Function at 0x10032587
Capabilities:
Allocate thread local storage
Create pipe
Get memory capacity
Get session user name
Parse pe header
Query environment variable

Disassembly:
mov eax, 0x1008e9e5
call fcn.1008d3c0
mov eax, 0x1644
call fcn.1008ac50
mov dword [ebp - 0x38], 0x847dfa86
xor eax, eax
mov dword [ebp - 0x38], 0x7bf0b96c
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 0x5043c4ab
mov dword [ebp - 0x64], 0xedcad208
mov dword [ebp - 0x44], 0xc9e53e58
mov dword [ebp - 0x10], 0x21a3
mov dword [ebp - 0x58], 0xd9935ff5
push ebx
mov dword [ebp - 0x28], 0xd36fbc6a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
push esi
push edi
mov byte [ebp - 0x85], dl
mov dword [ebp - 0x74], ecx
jge 0x1003260d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe24], 0xd2703d9b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100325f4
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1003262f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1104], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10032616
xor eax, eax
dec dword [ebp - 0x1100]
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 6
pop edx
push 3
pop edi
mov dword [ebp - 0x30], eax
push 1
pop ebx
cmp dword [ebp - 0x30], eax
jg 0x1003271b
mov dword [ebp - 0x3c], 0xb39e
mov dword [ebp - 0x54], 0x2506ed55
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x10], eax
jmp 0x10032673
mov dword [ebp - 0x54], 0x7fce
inc dword [ebp - 0x54]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x10032666
cmp dword [ebp - 0x3c], eax
jne 0x10032693
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0xe20]
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x10032695
mov eax, ebx
mov dword [ebp - 0x54], eax
xor ebx, ebx
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x64]
cmp ecx, eax
setne bl
sub ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
setl dl
imul eax, dword [ebp - 0x3c], 0x3f29
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x60], ecx
cmp dword [ebp - 0x60], eax
je 0x100326e6
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x100326df
push 0x90a
push eax
call esi
mov eax, dword [ebp - 0x60]
xor eax, eax
jmp 0x10032706
push 0xfffffffffffffffd
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x10], 0xfffffff8
pop ecx
jmp 0x10032701
cmp dword [ebp - 0x54], eax
jne 0x10032706
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x100326f9
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
push 0
pop eax
push 1
pop ebx
push 6
pop edx
jle 0x10032650
mov dword [ebp - 0x1c], 0xf5540d7f
mov dword [ebp - 0x38], 0xdce9d05b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x10032754
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1003274f
push eax
push eax
push 0x17fd
push 0x7b3
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10032731
push 4
lea ecx, [ebp - 0x150]
call fcn.10018753
xor eax, eax
mov dword [ebp - 4], eax
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10032791
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe38], 0x8948
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10032778
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x100327c3
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x100327a9
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xe38], 0
jne 0x100327c1
inc dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], ebx
jle 0x10032799
xor eax, eax
push 9
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0x37b1891f
mov dword [ebp - 0x38], 0x847dfa86
mov dword [ebp - 0x38], 0x7bf0b96c
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 0x5043c4ab
mov dword [ebp - 0x64], 0xedcad208
mov dword [ebp - 0x44], 0xc9e53e58
mov dword [ebp - 0x10], 0x21a3
mov dword [ebp - 0x58], 0xd9935ff5
mov dword [ebp - 0x28], 0xd36fbc6a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10032834
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe4c], 0xd2703d9b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003281b
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10032852
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1344], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003283d
xor eax, eax
dec dword [ebp - 0x1340]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x10032930
jmp 0x10032868
xor eax, eax
mov dword [ebp - 0x3c], 0xb39e
push 6
mov dword [ebp - 0x54], 0x2506ed55
pop ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x10], eax
jmp 0x1003288e
mov dword [ebp - 0x54], 0x7fce
inc dword [ebp - 0x54]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x10032881
cmp dword [ebp - 0x3c], eax
jne 0x100328ae
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0xe48]
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x100328b0
mov eax, ebx
mov dword [ebp - 0x54], eax
xor ebx, ebx
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x64]
cmp ecx, eax
setne bl
sub ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
setl dl
imul eax, dword [ebp - 0x3c], 0x3f29
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x60], ecx
cmp dword [ebp - 0x60], eax
je 0x10032901
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x100328fa
push 0x90a
push eax
call esi
mov eax, dword [ebp - 0x60]
xor eax, eax
jmp 0x10032921
push 0xfffffffffffffffd
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x10], 0xfffffff8
pop ecx
jmp 0x1003291c
cmp dword [ebp - 0x54], eax
jne 0x10032921
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x10032914
inc dword [ebp - 0x30]
push 1
pop ebx
cmp dword [ebp - 0x30], eax
jle 0x10032866
push edi
lea ecx, [ebp - 0x9d8]
call fcn.10018753
mov byte [ebp - 4], bl
xor eax, eax
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x38], 0xd1d4
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x10032985
push dword [ebp - 0x34]
lea ecx, [ebp - 0x150]
call fcn.100187f4
mov dword [eax], 0x824a8c6a
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x10032966
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
jge 0x100329a5
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x518], 0x6ccb0362
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x1003298d
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x100329c1
push dword [ebp - 0x34]
lea ecx, [ebp - 0x9d8]
call fcn.100187f4
mov dword [eax], 8
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x100329aa
push 2
lea ecx, [ebp - 0x150]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x150]
and dword [eax], 0
call fcn.100187f4
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
jmp 0x10032c2f
push 2
lea ecx, [ebp - 0x200]
call fcn.10018753
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x54], 0xa1a8
mov dword [ebp - 0x58], 5
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x10032a2c
push dword [ebp - 0x18]
call fcn.100187f4
mov dword [eax], 0xd225
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
lea ecx, [ebp - 0x200]
jl 0x10032a1b
push ebx
call fcn.100187f4
push ebx
lea ecx, [ebp - 0x200]
dec dword [eax]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x150]
call fcn.100187f4
xor eax, eax
lea ecx, [ebp - 0x200]
push eax
call fcn.100187f4
cmp dword [eax], 0
je 0x10032a86
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x200]
xor eax, eax
push eax
call fcn.100187f4
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x510]
mov ecx, dword [ebp - 0x514]
mov eax, dword [ebp - 0x510]
add eax, ecx
mov dword [ebp - 0x514], eax
jne 0x10032a9f
mov eax, dword [ebp - 0x54]
push ebx
lea ecx, [ebp - 0x200]
call fcn.100187f4
mov ecx, dword [ebp - 0x24]
xor ebx, ebx
shl ecx, 2
cmp ecx, dword [eax]
lea ecx, [ebp - 0x200]
setg bl
xor eax, eax
inc eax
push eax
call fcn.100187f4
xor ecx, ecx
push 2
cmp ebx, dword [eax]
sete cl
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x150]
mov eax, dword [ebp - 0x24]
call fcn.100187f4
xor eax, eax
lea ecx, [ebp - 0x150]
push eax
call fcn.100187f4
push 2
lea ecx, [ebp - 0x150]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x150]
call fcn.100187f4
xor ebx, ebx
lea ecx, [ebp - 0x150]
inc ebx
push ebx
call fcn.100187f4
mov ecx, dword [ebp - 0x510]
xor edx, edx
push 0xfffffffffffffff9
cmp ecx, dword [eax]
pop ecx
setg dl
xor eax, eax
cmp edx, ecx
push 6
setle al
pop ecx
cmp eax, ecx
jbe 0x10032bac
mov dword [ebp - 0x1c], ecx
xor eax, eax
push eax
lea ecx, [ebp - 0x150]
call fcn.100187f4
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax]
jne 0x10032b58
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10032b58
mov eax, dword [ebp - 0x1c]
push ebx
lea ecx, [ebp - 0x200]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x9d8]
call fcn.100187f4
xor eax, eax
lea ecx, [ebp - 0x200]
push eax
call fcn.100187f4
mov ecx, dword [ebp - 0x1c]
push ebx
imul ecx, dword [eax]
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x200]
call fcn.100187f4
mov ecx, dword [ebp - 0x58]
xor edx, edx
cmp ecx, dword [eax]
setg dl
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x510], eax
jmp 0x10032c05
mov dword [ebp - 0x24], 0xfffffffc
cmp dword [ebp - 0x24], 0xfffffff6
jle 0x10032bd4
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10032bcb
push eax
push eax
push eax
call edi
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff6
jg 0x10032bbb
mov dword [ebp - 0x24], 0xb
cmp dword [ebp - 0x24], 0x19
jle 0x10032c05
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10032bfc
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x19
jg 0x10032be3
lea ecx, [ebp - 0x200]
mov byte [ebp - 4], bl
call fcn.100187d8
push 2
lea ecx, [ebp - 0x150]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x150]
inc dword [eax]
call fcn.100187f4
cmp dword [eax], 0x1c
jne 0x100329ee
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0x9d8]
call fcn.100187d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.100187d8
mov dword [ebp - 0x2c], 0xffffffff
xor eax, eax
mov dword [ebp - 0x54], 0xdedfc3e8
mov dword [ebp - 0x44], 0x9e56e623
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffec
jge 0x10032d8f
push 0xfffffffffffffff9
pop edi
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x48], 9
jmp 0x10032d70
mov dword [ebp - 0x20], 0xd3f46721
lea ecx, [ebp - 0xba0]
mov dword [ebp - 0x54], 0x26d8d38
push 3
call fcn.10018753
push 3
pop ecx
xor eax, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10032cd5
push dword [ebp - 0x18]
lea ecx, [ebp - 0xba0]
call fcn.100187f4
mov dword [eax], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10032cba
xor eax, eax
mov dword [ebp - 0x20], 0x1b
jmp 0x10032d58
mov dword [ebp - 0x58], 0xbb6b
mov dword [ebp - 0x44], 0x7d19
mov dword [ebp - 0x18], eax
jmp 0x10032d02
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd5c], 0x3672d714
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10032cf1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x2c]
neg eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xd5c], eax
cmp eax, dword [ebp - 0x20]
je 0x10032d4d
push ebx
lea ecx, [ebp - 0xba0]
call fcn.100187f4
cmp dword [eax], 0
je 0x10032d4d
mov eax, ebx
jmp 0x10032d4f
xor eax, eax
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], 0x1b
jl 0x10032cde
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xba0]
call fcn.100187d8
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x17
jne 0x10032c8f
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffec
jl 0x10032c7c
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor eax, eax
mov dword [ebp - 0x38], 0x847dfa86
mov dword [ebp - 0x38], 0x7bf0b96c
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 0x5043c4ab
mov dword [ebp - 0x64], 0xedcad208
mov dword [ebp - 0x44], 0xc9e53e58
mov dword [ebp - 0x10], 0x21a3
mov dword [ebp - 0x58], 0xd9935ff5
mov dword [ebp - 0x28], 0xd36fbc6a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10032df3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd2c], 0xd2703d9b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10032dda
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10032e15
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1144], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10032dfc
xor eax, eax
dec dword [ebp - 0x1140]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x10032efa
push 6
pop edi
jmp 0x10032e2e
xor eax, eax
mov dword [ebp - 0x3c], 0xb39e
mov dword [ebp - 0x54], 0x2506ed55
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x10], eax
jmp 0x10032e51
mov dword [ebp - 0x54], 0x7fce
inc dword [ebp - 0x54]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x10032e44
cmp dword [ebp - 0x3c], eax
jne 0x10032e72
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0xd28]
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x10032e74
mov eax, ebx
mov dword [ebp - 0x54], eax
xor ebx, ebx
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x64]
cmp ecx, eax
setne bl
sub ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
setl dl
imul eax, dword [ebp - 0x3c], 0x3f29
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x60], ecx
cmp dword [ebp - 0x60], eax
je 0x10032ec5
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10032ebe
push 0x90a
push eax
call esi
mov eax, dword [ebp - 0x60]
xor eax, eax
jmp 0x10032ee5
push 0xfffffffffffffffd
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x10], 0xfffffff8
pop ecx
jmp 0x10032ee0
cmp dword [ebp - 0x54], eax
jne 0x10032ee5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x10032ed8
inc dword [ebp - 0x30]
push 1
pop ebx
cmp dword [ebp - 0x30], eax
jle 0x10032e2c
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 4
lea ecx, [ebp - 0x198]
call fcn.10018753
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x10], 0x37b1891f
mov dword [ebp - 0x1c], 0xf5540d7f
mov dword [ebp - 0x38], 0xdce9d05b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x10032f50
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10032f4b
push eax
push eax
push 0x17fd
push 0x7b3
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10032f2d
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x38], eax
push 2
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jge 0x10032f7c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1070], 0x8948
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10032f64
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jg 0x10032fb1
jmp 0x10032f89
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10032f99
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x1070], 0
jne 0x10032fb1
inc dword [ebp - 0x20]
xor eax, eax
inc eax
cmp dword [ebp - 0x20], eax
jle 0x10032f87
mov dword [ebp - 0x20], 9
lea ecx, [ebp - 0xa68]
push 3
call fcn.10018753
mov byte [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x38], 0x847dfa86
mov dword [ebp - 0x38], 0x7bf0b96c
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 0x5043c4ab
mov dword [ebp - 0x64], 0xedcad208
mov dword [ebp - 0x44], 0xc9e53e58
mov dword [ebp - 0x24], 0x21a3
mov dword [ebp - 0x58], 0xd9935ff5
mov dword [ebp - 0x28], 0xd36fbc6a
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1003302d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd40], 0xd2703d9b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10033015
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1003304f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x12a4], 9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10033036
xor eax, eax
dec dword [ebp - 0x12a0]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x10033137
xor edi, edi
jmp 0x10033067
xor eax, eax
mov dword [ebp - 0x3c], 0xb39e
push 6
mov dword [ebp - 0x54], 0x2506ed55
pop ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x24], eax
jmp 0x1003308d
mov dword [ebp - 0x54], 0x7fce
inc dword [ebp - 0x54]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x10033080
cmp dword [ebp - 0x3c], eax
jne 0x100330ae
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0xd3c]
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x100330b1
lea eax, [edi + 1]
mov dword [ebp - 0x54], eax
xor ebx, ebx
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x64]
cmp ecx, eax
setne bl
sub ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
setl dl
imul eax, dword [ebp - 0x3c], 0x3f29
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x60], ecx
cmp dword [ebp - 0x60], eax
je 0x10033102
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x100330fb
push 0x90a
push eax
call esi
mov eax, dword [ebp - 0x60]
xor eax, eax
jmp 0x10033122
push 0xfffffffffffffffd
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x24], 0xfffffff8
pop ecx
jmp 0x1003311d
cmp dword [ebp - 0x54], eax
jne 0x10033122
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x10033115
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x10033065
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 2
pop ebx
push 3
pop esi
mov dword [ebp - 0x38], 0xfffffff6
lea ecx, [ebp - 0xdc4]
mov dword [ebp - 0x38], esi
push ebx
call fcn.10018753
push 6
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x38], 0x13fe
mov dword [ebp - 0x54], 0x145c
mov dword [ebp - 0x58], 0xfffffff8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10033193
push dword [ebp - 0x24]
lea ecx, [ebp - 0xdc4]
call fcn.100187f4
mov dword [eax], 0xe19d29be
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10033175
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100331a9
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1578], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10033198
dec dword [ebp - 0x54]
lea ecx, [ebp - 0xdc4]
inc dword [ebp - 0x58]
mov byte [ebp - 4], 5
call fcn.100187d8
mov dword [ebp - 0x38], 0xfffffffc
lea ecx, [ebp - 0x9f0]
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x38], 0xd1d4
push esi
call fcn.10018753
xor eax, eax
mov byte [ebp - 4], 7
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10033213
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9f0]
call fcn.100187f4
mov dword [eax], 0xb9b55bb2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100331f5
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1003322e
push dword [ebp - 0x30]
lea ecx, [ebp - 0x9f0]
call fcn.100187f4
cmp dword [eax], 0
jne 0x10033233
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x10033218
lea ecx, [ebp - 0x9f0]
mov byte [ebp - 4], 5
call fcn.100187d8
xor eax, eax
lea ecx, [ebp - 0x584]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x58], 0x17ca4e86
mov dword [ebp - 0x38], 0x4795ed7
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x18], 0x7d1dc6b7
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x54], 0xca955a63
push esi
call fcn.10018753
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xc6c]
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x44], 0x8b474307
push ebx
call fcn.10018753
lea eax, [ebp - 0x1154]
mov byte [ebp - 4], 9
movdqa xmm0, xmmword [0x10008310]
lea ecx, [ebp - 0x1590]
push eax
lea eax, [ebp - 0x1164]
push eax
movdqu xmmword [ebp - 0x1164], xmm0
call fcn.10018803
lea ecx, [ebp - 0x24a]
mov esi, eax
call fcn.100094a3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xfa8]
push dword [esi]
call fcn.100187b2
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10033317
push dword [ebp - 0x24]
lea ecx, [ebp - 0x584]
call fcn.100187f4
mov dword [eax], 0x855eec80
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x100332f8
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10033333
push dword [ebp - 0x24]
lea ecx, [ebp - 0xc6c]
call fcn.100187f4
mov dword [eax], 0xfffb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1003331c
mov ecx, dword [ebp - 0x1c]
xor edx, edx
imul ecx, dword [ebp - 0x60]
sub ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor ebx, ebx
imul ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
lea ecx, [ebp - 0x584]
setle bl
xor eax, eax
inc eax
push eax
call fcn.100187f4
mov dword [eax], ebx
test ebx, ebx
je 0x100333af
xor eax, eax
lea ecx, [ebp - 0x584]
push eax
call fcn.100187f4
cmp dword [eax], 0
je 0x100333af
xor eax, eax
lea ecx, [ebp - 0x584]
push eax
call fcn.100187f4
cmp dword [eax], 0
jne 0x100333af
xor eax, eax
mov esi, eax
jmp 0x100333b4
xor eax, eax
lea esi, [eax + 1]
push eax
lea ecx, [ebp - 0xc6c]
call fcn.100187f4
neg esi
mov edx, dword [eax]
lea ecx, [edx + 1]
mov dword [eax], ecx
xor eax, eax
cmp edx, esi
lea edx, [eax + 1]
jl 0x100333d4
mov edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, edx
push 0xfffffffffffffff9
setg cl
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setl cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x58]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x3c]
jg 0x10033446
xor eax, eax
lea ecx, [ebp - 0x584]
inc eax
push eax
call fcn.100187f4
cmp dword [eax], 0
je 0x10033446
xor eax, eax
inc eax
mov esi, eax
jmp 0x1003344b
xor eax, eax
mov esi, eax
inc eax
push eax
lea ecx, [ebp - 0xfa8]
call fcn.100187f4
xor ecx, ecx
cmp esi, 0xf75d
setge cl
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x18]
cmp ecx, eax
lea ecx, [ebp - 0xfa8]
setl dl
sub edx, 0x5004
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x60], edx
call fcn.100187d8
lea ecx, [ebp - 0xc6c]
call fcn.100187d8
lea ecx, [ebp - 0x584]
mov byte [ebp - 4], 5
call fcn.100187d8
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x100334cb
push dword [ebp - 0x34]
lea ecx, [ebp - 0x198]
call fcn.100187f4
mov dword [eax], 0x824a8c6a
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x100334ac
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x3c], 0x2ef703c5
mov dword [ebp - 0x1c], 0xd66de6b9
mov dword [ebp - 0x60], 0xa6c65b0b
mov dword [ebp - 0x54], 0x32883e73
mov dword [ebp - 0x44], 0xd2ac30bc
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1003351f
push eax
push 0xc57
push 0x1601
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jg 0x100335ac
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
sub edx, 0xbc42
cmp edx, eax
setge cl
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
add ecx, 0xffff48e8
neg ecx
sbb ecx, ecx
add ecx, 0x9c4f5931
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x7b1b
setge al
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
jne 0x100335ac
xor ebx, ebx
xor eax, eax
inc ebx
jmp 0x100335b1
xor ebx, ebx
inc ebx
mov eax, ebx
mov edx, dword [ebp - 0x24]
xor ecx, ecx
add edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
push 3
setl cl
xor eax, eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x34], eax
pop ecx
cmp dword [ebp - 0x34], ecx
jge 0x100335e8
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x59c], 0x6ccb0362
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x100335d0
xor eax, eax
mov dword [ebp - 0x24], 0x3f4f46db
mov dword [ebp - 0x1c], 0x9687fd07
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10033616
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x29c], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100335fe
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100336b0
push ebx
lea ecx, [ebp - 0x524]
call fcn.10018753
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10033659
push dword [ebp - 0x18]
lea ecx, [ebp - 0x524]
call fcn.100187f4
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10033638
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x524]
call fcn.100187f4
and dword [eax], 0
jmp 0x1003368b
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1003367d
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
push eax
lea ecx, [ebp - 0x524]
call fcn.100187f4
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x524]
push eax
call fcn.100187f4
cmp dword [eax], 2
jle 0x1003366a
lea ecx, [ebp - 0x524]
mov byte [ebp - 4], 5
call fcn.100187d8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x1003361e
mov eax, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x298]
mov eax, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x298]
dec eax
jne 0x100336ec
cmp dword [ebp - 0x1c], eax
je 0x100336ee
mov eax, ebx
xor ecx, ecx
cmp eax, 0x5d87
mov eax, dword [ebp - 0x294]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x298]
setle dl
xor ecx, ecx
cmp eax, edx
mov edx, dword [ebp - 0x1c]
setne cl
add edx, ecx
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
cmp eax, ecx
setl dl
xor eax, eax
cmp edx, 0x14c3
setl al
sub eax, 0xd86b
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x29c]
jle 0x1003375f
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10033761
mov eax, ebx
jmp 0x10033761
xor eax, eax
mov dword [ebp - 0x29c], eax
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10033785
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa68]
call fcn.100187f4
mov dword [eax], 8
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x1003376e
mov dword [ebp - 0x38], 0xda115252
lea ecx, [ebp - 0xdd8]
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x38], 0x9aed23b6
mov dword [ebp - 0x38], 0x53072226
mov dword [ebp - 0x38], 5
push 2
call fcn.10018753
mov byte [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x18], eax
jmp 0x100337da
push dword [ebp - 0x18]
call fcn.100187f4
mov dword [eax], 0xe08cccdd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
lea ecx, [ebp - 0xdd8]
jl 0x100337c9
dec dword [ebp - 0x54]
mov byte [ebp - 4], 5
call fcn.100187d8
push 2
lea ecx, [ebp - 0x198]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x198]
and dword [eax], 0
call fcn.100187f4
cmp dword [eax], 0x1c
je 0x10035647
jmp 0x10033820
mov esi, dword [sym.imp.USER32.dll_GetDC]
push 2
lea ecx, [ebp - 0x118]
call fcn.10018753
mov byte [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1003386c
push dword [ebp - 0x18]
lea ecx, [ebp - 0x118]
call fcn.100187f4
mov dword [eax], 0xfffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1003384d
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jg 0x10033b97
mov dword [ebp - 0x40], 0xf1dbeccc
mov dword [ebp - 0x1c], 0xb6890635
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x54], 0xd4e203d7
mov dword [ebp - 0x40], eax
jmp 0x100338de
mov dword [ebp - 0x20], 0xcdcb363f
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x100338d6
push dword [ebp - 0x20]
lea ecx, [ebp - 0x118]
call fcn.100187f4
push dword [ebp - 0x20]
lea ecx, [ebp - 0x118]
mov esi, eax
call fcn.100187f4
mov ecx, dword [esi]
mov dword [eax], ecx
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jle 0x100338a4
xor ebx, ebx
xor eax, eax
inc ebx
cmp dword [ebp - 0x20], eax
jne 0x100338e3
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jle 0x10033895
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ebx
jg 0x10033b7f
xor eax, eax
inc eax
mov dword [ebp - 0x18], 0x1b185749
lea ecx, [ebp - 0x768]
push eax
call fcn.10018753
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x18], eax
jmp 0x10033927
push dword [ebp - 0x18]
lea ecx, [ebp - 0x768]
call fcn.100187f4
mov dword [eax], 0x8301
inc dword [ebp - 0x18]
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10033910
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x118]
push dword [ebp - 0x40]
call fcn.100187f4
push dword [ebp - 0x40]
xor edi, edi
lea ecx, [ebp - 0x118]
xor ebx, ebx
inc edi
cmp dword [eax], edi
sete bl
call fcn.100187f4
mov eax, dword [eax]
imul eax, ebx
imul eax, eax, 0x94bb
test eax, eax
je 0x10033981
push dword [ebp - 0x40]
lea ecx, [ebp - 0x118]
call fcn.100187f4
cmp dword [eax], 0
je 0x10033981
xor eax, eax
lea esi, [eax + 1]
jmp 0x10033985
xor eax, eax
mov esi, eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x118]
call fcn.100187f4
xor edx, edx
cmp esi, 0x3388
setl dl
xor ecx, ecx
add edx, 0x1932
imul edx, dword [ebp - 0x2c]
cmp dword [eax], edx
setne cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x118]
push dword [ebp - 0x40]
call fcn.100187f4
mov ecx, dword [ebp - 0x1c]
cmp dword [eax], ecx
jle 0x100339d5
push dword [ebp - 0x40]
lea ecx, [ebp - 0x118]
call fcn.100187f4
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setne dl
xor eax, eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x2c], eax
jmp 0x10033b53
mov dword [ebp - 0x3c], 0x3c6d
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x44], 0xa0ff8149
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10033a26
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3fc], 0x39ab1b57
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10033a08
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edi
jg 0x10033b3b
mov dword [ebp - 0x44], 0xffffffff
lea ecx, [ebp - 0x118]
push dword [ebp - 0x24]
call fcn.100187f4
push dword [ebp - 0x24]
lea ecx, [ebp - 0x118]
mov dword [eax], 0xca7a
call fcn.100187f4
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
sub eax, 0xffff611b
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x58], eax
je 0x10033a9e
push dword [ebp - 0x40]
lea ecx, [ebp - 0x118]
call fcn.100187f4
cmp dword [eax], 0
je 0x10033a9e
xor eax, eax
xor edi, edi
inc edi
lea esi, [eax + 1]
jmp 0x10033aa2
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x768]
call fcn.100187f4
mov eax, dword [eax]
add eax, esi
jne 0x10033ab7
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x768]
xor eax, eax
push eax
call fcn.100187f4
xor ecx, ecx
cmp dword [eax], edi
sete cl
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x768]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.100187f4
push dword [ebp - 0x24]
lea ecx, [ebp - 0x118]
call fcn.100187f4
cmp dword [eax], 0
jne 0x10033b0d
xor eax, eax
cmp dword [ebp - 0x3fc], eax
jne 0x10033b0d
mov ecx, eax
jmp 0x10033b12
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x24]
xor edx, edx
add ecx, 0xfffe
cmp ecx, eax
setle dl
xor eax, eax
mov dword [ebp - 0x44], edx
inc eax
inc dword [ebp - 0x30]
push eax
pop edi
cmp dword [ebp - 0x30], eax
jle 0x10033a32
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], eax
jl 0x10033b50
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x18]
jns 0x10033b43
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x100339ef
lea ecx, [ebp - 0x768]
mov byte [ebp - 4], 0xd
call fcn.100187d8
inc dword [ebp - 0x40]
xor eax, eax
inc eax
cmp dword [ebp - 0x40], eax
jle 0x100338f2
xor ebx, ebx
xor eax, eax
inc ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10033878
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov esi, dword [sym.imp.USER32.dll_GetDC]
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 5
call fcn.100187d8
push 2
lea ecx, [ebp - 0x210]
call fcn.10018753
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x1c], 0x72159124
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x64], 0xe6fc2e60
push 4
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10033bf0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe68], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10033bdf
cmp dword [ebp - 0x30], 0xfd2d
jne 0x10033c01
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 5
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xe68]
mov eax, dword [ebp - 0xe60]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xe68]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x64], ecx
push 0xfffffffffffffff9
mov dword [ebp - 0x58], 0xa1a8
pop eax
mov dword [ebp - 0x34], eax
push 6
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x24], 0x15a6
mov dword [ebp - 0x54], 0x8027
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x18], eax
jmp 0x10033c71
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf08], 0xebdb88dc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10033c60
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10033c89
xor ebx, ebx
lea edx, [eax + 1]
inc ebx
jmp 0x10033c8b
mov edx, eax
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setge cl
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setl dl
xor ecx, ecx
sub edx, 0xfff6
cmp edx, eax
setne cl
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
imul edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setne cl
xor eax, eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
je 0x10033cdc
cmp dword [ebp - 0x54], eax
je 0x10033cdc
mov eax, ebx
xor edx, edx
cmp eax, 0x161ab6ec
sete dl
add edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x54]
neg ecx
sbb ecx, ecx
inc ecx
neg ecx
mov dword [ebp - 0xf08], ecx
je 0x10033d62
mov dword [ebp - 0x24], ebx
xor eax, eax
cmp dword [ebp - 0x24], eax
jl 0x10033d42
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10033d3d
push eax
push 0xc57
push 0x1601
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
xor eax, eax
dec dword [ebp - 0x24]
jns 0x10033d17
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10033e14
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x10033e14
mov dword [ebp - 0x38], 0x14d41bd4
xor eax, eax
mov dword [ebp - 0x38], 0x74c3eec7
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10033d97
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1588], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10033d7e
xor eax, eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], eax
jl 0x10033e14
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0xc29ba1f1
mov dword [ebp - 0x24], eax
jmp 0x10033df2
mov dword [ebp - 0x38], 0x1d89e177
mov dword [ebp - 0x38], 0xe52275dd
mov dword [ebp - 0x54], 0x42f53403
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10033dec
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1630], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10033dd3
xor eax, eax
dec dword [ebp - 0x54]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10033db5
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10033e0f
push ebx
push 0x2547
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x10033d9f
mov dword [ebp - 0x54], 5
lea ecx, [ebp - 0x56c]
push ebx
call fcn.10018753
push 2
lea ecx, [ebp - 0xa08]
mov byte [ebp - 4], 0x10
call fcn.10018753
mov byte [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x48], eax
mov ecx, 0xffff
mov dword [ebp - 0x38], 0x2891f433
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x10033e76
push dword [ebp - 0x34]
lea ecx, [ebp - 0x56c]
call fcn.100187f4
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x34]
inc eax
cmp dword [ebp - 0x34], eax
jl 0x10033e58
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10033e9b
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa08]
call fcn.100187f4
or dword [eax], 0xffffffff
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jl 0x10033e7f
xor eax, eax
push 3
mov dword [ebp - 0x34], eax
pop ebx
cmp dword [ebp - 0x34], ebx
jge 0x10033ebe
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1620], 0xcd1d2a6f
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x10033ea6
xor eax, eax
push eax
lea ecx, [ebp - 0x56c]
call fcn.100187f4
mov dword [eax], 0x16
jmp 0x10033f16
xor eax, eax
mov dword [ebp - 0x18], 0xffffffff
inc eax
mov dword [ebp - 0x38], 0x4f3d4e67
mov dword [ebp - 0x18], eax
jmp 0x10033f00
push eax
lea ecx, [ebp - 0xa08]
call fcn.100187f4
push 1
mov dword [eax], 0xb4b5a9ce
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], 4
jl 0x10033ee8
xor eax, eax
lea ecx, [ebp - 0x56c]
push eax
call fcn.100187f4
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x56c]
push eax
call fcn.100187f4
cmp dword [eax], 0x14
jge 0x10033ed2
mov dword [ebp - 0x48], 0xffffffee
cmp dword [ebp - 0x48], ebx
je 0x10033f80
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x38], 0x254e
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10033f6f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdb0], edi
xor eax, eax
inc dword [ebp - 0x18]
inc eax
push eax
pop edi
cmp dword [ebp - 0x18], eax
jl 0x10033f53
xor edi, edi
xor eax, eax
inc edi
inc dword [ebp - 0x54]
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
jne 0x10033f3a
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea ecx, [ebp - 0xa08]
call fcn.100187d8
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 0xf
call fcn.100187d8
mov dword [ebp - 0x54], 0xffffffff
xor eax, eax
mov dword [ebp - 0x2c], 0x2e0cf572
cmp dword [ebp - 0x2c], eax
mov byte [ebp - 0x49], al
je 0x10033fd4
cmp byte [ebp - 0x49], al
je 0x10033ffc
push eax
push 0x1a0a
push 0x1f2a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
jmp 0x10033ffa
cmp byte [ebp - 0x49], al
je 0x10033ffc
push 0x1c69
push eax
push 0x1756
push 0x165f
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x2c], eax
inc ebx
cmp dword [ebp - 0x2c], 0x14
jg 0x1003404d
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], 0xa29f5838
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
sub ecx, 0xfffffff8
neg ecx
sbb ecx, ecx
sub eax, 0xb513
inc ecx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x44], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x14
jle 0x10034008
xor eax, eax
push 0xfffffffffffffff9
mov dword [ebp - 0x24], 0x52cb1363
pop ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1003407c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x328], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10034063
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1003408e
push eax
call dword [sym.imp.USER32.dll_ShowCursor]
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x100341f1
push 0xfffffffffffffff9
pop edi
mov dword [ebp - 0x30], 0x6c4779d4
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x328]
mov eax, dword [ebp - 0x24]
test eax, eax
sets cl
xor eax, eax
cmp ecx, 2
setl al
xor ecx, ecx
cmp eax, ebx
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x328]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x328]
cmp eax, edx
sete cl
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
imul edx, dword [ebp + eax*4 - 0x328], 0x209c
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x328]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl cl
imul ecx, ecx, 0xa
mov eax, dword [ebp + eax*4 - 0x328]
sub eax, ecx
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], eax
jl 0x100341e0
mov dword [ebp - 0x1c], 0xd370
lea ecx, [ebp - 0xb7c]
push 4
call fcn.10018753
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x18], eax
jmp 0x10034161
push dword [ebp - 0x18]
call fcn.100187f4
mov dword [eax], 0x6eae1177
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
lea ecx, [ebp - 0xb7c]
jl 0x10034150
push ebx
call fcn.100187f4
xor ecx, ecx
mov dword [eax], 0xfffffffc
mov eax, dword [ebp - 0x1c]
test eax, eax
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
sub eax, ecx
inc eax
neg eax
sbb eax, eax
inc eax
sub eax, edi
neg eax
sbb eax, eax
add eax, 0xa3b48658
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
imul eax, eax, 7
cmp eax, 0x2f4e55b6
setl cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0xb7c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xf
call fcn.100187d8
dec dword [ebp - 0x30]
jns 0x10034131
dec dword [ebp - 0x24]
jns 0x1003409d
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10034219
push dword [ebp - 0x18]
lea ecx, [ebp - 0x210]
call fcn.100187f4
mov dword [eax], 0xd225
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100341fa
xor eax, eax
mov dword [ebp - 0x1c], 0x72159124
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x64], 0xe6fc2e60
push 4
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10034251
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe84], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10034240
cmp dword [ebp - 0x30], 0xfd2d
jne 0x10034262
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 5
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xe84]
mov eax, dword [ebp - 0xe7c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xe84]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x64], ecx
lea ecx, [ebp - 0x210]
push ebx
call fcn.100187f4
push ebx
lea ecx, [ebp - 0x210]
dec dword [eax]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x198]
call fcn.100187f4
xor eax, eax
lea ecx, [ebp - 0x210]
push eax
call fcn.100187f4
cmp dword [eax], 0
je 0x100342ea
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x210]
xor eax, eax
push eax
call fcn.100187f4
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x594]
mov ecx, dword [ebp - 0x598]
mov eax, dword [ebp - 0x594]
add eax, ecx
mov dword [ebp - 0x598], eax
jne 0x10034303
mov eax, dword [ebp - 0x58]
push ebx
lea ecx, [ebp - 0x210]
call fcn.100187f4
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
shl ecx, 2
cmp ecx, dword [eax]
lea ecx, [ebp - 0x210]
setg bl
xor eax, eax
inc eax
push eax
call fcn.100187f4
xor ecx, ecx
push 2
cmp ebx, dword [eax]
sete cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x198]
mov eax, dword [ebp - 0x10]
call fcn.100187f4
xor eax, eax
lea ecx, [ebp - 0x198]
push eax
call fcn.100187f4
push 2
lea ecx, [ebp - 0x198]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x198]
call fcn.100187f4
xor ebx, ebx
lea ecx, [ebp - 0x198]
inc ebx
push ebx
call fcn.100187f4
mov ecx, dword [ebp - 0x594]
xor edx, edx
push 0xfffffffffffffff9
cmp ecx, dword [eax]
pop ecx
setg dl
xor eax, eax
cmp edx, ecx
push 6
setle al
pop ecx
cmp eax, ecx
jbe 0x100346e7
mov dword [ebp - 0x48], 7
lea ecx, [ebp - 0xde8]
push ebx
call fcn.10018753
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100343e3
push dword [ebp - 0x18]
lea ecx, [ebp - 0xde8]
call fcn.100187f4
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100343c2
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x16
jne 0x10034513
push 0xfffffffffffffff9
pop edi
jmp 0x100343f7
xor eax, eax
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0xfc0]
push 3
call fcn.10018753
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x38], 0x1e19e95d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1003443c
push dword [ebp - 0x18]
lea ecx, [ebp - 0xfc0]
call fcn.100187f4
mov dword [eax], 0x3de0369b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003441d
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10034457
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x100344e7
push 2
lea ecx, [ebp - 0x53c]
call fcn.10018753
mov byte [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x54], 8
mov dword [ebp - 0x18], eax
jmp 0x1003448b
push dword [ebp - 0x18]
call fcn.100187f4
mov dword [eax], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
lea ecx, [ebp - 0x53c]
jl 0x1003447e
push ebx
call fcn.100187f4
and dword [eax], 0
jmp 0x100344c1
xor ecx, ecx
mov dword [ebp - 0x44], ebx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
push ebx
sbb eax, eax
lea ecx, [ebp - 0x53c]
neg eax
mov dword [ebp - 0x44], eax
call fcn.100187f4
dec dword [eax]
push ebx
lea ecx, [ebp - 0x53c]
call fcn.100187f4
cmp dword [eax], 0xffffffef
je 0x100344a2
inc dword [ebp - 0x54]
lea ecx, [ebp - 0x53c]
mov byte [ebp - 4], 0x14
call fcn.100187d8
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xf
jne 0x1003445f
lea ecx, [ebp - 0xfc0]
mov byte [ebp - 4], 0x13
call fcn.100187d8
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x16
je 0x100343f5
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea ecx, [ebp - 0xde8]
mov byte [ebp - 4], 0xf
call fcn.100187d8
push 6
pop eax
mov dword [ebp - 0x1c], eax
mov eax, 0x5969a22d
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x7dc], eax
mov dword [ebp - 0x7d8], eax
mov dword [ebp - 0x7d4], eax
mov dword [ebp - 0x7d0], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x19
jl 0x10034673
mov dword [ebp - 0x24], 0x4fdd
cmp dword [ebp - 0x24], eax
jne 0x10034571
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
test eax, eax
setns cl
xor eax, eax
cmp ecx, 9
setne al
cmp eax, dword [ebp - 0x20]
jl 0x100345f4
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x1003462f
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x7dc], 0
je 0x100345ca
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x100345e9
push 0x639
push 0x833
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
jmp 0x100345e9
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x100345e9
push 0x129
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x100345a0
jmp 0x1003462d
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x1003461e
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x7dc]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x7dc], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x100345ff
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1003462d
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1003465d
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1003465a
push 0xf5d
push 0xa39
push 0x1c9
push 0x19b7
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x20
jle 0x10034634
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x19
push 0
pop eax
jge 0x10034562
push eax
lea ecx, [ebp - 0x198]
call fcn.100187f4
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax]
jne 0x10034690
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10034690
mov eax, dword [ebp - 0x1c]
push ebx
lea ecx, [ebp - 0x210]
call fcn.100187f4
push 2
lea ecx, [ebp - 0xa68]
call fcn.100187f4
xor eax, eax
lea ecx, [ebp - 0x210]
push eax
call fcn.100187f4
mov ecx, dword [ebp - 0x1c]
push ebx
imul ecx, dword [eax]
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x210]
call fcn.100187f4
mov ecx, dword [ebp - 0x54]
xor edx, edx
cmp ecx, dword [eax]
setg dl
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x594], eax
jmp 0x10035613
movdqa xmm0, xmmword [0x10008270]
lea eax, [ebp - 0x1394]
push eax
lea eax, [ebp - 0x13a4]
push eax
lea ecx, [ebp - 0x14b0]
movdqu xmmword [ebp - 0x13a4], xmm0
call fcn.10018803
lea ecx, [ebp - 0x243]
mov esi, eax
call fcn.100094a3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1424]
push dword [esi]
call fcn.100187b2
mov dword [ebp - 0x18], 0xffffffff
xor eax, eax
push 3
mov dword [ebp - 0x38], 0xb950ba1b
mov dword [ebp - 0x18], eax
pop esi
jmp 0x1003475d
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1003475a
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10034746
lea ecx, [ebp - 0x1424]
call fcn.100187d8
mov dword [ebp - 0x10], 0xfffffffc
jmp 0x10034dc3
mov dword [ebp - 0x2c], 0x1928c176
mov dword [ebp - 0x44], 0x57863718
mov dword [ebp - 0x2c], eax
jmp 0x10034854
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x44], 0xbaef6e22
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff0
jle 0x10034851
mov dword [ebp - 0x20], 0x80849f84
mov dword [ebp - 0x64], 0x6f9b6917
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x17
jne 0x10034841
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100347e2
mov ecx, 0xffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd54], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100347cf
mov eax, dword [ebp - 0x30]
xor ebx, ebx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xd50]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setl bl
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x64], ecx
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10034835
push 0x38c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x17
push 0
pop eax
je 0x100347c1
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff0
jg 0x100347a6
xor ebx, ebx
inc ebx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffea
jne 0x1003478f
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x30], 0x1f7e2799
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xa
jg 0x10034a37
mov dword [ebp - 0x474], 0xffffffff
mov dword [ebp - 0x470], 0xffffffff
mov dword [ebp - 0x46c], 0xffffffff
mov dword [ebp - 0x468], 0xffffffff
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0xffffffeb
jg 0x10034a1b
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x44], 0xffffffff
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x100348d7
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x18
jge 0x10034a05
push 2
lea ecx, [ebp - 0x720]
call fcn.10018753
xor eax, eax
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1003491b
push dword [ebp - 0x24]
lea ecx, [ebp - 0x720]
call fcn.100187f4
mov dword [eax], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10034900
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10034931
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6fc], 0xab06
inc dword [ebp - 0x24]
xor eax, eax
inc eax
cmp dword [ebp - 0x24], eax
jl 0x10034920
mov ecx, dword [ebp - 0x6fc]
xor edx, edx
mov eax, dword [ebp - 0x44]
cmp ecx, eax
setle dl
cmp dword [ebp - 0x30], edx
jle 0x10034969
dec dword [ebp - 0x474]
cmp dword [ebp - 0x474], 0xffffffeb
push 1
pop ebx
jle 0x100348bb
mov dword [ebp - 0x474], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xa
jle 0x1003487d
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 3
pop esi
mov byte [ebp - 0x11], al
mov dword [ebp - 0x18], 0x31713b91
mov dword [ebp - 0x44], 0x1c76d7be
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff4
jge 0x10034a88
mov dword [ebp - 0x44], 0xe838
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10034a76
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff4
push 0
pop eax
jl 0x10034a51
cmp byte [ebp - 0x11], 0
je 0x10034dbd
mov dword [ebp - 0x34], 0xb0ceafd9
lea ecx, [ebp - 0x5e4]
mov dword [ebp - 0x20], 0x6923607a
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x58], 0xfffffffe
mov dword [ebp - 0x2c], 0xc51938d1
push ebx
call fcn.10018753
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x30], 0x662b0a94
mov dword [ebp - 0x1c], 0x3e2ca52c
push 0xfffffffffffffff9
mov dword [ebp - 0x40], 5
pop eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10034afe
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x408], 0xcbcef054
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10034ae6
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10034b17
push dword [ebp - 0x24]
lea ecx, [ebp - 0x5e4]
call fcn.100187f4
or dword [eax], 0xffffffff
inc dword [ebp - 0x24]
xor eax, eax
inc eax
cmp dword [ebp - 0x24], eax
jl 0x10034b03
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setg dl
xor ecx, ecx
mov dword [ebp - 0x408], edx
mov eax, dword [ebp - 0x34]
cmp edx, eax
setge cl
xor eax, eax
add ecx, dword [ebp - 0x34]
cmp ecx, 0xc809
jg 0x10034d82
dec dword [ebp - 0x10]
push 1
pop ebx
xor eax, eax
cmp dword [ebp - 0x10], 0xfffffff6
jg 0x10034779
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0x46e74a6
inc dword [ebp - 0x34]
mov dword [ebp - 0x34], 2
cmp dword [ebp - 0x34], 0x12
jle 0x10034f29
xor edi, edi
inc edi
xor eax, eax
mov dword [ebp - 0x10], 0x2fd4914d
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], eax
jmp 0x10034f06
mov dword [ebp - 0x20], edi
xor edx, edx
mov dword [ebp - 0x2c], 0xe737
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setge cl
xor eax, eax
sub ecx, dword [ebp - 0x20]
add ecx, 0xcf04
je 0x10034e46
cmp dword [ebp - 0x10], 0x18
jle 0x10034e05
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x12
jg 0x10034df1
mov dword [ebp - 0x10], 0xb
cmp dword [ebp - 0x10], 0x19
jle 0x10035610
push 0xfffffffffffffffd
pop edi
mov dword [ebp - 0x48], 0xfffffffb
lea ecx, [ebp - 0xdf8]
mov dword [ebp - 0x38], 0xf7e7308f
push 4
call fcn.10018753
xor eax, eax
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10034f86
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdf8]
call fcn.100187f4
mov dword [eax], 0xd7d711e7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10034f67
push 0xfffffffffffffff5
mov dword [ebp - 0x48], 0xffffffef
pop ebx
cmp dword [ebp - 0x48], ebx
jl 0x1003502c
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 5
call fcn.100187d8
push 2
lea ecx, [ebp - 0x198]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x198]
inc dword [eax]
call fcn.100187f4
cmp dword [eax], 0x1c
jne 0x1003381a
mov dword [ebp - 0x30], 0x30f9
lea ecx, [ebp - 0x8c0]
mov dword [ebp - 0x3c], 0x43d9532b
xor eax, eax
mov dword [ebp - 0x10], 5
push 3
mov dword [ebp - 0x2c], eax
pop esi
mov dword [ebp - 0x54], 0x3a79cc09
mov dword [ebp - 0x24], 0xd40a7f
mov dword [ebp - 0x58], 0x8e65
push esi
call fcn.10018753
push 4
lea ecx, [ebp - 0x68c]
mov byte [ebp - 4], 0x20
call fcn.10018753
xor eax, eax
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x100356c2
push dword [ebp - 0x34]
lea ecx, [ebp - 0x8c0]
call fcn.100187f4
mov dword [eax], 0x92f5726b
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x100356a4
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x100356e7
push dword [ebp - 0x34]
lea ecx, [ebp - 0x68c]
call fcn.100187f4
or dword [eax], 0xffffffff
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x100356cb
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x100356fd
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x3f4], 0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x100356ec
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x13
jge 0x10035893
mov dword [ebp - 0x20], 0x3a92bd42
lea ecx, [ebp - 0x554]
mov dword [ebp - 0x1c], 0x80366e52
push esi
call fcn.10018753
mov byte [ebp - 4], 0x22
xor eax, eax
mov dword [ebp - 0x50], 0xae9ec2b4
mov dword [ebp - 0x18], eax
jmp 0x1003575e
push dword [ebp - 0x18]
lea ecx, [ebp - 0x554]
call fcn.100187f4
mov dword [eax], 0xcdb59559
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10035747
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x30], ebx
jne 0x1003577b
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1003577b
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20], 3
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x1c]
imul edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x54]
cmp eax, edx
setge cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x58]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x1c]
cmp ecx, 0x734e2e0f
jl 0x100357c2
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x2c], eax
jg 0x100357db
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x100357dd
mov ecx, ebx
jmp 0x100357df
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, esi
setl al
cmp eax, 0xffff4930
jl 0x10035900
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
sub edx, 7
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setg cl
xor eax, eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
je 0x10035842
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10035934
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetParent]
xor ebx, ebx
inc ebx
jmp 0x10035934
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jne 0x10035856
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x60]
jne 0x10035856
mov ecx, eax
jmp 0x10035858
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
sub ecx, eax
add ecx, dword [ebp - 0x60]
jne 0x10035869
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1003586b
mov eax, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], ebx
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10035934
lea ecx, [ebp - 0x554]
call fcn.100187d8
lea ecx, [ebp - 0x68c]
call fcn.100187d8
lea ecx, [ebp - 0x8c0]
call fcn.100187d8
inc dword [ebp - 0x28]
lea ecx, [ebp - 0xa68]
call fcn.100187d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x198]
call fcn.100187d8
mov dword [ebp - 0x20], 0x7f6af112
xor eax, eax
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100358f8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x970], 0xa75c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100358df
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10035a66
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10035915
push 0x10b
call dword [sym.imp.USER32.dll_MessageBeep]
push ebx
lea ecx, [ebp - 0x8c0]
call fcn.100187f4
imul ecx, dword [ebp - 0x24], 0x9405
cmp ecx, 0xad1dc2cb
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
push esi
lea ecx, [ebp - 0x68c]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x554]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x554]
call fcn.100187f4
xor eax, eax
lea ecx, [ebp - 0x8c0]
push eax
call fcn.100187f4
inc dword [ebp - 0x3f4]
lea ecx, [ebp - 0x68c]
mov eax, dword [ebp - 0x50]
push ebx
call fcn.100187f4
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0x554]
push 2
call fcn.100187f4
mov ecx, dword [ebp - 0x2c]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x68c]
setge bl
xor eax, eax
push eax
call fcn.100187f4
lea ecx, [ebp - 0x554]
mov byte [ebp - 4], 0x21
mov dword [eax], ebx
call fcn.100187d8
inc dword [ebp - 0x10]
xor ebx, ebx
inc ebx
jmp 0x10035711
mov dword [ebp - 0x1c], 0xdd3f4672
mov dword [ebp - 0x28], 0x22db785b
mov dword [ebp - 0x50], 0x5429
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100359e8
push eax
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
xor eax, eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x10035a63
mov dword [ebp - 0x18], eax
jmp 0x10035a06
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xff0], 0xb04800fa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100359f5
inc dword [ebp - 0xfec]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0xafa3
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
add ecx, dword [ebp - 0x970]
je 0x10035a42
cmp dword [ebp - 0x970], eax
je 0x10035a42
mov eax, ebx
imul eax, eax, 0x226c
xor ecx, ecx
push 0
cmp eax, 0xd238
setne cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x1c]
pop eax
jns 0x100359f0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x19
jg 0x100359c1
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10035a82
push eax
call esi
push 4
lea ecx, [ebp - 0x180]
call fcn.10018753
mov dword [ebp - 4], 0x23
lea ecx, [ebp - 0xbac]
mov dword [ebp - 0x10], 0x37b1891f
push 3
call fcn.10018753
mov byte [ebp - 4], 0x24
xor eax, eax
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x38], 0xd1d4
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x10035af4
push dword [ebp - 0x34]
lea ecx, [ebp - 0x180]
call fcn.100187f4
mov dword [eax], 0x824a8c6a
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x10035ad5
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x10035b16
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x500], 0x6ccb0362
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x10035afd
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10035b32
push dword [ebp - 0x34]
lea ecx, [ebp - 0xbac]
call fcn.100187f4
mov dword [eax], 8
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x10035b1b
push 2
lea ecx, [ebp - 0x180]
call fcn.100187f4
and dword [eax], 0
jmp 0x10035d82
push 2
lea ecx, [ebp - 0x220]
call fcn.10018753
mov byte [ebp - 4], 0x25
xor eax, eax
mov dword [ebp - 0x28], 0xa1a8
mov dword [ebp - 0x54], 5
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x10035b8b
push dword [ebp - 0x18]
call fcn.100187f4
mov dword [eax], 0xd225
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
lea ecx, [ebp - 0x220]
jl 0x10035b7a
push ebx
call fcn.100187f4
push ebx
lea ecx, [ebp - 0x220]
dec dword [eax]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x180]
call fcn.100187f4
xor eax, eax
lea ecx, [ebp - 0x220]
push eax
call fcn.100187f4
cmp dword [eax], 0
je 0x10035be5
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x220]
xor eax, eax
push eax
call fcn.100187f4
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4f8]
mov ecx, dword [ebp - 0x4fc]
mov eax, dword [ebp - 0x4f8]
add eax, ecx
mov dword [ebp - 0x4fc], eax
jne 0x10035bfe
mov eax, dword [ebp - 0x28]
push ebx
lea ecx, [ebp - 0x220]
call fcn.100187f4
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
shl ecx, 2
cmp ecx, dword [eax]
lea ecx, [ebp - 0x220]
setg bl
xor eax, eax
inc eax
push eax
call fcn.100187f4
xor ecx, ecx
push 2
cmp ebx, dword [eax]
sete cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x180]
mov eax, dword [ebp - 0x10]
call fcn.100187f4
xor eax, eax
lea ecx, [ebp - 0x180]
push eax
call fcn.100187f4
push 2
lea ecx, [ebp - 0x180]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x180]
call fcn.100187f4
xor ebx, ebx
lea ecx, [ebp - 0x180]
inc ebx
push ebx
call fcn.100187f4
mov ecx, dword [ebp - 0x4f8]
xor edx, edx
push 0xfffffffffffffff9
cmp ecx, dword [eax]
pop ecx
setg dl
xor eax, eax
cmp edx, ecx
push 6
setle al
pop ecx
cmp eax, ecx
jbe 0x10035d0b
mov dword [ebp - 0x1c], ecx
xor eax, eax
push eax
lea ecx, [ebp - 0x180]
call fcn.100187f4
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax]
jne 0x10035cb7
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10035cb7
mov eax, dword [ebp - 0x1c]
push ebx
lea ecx, [ebp - 0x220]
call fcn.100187f4
push 2
lea ecx, [ebp - 0xbac]
call fcn.100187f4
xor eax, eax
lea ecx, [ebp - 0x220]
push eax
call fcn.100187f4
mov ecx, dword [ebp - 0x1c]
push ebx
imul ecx, dword [eax]
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x220]
call fcn.100187f4
mov ecx, dword [ebp - 0x54]
xor edx, edx
cmp ecx, dword [eax]
setg dl
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x4f8], eax
jmp 0x10035d64
mov dword [ebp - 0x10], 0xfffffffc
cmp dword [ebp - 0x10], 0xfffffff6
jle 0x10035d33
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10035d2a
push eax
push eax
push eax
call edi
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff6
jg 0x10035d1a
mov dword [ebp - 0x10], 0xb
cmp dword [ebp - 0x10], 0x19
jle 0x10035d64
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10035d5b
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x19
jg 0x10035d42
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0x24
call fcn.100187d8
push 2
lea ecx, [ebp - 0x180]
call fcn.100187f4
inc dword [eax]
push 2
lea ecx, [ebp - 0x180]
call fcn.100187f4
cmp dword [eax], 0x1c
jne 0x10035b4d
inc dword [ebp - 0x58]
lea ecx, [ebp - 0xbac]
call fcn.100187d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x180]
call fcn.100187d8
push 4
lea ecx, [ebp - 0x1b0]
call fcn.10018753
mov dword [ebp - 4], 0x26
lea ecx, [ebp - 0xa80]
mov dword [ebp - 0x10], 0x37b1891f
push 3
call fcn.10018753
mov byte [ebp - 4], 0x27
xor eax, eax
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x38], 0xd1d4
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x10035e27
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1b0]
call fcn.100187f4
mov dword [eax], 0x824a8c6a
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x10035e08
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x10035e49
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x4f4], 0x6ccb0362
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x10035e30
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10035e65
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa80]
call fcn.100187f4
mov dword [eax], 8
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x10035e4e
push 2
lea ecx, [ebp - 0x1b0]
call fcn.100187f4
and dword [eax], 0
jmp 0x100360b5
push 2
lea ecx, [ebp - 0x230]
call fcn.10018753
mov byte [ebp - 4], 0x28
xor eax, eax
mov dword [ebp - 0x28], 0xa1a8
mov dword [ebp - 0x54], 5
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x10035ebe
push dword [ebp - 0x18]
call fcn.100187f4
mov dword [eax], 0xd225
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
lea ecx, [ebp - 0x230]
jl 0x10035ead
push ebx
call fcn.100187f4
push ebx
lea ecx, [ebp - 0x230]
dec dword [eax]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x1b0]
call fcn.100187f4
xor eax, eax
lea ecx, [ebp - 0x230]
push eax
call fcn.100187f4
cmp dword [eax], 0
je 0x10035f18
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x230]
xor eax, eax
push eax
call fcn.100187f4
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [ebp - 0x4f0]
mov eax, dword [ebp - 0x4ec]
add eax, ecx
mov dword [ebp - 0x4f0], eax
jne 0x10035f31
mov eax, dword [ebp - 0x28]
push ebx
lea ecx, [ebp - 0x230]
call fcn.100187f4
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
shl ecx, 2
cmp ecx, dword [eax]
lea ecx, [ebp - 0x230]
setg bl
xor eax, eax
inc eax
push eax
call fcn.100187f4
xor ecx, ecx
push 2
cmp ebx, dword [eax]
sete cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x1b0]
mov eax, dword [ebp - 0x10]
call fcn.100187f4
xor eax, eax
lea ecx, [ebp - 0x1b0]
push eax
call fcn.100187f4
push 2
lea ecx, [ebp - 0x1b0]
call fcn.100187f4
push 2
lea ecx, [ebp - 0x1b0]
call fcn.100187f4
xor ebx, ebx
lea ecx, [ebp - 0x1b0]
inc ebx
push ebx
call fcn.100187f4
mov ecx, dword [ebp - 0x4ec]
xor edx, edx
push 0xfffffffffffffff9
cmp ecx, dword [eax]
pop ecx
setg dl
xor eax, eax
cmp edx, ecx
push 6
setle al
pop ecx
cmp eax, ecx
jbe 0x1003603e
mov dword [ebp - 0x1c], ecx
xor eax, eax
push eax
lea ecx, [ebp - 0x1b0]
call fcn.100187f4
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax]
jne 0x10035fea
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10035fea
mov eax, dword [ebp - 0x1c]
push ebx
lea ecx, [ebp - 0x230]
call fcn.100187f4
push 2
lea ecx, [ebp - 0xa80]
call fcn.100187f4
xor eax, eax
lea ecx, [ebp - 0x230]
push eax
call fcn.100187f4
mov ecx, dword [ebp - 0x1c]
push ebx
imul ecx, dword [eax]
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x230]
call fcn.100187f4
mov ecx, dword [ebp - 0x54]
xor edx, edx
cmp ecx, dword [eax]
setg dl
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x4ec], eax
jmp 0x10036097
mov dword [ebp - 0x10], 0xfffffffc
cmp dword [ebp - 0x10], 0xfffffff6
jle 0x10036066
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003605d
push eax
push eax
push eax
call edi
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff6
jg 0x1003604d
mov dword [ebp - 0x10], 0xb
cmp dword [ebp - 0x10], 0x19
jle 0x10036097
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003608e
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x19
jg 0x10036075
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0x27
call fcn.100187d8
push 2
lea ecx, [ebp - 0x1b0]
call fcn.100187f4
inc dword [eax]
push 2
lea ecx, [ebp - 0x1b0]
call fcn.100187f4
cmp dword [eax], 0x1c
jne 0x10035e80
inc dword [ebp - 0x58]
lea ecx, [ebp - 0xa80]
call fcn.100187d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b0]
call fcn.100187d8
mov dword [ebp - 0x20], 0x7f6af112
xor eax, eax
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1003611a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x958], 0xa75c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10036101
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x100361c8
mov dword [ebp - 0x1c], 0xdd3f4672
mov dword [ebp - 0x28], 0x22db785b
mov dword [ebp - 0x50], 0x5429
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10036149
push eax
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
xor eax, eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x100361c5
mov dword [ebp - 0x18], eax
jmp 0x10036167
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe08], 0xb04800fa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10036156
inc dword [ebp - 0xe04]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0xafa3
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
add ecx, dword [ebp - 0x958]
je 0x100361a4
cmp dword [ebp - 0x958], eax
je 0x100361a4
mov eax, ebx
imul eax, eax, 0x226c
xor ecx, ecx
push 0
cmp eax, 0xd238
setne cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x1c]
pop eax
jns 0x10036151
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x19
jg 0x10036122
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100361e0
push eax
call esi
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [ebp - 0x48], 0xad313dd3
mov dword [ebp - 0x48], 8
jmp 0x10036225
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x50], 0xfffffffc
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10036211
call edi
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1003621c
cmp dword [ebp - 0x18], 0xffffffeb
jge 0x10036216
cmp dword [ebp - 0x48], 0xfffffff6
jl 0x100361f6
mov dword [ebp - 0x20], 0x7f6af112
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1003625b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x998], 0xa75c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10036242
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10036309
cmp dword [ebp - 0x20], 0x19
jg 0x10036263