Function at 0x10034a73
Capabilities:
Accept command line arguments
Allocate thread local storage
Create pipe
Create process on windows
Enumerate files on windows
Enumerate gui resources
Get file size
Get file system object information
Get geographical location
Identify system language via api
Log keystrokes
Log keystrokes via polling
Parse pe header
Query environment variable
Query or enumerate registry value
Read .ini file
Set environment variable
Set registry value

Disassembly:
mov eax, 0x1008edad
call fcn.1008d170
mov eax, 0x18d4
call fcn.10089590
push ebx
push esi
push edi
push 2
pop ebx
mov dword [ebp - 0x74], ecx
lea ecx, [ebp - 0xcb8]
push ebx
mov byte [ebp - 0x69], dl
call fcn.10019c20
push 3
pop edi
xor eax, eax
lea ecx, [ebp - 0x5c8]
push edi
mov dword [ebp - 4], eax
call fcn.10019c20
xor eax, eax
inc eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x18], eax
push ebx
pop esi
cmp dword [ebp - 0x18], ebx
jge 0x10034ae4
xor ebx, ebx
inc ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0xcb8]
call fcn.10019cac
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10034ac8
xor eax, eax
jmp 0x10034ae7
xor ebx, ebx
inc ebx
mov dword [ebp - 0x18], eax
jmp 0x10034afd
push dword [ebp - 0x18]
call fcn.10019cac
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x5c8]
cmp dword [ebp - 0x18], edi
jl 0x10034aec
push esi
call fcn.10019cac
push esi
and dword [eax], 0
jmp 0x10034bd9
push ebx
lea ecx, [ebp - 0x4f4]
call fcn.10019c20
push 2
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10034b57
push dword [ebp - 0x14]
lea ecx, [ebp - 0x4f4]
call fcn.10019cac
mov dword [eax], 0x6444696a
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x10034b33
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x4f4]
call fcn.10019cac
lea ecx, [ebp - 0x4f4]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10019cac
push 2
pop esi
jmp 0x10034bb2
xor eax, eax
push eax
call fcn.10019cac
lea ecx, [ebp - 0xcb8]
push dword [eax]
call fcn.10019cac
lea ecx, [ebp - 0x4f4]
mov dword [eax], 0x5cbd9454
xor eax, eax
push eax
call fcn.10019cac
lea ecx, [ebp - 0x4f4]
inc dword [eax]
xor eax, eax
push eax
call fcn.10019cac
lea ecx, [ebp - 0x4f4]
cmp dword [eax], esi
jl 0x10034b79
mov byte [ebp - 4], bl
call fcn.10019ca7
push 2
pop eax
push eax
lea ecx, [ebp - 0x5c8]
call fcn.10019cac
push 2
inc dword [eax]
pop eax
push eax
lea ecx, [ebp - 0x5c8]
call fcn.10019cac
cmp dword [eax], ebx
jle 0x10034b17
lea ecx, [ebp - 0x5c8]
call fcn.10019ca7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcb8]
call fcn.10019ca7
push 2
pop eax
push eax
lea ecx, [ebp - 0xdb4]
call fcn.10019c20
push edi
lea ecx, [ebp - 0x6d0]
mov dword [ebp - 4], edi
call fcn.10019c20
push 4
pop eax
mov byte [ebp - 4], al
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x10034c54
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdb4]
call fcn.10019cac
push 2
mov dword [eax], ebx
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x10034c37
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10034c6a
push dword [ebp - 0x18]
call fcn.10019cac
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x6d0]
cmp dword [ebp - 0x18], edi
jl 0x10034c59
push 2
pop eax
push eax
call fcn.10019cac
and dword [eax], 0
jmp 0x10034d45
push ebx
lea ecx, [ebp - 0x4c4]
call fcn.10019c20
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10034cc4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x4c4]
call fcn.10019cac
mov dword [eax], 0x6444696a
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x10034ca0
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x4c4]
call fcn.10019cac
lea ecx, [ebp - 0x4c4]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10019cac
push 2
pop esi
jmp 0x10034d1f
xor eax, eax
push eax
call fcn.10019cac
lea ecx, [ebp - 0xdb4]
push dword [eax]
call fcn.10019cac
lea ecx, [ebp - 0x4c4]
mov dword [eax], 0x5cbd9454
xor eax, eax
push eax
call fcn.10019cac
lea ecx, [ebp - 0x4c4]
inc dword [eax]
xor eax, eax
push eax
call fcn.10019cac
lea ecx, [ebp - 0x4c4]
cmp dword [eax], esi
jl 0x10034ce6
push 4
pop eax
mov byte [ebp - 4], al
call fcn.10019ca7
push 2
pop eax
push eax
lea ecx, [ebp - 0x6d0]
call fcn.10019cac
inc dword [eax]
push 2
pop eax
push eax
lea ecx, [ebp - 0x6d0]
call fcn.10019cac
cmp dword [eax], ebx
jle 0x10034c86
lea ecx, [ebp - 0x6d0]
call fcn.10019ca7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdb4]
call fcn.10019ca7
xor eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 0x2006887e
mov dword [ebp - 0x30], 0x141e4f1f
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x30], 0x3a4df6f9
mov dword [ebp - 0x30], 0xc92ea21e
mov dword [ebp - 0x30], 0x2b96ce02
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x37e0d1b7
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x3c], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x38], 0x1b
cmp dword [ebp - 0x38], 0xfffffff5
push 0xfffffffffffffffe
pop ebx
je 0x10034e58
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x30], 0x444696a4
mov dword [ebp - 0x30], 0xbd94543b
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10034e32
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x16e0], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10034e1e
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10034e49
push 0x622
push eax
push eax
call edi
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x3c]
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff5
jne 0x10034dfe
xor eax, eax
inc eax
movdqa xmm0, xmmword [0x100080f0]
lea ecx, [ebp - 0x16f0]
mov dword [ebp - 0x24], 0x8cff0ea7
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x137c]
push eax
lea eax, [ebp - 0x138c]
push eax
movdqu xmmword [ebp - 0x138c], xmm0
call fcn.10019cbb
lea ecx, [ebp - 0x295]
mov esi, eax
call fcn.100091c3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x106c]
push dword [esi]
call fcn.10019c81
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 0x2e4a6b2c
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x24], eax
jmp 0x10034ef0
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10034ee4
push 0x2100
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x64], eax
dec dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], ebx
jne 0x10034ecf
xor ecx, ecx
mov dword [ebp - 0x64], 0xfffffff8
mov eax, dword [ebp - 0x24]
cmp eax, 0x9333
push 3
setl cl
sub ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
sub esi, ecx
lea ecx, [ebp - 0x106c]
neg esi
sbb esi, esi
inc esi
call fcn.10019cac
cmp esi, 0xcd833989
sbb ecx, ecx
inc ecx
mov dword [eax], esi
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x64]
cmp eax, ecx
setl dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0x3359003
cmp edx, eax
mov eax, dword [ebp - 0x24]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne bl
xor ecx, ecx
cmp ebx, eax
setle cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x24], eax
jle 0x10034fa7
xor eax, eax
cmp dword [ebp - 0x64], eax
jne 0x10034fa7
xor ebx, ebx
inc ebx
jmp 0x10034fac
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x106c]
or dword [ebp - 4], 0xffffffff
call fcn.10019ca7
push 2
pop eax
push eax
lea ecx, [ebp - 0xc34]
call fcn.10019c20
push 3
lea ecx, [ebp - 0x5e0]
mov dword [ebp - 4], 7
call fcn.10019c20
xor eax, eax
mov byte [ebp - 4], 8
push 2
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x1003500f
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc34]
call fcn.10019cac
push 2
mov dword [eax], ebx
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x10034ff2
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10035025
push dword [ebp - 0x18]
call fcn.10019cac
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
lea ecx, [ebp - 0x5e0]
jl 0x10035014
push 2
pop eax
push eax
call fcn.10019cac
and dword [eax], 0
jmp 0x100350ff
push ebx
lea ecx, [ebp - 0x50c]
call fcn.10019c20
xor eax, eax
mov byte [ebp - 4], 9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10035080
push dword [ebp - 0x14]
lea ecx, [ebp - 0x50c]
call fcn.10019cac
mov dword [eax], 0x6444696a
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1003505c
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x50c]
call fcn.10019cac
lea ecx, [ebp - 0x50c]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10019cac
push 2
pop esi
jmp 0x100350db
xor eax, eax
push eax
call fcn.10019cac
lea ecx, [ebp - 0xc34]
push dword [eax]
call fcn.10019cac
lea ecx, [ebp - 0x50c]
mov dword [eax], 0x5cbd9454
xor eax, eax
push eax
call fcn.10019cac
lea ecx, [ebp - 0x50c]
inc dword [eax]
xor eax, eax
push eax
call fcn.10019cac
lea ecx, [ebp - 0x50c]
cmp dword [eax], esi
jl 0x100350a2
mov byte [ebp - 4], 8
call fcn.10019ca7
push 2
pop eax
push eax
lea ecx, [ebp - 0x5e0]
call fcn.10019cac
inc dword [eax]
push 2
pop eax
push eax
lea ecx, [ebp - 0x5e0]
call fcn.10019cac
cmp dword [eax], ebx
jle 0x10035042
lea ecx, [ebp - 0x5e0]
call fcn.10019ca7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc34]
call fcn.10019ca7
mov dword [ebp - 0x38], 0x53b26bdd
xor eax, eax
mov dword [ebp - 0x30], 0x6318d581
mov dword [ebp - 0x30], 0xe8e1b881
mov dword [ebp - 0x30], 0xfffffffd
push 2
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], eax
pop esi
cmp dword [ebp - 0x38], 0x16
jg 0x100351a9
mov dword [ebp - 0x30], 0x3ed1
mov dword [ebp - 0x30], 0x5a60d005
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x58], 0xfeb9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1003519e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x17d0], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10035189
xor eax, eax
inc dword [ebp - 0x3c]
inc dword [ebp - 0x58]
inc dword [ebp - 0x38]
jmp 0x10035157
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], 0x2006887e
mov dword [ebp - 0x30], 0x141e4f1f
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x30], 0x3a4df6f9
mov dword [ebp - 0x30], 0xc92ea21e
mov dword [ebp - 0x30], 0x2b96ce02
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0x37e0d1b7
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x38], 0x1b
cmp dword [ebp - 0x38], 0xfffffff5
je 0x10035285
push 2
pop ecx
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x30], 0x444696a4
mov dword [ebp - 0x30], 0xbd94543b
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1003525f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1700], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10035247
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10035276
push 0x622
push eax
push eax
call edi
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x3c]
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff5
jne 0x10035227
push 2
pop esi
mov dword [ebp - 0x30], 0xfffffff9
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x100352a4
push eax
push 0x260f
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x100352b7
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
xor eax, eax
mov dword [ebp - 0x28], 0x15a13695
mov dword [ebp - 0x44], 0x59229a27
mov dword [ebp - 0x10], 0xfff7
mov dword [ebp - 0x3c], 0x98ba832a
mov dword [ebp - 0x14], 0x4adb5d23
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100352f8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x978], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100352e3
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10035383
mov dword [ebp - 0x974], 6
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x7293cc9d
jg 0x10035327
xor eax, eax
cmp dword [ebp - 0x978], eax
je 0x1003532d
mov eax, dword [ebp - 0x978]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setg dl
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
inc edx
neg edx
sbb edx, edx
inc edx
imul ecx, edx, 0x8967
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
cmp ecx, ebx
setge dl
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
or eax, 0xffffffff
inc edx
sub eax, edx
imul eax, dword [ebp - 0x10]
test eax, eax
je 0x10035385
mov eax, ebx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x44], eax
jmp 0x100353b4
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x100353b1
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x978], 0
jne 0x100353af
dec dword [ebp - 0x14]
jns 0x1003539d
xor eax, eax
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x17
jle 0x10035395
push 2
pop eax
push eax
lea ecx, [ebp - 0xe8c]
call fcn.10019c20
push 3
lea ecx, [ebp - 0x6e8]
mov dword [ebp - 4], 0xa
call fcn.10019c20
xor eax, eax
mov byte [ebp - 4], 0xb
inc eax
lea ecx, [ebp - 0xf34]
mov dword [ebp - 0x14], eax
push eax
call fcn.10019c20
xor eax, eax
mov byte [ebp - 4], 0xc
xor ebx, ebx
mov dword [ebp - 0x14], eax
inc ebx
cmp dword [ebp - 0x14], ebx
jge 0x10035425
push dword [ebp - 0x14]
lea ecx, [ebp - 0xf34]
call fcn.10019cac
or dword [eax], 0xffffffff
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x10035404
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x14], 0xffffffeb
jmp 0x1003544a
mov dword [ebp - 0x3c], 0xf7a73d2
push eax
call fcn.10019cac
push 0
mov dword [eax], 0x32a27689
dec dword [ebp - 0x3c]
inc dword [ebp - 0x14]
pop eax
lea ecx, [ebp - 0xf34]
cmp dword [ebp - 0x14], ebx
jge 0x1003542e
mov byte [ebp - 4], 0xb
call fcn.10019ca7
movdqa xmm0, xmmword [0x100080f0]
lea eax, [ebp - 0x14dc]
push eax
lea eax, [ebp - 0x14ec]
mov dword [ebp - 0x24], 0x8cff0ea7
mov dword [ebp - 0x64], ebx
lea ecx, [ebp - 0x1710]
push eax
movdqu xmmword [ebp - 0x14ec], xmm0
call fcn.10019cbb
lea ecx, [ebp - 0x271]
mov esi, eax
call fcn.100091c3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x12c0]
push dword [esi]
call fcn.10019c81
mov byte [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 0x2e4a6b2c
push 0xfffffffffffffffe
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x24], eax
pop ebx
jmp 0x100354f6
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x100354ea
push 0x2100
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x64], eax
dec dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], ebx
jne 0x100354d5
xor ecx, ecx
mov dword [ebp - 0x64], 0xfffffff8
mov eax, dword [ebp - 0x24]
cmp eax, 0x9333
push 3
setl cl
sub ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
sub esi, ecx
lea ecx, [ebp - 0x12c0]
neg esi
sbb esi, esi
inc esi
call fcn.10019cac
cmp esi, 0xcd833989
sbb ecx, ecx
inc ecx
mov dword [eax], esi
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x64]
cmp eax, ecx
setl dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0x3359003
cmp edx, eax
mov eax, dword [ebp - 0x24]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne bl
xor ecx, ecx
cmp ebx, eax
setle cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x24], eax
jle 0x100355ad
xor eax, eax
cmp dword [ebp - 0x64], eax
jne 0x100355ad
xor ebx, ebx
inc ebx
jmp 0x100355b2
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x12c0]
mov byte [ebp - 4], 0xb
call fcn.10019ca7
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x100355ee
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe8c]
call fcn.10019cac
push 2
mov dword [eax], ebx
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x100355d1
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop esi
jmp 0x1003560d
push dword [ebp - 0x18]
lea ecx, [ebp - 0x6e8]
call fcn.10019cac
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100355f6
mov dword [ebp - 0x24], 0x890
lea ecx, [ebp - 0x920]
push ebx
call fcn.10019c20
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x28], 0xaaf7cc73
mov dword [ebp - 0x3c], 0x7c7a5019
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10035665
push dword [ebp - 0x14]
lea ecx, [ebp - 0x920]
call fcn.10019cac
mov dword [eax], 0xfffffff9
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x10035641
xor ebx, ebx
xor eax, eax
inc ebx
cmp dword [ebp - 0x24], eax
je 0x100357bf
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x36
jge 0x10035775
push esi
lea ecx, [ebp - 0x748]
call fcn.10019c20
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x100356b3
push dword [ebp - 0x14]
lea ecx, [ebp - 0x748]
call fcn.10019cac
mov dword [eax], 0x54fddd3f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10035695
xor eax, eax
push eax
lea ecx, [ebp - 0x748]
call fcn.10019cac
and dword [eax], 0
jmp 0x10035740
xor eax, eax
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x11
jg 0x10035732
push 4
pop ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x100356fc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb0c], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100356e4
xor eax, eax
mov dword [ebp - 0xb0c], eax
cmp dword [ebp - 0xb0c], 0xffffffe7
je 0x10035729
mov dword [ebp - 0x34], 0xffffffff
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0xb0c]
cmp dword [ebp - 0xb0c], 0xffffffe7
jne 0x1003570b
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x11
jle 0x100356dc
push eax
lea ecx, [ebp - 0x748]
call fcn.10019cac
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x748]
push eax
call fcn.10019cac
cmp dword [eax], 0x1b
jne 0x100356c4
lea ecx, [ebp - 0x748]
mov byte [ebp - 4], 0xe
call fcn.10019ca7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x36
jl 0x1003567b
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10035799
push 0x2554
push 0x6a3
push 0xbf3
push 0x1320
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push 2
pop ebx
lea ecx, [ebp - 0x920]
mov byte [ebp - 4], 0xb
call fcn.10019ca7
push ebx
lea ecx, [ebp - 0x6e8]
call fcn.10019cac
and dword [eax], 0
jmp 0x1003656f
push 6
pop eax
mov dword [ebp - 0x1000], eax
lea ecx, [ebp - 0x5f8]
mov dword [ebp - 0xffc], eax
mov dword [ebp - 0xff8], eax
mov dword [ebp - 0xff4], eax
push esi
call fcn.10019c20
push 4
pop eax
push eax
lea ecx, [ebp - 0xc4c]
mov byte [ebp - 4], 0x10
call fcn.10019c20
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10035822
push dword [ebp - 0x20]
lea ecx, [ebp - 0x5f8]
call fcn.10019cac
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10035807
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10035846
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x908], ebx
xor eax, eax
inc dword [ebp - 0x20]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x20], eax
jl 0x1003582a
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
push 4
pop eax
cmp dword [ebp - 0x20], eax
jge 0x10035872
push eax
pop ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc4c]
call fcn.10019cac
mov dword [eax], 0x52ee8b72
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10035853
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1000], eax
test eax, eax
jne 0x10035894
cmp dword [ebp - 0x24], eax
je 0x10035889
mov eax, dword [ebp - 0x24]
mov eax, ebx
add eax, 0xc5a7
jne 0x10035894
mov esi, eax
jmp 0x10035899
xor eax, eax
lea esi, [eax + 1]
push eax
lea ecx, [ebp - 0x920]
call fcn.10019cac
push 2
pop ebx
push ebx
mov dword [eax], esi
lea ecx, [ebp - 0x5f8]
mov eax, dword [ebp - 0x24]
call fcn.10019cac
mov ecx, dword [ebp - 0x24]
cmp dword [eax], ecx
je 0x100358d8
push ebx
lea ecx, [ebp - 0x5f8]
call fcn.10019cac
cmp dword [eax], 0
jne 0x100358d8
xor eax, eax
mov esi, eax
inc eax
jmp 0x100358dd
xor eax, eax
inc eax
mov esi, eax
push eax
lea ecx, [ebp - 0x5f8]
call fcn.10019cac
xor ecx, ecx
cmp esi, dword [eax]
setge cl
cmp ecx, 0xfffffffa
jge 0x10035903
xor eax, eax
lea ecx, [ebp - 0x920]
push eax
call fcn.10019cac
xor eax, eax
lea ecx, [ebp - 0x5f8]
push eax
call fcn.10019cac
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xc4c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x3c], eax
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x908], esi
push ebx
call fcn.10019cac
push 0xfffffffffffffffd
pop ecx
cmp ecx, esi
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x24]
mov dword [eax], ecx
mov dword [ebp - 0x28], 7
jmp 0x10035969
xor eax, eax
lea ecx, [ebp - 0x920]
push eax
call fcn.10019cac
mov dword [eax], 0x700c0d35
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffffc
je 0x10035952
lea ecx, [ebp - 0xc4c]
call fcn.10019ca7
lea ecx, [ebp - 0x5f8]
call fcn.10019ca7
jmp 0x1003579c
push 2
pop eax
push eax
lea ecx, [ebp - 0x108]
call fcn.10019c20
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x20], 0x8c45cdbe
mov dword [ebp - 0x28], 0x9ef4a042
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x38], 0x58a13c44
push 2
mov dword [ebp - 0x14], eax
pop esi
cmp dword [ebp - 0x14], esi
jge 0x100359e4
push esi
pop ebx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x108]
call fcn.10019cac
push 4
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100359c4
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x10035b51
mov dword [ebp - 0x44], 3
lea ecx, [ebp - 0x108]
push dword [ebp - 0x20]
call fcn.10019cac
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10035a7a
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, 0x324015fb
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x44]
jne 0x10035a46
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x10035a46
mov esi, eax
jmp 0x10035a4e
xor eax, eax
xor ebx, ebx
inc ebx
lea esi, [eax + 1]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x108]
call fcn.10019cac
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp esi, ecx
mov ecx, 0xe294b58f
sete dl
cmp ecx, edx
sbb ecx, ecx
neg ecx
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x28]
jne 0x10035a8b
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10035a8b
push ebx
lea ecx, [ebp - 0x108]
call fcn.10019cac
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x108]
push dword [ebp - 0x20]
call fcn.10019cac
xor eax, eax
lea ecx, [ebp - 0x108]
push eax
call fcn.10019cac
push dword [ebp - 0x20]
lea ecx, [ebp - 0x108]
call fcn.10019cac
xor eax, eax
lea ecx, [ebp - 0x108]
push eax
call fcn.10019cac
push dword [ebp - 0x20]
lea ecx, [ebp - 0x108]
call fcn.10019cac
push dword [ebp - 0x20]
lea ecx, [ebp - 0x108]
call fcn.10019cac
xor ecx, ecx
cmp dword [eax], ecx
setne cl
xor eax, eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jne 0x10035b0d
push dword [ebp - 0x20]
lea ecx, [ebp - 0x108]
call fcn.10019cac
cmp dword [eax], 0
jne 0x10035b0d
xor eax, eax
mov esi, eax
inc eax
jmp 0x10035b12
xor eax, eax
inc eax
mov esi, eax
push eax
lea ecx, [ebp - 0x108]
call fcn.10019cac
cmp esi, 0xe74bb9ce
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x44]
setl dl
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
mov dword [ebp - 0x38], ecx
inc eax
inc dword [ebp - 0x20]
push eax
pop ebx
cmp dword [ebp - 0x20], eax
jle 0x100359f0
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x10035bb7
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], eax
jl 0x10035bb2
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x10035bad
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10035b7d
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jg 0x10035ba8
push dword [ebp - 0x28]
lea ecx, [ebp - 0x108]
call fcn.10019cac
cmp dword [eax], 0
jne 0x10035ba3
inc dword [ebp - 0x28]
xor eax, eax
inc eax
cmp dword [ebp - 0x28], eax
jle 0x10035b85
xor ebx, ebx
xor eax, eax
inc ebx
dec dword [ebp - 0x20]
jns 0x10035b69
dec dword [ebp - 0x38]
jns 0x10035b61
dec dword [ebp - 0x14]
jns 0x10035b59
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 0xb
call fcn.10019ca7
push ebx
lea ecx, [ebp - 0x524]
call fcn.10019c20
push 3
lea ecx, [ebp - 0xabc]
mov byte [ebp - 4], 0x13
call fcn.10019c20
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x14], eax
jmp 0x10035c03
push dword [ebp - 0x14]
call fcn.10019cac
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
lea ecx, [ebp - 0xabc]
jl 0x10035bf5
push ebx
call fcn.10019cac
push 2
pop ebx
mov dword [eax], 0xae355683
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x10035c6e
jmp 0x10035c2c
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10035c53
push eax
push eax
push 0x709
push eax
push 0x1df4
push eax
push 0xc8f
push 0x2f7
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 0x14]
lea ecx, [ebp - 0xabc]
call fcn.10019cac
cmp dword [eax], 0
jne 0x10035c6e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10035c2a
lea ecx, [ebp - 0xabc]
mov byte [ebp - 4], 0x13
call fcn.10019ca7
mov dword [ebp - 0x20], 5
xor eax, eax
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x44], 0xf5cbf793
mov dword [ebp - 0x28], 0x26cdee94
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x60], 0x23fe2983
mov dword [ebp - 0x4c], 0xee3e797a
mov dword [ebp - 0x14], eax
jmp 0x10035cd0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xdcc], 0xaeb8f83f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10035cbf
mov eax, dword [ebp - 0x20]
xor ecx, ecx
xor eax, eax
cmp dword [ebp - 0x20], eax
mov edx, eax
dec dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x20]
cmp eax, edx
setg cl
add ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x20]
jge 0x10035cfb
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ebx, ebx
cmp edx, eax
setne bl
sub ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x64]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
sub eax, ecx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setl dl
add edx, dword [ebp - 0x64]
neg edx
sbb edx, edx
neg edx
lea eax, [edx - 1]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0x15
jmp 0x1003605d
mov dword [ebp - 0x24], 0xf839313
xor eax, eax
mov dword [ebp - 0x38], eax
xor edx, edx
mov dword [ebp - 0x54], 0x722e0a50
inc edx
mov dword [ebp - 0x58], 0xd39d0e3e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10035d9b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x484], edx
inc dword [ebp - 0x14]
jmp 0x10035d86
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x64], eax
jne 0x10035daa
cmp dword [ebp - 0x24], eax
je 0x10035dac
mov eax, edx
push 4
pop ecx
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x584e
setne cl
cmp ecx, 0xdad3
jl 0x10035dcd
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10035dcf
mov eax, edx
mov dword [ebp - 0x28], eax
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x50]
cmp ecx, eax
mov esi, dword [ebp - 0x24]
setle dl
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
add esi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
cmp esi, eax
setg cl
add ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x18]
jne 0x10035e01
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x60]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x24]
jle 0x10035fa1
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10036067
mov dword [ebp - 0x24], 6
jmp 0x10035f95
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x990]
call fcn.10019c20
mov byte [ebp - 4], 0x15
xor eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10035e78
push dword [ebp - 0x14]
lea ecx, [ebp - 0x990]
call fcn.10019cac
mov dword [eax], 0xefb6675f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10035e5a
xor eax, eax
mov dword [ebp - 0x44], eax
jmp 0x10035f0c
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x10035f09
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x990]
mov eax, dword [ebp + eax*4 - 0xdcc]
xor eax, eax
push eax
call fcn.10019cac
xor ecx, ecx
cmp dword [eax], ecx
sete cl
xor eax, eax
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
je 0x10035ecd
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xfca6
setle al
xor edx, edx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x50]
cmp ecx, eax
setg dl
sub edx, 0x9074
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x3c], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10035e8f
xor eax, eax
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xfffffffa
jle 0x10035e80
mov dword [ebp - 0x480], 0x6f81
lea ecx, [ebp - 0x990]
mov eax, dword [ebp - 0xdcc]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x38], 0x2ba733a7
push eax
call fcn.10019cac
imul edx, dword [eax], 0xbda1
mov eax, dword [ebp - 0x28]
sub eax, 0x769e
neg eax
sbb eax, eax
inc eax
cmp ebx, eax
mov eax, dword [ebp - 0x38]
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x5c]
setg bl
add ebx, edx
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x48]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x990]
mov byte [ebp - 4], 0x13
call fcn.10019ca7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x19
jge 0x10035e2a
jmp 0x10035fbd
mov dword [ebp - 0x34], 0x25ba
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10036067
mov dword [ebp - 0x47c], 0xc75b897e
mov eax, dword [ebp - 0x60]
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10036011
mov eax, dword [ebp - 0x480]
mov eax, dword [ebp - 0x47c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x480]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x58]
jl 0x10036000
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10036002
inc eax
jmp 0x10036002
xor eax, eax
imul eax, eax, 0x868e
test eax, eax
jne 0x10036011
cmp dword [ebp - 0x28], eax
je 0x10036014
xor eax, eax
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0xdc8], 0xb4a0
jl 0x10036038
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x47c], eax
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x480]
cmp eax, ecx
setle dl
mov dword [ebp - 0x38], edx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 8
je 0x10035d66
xor eax, eax
mov dword [ebp - 0x14], eax
inc eax
cmp dword [ebp - 0x14], eax
jge 0x10036091
push dword [ebp - 0x14]
lea ecx, [ebp - 0x524]
call fcn.10019cac
mov dword [eax], 0x6444696a
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x10036072
mov dword [ebp - 0x34], 0x83c7730f
lea ecx, [ebp - 0x1084]
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0xcbad86e5
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x30], 0xffffffff
push eax
call fcn.10019c20
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x4c], 0x42ca8cda
mov dword [ebp - 0x14], eax
jmp 0x100360e7
push dword [ebp - 0x14]
call fcn.10019cac
or dword [eax], 0xffffffff
inc dword [ebp - 0x14]
xor eax, eax
lea ecx, [ebp - 0x1084]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x100360d9
mov dword [ebp - 0x34], 0xfffffffc
dec dword [ebp - 0x4c]
mov byte [ebp - 4], 0x13
call fcn.10019ca7
xor eax, eax
lea ecx, [ebp - 0x524]
push eax
call fcn.10019cac
and dword [eax], 0
jmp 0x10036539
mov dword [ebp - 0x20], 5
xor eax, eax
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x28], 0xf5cbf793
mov dword [ebp - 0x44], 0x26cdee94
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x64], 0x23fe2983
mov dword [ebp - 0x3c], 0xee3e797a
mov dword [ebp - 0x14], eax
jmp 0x10036171
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc64], 0xaeb8f83f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10036160
mov eax, dword [ebp - 0x20]
xor ecx, ecx
xor eax, eax
cmp dword [ebp - 0x20], eax
mov edx, eax
dec dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x20]
cmp eax, edx
setg cl
add ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x20]
jge 0x1003619c
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ebx, ebx
cmp edx, eax
setne bl
sub ebx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x58]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
sub eax, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setl dl
add edx, dword [ebp - 0x58]
neg edx
sbb edx, edx
neg edx
lea eax, [edx - 1]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0x15
jmp 0x100364fe
mov dword [ebp - 0x24], 0xf839313
xor eax, eax
mov dword [ebp - 0x50], eax
xor edx, edx
mov dword [ebp - 0x10], 0x722e0a50
inc edx
mov dword [ebp - 0x40], 0xd39d0e3e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1003623c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x430], edx
inc dword [ebp - 0x14]
jmp 0x10036227
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x58], eax
jne 0x1003624b
cmp dword [ebp - 0x24], eax
je 0x1003624d
mov eax, edx
push 4
pop ecx
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x584e
setne cl
cmp ecx, 0xdad3
jl 0x1003626e
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x10036270
mov eax, edx
mov dword [ebp - 0x44], eax
xor edx, edx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov esi, dword [ebp - 0x24]
setle dl
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
add esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmp esi, eax
setg cl
add ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x18]
jne 0x100362a2
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x64]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x24]
jle 0x10036442
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10036508
mov dword [ebp - 0x24], 6
jmp 0x10036436
push 2
pop ebx
push ebx
lea ecx, [ebp - 0xa98]
call fcn.10019c20
mov byte [ebp - 4], 0x17
xor eax, eax
inc eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10036319
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa98]
call fcn.10019cac
mov dword [eax], 0xefb6675f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100362fb
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x100363ad
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x100363aa
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xa98]
mov eax, dword [ebp + eax*4 - 0xc64]
xor eax, eax
push eax
call fcn.10019cac
xor ecx, ecx
cmp dword [eax], ecx
sete cl
xor eax, eax
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], eax
je 0x1003636e
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor eax, eax
inc eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xfca6
setle al
xor edx, edx
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setg dl
sub edx, 0x9074
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x4c], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10036330
xor eax, eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffffa
jle 0x10036321
mov dword [ebp - 0x42c], 0x6f81
lea ecx, [ebp - 0xa98]
mov eax, dword [ebp - 0xc64]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x50], 0x2ba733a7
push eax
call fcn.10019cac
imul edx, dword [eax], 0xbda1
mov eax, dword [ebp - 0x44]
sub eax, 0x769e
neg eax
sbb eax, eax
inc eax
cmp ebx, eax
mov eax, dword [ebp - 0x50]
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x5c]
setg bl
add ebx, edx
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x48]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0xa98]
mov byte [ebp - 4], 0x13
call fcn.10019ca7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x19
jge 0x100362cb
jmp 0x1003645e
mov dword [ebp - 0x34], 0x25ba
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10036508
mov dword [ebp - 0x428], 0xc75b897e
mov eax, dword [ebp - 0x64]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x100364b2
mov eax, dword [ebp - 0x42c]
mov eax, dword [ebp - 0x428]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x42c]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x40]
jl 0x100364a1
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x100364a3
inc eax
jmp 0x100364a3
xor eax, eax
imul eax, eax, 0x868e
test eax, eax
jne 0x100364b2
cmp dword [ebp - 0x44], eax
je 0x100364b5
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xc60], 0xb4a0
jl 0x100364d9
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x428], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x42c]
cmp eax, ecx
setle dl
mov dword [ebp - 0x50], edx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 8
je 0x10036207
xor eax, eax
lea ecx, [ebp - 0x524]
push eax
call fcn.10019cac
lea ecx, [ebp - 0xe8c]
push dword [eax]
call fcn.10019cac
lea ecx, [ebp - 0x524]
mov dword [eax], 0x5cbd9454
xor eax, eax
push eax
call fcn.10019cac
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x524]
push eax
call fcn.10019cac
push 2
pop ebx
cmp dword [eax], ebx
jl 0x1003611e
lea ecx, [ebp - 0x524]
mov byte [ebp - 4], 0xb
call fcn.10019ca7
push ebx
lea ecx, [ebp - 0x6e8]
call fcn.10019cac
inc dword [eax]
push ebx
lea ecx, [ebp - 0x6e8]
call fcn.10019cac
xor ebx, ebx
inc ebx
cmp dword [eax], ebx
jle 0x1003598a
lea ecx, [ebp - 0x6e8]
call fcn.10019ca7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8c]
call fcn.10019ca7
xor eax, eax
lea ecx, [ebp - 0x1218]
mov dword [ebp - 0x44], eax
push 4
mov dword [ebp - 0x28], 0x664dc9ed
mov dword [ebp - 0x34], eax
pop eax
push eax
call fcn.10019c20
xor eax, eax
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x14], eax
push 4
pop eax
cmp dword [ebp - 0x14], eax
jge 0x100365f3
push eax
pop ebx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1218]
call fcn.10019cac
mov dword [eax], 0x37a5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100365d4
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x44], eax
jne 0x10036613
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x44]
je 0x10036613
mov eax, ebx
jmp 0x10036615
xor eax, eax
cmp eax, 0xf9c28ade
push 3
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x28], eax
pop ebx
jmp 0x1003664d
mov dword [ebp - 0x44], eax
jmp 0x10036645
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10036642
push eax
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor eax, eax
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jle 0x1003662f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x1003662a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1218]
call fcn.10019ca7
mov dword [ebp - 0x38], 0x53b26bdd
mov dword [ebp - 0x30], 0x6318d581
mov dword [ebp - 0x30], 0xe8e1b881
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x16
jg 0x100366db
push 2
pop esi
mov dword [ebp - 0x30], 0x3ed1
mov dword [ebp - 0x30], 0x5a60d005
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x5c], 0xfeb9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100366cc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x183c], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100366b8
xor eax, eax
inc dword [ebp - 0x4c]
inc dword [ebp - 0x5c]
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x16
jle 0x1003668d
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x38], 0x4530
lea ecx, [ebp - 0xde4]
mov dword [ebp - 0x4c], eax
xor eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x5c], 7
push eax
call fcn.10019c20
xor eax, eax
mov dword [ebp - 4], 0x19
inc eax
lea ecx, [ebp - 0xc7c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0xa3a7
push eax
call fcn.10019c20
xor eax, eax
mov byte [ebp - 4], 0x1a
xor ebx, ebx
mov dword [ebp - 0x18], eax
inc ebx
cmp dword [ebp - 0x18], ebx
jge 0x10036751
push dword [ebp - 0x18]
lea ecx, [ebp - 0xde4]
call fcn.10019cac
mov dword [eax], ebx
xor eax, eax
inc dword [ebp - 0x18]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x18], eax
jl 0x10036732
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1003676d
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc7c]
call fcn.10019cac
mov dword [eax], 0x30b137d3
inc dword [ebp - 0x18]
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10036756
mov ecx, dword [ebp - 0x38]
mov esi, 0xb8f6
mov eax, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
add ecx, esi
cmp ecx, eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
setne bl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setl dl
add eax, 0x10994e85
add ebx, edx
add eax, ebx
sub eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x38]
jne 0x100367c2