [ebx + 0xc]
setle cl
xor eax, eax
sub ecx, esi
cmp ecx, edi
setle al
xor ecx, ecx
cmp eax, edi
mov eax, dword [ebp - 0x1b0]
setg cl
add ecx, dword [eax]
xor eax, eax
cmp ecx, 0x3b7c39c9
lea ecx, [ebp - 0x1b0]
setg al
mov dword [ebp - 0x24], eax
call fcn.10011dfa
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x18], ebx
inc edi
jmp 0x10036971
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x68], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10036967
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], bl
je 0x1003698b
push edi
push ebx
push 0x471
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebp - 0x68], ebx
jmp 0x100369a0
mov dword [ebp - 0x24], 0xffff
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x68]
cmp dword [ebp - 0x68], 0xffffffed
jl 0x10036990
push 2
lea ecx, [ebp - 0x330]
call fcn.10011d78
mov dword [ebp - 0x34], 0x4cd4536
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x18], ebx
jmp 0x100369d9
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x330]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100369c6
mov dword [ebp - 0x34], ebx
jmp 0x10036a0b
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], bl
je 0x100369f9
push ebx
push ebx
push 0x2597
call dword [sym.imp.ADVAPI32.dll_CopySid]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x330]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jle 0x100369e4
lea ecx, [ebp - 0x330]
call fcn.10011dfa
mov dword [ebp - 0x14], 0x99ac7894
lea ecx, [ebp - 0x3b4]
push 4
call fcn.10011d78
mov dword [ebp - 4], 6
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x18], ebx
jmp 0x10036a55
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3b4]
mov dword [eax + ecx*4], 0xb57e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10036a42
inc dword [ebp - 0x14]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 3
jg 0x10036b34
mov dword [ebp - 0x28], 0xac196a16
mov dword [ebp - 0x40], 0xffffffff
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x3b4]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov dword [ebp - 0x28], ebx
jmp 0x10036b1c
push 2
lea ecx, [ebp - 0x324]
call fcn.10011d78
mov dword [ebp - 0x18], ebx
jmp 0x10036ab8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x324]
mov dword [eax + ecx*4], 0x8ae5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10036aa5
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x10036ace
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x324]
cmp dword [esi + 4], ebx
je 0x10036afe
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov ecx, edi
setge dl
xor eax, eax
cmp edx, dword [esi + 4]
setge al
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x28]
jne 0x10036b00
mov ecx, ebx
xor eax, eax
cmp ecx, 0xc5b6
lea ecx, [ebp - 0x324]
setle al
mov dword [ebp - 0x24], eax
call fcn.10011dfa
inc dword [ebp - 0x28]
push 3
pop eax
cmp dword [ebp - 0x28], eax
jle 0x10036a93
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x10036a6b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3b4]
call fcn.10011dfa
mov dword [ebp - 0x44], edi
lea ecx, [ebp - 0x294]
push 3
call fcn.10011d78
mov dword [ebp - 4], 7
mov dword [ebp - 0x38], 0x1b9d
cmp dword [ebp - 0x38], 0x1c09
jle 0x10036bc2
push edi
push ebx
push 0x1bd2
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov eax, ebx
mov dword [ebp - 0x1c], ebx
mov esi, ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x24], esi
mov edi, ebx
and esi, eax
mov eax, edi
mov ecx, 0x10606d98
xor eax, esi
cdq
push edx
push eax
call fcn.10011b50
inc edi
cmp edi, 0x2e67
jl 0x10036b88
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x40], esi
cmp esi, 0x1462
jl 0x10036b81
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x2271
jl 0x10036b7c
xor edi, edi
inc edi
mov dword [ebp - 0x34], 0xcdf98a59
mov byte [ebp - 4], 8
cmp dword [ebp - 0x38], 0x1aa3
jge 0x10036be5
mov edx, 0x1000ac18
mov ecx, 0x10606d98
call fcn.10014461
push 2
pop esi
push 3
pop edx
mov dword [ebp - 0x18], ebx
jmp 0x10036c2a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x294]
mov dword [eax + ecx*4], 0x4e1a3622
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10036c17
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x34], ebx
jl 0x10036ca0
mov dword [ebp - 0x14], 0xb44cf59
xor ebx, ebx
mov dword [ebp - 0x28], 0xd40a1650
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x294]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
cmp dword [ecx + edx*4], ebx
setne bl
sub ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
mov dword [ebp - 0x28], ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
jmp 0x10036c96
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], ebx
jl 0x10036c93
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x294]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [ebp - 0x28]
jns 0x10036c7c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10036c74
dec dword [ebp - 0x34]
jns 0x10036c37
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x294]
call fcn.10011dfa
mov dword [ebp - 0x44], ebx
jmp 0x10037125
mov dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x33c]
mov dword [ebp - 0x34], ebx
push 3
call fcn.10011d78
mov dword [ebp - 0x14], ebx
jmp 0x10036ce4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2d0], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10036cd3
push 3
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x10036d04
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x33c]
mov dword [eax + ecx*4], 0xd9cd4431
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10036cf1
mov dword [ebp - 0x18], 6
cmp dword [ebp - 0x18], 0xffffffec
jle 0x10036d72
mov esi, dword [ebp - 0x33c]
mov dword [ebp - 0x1c], 0x53bc
xor edx, edx
mov dword [ebp - 0x24], 0xa530
mov dword [ebp - 0x2d0], ebx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setle dl
cmp edx, dword [ebp - 0x2cc]
jne 0x10036d48
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, 0x51e
setg al
mov dword [esi + 4], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffec
jg 0x10036d1c
push 2
pop esi
mov dword [ebp - 0x34], ebx
jmp 0x10036d8a
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x10036d87
push ebx
call dword [sym.imp.KERNEL32.dll_EncodePointer]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xd
jle 0x10036d77
lea ecx, [ebp - 0x33c]
call fcn.10011dfa
mov dword [ebp - 0x38], 0x57102d14
lea ecx, [ebp - 0x354]
push esi
call fcn.10011d78
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x3fc]
mov dword [ebp - 0x14], 0xffffffff
push edi
call fcn.10011d78
mov dword [ebp - 0x48], ebx
jmp 0x10036de0
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x354]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], esi
jl 0x10036dcd
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], esi
jge 0x10036e02
or edx, 0xffffffff
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x9c], edx
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], esi
jl 0x10036df0
mov dword [ebp - 0x48], ebx
jmp 0x10036e1a
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3fc]
mov dword [eax + ecx*4], 0x54ba4fda
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], edi
jl 0x10036e07
mov dword [ebp - 0x14], 0x87223b1c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0x1b
je 0x10036f36
mov esi, dword [ebp - 0x354]
mov dword [ebp - 0x48], 0xdfcc86f8
mov dword [ebp - 0x24], 0x1ebdc590
mov dword [ebp - 0x18], ebx
jmp 0x10036e66
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x54c], 0x17f72684
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10036e55
mov dword [ebp - 0x48], ebx
jmp 0x10036e84
mov dword [ebp - 0x24], 0xdd4d14b7
mov dword [ebp - 0x9c], edi
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xfffffff9
je 0x10036e71
mov edx, dword [ebp - 0x48]
xor ecx, ecx
imul edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x48]
jl 0x10036ebe
mov eax, dword [esi + 4]
xor ecx, ecx
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x9c], eax
sete cl
cmp ecx, dword [ebp - 0x48]
mov ecx, ebx
je 0x10036ec0
mov ecx, edi
mov eax, dword [ebp - 0x3fc]
xor edx, edx
mov dword [eax], ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setg dl
xor ecx, ecx
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x548]
imul eax, dword [ebp - 0x48]
cmp eax, 0x92e0
setle cl
xor eax, eax
cmp ecx, dword [esi + 4]
setne al
dec eax
je 0x10036f0e
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x10036f26
call dword [sym.imp.USER32.dll_CreateMenu]
jmp 0x10036f26
mov dword [ebp - 0x40], 0x4a037a76
mov dword [ebp - 0x48], ebx
jmp 0x10036f20
inc dword [ebp - 0x40]
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 6
jle 0x10036f1a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1b
jne 0x10036e42
push 2
pop esi
lea ecx, [ebp - 0x3fc]
call fcn.10011dfa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x354]
call fcn.10011dfa
cmp dword [ebp - 0x38], ebx
jne 0x1003712f
mov dword [ebp - 0x34], edi
lea ecx, [ebp - 0x234]
push esi
call fcn.10011d78
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0xfff6
mov dword [ebp - 0x18], ebx
jmp 0x10036f97
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x234]
mov dword [eax + ecx*4], 0x6e87
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10036f84
mov dword [ebp - 0x34], ebx
jmp 0x10037000
push 3
lea ecx, [ebp - 0x3cc]
call fcn.10011d78
push 3
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10036fc9
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3cc]
mov dword [eax + ecx*4], 0xfe1ca2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10036fb6
mov esi, dword [ebp - 0x3cc]
mov dword [esi + 8], ebx
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x10036fea
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
inc dword [esi + 8]
cmp dword [esi + 8], edi
jle 0x10036fd7
lea ecx, [ebp - 0x3cc]
call fcn.10011dfa
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffffc
jg 0x10036fa1
mov esi, dword [ebp - 0x234]
xor ecx, ecx
mov eax, dword [esi]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp dword [esi + 4], eax
mov eax, dword [ebp - 0x1c]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x234]
sete dl
xor ecx, ecx
cmp dword [eax], 0xb060
setne cl
sub ecx, edx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0x8a277ebd
mov eax, dword [ebp - 0x28]
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [esi + 4]
cmp edx, eax
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
imul eax, ecx, 0xfffffffb
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x24], eax
or dword [ebp - 4], 0xffffffff
call fcn.10011dfa
mov dword [ebp - 0x14], 0x6cc9ca31
mov dword [ebp - 0x1c], ebx
push 2
mov dword [ebp - 0x50], 0xfffffff8
pop esi
mov dword [ebp - 0x24], esi
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x100370a4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, 9
setne cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], ebx
mov eax, edi
cmp eax, dword [ebp - 0x14]
jle 0x100370df
cmp dword [ebp - 0x50], ebx
jne 0x100370e2
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
cmp eax, 0x21dd
setg cl
sub ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
cmp ecx, 0xffff
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x10037122
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xfffffff6
jg 0x10036cb7
movdqa xmm0, xmmword [0x1000bf40]
lea ecx, [ebp - 0x5a0]
push ecx
lea eax, [ebp - 0x590]
push eax
push ecx
lea ecx, [ebp - 0x158]
movdqu xmmword [ebp - 0x5a0], xmm0
call fcn.10011dd4
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x44], 0xfffffffd
mov dword [ebp - 0x40], 0x57fd
cmp dword [ebp - 0x40], 0x5a19
jle 0x100371cd
mov dword [ebp - 0x18], ebx
mov edx, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov esi, ebx
mov ecx, esi
mov eax, edi
sar eax, cl
mov ecx, 0x10606d98
and eax, edx
or eax, dword [ebp - 0x18]
cdq
push edx
push eax
call fcn.10011b50
mov edx, dword [ebp - 0x1c]
inc esi
cmp esi, 0x644c
jl 0x10037186
inc edi
cmp edi, 0x3617
jl 0x10037184
inc edx
mov dword [ebp - 0x1c], edx
cmp edx, 0x5dc3
jl 0x10037182
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x5851
jl 0x1003717d
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x40], 0x542c
jge 0x10037207
mov edx, 0x1000ac88
mov ecx, 0x10606d98
call fcn.10014461
jmp 0x10037207
push 3
mov dword [ebp - 0x24], 0x132d683a
pop ecx
mov dword [ebp - 0x18], ebx
jmp 0x10037227
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5dc], 0x2668451f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10037216
mov dword [ebp - 0x34], ebx
jmp 0x10037244
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x158]
mov dword [eax + ecx*4], 0x4fda0e60
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x10037231
mov ebx, dword [ebp - 0x158]
xor eax, eax
cmp dword [ebx + 0xc], eax
setle al
cmp dword [ebx], 0xf63588c5
mov dword [ebp - 0x34], eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, dword [ebx + 4]
mov eax, dword [ebp - 0x44]
setg cl
mov esi, dword [ebp - 0x158]
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [ebp - 0x5dc], edx
mov eax, dword [ebp - 0x44]
cmp edx, eax
mov eax, dword [ebp - 0x44]
setle cl
mov edi, dword [ebx + 4]
xor edx, edx
cmp dword [esi + 8], ecx
mov esi, dword [esi + 8]
sete dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, esi
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0xfffe
xor ecx, ecx
cmp eax, dword [ebx + 0xc]
setle cl
xor eax, eax
sub ecx, esi
cmp ecx, edi
setle al
xor ecx, ecx
cmp eax, edi
mov eax, dword [ebp - 0x158]
setg cl
add ecx, dword [eax]
xor eax, eax
cmp ecx, 0x3b7c39c9
lea ecx, [ebp - 0x158]
setg al
or edi, 0xffffffff
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], edi
call fcn.10011dfa
mov dword [ebp - 0x24], 0xae9714a
xor ebx, ebx
mov byte [ebp - 0x29], bl
mov dword [ebp - 0x38], 0x247
cmp dword [ebp - 0x38], 0x475
jle 0x10037396
mov edx, ebx
mov dword [ebp - 0x18], ebx
mov eax, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov dword [ebp - 0x40], ebx
mov ecx, edi
mov dword [ebp - 0x24], eax
mov edi, eax
mov esi, ebx
shl edi, cl
mov eax, esi
lea ecx, [ebp - 0x63c]
or eax, edx
or eax, edi
cdq
push edx
push eax
call fcn.1000d3ae
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10037349
mov eax, dword [eax]
push eax
call fcn.100489bf
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x63c]
call fcn.100122f8
mov edx, dword [ebp - 0x18]
inc esi
cmp esi, 0x5dda
jl 0x1003732b
mov edi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x40], edi
cmp edi, 0x617e
jl 0x10037320
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x36e4
jl 0x1003731b
inc edx
mov dword [ebp - 0x18], edx
cmp edx, 0x2e97
jl 0x10037316
or edi, 0xffffffff
cmp byte [ebp - 0x29], bl
je 0x100373a6
push 0x6b0
call dword [sym.imp.USER32.dll_GetMenu]
cmp dword [ebp - 0x38], 0xffffff22
jge 0x100373ba
push 0x1000aca0
call fcn.100489bf
pop ecx
mov dword [ebp - 4], edi
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], bl
je 0x100373d1
push ebx
push 0x1429
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, 0x1006560c
mov dword [ebp - 0x30], 0xac204e2d
push 3
lea ecx, [ebp - 0x49c]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x50], eax
call fcn.10011d78
mov dword [ebp - 0x24], 0xfffffffc
push 3
mov dword [ebp - 0x40], 0x90ae
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10037419
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x49c]
mov dword [eax + ecx*4], 0x36a5b5cf
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10037406
mov dword [ebp - 0x30], 0x1b
jmp 0x10037526