Function at 0x100309fa
Capabilities:
Allocate thread local storage
Compare security identifiers
Create process on windows
Create thread
Delete file
Get keyboard layout
Parse pe header
Query environment variable

Disassembly:
mov eax, 0x100849c1
call fcn.10083108
mov eax, 0x162c
call fcn.1006c390
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ecx
inc ebx
mov byte [ebp - 0x61], dl
or edi, 0xffffffff
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x3c], edi
lea ecx, [ebp - 0xbe0]
push 2
call fcn.10018b26
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], eax
jmp 0x10030a51
push dword [ebp - 0x20]
lea ecx, [ebp - 0xbe0]
call fcn.10018bb0
mov dword [eax], 4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10030a3a
mov dword [ebp - 0x30], 0xfffffff1
mov esi, 0xffff
cmp dword [ebp - 0x30], 0xfffffff7
jg 0x10030b9b
mov dword [ebp - 0x10], 0x6a76
lea ecx, [ebp - 0xbc8]
push 4
call fcn.10018b26
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10030aab
push dword [ebp - 0x20]
lea ecx, [ebp - 0xbc8]
call fcn.10018bb0
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10030a8f
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10030ae2
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0x126c7f05
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, esi
setge cl
sub eax, ecx
cmp eax, 5
jl 0x10030ae2
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0xbc8]
push 2
call fcn.10018bb0
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jg 0x10030b08
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x30], eax
je 0x10030b0a
mov edi, ebx
push ebx
lea ecx, [ebp - 0xbe0]
call fcn.10018bb0
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp edi, ecx
mov esi, eax
mov ecx, dword [ebp - 0x30]
sete dl
xor eax, eax
cmp edx, ecx
setge al
xor ecx, ecx
imul eax, dword [ebp - 0x30]
cmp eax, 0x756f
mov eax, dword [ebp - 0x30]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [esi], ecx
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x10030b78
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
lea ecx, [ebp - 0xbc8]
mov byte [ebp - 4], al
call fcn.10018bab
inc dword [ebp - 0x30]
mov esi, 0xffff
cmp dword [ebp - 0x30], 0xfffffff7
jle 0x10030a6d
or edi, 0xffffffff
lea ecx, [ebp - 0xbe0]
mov dword [ebp - 4], edi
call fcn.10018bab
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0xc10]
mov dword [ebp - 0x3c], edi
push 2
call fcn.10018b26
push 2
pop ecx
xor eax, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x10030be9
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc10]
call fcn.10018bb0
mov dword [eax], 4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10030bcc
mov dword [ebp - 0x30], 0xfffffff1
cmp dword [ebp - 0x30], 0xfffffff7
jg 0x10030d28
mov dword [ebp - 0x10], 0x6a76
lea ecx, [ebp - 0xbf8]
push 4
call fcn.10018b26
xor eax, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10030c39
push dword [ebp - 0x20]
lea ecx, [ebp - 0xbf8]
call fcn.10018bb0
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10030c1d
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10030c70
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0x126c7f05
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, esi
setge cl
sub eax, ecx
cmp eax, 5
jl 0x10030c70
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0xbf8]
push 2
call fcn.10018bb0
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jg 0x10030c96
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x30], eax
je 0x10030c98
mov edi, ebx
push ebx
lea ecx, [ebp - 0xc10]
call fcn.10018bb0
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp edi, ecx
mov esi, eax
mov ecx, dword [ebp - 0x30]
sete dl
xor eax, eax
cmp edx, ecx
setge al
xor ecx, ecx
imul eax, dword [ebp - 0x30]
cmp eax, 0x756f
mov eax, dword [ebp - 0x30]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [esi], ecx
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x10030d04
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
lea ecx, [ebp - 0xbf8]
mov byte [ebp - 4], 2
call fcn.10018bab
inc dword [ebp - 0x30]
mov esi, 0xffff
cmp dword [ebp - 0x30], 0xfffffff7
jle 0x10030bfa
or edi, 0xffffffff
lea ecx, [ebp - 0xc10]
mov dword [ebp - 4], edi
call fcn.10018bab
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0xc40]
mov dword [ebp - 0x3c], edi
push 2
call fcn.10018b26
xor eax, eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x20], eax
jmp 0x10030d6e
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc40]
call fcn.10018bb0
mov dword [eax], 4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10030d57
mov dword [ebp - 0x30], 0xfffffff1
cmp dword [ebp - 0x30], 0xfffffff7
jg 0x10030eb1
mov dword [ebp - 0x10], 0x6a76
lea ecx, [ebp - 0xc28]
push 4
call fcn.10018b26
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10030dc4
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc28]
call fcn.10018bb0
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10030da8
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10030dfe
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0x126c7f05
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xffff
setge cl
sub eax, ecx
cmp eax, 5
jl 0x10030dfe
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0xc28]
push 2
call fcn.10018bb0
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jg 0x10030e24
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x30], eax
je 0x10030e26
mov edi, ebx
push ebx
lea ecx, [ebp - 0xc40]
call fcn.10018bb0
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp edi, ecx
mov esi, eax
mov ecx, dword [ebp - 0x30]
sete dl
xor eax, eax
cmp edx, ecx
setge al
xor ecx, ecx
imul eax, dword [ebp - 0x30]
cmp eax, 0x756f
mov eax, dword [ebp - 0x30]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [esi], ecx
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x10030e92
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
lea ecx, [ebp - 0xc28]
mov byte [ebp - 4], 4
call fcn.10018bab
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff7
jle 0x10030d85
or edi, 0xffffffff
lea ecx, [ebp - 0xc40]
mov dword [ebp - 4], edi
call fcn.10018bab
mov dword [ebp - 0x4c], 0x9968cb66
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10030eed
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xcc], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10030ed4
xor eax, eax
mov dword [ebp - 0xc8], eax
jmp 0x10030f21
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10030f15
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2ec], 0xf55e00fe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10030efd
xor eax, eax
dec dword [ebp - 0x2ec]
dec dword [ebp - 0xc8]
cmp dword [ebp - 0xc8], 0xfffffff2
jle 0x10030ef5
cmp dword [ebp - 0xc8], eax
jne 0x10030fa7
mov esi, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc8]
neg esi
sbb esi, esi
xor ecx, ecx
neg esi
cmp eax, 0x3c1d
mov eax, dword [ebp - 0xc8]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc8]
setge dl
sub edx, eax
cmp edx, 0xa277ebd0
mov edx, dword [ebp - 0xc8]
sbb eax, eax
xor ecx, ecx
inc eax
imul edx, eax
mov eax, dword [ebp - 0xc8]
cmp edx, eax
setg cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x4c], eax
jle 0x10030f93
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0xc8]
cmp esi, dword [ebp - 0xc8]
jg 0x10030fa7
xor eax, eax
mov edx, eax
jmp 0x10030fa9
mov edx, ebx
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
push 3
setge cl
mov dword [ebp - 0xc8], ecx
lea ecx, [ebp - 0xd54]
call fcn.10018b26
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x20], 0xaeef20fe
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10030ffe
push dword [ebp - 0x20]
lea ecx, [ebp - 0xd54]
call fcn.10018bb0
mov dword [eax], 0x7571177e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10030fdf
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x10031032
xor ebx, ebx
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x10031026
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x10031009
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xd54]
mov dword [ebp - 4], edi
call fcn.10018bab
push 3
mov dword [ebp - 0x40], 0x24ec2e0c
xor eax, eax
pop edx
mov dword [ebp - 0x38], 0x6aac8953
mov dword [ebp - 0x40], eax
push 8
pop esi
cmp dword [ebp - 0x40], edx
je 0x100310ee
mov dword [ebp - 0x14], 0xb4c23afc
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x40], eax
jne 0x100310a6
cmp dword [ebp - 0x14], eax
jne 0x10031092
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10031092
xor eax, eax
jmp 0x10031094
mov eax, ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x100310a8
mov ecx, ebx
mov eax, dword [ebp - 0x14]
neg eax
cmp eax, ecx
jl 0x100310d8
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100310d1
mov dword [ebp - 0x20], 0xffffffed
jmp 0x100310c9
cmp dword [ebp - 0x14], eax
jne 0x100310ce
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
je 0x100310c1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jg 0x100310b8
jmp 0x100310df
mov dword [ebp - 0x38], 0x14055248
inc dword [ebp - 0x40]
push 0
pop eax
cmp dword [ebp - 0x40], edx
jne 0x10031062
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x1003110d
push 0x12cb
push eax
push eax
push eax
push 0x14cc
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor eax, eax
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x1048]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x34], 0x4fda0e60
mov dword [ebp - 0x34], ebx
push ebx
call fcn.10018b26
mov dword [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffffa
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10031166
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1048]
call fcn.10018bb0
mov dword [eax], 0x6942a1e9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10031148
xor eax, eax
inc dword [ebp - 0x4c]
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x1003117f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
lea ecx, [ebp - 0x1048]
mov dword [ebp - 4], edi
call fcn.10018bab
mov dword [ebp - 0x44], edi
lea ecx, [ebp - 0xd6c]
mov dword [ebp - 0x40], 0x17f75960
xor eax, eax
mov dword [ebp - 0x10], 0x2eda8ed4
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x48], 0x8461e707
mov dword [ebp - 0x14], 0xa23a3407
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], 0xecce005a
mov dword [ebp - 0x20], 0xf3bba684
mov dword [ebp - 0x34], eax
push ebx
call fcn.10018b26
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x38], 0xf9aa
mov dword [ebp - 0x34], 0x2ad
mov dword [ebp - 0x20], eax
jmp 0x10031203
push dword [ebp - 0x20]
lea ecx, [ebp - 0xd6c]
call fcn.10018bb0
mov dword [eax], 0x3d2cf3e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x100311ec
mov ecx, dword [ebp - 0x40]
xor edx, edx
add ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x100312b1
cmp dword [ebp - 0x3c], eax
jne 0x100312b1
push 3
lea ecx, [ebp - 0xc58]
call fcn.10018b26
xor eax, eax
mov byte [ebp - 4], 9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10031287
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc58]
call fcn.10018bb0
mov dword [eax], 0xeda7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10031268
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1003129f
mov dword [ebp - 0x38], esi
push ebx
call fcn.10018bb0
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
inc dword [ebp - 0x20]
xor eax, eax
lea ecx, [ebp - 0xc58]
cmp dword [ebp - 0x20], eax
jle 0x1003128c
call fcn.10018bab
jmp 0x10031323
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x28], 0xd423cb8e
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x20], eax
jmp 0x100312d8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x137c], 0x3c9e4a04
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x100312c7
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
dec dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x40]
sub ecx, eax
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x9e47
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x5d580090
setle al
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
xor eax, eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x10031348
push eax
push 0x265b
push 0x1cfa
push 0xaa6
push 0x1769
call dword [sym.imp.GDI32.dll_CreateBitmap]
lea ecx, [ebp - 0xd6c]
mov dword [ebp - 4], edi
call fcn.10018bab
push 2
lea ecx, [ebp - 0xcd0]
call fcn.10018b26
xor eax, eax
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1003138e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x670], 0xa8eac8b1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10031375
xor eax, eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x100313a7
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
xor eax, eax
mov dword [ebp - 0x668], 0xffffffe2
jmp 0x100313bf
mov dword [ebp - 0x4c], edi
inc dword [ebp - 0x4c]
inc dword [ebp - 0x668]
cmp dword [ebp - 0x668], 0xffffffe9
jle 0x100313b3
push 2
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x100313f4
push dword [ebp - 0x20]
lea ecx, [ebp - 0xcd0]
call fcn.10018bb0
push 2
pop ecx
mov dword [eax], 4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100313d3
xor eax, eax
mov dword [ebp - 0x20], 0xd4e06482
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], 0x72d9ee1c
mov dword [ebp - 0x34], 0xb1b6fd43
mov dword [ebp - 0x4c], 0x520c256f
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10031444
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x44c], 0xf3d37a5b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003142c
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10031464
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x590], 0x23703acb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003144c
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffb
jmp 0x1003149c
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jge 0x10031493
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x138c], 0xd45db34e
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1003147b
xor eax, eax
dec dword [ebp - 0x58c]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jne 0x1003146d
cmp dword [ebp - 0x40], eax
jne 0x10031517
mov eax, dword [ebp - 0x40]
xor edx, edx
mov ecx, dword [ebp - 0x590]
mov eax, dword [ebp - 0x448]
cmp ecx, eax
mov eax, dword [ebp - 0x44c]
setle dl
add eax, 0x307b364f
add eax, edx
xor ecx, ecx
mov edx, dword [ebp - 0x448]
imul edx, eax
mov eax, dword [ebp - 0x40]
cmp edx, eax
setg cl
cmp ebx, ecx
sbb eax, eax
xor edx, edx
inc eax
imul eax, dword [ebp - 0x4c]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x4c]
imul ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
add eax, 0xffff2176
add eax, ecx
cmp eax, 0xce17
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
je 0x10031520
cmp dword [ebp - 0x38], eax
je 0x10031522
mov eax, ebx
jmp 0x10031522
xor eax, eax
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], 0xfffffff1
cmp dword [ebp - 0x18], 0xfffffff7
jg 0x100324d3
jmp 0x10031541
push 8
pop esi
mov dword [ebp - 0x30], 0x915a1369
xor edx, edx
mov dword [ebp - 0x40], 0x6c74aa0d
mov dword [ebp - 0x2c], 0x66941fc9
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
imul eax, dword [ebp - 0x30], 0x49b7
sub eax, dword [ebp - 0x30]
imul ecx, eax, 0xece3
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setne dl
xor ecx, ecx
sub edx, esi
imul edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x40], eax
jmp 0x1003186c
push 2
lea ecx, [ebp - 0xe4]
call fcn.10018b26
mov byte [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x20], 0xa95534fd
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x100315e3
push dword [ebp - 0x30]
lea ecx, [ebp - 0xe4]
call fcn.10018bb0
mov dword [eax], edi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x100315c8
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jg 0x1003175d
mov dword [ebp - 0x4c], 0xec767dbf
lea ecx, [ebp - 0xc70]
push 2
call fcn.10018b26
xor eax, eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x10], eax
jmp 0x10031625
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc70]
call fcn.10018bb0
mov dword [eax], 0x1dd6b9ec
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003160e
push dword [ebp - 0x30]
lea ecx, [ebp - 0xe4]
call fcn.10018bb0
cmp dword [eax], 0
je 0x100316fb
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0xe4]
push ebx
call fcn.10018bb0
mov esi, eax
lea ecx, [ebp - 0xe4]
xor eax, eax
push eax
call fcn.10018bb0
mov ecx, dword [esi]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x1d68c2af
lea ecx, [ebp - 0xe4]
setl al
xor ebx, ebx
cmp eax, 0xb927eecf
setl bl
xor eax, eax
push eax
call fcn.10018bb0
sub ebx, dword [eax]
je 0x100316a9
xor ebx, ebx
lea ecx, [ebp - 0xe4]
inc ebx
push ebx
call fcn.10018bb0
cmp dword [eax], 0
je 0x100316ac
mov ecx, ebx
jmp 0x100316b0
xor ebx, ebx
inc ebx
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0xfffffff8
setne al
xor ecx, ecx
imul eax, eax, 0xf407
cmp eax, 0xc9d6c840
setne cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0xe4]
push dword [ebp - 0x30]
call fcn.10018bb0
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0xe4]
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x30]
call fcn.10018bb0
push dword [ebp - 0x30]
lea ecx, [ebp - 0xe4]
call fcn.10018bb0
xor eax, eax
lea ecx, [ebp - 0xe4]
push eax
call fcn.10018bb0
push ebx
lea ecx, [ebp - 0xe4]
call fcn.10018bb0
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xe4]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
push ebx
call fcn.10018bb0
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0xc70]
push ebx
add esi, dword [eax]
call fcn.10018bb0
lea ecx, [ebp - 0xc70]
mov byte [ebp - 4], 0xb
mov dword [eax], esi
call fcn.10018bab
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x100315ef
xor eax, eax
mov dword [ebp - 0x20], 0xffffffe9
jmp 0x10031850
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1003178e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xfa0], 0xfff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031775
xor eax, eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x100317ca
push eax
push 0x60b
push 0xf78
push 0x134c
push 0x6ce
push 0x2307
push 0xabf
push 0x2576
push 0x1866
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10031848
mov dword [ebp - 0x28], 0xe267
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jg 0x10031845
push dword [ebp - 0x30]
lea ecx, [ebp - 0xe4]
call fcn.10018bb0
xor ecx, ecx
cmp dword [eax], 0x21da
setg cl
mov dword [ebp - 0xf9c], ecx
mov dword [ebp - 0x14], ebx
jmp 0x10031835
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xfa0]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
setg dl
sub edx, 0x5834d56b
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x38], edx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffed
jle 0x10031802
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x100317de
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x100317cf
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x39
je 0x10031769
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 0xa
call fcn.10018bab
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xffffffe3
je 0x100315a2
mov dword [ebp - 0x3c], 0x6a76
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x14], 0xe60f951
mov dword [ebp - 0x30], 0xfffffff9
push ebx
call fcn.10018b26
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x100318bf
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x26c], 0xf196
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x100318a6
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x100318d8
push dword [ebp - 0x30]
lea ecx, [ebp - 0x16c]
call fcn.10018bb0
and dword [eax], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x100318c4
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
test eax, eax
jne 0x10031915
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
sub ecx, 0xc11e
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
cmp eax, dword [ebp - 0x14]
jge 0x10031915
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10031915
mov ebx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x26c]
lea ecx, [ebp - 0x16c]
setl dl
xor ebx, ebx
cmp edx, eax
setne bl
xor eax, eax
push eax
call fcn.10018bb0
mov dword [eax], ebx
test ebx, ebx
je 0x10031a6c
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x4c], 0xfaf14186
mov edx, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x48]
neg edx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x26c]
sbb edx, edx
mov ecx, dword [ebp - 0x4c]
neg edx
sub ecx, eax
xor ebx, ebx
cmp ecx, edx
lea ecx, [ebp - 0x16c]
setg bl
xor eax, eax
push eax
call fcn.10018bb0
mov dword [eax], ebx
mov eax, dword [ebp - 0x48]
add eax, ebx
mov dword [ebp - 0x30], eax
xor edi, edi
inc edi
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x16c]
mov eax, dword [ebp - 0x26c]
xor eax, eax
push eax
call fcn.10018bb0
xor eax, eax
lea ecx, [ebp - 0x16c]
push eax
call fcn.10018bb0
xor eax, eax
lea ecx, [ebp - 0x16c]
push eax
call fcn.10018bb0
mov eax, dword [ebp - 0x26c]
lea ecx, [ebp - 0x16c]
xor eax, eax
push eax
call fcn.10018bb0
mov ecx, dword [ebp - 0x26c]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x16c]
setne dl
xor eax, eax
cmp edx, 0xfffffff7
setle al
xor ebx, ebx
test eax, eax
sets bl
xor eax, eax
push eax
call fcn.10018bb0
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0xa
mov dword [eax], ebx
call fcn.10018bab
push 4
lea ecx, [ebp - 0xcb8]
call fcn.10018b26
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xd84]
mov eax, 0xffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x40], 0xf33880e0
mov dword [ebp - 0x2c], 0x71013923
mov dword [ebp - 0x10], 0x2465cd38
mov dword [ebp - 0x38], 0x69376522
push edi
call fcn.10018b26
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x10], eax
jmp 0x10031c2b
xor eax, eax
mov dword [ebp - 0x20], 0xf9c202d2
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x10031998
xor edi, edi
inc edi
jmp 0x10031a88
xor eax, eax
mov dword [ebp - 0x40], 0xf5e17530
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x2c], 0x99cc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10031ac6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x800], 0xffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10031aad
xor eax, eax
cmp dword [ebp - 0x264], eax
jne 0x10031b05
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x16c]
mov eax, dword [ebp - 0x40]
xor ebx, ebx
mov eax, dword [ebp - 0x40]
cmp eax, 0x2e51
push dword [ebp - 0x30]
setne bl
call fcn.10018bb0
mov dword [eax], ebx
xor eax, eax
cmp ebx, 0x4463
setle al
mov dword [ebp - 0x7fc], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x264]
sub eax, 0x5eac
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x30]
jge 0x10031bd0
mov dword [ebp - 0x38], 0xf9d4
xor eax, eax
mov dword [ebp - 0x4c], 0x76018f8c
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x10031b44
push eax
push 0x1541
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], edi
jg 0x10031bf3
mov dword [ebp - 0x48], edi
xor edx, edx
mov dword [ebp - 0x4c], 0x61339852
mov eax, dword [ebp - 0x38]
cmp eax, edi
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
add edx, 0xbec3a43
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x14]
jne 0x10031b7c
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x26c], eax
je 0x10031b9f
push dword [ebp - 0x30]
lea ecx, [ebp - 0x16c]
call fcn.10018bb0
cmp dword [eax], 0
je 0x10031b9d
mov ecx, edi
jmp 0x10031ba1
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x20]
xor edx, edx
add eax, ecx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, edi
jbe 0x10031bc3
cmp dword [ebp - 0x2c], eax
je 0x10031bc3
mov eax, edi
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edi
jle 0x10031b50
jmp 0x10031bf1
xor eax, eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x10031be9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
xor eax, eax
cmp dword [ebp - 0x7fc], eax
jne 0x10031c06
xor eax, eax
push eax
lea ecx, [ebp - 0x16c]
call fcn.10018bb0
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x10031a86
jmp 0x1003199b
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd84]
call fcn.10018bb0
or dword [eax], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10031c17
mov eax, dword [ebp - 0x20]
inc eax
je 0x10031c42
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10031c42
cmp dword [ebp - 0x40], eax
jne 0x10031c45
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x10]
neg eax
cmp eax, edi
jne 0x10031ce9
push 2
lea ecx, [ebp - 0x75c]
call fcn.10018b26
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x38], 0x9b504dbf
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x10031c9a
push dword [ebp - 0x30]
lea ecx, [ebp - 0x75c]
call fcn.10018bb0
mov dword [eax], 0x6a056ebf
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x10031c7b
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10031cb0
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x5a0], 0xffffffff
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x10031c9f
push edi
lea ecx, [ebp - 0x75c]
call fcn.10018bb0
lea ecx, [ebp - 0x75c]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
xor eax, eax
push eax
call fcn.10018bb0
lea ecx, [ebp - 0x75c]
mov eax, dword [eax]
mov dword [ebp - 0x5a0], eax
call fcn.10018bab
jmp 0x10031d59
mov dword [ebp - 0x10], 0xfff8
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xbab6ea13
mov dword [ebp - 0x4c], 0xa4ec
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
push 0xfffffffffffffff6
pop eax
cmp dword [ebp - 0x10], eax
jne 0x10031d24
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x20], eax
je 0x10031d26
mov ecx, edi
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp eax, 0x35dd
mov eax, dword [ebp - 0x10]
setg dl
add edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x10], ecx
dec dword [ebp - 0x4c]
lea ecx, [ebp - 0xd84]
mov byte [ebp - 4], 0xe
call fcn.10018bab
movdqa xmm0, xmmword [0x10009230]
lea eax, [ebp - 0x1180]
push eax
lea eax, [ebp - 0x1190]
mov dword [ebp - 0x14], 0x60b4ffb8
push eax
lea ecx, [ebp - 0x146c]
movdqu xmmword [ebp - 0x1190], xmm0
call fcn.10018bbf
lea ecx, [ebp - 0x1b2]
mov esi, eax
call fcn.1000a443
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xc88]
push dword [esi]
call fcn.10018b85
mov byte [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10031de3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd8], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10031dcb
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x10031e10
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0xd8]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebp + eax*4 - 0xd8]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd8], ecx
dec dword [ebp - 0x14]
jns 0x10031deb
xor eax, eax
push eax
lea ecx, [ebp - 0xc88]
call fcn.10018bb0
xor ebx, ebx
lea ecx, [ebp - 0xc88]
cmp dword [eax], ebx
setl bl
xor eax, eax
mov dword [ebp - 0xd8], ebx
push eax
call fcn.10018bb0
xor edx, edx
push 0xfffffffffffffff8
pop ecx
sub ecx, ebx
cmp ecx, dword [eax]
setge dl
cmp edx, 0xc1d6b3bf
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
add eax, 0xf5cace0f
add ecx, eax
mov eax, dword [ebp - 0x14]
cmp eax, ecx
lea ecx, [ebp - 0xc88]
setne dl
mov dword [ebp - 0x14], edx
mov byte [ebp - 4], 0xe
call fcn.10018bab
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10031e9f
push dword [ebp - 0x10]
lea ecx, [ebp - 0xcb8]
call fcn.10018bb0
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10031e83
xor eax, eax
push 2
mov dword [ebp - 0x30], 0xffffffff
lea ecx, [ebp - 0x1094]
mov dword [ebp - 0x20], eax
pop ebx
mov dword [ebp - 0x14], 0xc4475ee4
mov dword [ebp - 0x2c], 0x752
push ebx
call fcn.10018b26
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x10], eax
jmp 0x10031ee8
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1094]
call fcn.10018bb0
mov dword [eax], 0xad8e65dd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10031ed1
cmp dword [ebp - 0x30], 0x9f58382b
mov ecx, dword [ebp - 0x30]
sbb eax, eax
neg eax
cmp eax, 0x979cd329
mov eax, dword [ebp - 0x30]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
setne dl
sub edx, 0x223fa3a9
add esi, edx
neg esi
sbb esi, esi
inc esi
sub esi, dword [ebp - 0x30]
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
test eax, eax
setns cl
add ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x30]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xffffffe8
cmp dword [ebp - 0x2c], 0x25
jg 0x1003203c
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1003200c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031f8c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1530], 0x705be734
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031f73
xor eax, eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x10031fb5
push 0x1b5e
push 0x1e9d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffd
jmp 0x10032003
mov dword [ebp - 0x4c], 0x6e52
mov dword [ebp - 0x48], 0xffff
mov dword [ebp - 0x14], 0xffffffee
jmp 0x10031ffa
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x34], 0xd40a7fc
mov dword [ebp - 0x10], eax
jmp 0x10031ff1
dec dword [ebp - 0x4c]
inc dword [ebp - 0x48]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xb
jne 0x10031fe8
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jle 0x10031fd5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x18
jle 0x10031fbe
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff1
jne 0x10031f6a
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x1003202f
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x25
jle 0x10031f62
lea ecx, [ebp - 0x1094]
mov byte [ebp - 4], 0xe
call fcn.10018bab
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10032087
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, 0x126c7f05
mov eax, dword [ebp - 0x3c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xffff
setge cl
sub eax, ecx
cmp eax, 5
jl 0x10032087
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0xcb8]
push ebx
call fcn.10018bb0
mov ecx, dword [ebp - 0x44]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jg 0x100320b1
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x100320b1
xor ebx, ebx
mov edi, eax
inc ebx
jmp 0x100320b6
xor ebx, ebx
inc ebx
mov edi, ebx
push ebx
lea ecx, [ebp - 0xcd0]
call fcn.10018bb0
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp edi, ecx
mov esi, eax
mov ecx, dword [ebp - 0x18]
sete dl
xor eax, eax
cmp edx, ecx
push ebx
setge al
xor ecx, ecx
imul eax, dword [ebp - 0x18]
cmp eax, 0x756f
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esi], ecx
lea ecx, [ebp - 0xd9c]
call fcn.10018b26
mov byte [ebp - 4], 0x13
or edi, 0xffffffff
mov dword [ebp - 0x20], 0xb4ffb87
xor eax, eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10032145
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd9c]
call fcn.10018bb0
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003212b
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1003217c
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10032176
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13b4], 0xb274bf90
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003215d
xor eax, eax
dec dword [ebp - 0x4c]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x1003214a
lea ecx, [ebp - 0xd9c]
mov byte [ebp - 4], 0xe
call fcn.10018bab
push 0xfffffffffffffff8
pop esi
mov dword [ebp - 0x40], 0x2db58e46
lea ecx, [ebp - 0xca0]
mov dword [ebp - 0x10], esi
push 2
call fcn.10018b26
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x3c], 0x1fc8
mov dword [ebp - 0x4c], 0xfffffff9
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x38], 0xb721
mov dword [ebp - 0x4c], 0xb25631cd
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x10], eax
jmp 0x100321ee
push dword [ebp - 0x10]
lea ecx, [ebp - 0xca0]
call fcn.10018bb0
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100321db
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x10032209
mov eax, dword [ebp - 0x40]
xor eax, eax
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0xca0]
push eax
call fcn.10018bb0
mov dword [eax], esi
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp - 0x4c]
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setg cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0xca0]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0xe
call fcn.10018bab
xor eax, eax
mov byte [ebp - 0x19], al
mov dword [ebp - 0x20], 0x730f94f3
mov dword [ebp - 0x4c], 0xd5f8
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100322a2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13fc], 0x4ec2e0cf
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10032289
xor eax, eax
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], eax
jl 0x100322f7
xor ebx, ebx
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x34], 0x58382bdb
mov dword [ebp - 0x10], ebx
jmp 0x100322d4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1060], 0x5425a80e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100322c3
dec dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x13fc]
mov dword [ebp - 0x105c], eax
dec dword [ebp - 0x20]
jns 0x100322b0
xor ebx, ebx
inc ebx
xor eax, eax
dec dword [ebp - 0x48]
cmp byte [ebp - 0x19], 0
je 0x100324b7
mov dword [ebp - 0x30], edi
lea ecx, [ebp - 0xfb8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0xc4475ee4
mov dword [ebp - 0x2c], 0x752
push 2
call fcn.10018b26
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x10], eax
jmp 0x10032347
push dword [ebp - 0x10]
lea ecx, [ebp - 0xfb8]
call fcn.10018bb0
mov dword [eax], 0xad8e65dd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10032330
cmp dword [ebp - 0x30], 0x9f58382b
mov ecx, dword [ebp - 0x30]
sbb eax, eax
neg eax
cmp eax, 0x979cd329
mov eax, dword [ebp - 0x30]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
setne dl
sub edx, 0x223fa3a9
add esi, edx
neg esi
sbb esi, esi
inc esi
sub esi, dword [ebp - 0x30]
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
test eax, eax
setns cl
add ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x30]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xffffffe8
cmp dword [ebp - 0x2c], 0x25
jg 0x10032498
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10032468
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100323ec
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x14c4], 0x705be734
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100323d3
xor eax, eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x10032415
push 0x1b5e
push 0x1e9d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffd
jmp 0x1003245f
mov dword [ebp - 0x4c], 0x6e52
mov dword [ebp - 0x48], 0xffff
mov dword [ebp - 0x14], 0xffffffee
jmp 0x10032456
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x34], 0xd40a7fc
mov dword [ebp - 0x10], eax
jmp 0x1003244d
dec dword [ebp - 0x4c]
inc dword [ebp - 0x48]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xb
jne 0x10032444
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jle 0x10032435
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x18
jle 0x1003241e
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff1
jne 0x100323ca
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x1003248b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x25
jle 0x100323c2
lea ecx, [ebp - 0xfb8]
call fcn.10018bab
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
lea ecx, [ebp - 0xcb8]
mov byte [ebp - 4], 0xa
call fcn.10018bab
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff7
jle 0x1003153e
lea ecx, [ebp - 0xcd0]
mov dword [ebp - 4], edi
call fcn.10018bab
mov dword [ebp - 0x34], ebx
lea ecx, [ebp - 0xdb4]
mov dword [ebp - 0x34], 0x32667a87
xor eax, eax
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x34], 0x696a485b
push 9
mov dword [ebp - 0x34], 7
pop edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x34], ebx
push 2
call fcn.10018b26
mov dword [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffffe
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10032553
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1564], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1003253e
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10032566
push dword [ebp - 0x14]
call fcn.10018bb0
or dword [eax], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
lea ecx, [ebp - 0xdb4]
jl 0x10032558
inc dword [ebp - 0x4c]
or dword [ebp - 4], 0xffffffff
call fcn.10018bab
mov dword [ebp - 0x4c], 0x9968cb66
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100325ac
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc0], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10032593
xor eax, eax
mov dword [ebp - 0xbc], eax
jmp 0x100325e0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100325d4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x358], 0xf55e00fe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100325bc
xor eax, eax
dec dword [ebp - 0x358]
dec dword [ebp - 0xbc]
cmp dword [ebp - 0xbc], 0xfffffff2
jle 0x100325b4
cmp dword [ebp - 0xbc], eax
jne 0x10032666
mov esi, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
neg esi
sbb esi, esi
xor ecx, ecx
neg esi
cmp eax, 0x3c1d
mov eax, dword [ebp - 0xbc]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xbc]
setge dl
sub edx, eax
cmp edx, 0xa277ebd0
mov edx, dword [ebp - 0xbc]
sbb eax, eax
xor ecx, ecx
inc eax
imul edx, eax
mov eax, dword [ebp - 0xbc]
cmp edx, eax
setg cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0xc0]
jle 0x10032652
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0xbc]
cmp esi, dword [ebp - 0xbc]
jg 0x10032666
xor eax, eax
mov edx, eax
jmp 0x10032668
mov edx, ebx
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
mov eax, 0x2e3ca369
setge cl
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0x40], 0x62d5e48d
mov dword [ebp - 0x898], eax
mov dword [ebp - 0x894], eax
mov dword [ebp - 0x890], eax
mov dword [ebp - 0x88c], eax
mov dword [ebp - 0x48], 0x380ee91b
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x38], 0xc38d679b
mov dword [ebp - 0x40], 0x10
jmp 0x10032751
mov dword [ebp - 0x4c], 0xeb16e2c9
mov dword [ebp - 0x4c], 0x1940c9ba
mov dword [ebp - 0x10], eax
jmp 0x100326e1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc7c], 0xb2aee5a9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100326d0
mov eax, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xc78]
mov ecx, dword [ebp - 0x894]
mov dword [ebp - 0x894], ecx
mov eax, dword [ebp - 0x48]
cmp ecx, eax
mov eax, dword [ebp - 0xc78]
setg dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 8
setg al
xor edx, edx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setl dl
sub edx, dword [ebp - 0x48]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xc7c]
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x40], 0x15
jl 0x100326bd
mov dword [ebp - 0x4c], 0x9968cb66
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10032789
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa8], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10032770
xor eax, eax
mov dword [ebp - 0xa4], eax
jmp 0x100327bd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100327b1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x374], 0xf55e00fe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032799
xor eax, eax
dec dword [ebp - 0x374]
dec dword [ebp - 0xa4]
cmp dword [ebp - 0xa4], 0xfffffff2
jle 0x10032791
cmp dword [ebp - 0xa4], eax
jne 0x10032843
mov esi, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
neg esi
sbb esi, esi
xor ecx, ecx
neg esi
cmp eax, 0x3c1d
mov eax, dword [ebp - 0xa4]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xa4]
setge dl
sub edx, eax
cmp edx, 0xa277ebd0
mov edx, dword [ebp - 0xa4]
sbb eax, eax
xor ecx, ecx
inc eax
imul edx, eax
mov eax, dword [ebp - 0xa4]
cmp edx, eax
setg cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0xa8]
jle 0x1003282f
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0xa4]
cmp esi, dword [ebp - 0xa4]
jg 0x10032843
xor eax, eax
mov edx, eax
jmp 0x10032845
mov edx, ebx
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0x18], 0x1e559696
mov dword [ebp - 0x3c], 0x55205300
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10032881
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x208], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003286d
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1003289c
mov dword [ebp - 0x38], 0x8974b66
mov dword [ebp - 0x38], 0xffffffff
dec dword [ebp - 0x18]
jns 0x10032889
mov eax, dword [ebp - 0x208]
xor eax, eax
cmp dword [ebp - 0x208], eax
je 0x100328bb
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x208]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov esi, 0x32667a87
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ebx, eax
push 2
sbb ecx, ecx
xor edx, edx
neg ecx
sub ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
lea ecx, [ebp - 0x1058]
setne dl
xor eax, eax
sub edx, 0xe3a4
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x34], 0x696a485b
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x34], ebx
call fcn.10018b26
mov dword [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffffe
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10032959
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1584], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10032944
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1003296c
push dword [ebp - 0x14]
call fcn.10018bb0
or dword [eax], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
lea ecx, [ebp - 0x1058]
jl 0x1003295e
inc dword [ebp - 0x4c]
or dword [ebp - 4], 0xffffffff
call fcn.10018bab
mov dword [ebp - 0x20], 0x7e2799ac
lea ecx, [ebp - 0xdcc]
mov dword [ebp - 0x34], 0xfd4914d2
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x34], 0xfffffffa
push 3
call fcn.10018b26
mov dword [ebp - 4], 0x18
lea ecx, [ebp - 0x904]
mov dword [ebp - 0x34], ebx
push 3
call fcn.10018b26
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100329ff
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdcc]
call fcn.10018bb0
mov dword [eax], 0x76881957
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100329e0
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10032a21
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14dc], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10032a08
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10032a49
push dword [ebp - 0x18]
lea ecx, [ebp - 0x904]
call fcn.10018bb0
mov dword [eax], 0xffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10032a2a
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10032afa
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x34], 0x4ad744d0
mov dword [ebp - 0x34], 0x3e34b64b
mov dword [ebp - 0x34], 0xb8bffbef
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10032a91
push 0xfffffffffffffff6
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x15e4], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10032a7c
xor eax, eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x10032ae6
push 3
push 0xfd
push 0x1586
push 0x217b
push 0x22fb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0xa2b
push 0x10fa
push 0x1d9c
push 0x949
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
push ebx
lea ecx, [ebp - 0x904]
call fcn.10018bb0
push 0
inc dword [eax]
dec dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], 0xfffffffa
jge 0x10032a51
lea ecx, [ebp - 0x904]
call fcn.10018bab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdcc]
call fcn.10018bab
mov dword [ebp - 0x40], 0x62d5e48d
mov ecx, 0x2e3ca369
mov dword [ebp - 0x858], ecx
mov dword [ebp - 0x854], ecx
mov dword [ebp - 0x850], ecx
mov dword [ebp - 0x84c], ecx
mov dword [ebp - 0x48], 0x380ee91b
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x38], 0xc38d679b
mov dword [ebp - 0x40], 0x10
jmp 0x10032bf7
mov dword [ebp - 0x4c], 0xeb16e2c9
mov dword [ebp - 0x4c], 0x1940c9ba
mov dword [ebp - 0x10], eax
jmp 0x10032b87
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xafc], 0xb2aee5a9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10032b76
mov eax, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xaf8]
mov ecx, dword [ebp - 0x854]
mov dword [ebp - 0x854], ecx
mov eax, dword [ebp - 0x48]
cmp ecx, eax
mov eax, dword [ebp - 0xaf8]
setg dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 8
setg al
xor edx, edx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setl dl
sub edx, dword [ebp - 0x48]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xafc]
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x40], 0x15
jl 0x10032b63
mov dword [ebp - 0x34], ebx
lea ecx, [ebp - 0xfd0]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x34], 0x696a485b
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x34], ebx
push 2
call fcn.10018b26
mov dword [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffffe
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10032c6c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x15a4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10032c57
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10032c7f
push dword [ebp - 0x14]
call fcn.10018bb0
or dword [eax], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
lea ecx, [ebp - 0xfd0]
jl 0x10032c71
inc dword [ebp - 0x4c]
or dword [ebp - 4], 0xffffffff
call fcn.10018bab
mov dword [ebp - 0x18], 0x1e559696
xor eax, eax
mov dword [ebp - 0x3c], 0x55205300
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10032cc3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1e4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032caf
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x10032cde
mov dword [ebp - 0x38], 0x8974b66
mov dword [ebp - 0x38], 0xffffffff
dec dword [ebp - 0x18]
jns 0x10032ccb
mov eax, dword [ebp - 0x1e4]
xor eax, eax
cmp dword [ebp - 0x1e4], eax
je 0x10032cfd
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ebx, eax
push 2
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp edx, eax
setne cl
sub ecx, 0xe3a4
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x10c]
call fcn.10018b26
xor eax, eax
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10032d61
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2ac], 0x62d5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10032d49
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10032d89
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10c]
call fcn.10018bb0
mov dword [eax], 0x7cb3f4f4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10032d6a
xor eax, eax
push eax
lea ecx, [ebp - 0x10c]
call fcn.10018bb0
and dword [eax], 0
jmp 0x10032dbb
xor eax, eax
push eax
call fcn.10018bb0
lea ecx, [ebp - 0x10c]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x2ac], ebx
xor eax, eax
push eax
call fcn.10018bb0
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x10c]
push eax
call fcn.10018bb0
lea ecx, [ebp - 0x10c]
cmp dword [eax], ebx
jl 0x10032d9a
xor eax, eax
push eax
call fcn.10018bb0
push ebx
lea ecx, [ebp - 0x10c]
call fcn.10018bb0
mov esi, eax
lea ecx, [ebp - 0x10c]
xor eax, eax
push eax
call fcn.10018bb0
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x10032e14
xor eax, eax
lea ecx, [ebp - 0x10c]
push eax
call fcn.10018bb0
cmp dword [eax], 0
je 0x10032e14
xor eax, eax
jmp 0x10032e18
xor eax, eax
mov ebx, eax
push eax
lea ecx, [ebp - 0x10c]
call fcn.10018bb0
mov ecx, dword [ebp - 0x2ac]
xor edx, edx
add ecx, 0xa86b
cmp ebx, ecx
lea ecx, [ebp - 0x10c]
setl dl
sub edx, dword [eax]
xor eax, eax
cmp edx, 0xfffffffc
setl al
xor ebx, ebx
cmp eax, 0xdfa8
setl bl
xor eax, eax
push eax
call fcn.10018bb0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10c]
mov dword [eax], ebx
call fcn.10018bab
xor edi, edi
inc edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], 0x4cb8f6c2
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x28], 0xffffffff
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x10032eae
push eax
push 0x413
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x9b642c70
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x13
cmp dword [ebp - 0x20], 0xffffffe6
je 0x10032f45
push 0xfffffffffffffff6
xor eax, eax
pop ecx
mov dword [ebp - 0x2dc], ecx
mov dword [ebp - 0x2d8], ecx
mov dword [ebp - 0x2d4], ecx
mov dword [ebp - 0x2d0], ecx
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x38], 0xe3cf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x10032f35
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x10032f29
push 0x1ac5
push 0x898
push 0x1905
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
call esi
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x10032f03
push 0xfffffffffffffff6
pop ecx
mov dword [ebp - 0x38], 0x185a1fa1
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe6
jne 0x10032ed4
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x13
cmp dword [ebp - 0x20], 0xffffffe6
je 0x10032fd1
push 0xfffffffffffffff6
xor eax, eax
pop ecx
mov dword [ebp - 0x2dc], ecx
mov dword [ebp - 0x2d8], ecx
mov dword [ebp - 0x2d4], ecx
mov dword [ebp - 0x2d0], ecx
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x38], 0xe3cf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x10032fc1
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x10032fb5
push 0x1ac5
push 0x898
push 0x1905
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
call esi
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x10032f8f
push 0xfffffffffffffff6
pop ecx
mov dword [ebp - 0x38], 0x185a1fa1
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe6
jne 0x10032f60
mov dword [ebp - 0x4c], 0x9968cb66
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], 0xe8cff0ea
push 2
call fcn.10018b26
xor eax, eax
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10033020
push dword [ebp - 0x14]
lea ecx, [ebp - 0x390]
call fcn.10018bb0
mov dword [eax], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10033001
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10033042
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xde4], 0x3395cc9e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10033029
xor eax, eax
push 0xfffffffffffffffb
pop esi
mov dword [ebp - 0x18], esi
jmp 0x100331d3
mov dword [ebp - 0x2c], 0x108f8256
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jne 0x1003310a
mov dword [ebp - 0x20], 0x61be360d
cmp dword [ebp - 0x18], eax
je 0x10033076
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
cmp edx, 8
sbb eax, eax
inc eax
imul eax, eax, 0x11e2
cmp dword [ebp - 0x18], eax
jg 0x1003309f
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100330a1
mov ecx, edi
jmp 0x100330a3
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x20]
add ecx, 0x3989
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ebx, ebx
cmp edx, 0xfffffff7
setg bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor eax, eax
cmp ecx, 0x1d26ec17
setle al
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], 0xffffffff
jg 0x100330e2
mov edx, edi
cmp dword [ebp - 0x2c], eax
jne 0x100330e4
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
mov eax, 0xffff
push 0
setg cl
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x2c]
pop eax
cmp dword [ebp - 0x2c], esi
je 0x10033067
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], eax
jl 0x100331d0
mov dword [ebp - 0x4c], edi
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x1003313c
push eax
push 0x1490
push 0x2211
push 0x112f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
xor eax, eax
mov dword [ebp - 0x4c], 6
cmp dword [ebp - 0x4c], eax
jne 0x100331a3
push dword [ebp - 0x30]
lea ecx, [ebp - 0x390]
call fcn.10018bb0
cmp dword [eax], 0
je 0x10033180
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x390]
push dword [ebp - 0x30]
call fcn.10018bb0
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x390]
push dword [ebp - 0x30]
call fcn.10018bb0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
lea ecx, [ebp - 0x390]
setg dl
mov dword [ebp - 0xde4], edx
push dword [ebp - 0x30]
call fcn.10018bb0
xor eax, eax
push eax
lea ecx, [ebp - 0x390]
call fcn.10018bb0
cmp dword [eax], 0
je 0x100331bf
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x100331c1
mov eax, edi
jmp 0x100331c1
xor eax, eax
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x30]
push 0
pop eax
jns 0x10033116
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1a
jle 0x1003304d
mov dword [ebp - 0x18], eax
jmp 0x100331f5
mov dword [ebp - 0x38], 0x14ff
mov eax, dword [ebp - 0xde4]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xa
jl 0x100331e2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x390]
call fcn.10018bab
mov dword [ebp - 0x2c], 0xffffffff
lea ecx, [ebp - 0x91c]
mov dword [ebp - 0x40], edi
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x34], 0xb5d06de2
push 0xfffffffffffffff6
mov dword [ebp - 0x14], 0xfffffffc
pop eax
mov dword [ebp - 0x34], 0x92ff822
mov dword [ebp - 0x34], 0x3d35555d
mov dword [ebp - 0x34], eax
push edi
call fcn.10018b26
push 0x1d
pop esi
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x38], 0x319d7fcc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1003327f
push dword [ebp - 0x10]
lea ecx, [ebp - 0x91c]
call fcn.10018bb0
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10033265
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1003339a
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100332b3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1074], 0x631e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003329a
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x100332ec
mov dword [ebp - 0x38], 0xc58f
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x100332e0
push eax
push 0x9d8
push 0x1e03
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
mov dword [ebp - 0x38], 0xffffffff
jmp 0x10033394
mov dword [ebp - 0x4c], 0x42e11914
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], 0x15
jne 0x10033380
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x10], 0x284818a8
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x1003331d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x2c], eax
jg 0x10033328
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1070], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x40]
push 0
setne bl
xor ecx, ecx
cmp ebx, eax
setge cl
xor eax, eax
cmp ecx, edi
setl al
mov dword [ebp - 0x10], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x15
pop eax
je 0x10033300
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x10033394
push 0xb4
call dword [sym.imp.USER32.dll_GetSystemMetrics]
inc dword [ebp - 0x2c]
push 0
pop eax
cmp dword [ebp - 0x2c], 0xa
jg 0x10033287
mov eax, dword [ebp - 0x44]
xor edx, edx
inc dword [ebp - 0x48]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
cmp edx, 0x3cf54cea
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x44]
setl cl
xor ebx, ebx
cmp eax, 0x406c49a7
setge bl
xor eax, eax
sub ebx, ecx
lea ecx, [ebp - 0x91c]
push eax
call fcn.10018bb0
or edi, 0xffffffff
lea ecx, [ebp - 0x91c]
mov dword [eax], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 4], edi
call fcn.10018bab
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ebx
cmp dword [ebp - 0x10], ebx
jge 0x1003342e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10033416
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10033453
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1110], 0xb4e1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003343a
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x1003349f
mov dword [ebp - 0x38], 0xc3fbb4eb
mov dword [ebp - 0x4c], 0xe3e63e31
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x10033498
push eax
push 0x1f75
push 0x1f5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
dec dword [ebp - 0x14]
jns 0x1003345b
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x100334d6
mov dword [ebp - 0x38], 0xf1adb2bc
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + eax*4 - 0x1110]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1110]
cmp edx, eax
setg cl
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x100334a7
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0xb0], eax
inc ebx
cmp dword [ebp - 0xb0], 0xfffffff2
jg 0x10033a85
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10033511
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1bc], 0x26d2e858
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100334f8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff1
jl 0x100335a0
mov dword [ebp - 0x20], 0xb4bc662a
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x38], 0x5dbfe6b8
mov dword [ebp - 0x10], eax
jmp 0x10033aa8
cmp dword [ebp - 0x10], ebx
jl 0x10033a9e