Function at 0x10038caa
Capabilities:
Check os version
Delete file
Get common file path
Get disk size
Get graphical window text
Get session user name

Disassembly:
mov eax, 0x10066417
call fcn.10064ce8
mov eax, 0x141e4
call fcn.1005d5c0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], 0xa684
mov byte [ebp - 0xd], bl
mov edi, 0x40e
push 1
mov byte [ebp - 0x51], dl
mov dword [ebp - 0x50], ecx
pop eax
cmp byte [ebp - 0xd], bl
je 0x10038cea
push ebx
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10038cfe
push 0x2639
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov dword [ebp - 0x44], 0xa684
xor esi, esi
mov byte [ebp - 0xd], bl
inc esi
cmp byte [ebp - 0xd], bl
je 0x10038d1a
push ebx
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10038d2e
push 0x2639
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x684]
mov dword [ebp - 0x1c], 0x5a40f2fd
push esi
call fcn.10028987
mov dword [ebp - 4], ebx
xor edx, edx
mov dword [ebp - 0x44], 0xd635
inc edx
mov dword [ebp - 0x20], ebx
jmp 0x10038d6d
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x684]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10038d5a
cmp dword [ebp - 0x18], ebx
jne 0x10038d9b
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
sub eax, edx
jne 0x10038d98
mov ecx, ebx
jmp 0x10038d9d
xor edx, edx
inc edx
mov ecx, edx
mov eax, dword [ebp - 0x684]
push 4
pop esi
mov dword [eax], ecx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jg 0x10038fcc
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jg 0x10038fbb
push esi
lea ecx, [ebp - 0x4f8]
call fcn.10028987
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov dword [ebp - 0x30], 0x1e21
cmp dword [ebp - 0x30], 0xfb5
jge 0x10038f5e
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0xa0]
push eax
push 0x10008014
call fcn.1004d62b
add esp, 0xc
lea ecx, [ebp - 0x69c]
push dword [ebp - 0xa0]
call fcn.10045458
mov eax, dword [ebp - 0x9c]
xorps xmm0, xmm0
movlpd qword [ebp - 0x70], xmm0
mov dword [ebp - 0x30], ebx
cmp eax, ebx
jl 0x10038e7e
jg 0x10038e31
cmp dword [ebp - 0xa0], ebx
jbe 0x10038e7e
mov esi, dword [ebp - 0x69c]
mov ebx, dword [ebp - 0x6c]
mov edi, dword [ebp - 0x70]
push esi
push 0x10008020
call fcn.1004d62b
add edi, dword [esi]
mov eax, dword [ebp - 0x30]
adc ebx, dword [esi + 4]
inc eax
pop ecx
mov dword [ebp - 0x30], eax
add esi, 8
cdq
pop ecx
mov ecx, eax
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x3c], ebx
cmp edx, eax
jl 0x10038e3d
jg 0x10038e76
cmp ecx, dword [ebp - 0xa0]
jb 0x10038e3d
mov edx, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x2c]
jmp 0x10038e8a
mov ebx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x3c], edx
xor ecx, ecx
mov dword [ebp - 0x30], ecx
test eax, eax
jl 0x10038f43
jg 0x10038ea5
cmp dword [ebp - 0xa0], ecx
jbe 0x10038f43
mov esi, dword [ebp - 0x69c]
mov eax, dword [esi + ecx*8]
mov edi, eax
mov ecx, dword [esi + ecx*8 + 4]
sub edi, ebx
mov esi, dword [ebp - 0x4b4]
mov ebx, ecx
sbb ebx, edx
mov edx, dword [ebp - 0x4b8]
add edi, edx
adc ebx, esi
test ebx, ebx
jg 0x10038eda
jl 0x10038ed5
cmp edi, 1
jae 0x10038eda
xor ebx, ebx
lea edi, [ebx + 1]
sub edx, dword [ebp - 0xa0]
sbb esi, dword [ebp - 0x9c]
add edx, 1
adc esi, 0
cmp esi, ecx
jl 0x10038efa
jg 0x10038ef6
cmp edx, eax
jbe 0x10038efa
mov edx, eax
mov esi, ecx
sub eax, edx
sbb ecx, esi
add eax, edi
adc ecx, ebx
xor edx, edx
inc edx
sub eax, edx
sbb ecx, 0
push ecx
push eax
push 0x10008028
call fcn.1004dfbc
mov ecx, dword [ebp - 0x30]
add esp, 0xc
mov ebx, dword [ebp - 0x2c]
inc ecx
mov eax, ecx
mov dword [ebp - 0x30], ecx
cdq
cmp edx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x3c]
jl 0x10038ea5
jg 0x10038f43
cmp eax, dword [ebp - 0xa0]
jb 0x10038ea5
push 0x10007a39
call fcn.1004e532
pop ecx
lea ecx, [ebp - 0x69c]
call fcn.10028c5d
push 4
xor ebx, ebx
pop esi
mov dword [ebp - 0x20], ebx
jmp 0x10038f76
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4f8]
mov dword [eax + ecx*4], 0xc8d46758
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10038f63
mov esi, dword [ebp - 0x4f8]
mov dword [esi + 8], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10038f95
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
inc dword [esi + 8]
cmp dword [esi + 8], 0
jle 0x10038f84
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], bl
call fcn.10028c5d
inc dword [ebp - 0x18]
push 4
pop esi
cmp dword [ebp - 0x18], ebx
jle 0x10038dc0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10038db4
mov edi, 0x40e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x684]
call fcn.10028c5d
mov dword [ebp - 0x44], 0xfffffff6
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10038ff7
push 0xe77
push ebx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003900b
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor edx, edx
mov dword [ebp - 0x44], 0xa684
inc edx
mov dword [ebp - 0x1c], edx
push 2
mov dword [ebp - 0x30], 0xa98ceef9
mov dword [ebp - 0x20], ebx
pop esi
jmp 0x10039038
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x778], 0x9c23edb3
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10039027
mov ecx, dword [ebp - 0x1c]
mov eax, 0xffff
add ecx, eax
xor eax, eax
cmp ecx, 0x7cb3
setle al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], ebx
jmp 0x100390ed
mov dword [ebp - 0x30], 0xade0980d
mov dword [ebp - 0x20], ebx
jmp 0x1003907a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x51c], 0x6ab2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10039069
cmp dword [ebp - 0x1c], ebx
jne 0x100390f7
mov eax, dword [ebp - 0x51c]
cmp eax, dword [ebp - 0x1c]
je 0x10039095
cmp dword [ebp - 0x1c], ebx
jne 0x10039097
mov edx, ebx
mov eax, dword [ebp - 0x51c]
sub eax, 0x64ba
neg eax
push 1
sbb eax, eax
xor ecx, ecx
inc eax
cmp edx, 0x213af72b
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, eax
setg dl
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x518]
imul edx, eax
mov eax, dword [ebp - 0x1c]
sub eax, edx
add eax, dword [ebp - 0x1c]
imul eax, eax, 0xa369
pop edx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x774], eax
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe6
je 0x1003905d
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x20], ebx
jmp 0x10039110
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x878], 0x2bd7b1c2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x100390ff
mov dword [ebp - 0x20], 0x1b
jmp 0x10039132
mov dword [ebp - 0x30], 0x1bf2
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jne 0x1003911f
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003918a
mov dword [ebp - 0x18], 0x52cb1363
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xffffffe7
jge 0x1003917d
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10039171
push 0xa65
push 0x17c8
push ebx
call dword [sym.imp.USER32.dll_RemoveMenu]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe7
jl 0x10039157
xor edx, edx
inc edx
push ebx
push edx
push edi
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
xor edx, edx
inc edx
mov dword [ebp - 0x44], edx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100391a8
push 0xb62
push ebx
push ebx
push 0xf4a
call dword [sym.imp.GDI32.dll_PolyPolygon]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100391bd
push ebx
push 0x18cf
call dword [sym.imp.GDI32.dll_SetTextColor]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10039370
push 4
pop edi
push edi
lea ecx, [ebp - 0x374]
call fcn.10028987
mov dword [ebp - 0x20], 0xee76f502
mov dword [ebp - 0x44], 0xcd430964
mov dword [ebp - 0x44], 0x8ab9c279
mov dword [ebp - 0x44], 0x787d6364
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x20], ebx
jmp 0x10039210
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x374]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100391fd
push 3
pop edi
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], ebx
jl 0x10039357
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], 0xfff9
mov dword [ebp - 0x1c], ebx
jmp 0x10039244
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8e4], 0x7008b15e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10039233
xor edx, edx
mov dword [ebp - 0x1c], ebx
inc edx
cmp dword [ebp - 0x1c], edi
jge 0x10039263
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x338], edx
inc dword [ebp - 0x1c]
jmp 0x1003924f
mov dword [ebp - 0x1c], ebx
jmp 0x1003927b
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x374]
mov dword [eax + ecx*4], 0xd3b3152c
inc dword [ebp - 0x1c]
push 4
pop eax
cmp dword [ebp - 0x1c], eax
jl 0x10039268
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], edi
jg 0x1003934e
jmp 0x10039294
xor edx, edx
inc edx
mov dword [ebp - 0x24], 6
mov eax, 0x796d402d
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x44], 0x33a4d1b4
mov dword [ebp - 0x6dc], eax
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 0x6d4], eax
mov dword [ebp - 0x6d0], eax
mov dword [ebp - 0x38], 7
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x338]
inc dword [ebp - 0x338]
test eax, eax
je 0x100392eb
mov eax, dword [ebp - 0x30]
mov esi, edx
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x24], eax
je 0x100392ed
mov esi, ebx
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
cmp esi, eax
mov eax, dword [ebp - 0x374]
setg cl
cmp dword [eax + edx*4], ecx
jge 0x1003930d
cmp dword [ebp - 0x338], ebx
jne 0x10039316
cmp dword [ebp - 0x14], ebx
jne 0x10039316
mov edx, ebx
jmp 0x1003931b
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
push 4
setge cl
xor eax, eax
sub ecx, dword [ebp - 0x20]
pop edx
cmp ecx, edx
setl al
neg eax
mov dword [ebp - 0x6d4], eax
cmp dword [ebp - 0x14], ebx
jne 0x1003934b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x10039291
push 2
pop esi
dec dword [ebp - 0x20]
jns 0x10039224
lea ecx, [ebp - 0x374]
call fcn.10028c5d
push 0x2639
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
jmp 0x10039373
push 3
pop edi
xor eax, eax
mov dword [ebp - 0x18], 0xffffffff
inc eax
mov dword [ebp - 0x1c], 0x5a40f2fd
push eax
lea ecx, [ebp - 0x510]
call fcn.10028987
mov dword [ebp - 4], esi
xor edx, edx
mov dword [ebp - 0x44], 0xd635
inc edx
mov dword [ebp - 0x20], ebx
jmp 0x100393b5
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x510]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x100393a2
cmp dword [ebp - 0x18], ebx
jne 0x100393e3
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
sub eax, edx
jne 0x100393e0
mov ecx, ebx
jmp 0x100393e5
xor edx, edx
inc edx
mov ecx, edx
mov eax, dword [ebp - 0x510]
mov dword [eax], ecx
mov dword [ebp - 0x1c], ebx
jmp 0x1003945c
mov dword [ebp - 0x18], ebx
jmp 0x10039454
push 4
pop esi
push esi
lea ecx, [ebp - 0x5d0]
call fcn.10028987
mov dword [ebp - 0x20], ebx
jmp 0x1003941e
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5d0]
mov dword [eax + ecx*4], 0xc8d46758
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1003940b
mov esi, dword [ebp - 0x5d0]
mov dword [esi + 8], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003943d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
inc dword [esi + 8]
cmp dword [esi + 8], 0
jle 0x1003942c
lea ecx, [ebp - 0x5d0]
call fcn.10028c5d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x100393f7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x100393f2
or esi, 0xffffffff
lea ecx, [ebp - 0x510]
mov dword [ebp - 4], esi
call fcn.10028c5d
push edi
lea ecx, [ebp - 0x470]
call fcn.10028987
xor eax, eax
mov dword [ebp - 4], edi
inc eax
mov dword [ebp - 0x1c], 0xb02971c
push eax
lea ecx, [ebp - 0x368]
call fcn.10028987
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x100394b2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x470]
mov dword [eax + ecx*4], 0x2e91a049
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003949f
xor edx, edx
mov dword [ebp - 0x1c], ebx
inc edx
jmp 0x100394ce
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x368]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100394bf
mov dword [ebp - 0x1c], ebx
jmp 0x100394eb
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x470]
mov dword [eax + ecx*4], 0xc2db2212
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100394d8
cmp dword [ebp - 0x1c], ebx
je 0x10039507
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x368]
cmp dword [edx], ebx
je 0x1003950d
xor eax, eax
inc eax
jmp 0x1003950f
mov edx, dword [ebp - 0x368]
mov eax, ebx
mov edx, dword [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x470]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
lea ecx, [ebp - 0x368]
setl al
add eax, edx
mov dword [ebp - 0x30], eax
call fcn.10028c5d
lea ecx, [ebp - 0x470]
mov dword [ebp - 4], esi
call fcn.10028c5d
xor eax, eax
mov dword [ebp - 0x2c], ebx
inc eax
lea ecx, [ebp - 0x1d8]
push eax
call fcn.10028987
push 4
pop eax
mov dword [ebp - 4], eax
xor edx, edx
push 0xfffffffffffffff6
pop ecx
mov dword [ebp - 0x2f0], ecx
inc edx
mov dword [ebp - 0x2ec], ecx
mov dword [ebp - 0x2e8], ecx
mov dword [ebp - 0x2e4], ecx
mov dword [ebp - 0x28], 0xdb7758b3
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x1c], ebx
jmp 0x100395af
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1d8]
mov dword [eax + ecx*4], 0x5ba7723
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1003959c
mov dword [ebp - 0x1c], ebx
jmp 0x100395c6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8b4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100395b9
cmp dword [ebp - 0x2c], ebx
je 0x10039616
mov dword [ebp - 0x20], ebx
jmp 0x100395e2
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x89c], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100395d5
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ebx
jl 0x10039669
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1d8]
cmp dword [eax + ecx*4], ebx
jne 0x10039669
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1d8]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x89c], eax
dec dword [ebp - 0x2c]
jns 0x100395ef
jmp 0x10039669
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x14], 0x568be135
mov dword [ebp - 0x30], 0x593c8699
mov dword [ebp - 0x24], 0x9dc8
mov eax, dword [eax]
mov dword [ebp - 0x30], 9
neg eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2f0], eax
jne 0x10039666
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
je 0x1003965d
cmp dword [ebp - 0x14], ebx
je 0x1003965d
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2f0]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x30], 0x1c39
cmp dword [ebp - 0x30], 0xe44
jge 0x1003979c
lea ecx, [ebp - 0xa8]
call fcn.10038855
mov esi, dword [ebp - 0xa8]
test esi, esi
je 0x1003978f
dec esi
lea ecx, [ebp - 0x15c]
mov dword [ebp - 0x30], esi
call fcn.10038855
mov ebx, dword [ebp - 0x15c]
test ebx, ebx
jle 0x100396cc
push 4
mov edi, 0x11397d80
pop esi
mov ecx, edi
call fcn.10038855
add edi, esi
dec ebx
jne 0x100396b7
mov esi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x15c]
dec ebx
xor edx, edx
push ebx
xor ecx, ecx
call fcn.10038705
pop ecx
lea eax, [ebp - 0x174]
push eax
push 0x10007acc
call fcn.1004d62b
xor edi, edi
pop ecx
pop ecx
cmp dword [ebp - 0x174], edi
jle 0x10039782
lea ecx, [ebp - 0x2e0]
call fcn.10038855
lea ecx, [ebp - 0xec]
call fcn.10038855
cmp dword [ebp - 0x2e0], 0
jne 0x1003974f
lea ecx, [ebp - 0x2d4]
call fcn.10038855
mov eax, dword [ebp - 0x2d4]
xor edx, edx
dec eax
xor ecx, ecx
push eax
mov eax, dword [ebp - 0xec]
dec eax
push eax
push ebx
call fcn.10038766
add esp, 0xc
push eax
push 0x10007b04
call fcn.1004dfbc
pop ecx
pop ecx
jmp 0x10039775
lea ecx, [ebp - 0x2dc]
call fcn.10038855
push dword [ebp - 0x2dc]
mov eax, dword [ebp - 0xec]
xor edx, edx
dec eax
xor ecx, ecx
push eax
push ebx
call fcn.100387f1
add esp, 0xc
inc edi
cmp edi, dword [ebp - 0x174]
jl 0x100396f9
test esi, esi
jne 0x10039696
push 3
xor ebx, ebx
pop edi
dec esi
xor edx, edx
mov dword [ebp - 0xa8], esi
inc edx
or esi, 0xffffffff
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x2f0], ebx
je 0x100397b6
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x28], 0xe4c1
jge 0x100397c9
cmp dword [ebp - 0x2f0], ebx
jne 0x100397c9
mov edx, ebx
mov eax, dword [ebp - 0x1d8]
xor ecx, ecx
cmp edx, dword [eax]
setg cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x8ac], eax
test eax, eax
jne 0x100397e9
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1d8]
xor ecx, ecx
cmp dword [eax], 0x76e9
setl cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x1d8]
mov dword [ebp - 4], esi
call fcn.10028c5d
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x34], 0xffffffe6
cmp dword [ebp - 0x34], 0xfffffffb
jl 0x1003984e
push 4
pop eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], ebx
jmp 0x10039840
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003983d
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 4
pop eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
je 0x1003982a
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffffb
jge 0x10039822
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x3c], 0x5a40f2fd
push edi
call fcn.10028987
xor eax, eax
mov dword [ebp - 4], 5
inc eax
mov dword [ebp - 0x18], 0xe7d8a870
mov dword [ebp - 0x38], 0x21ec2184
lea ecx, [ebp - 0x690]
push eax
call fcn.10028987
mov byte [ebp - 4], 6
mov eax, 0xa83a
mov dword [ebp - 0x6bc], eax
mov dword [ebp - 0x6b8], eax
mov dword [ebp - 0x6b4], eax
mov dword [ebp - 0x6b0], eax
mov dword [ebp - 0x1c], ebx
jmp 0x100398c1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x380]
mov dword [eax + ecx*4], 0xd7f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100398ae
xor edx, edx
mov dword [ebp - 0x1c], ebx
inc edx
jmp 0x100398e1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x690]
mov dword [eax + ecx*4], 0xb81eca6c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100398ce
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x10039dbc
jmp 0x100398fb
xor edx, edx
inc edx
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x44], 0x88039d6b
mov dword [ebp - 0x44], 0xc593c869
mov dword [ebp - 0x28], 0xca69
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], 0x783de769
mov dword [ebp - 0x20], ebx
jmp 0x10039936
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xbc], 0xa52b4b5a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10039925
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003994e
push ebx
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x380]
cmp dword [eax + ecx*4], ebx
jne 0x100399a3
mov eax, dword [ebp - 0x18]
mov ecx, edx
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
cmp eax, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xbc]
cmovne ecx, ebx
neg ecx
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov eax, dword [ebp - 0xbc]
setg dl
add eax, edx
cmp eax, dword [ebp - 0x28]
jl 0x100399a3
xor ecx, ecx
mov eax, ebx
inc ecx
jmp 0x100399a8
xor ecx, ecx
inc ecx
mov eax, ecx
cmp eax, dword [ebp - 0xbc]
jge 0x100399bc
mov eax, dword [ebp - 0x690]
cmp dword [eax], ebx
jne 0x100399bc
mov ecx, ebx
mov eax, dword [ebp - 0x6b4]
sub ecx, eax
cmp ecx, dword [ebp - 0xbc]
jle 0x10039dad
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100399fb
push ebx
push 0xf09
push ebx
push ebx
push 0x194d
push 0xf2
push 0x1d2b
push 0x1de4
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov dword [ebp - 0x30], 0x15dc
cmp dword [ebp - 0x30], 0xf1e
jge 0x10039d9c
call fcn.1004d765
push eax
push 0x10007be0
push 0x10007be4
call fcn.1004e3f1
add esp, 0xc
call fcn.1004d765
add eax, 0x20
push eax
push 0x10007bec
push 0x10007bf0
call fcn.1004e3f1
add esp, 0xc
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x64]
push eax
push 0x10007b30
call fcn.1004d62b
mov eax, dword [ebp - 0x64]
add esp, 0x10
mov ecx, dword [ebp - 0x58]
lea ecx, [ecx + eax*2]
mov eax, dword [ebp - 0xf8]
inc eax
add ecx, eax
mov dword [0x1131d808], ecx
lea eax, [ecx + 1]
test eax, eax
jle 0x10039ae1
xor eax, eax
mov dword [ebp - 0x248], eax
mov esi, eax
mov dword [ebp - 0x2b8], eax
mov edi, eax
lea eax, [ebp - 0x248]
push eax
lea eax, [esi + ecx]
lea edx, [eax*4 + 0x113f9924]
lea ecx, [edi + 0x113f9920]
call fcn.1002ca1a
pop ecx
lea eax, [ebp - 0x2b8]
push eax
mov eax, dword [0x1131d808]
lea ecx, [edi + 0x113f9db0]
add eax, esi
lea edx, [eax*4 + 0x113f9db4]
call fcn.1002ca1a
pop ecx
mov ecx, dword [0x1131d808]
lea edi, [edi + 0x44]
inc ebx
add esi, 0x11
lea eax, [ecx + 1]
cmp ebx, eax
jl 0x10039a8f
lea eax, [ecx + 1]
push eax
call fcn.10045367
xor ebx, ebx
mov esi, ebx
cmp dword [ebp - 0x58], ebx
jle 0x10039b3d
mov edi, ebx
mov ecx, dword [0x113fa2e8]
xor eax, eax
inc eax
mov dword [esi*4 + 0x113f9924], eax
lea eax, [ebp - 0x258]
inc esi
push eax
mov dword [ebp - 0x258], esi
call fcn.100289e5
mov ecx, dword [0x113fa2e8]
lea eax, [ebp - 0x2d8]
add ecx, 0xc
mov dword [ebp - 0x2d8], ebx
push eax
add ecx, edi
call fcn.100289e5
add edi, 0xc
cmp esi, dword [ebp - 0x58]
jl 0x10039af5
mov eax, dword [ebp - 0x64]
test eax, eax
jle 0x10039d0a
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x164]
push eax
push 0x10007b20
call fcn.1004d62b
xor esi, esi
add esp, 0xc
cmp dword [ebp - 0x164], esi
jle 0x10039bdf
lea eax, [ebp - 0x88]
push eax
push 0x10007acc
call fcn.1004d62b
mov eax, dword [ebp - 0x58]
pop ecx
pop ecx
imul ecx, dword [ebp - 0x88], 0x11
add ecx, ebx
add ecx, eax
inc eax
add eax, ebx
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x268]
push eax
mov dword [ecx*4 + 0x113f9924], 1
imul ecx, dword [ebp - 0x88], 0xc
add ecx, dword [0x113fa2e8]
call fcn.100289e5
lea eax, [ebp - 0x88]
push eax
mov eax, dword [ebp - 0x58]
inc eax
add eax, ebx
imul ecx, eax, 0xc
add ecx, dword [0x113fa2e8]
call fcn.100289e5
inc esi
cmp esi, dword [ebp - 0x164]
jl 0x10039b6d
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x64]
lea esi, [ebx + edx]
imul ecx, esi, 0x11
add ecx, ebx
add ecx, eax
inc eax
add eax, ebx
add ecx, edx
add eax, edx
mov dword [ebp - 0x2c0], eax
lea eax, [ebp - 0x2c0]
push eax
mov dword [ecx*4 + 0x113f9968], 1
lea eax, [esi + 1]
imul ecx, eax, 0xc
add ecx, dword [0x113fa2e8]
call fcn.100289e5
mov ecx, dword [ebp - 0x58]
lea eax, [ecx + 1]
inc ecx
add eax, ebx
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x278]
push eax
mov eax, dword [ebp - 0x64]
add eax, ebx
add eax, ecx
imul ecx, eax, 0xc
add ecx, dword [0x113fa2e8]
call fcn.100289e5
and dword [ebp - 0x30], 0
cmp dword [ebp - 0x16c], 0
jle 0x10039cfe
lea eax, [ebp - 0x88]
push eax
push 0x10007acc
call fcn.1004d62b
mov esi, dword [ebp - 0x58]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x64]
lea edi, [ebx + ecx]
add edi, esi
lea edx, [ecx + ecx]
mov ecx, dword [ebp - 0x88]
imul eax, edi, 0x11
add eax, ecx
add eax, edx
add eax, esi
mov dword [eax*4 + 0x113f9964], 1
lea eax, [ecx + edx]
add eax, esi
mov dword [ebp - 0x288], eax
lea eax, [ebp - 0x288]
push eax
lea eax, [edi + 1]
imul ecx, eax, 0xc
add ecx, dword [0x113fa2e8]
call fcn.100289e5
mov edx, dword [ebp - 0x64]
lea eax, [edx + 1]
add eax, ebx
add eax, dword [ebp - 0x58]
mov dword [ebp - 0x2c8], eax
lea eax, [ebp - 0x2c8]
push eax
mov eax, dword [ebp - 0x88]
lea eax, [eax + edx*2]
add eax, dword [ebp - 0x58]
imul ecx, eax, 0xc
add ecx, dword [0x113fa2e8]
call fcn.100289e5
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, dword [ebp - 0x16c]
jl 0x10039c5b
mov eax, dword [ebp - 0x64]
inc ebx
cmp ebx, eax
jl 0x10039b48
xor ebx, ebx
mov esi, ebx
cmp dword [ebp - 0xf8], ebx
jle 0x10039d7e
lea ecx, [esi + eax*2]
xor edx, edx
add ecx, dword [ebp - 0x58]
inc edx
imul eax, ecx, 0x11
push 0x1131d808
add eax, dword [0x1131d808]
mov dword [eax*4 + 0x113f9964], edx
lea eax, [ecx + 1]
imul ecx, eax, 0xc
add ecx, dword [0x113fa2e8]
call fcn.100289e5
mov eax, dword [ebp - 0x64]
lea ecx, [esi + eax*2]
mov eax, dword [ebp - 0x58]
inc eax
add eax, ecx
imul ecx, dword [0x1131d808], 0xc
mov dword [ebp - 0x298], eax
lea eax, [ebp - 0x298]
push eax
add ecx, dword [0x113fa2e8]
call fcn.100289e5
inc esi
cmp esi, dword [ebp - 0xf8]
jge 0x10039d7e
mov eax, dword [ebp - 0x64]
jmp 0x10039d16
mov esi, ebx
jmp 0x10039d83
inc esi
call fcn.100388aa
test al, al
jne 0x10039d82
push esi
push 0x10007b04
call fcn.1004dfbc
pop ecx
pop ecx
or esi, 0xffffffff
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x380]
mov dword [eax + edx*4], ecx
jmp 0x10039db3
mov dword [ebp - 0x30], esi
inc dword [ebp - 0x30]
dec dword [ebp - 0x18]
jns 0x100398f8
lea ecx, [ebp - 0x690]
call fcn.10028c5d
lea ecx, [ebp - 0x380]
mov dword [ebp - 4], esi
call fcn.10028c5d
xor eax, eax
lea ecx, [ebp - 0x678]
inc eax
push eax
call fcn.10028987
xor eax, eax
mov dword [ebp - 4], 7
inc eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0x5a40f2fd
lea ecx, [ebp - 0x5e8]
push eax
call fcn.10028987
mov byte [ebp - 4], 8
mov edi, 0xd635
xor edx, edx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10039e2b
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5e8]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10039e18
cmp dword [ebp - 0x18], ebx
jne 0x10039e59
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
sub eax, edx
jne 0x10039e56
mov ecx, ebx
jmp 0x10039e5b
xor edx, edx
inc edx
mov ecx, edx
mov eax, dword [ebp - 0x5e8]
mov dword [eax], ecx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jg 0x10039edd
mov dword [ebp - 0x18], ebx
jmp 0x10039ecd
push 4
pop esi
push esi
lea ecx, [ebp - 0x528]
call fcn.10028987
mov dword [ebp - 0x20], ebx
jmp 0x10039e97
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x528]
mov dword [eax + ecx*4], 0xc8d46758
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10039e84
mov esi, dword [ebp - 0x528]
mov dword [esi + 8], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10039eb6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
inc dword [esi + 8]
cmp dword [esi + 8], 0
jle 0x10039ea5
lea ecx, [ebp - 0x528]
call fcn.10028c5d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10039e70
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10039e6b
or esi, 0xffffffff
lea ecx, [ebp - 0x5e8]
mov byte [ebp - 4], 7
call fcn.10028c5d
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x28], 0xe2c0
mov dword [ebp - 0x4c], 0xfffffff8
push 4
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x34], esi
inc eax
mov dword [ebp - 0x24], 0x2b441a62
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x44], 0x66b7a7bc
mov dword [ebp - 0x14], 0x5300
push 3
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], ebx
pop esi
jmp 0x10039f3d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x704], 0x9d221e9c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10039f2c
inc dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x6fc]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
sub edx, eax
mov dword [ebp - 0x700], edx
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x30], 9
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setl dl
xor ebx, ebx
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4c]
cmp edx, eax
setl bl
sub ebx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setg cl
xor ebx, ebx
xor edx, edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10039fb6
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x678]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10039fa3
cmp dword [ebp - 0x2c], ebx
jne 0x10039fe4
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
add ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setge dl
sub eax, edx
jne 0x10039fe1
mov ecx, ebx
jmp 0x10039fe6
xor edx, edx
inc edx
mov ecx, edx
mov eax, dword [ebp - 0x678]
push esi
mov dword [eax], ecx
lea ecx, [ebp - 0x254]
call fcn.10028987
lea ecx, [ebp - 0x80c]
mov byte [ebp - 4], 9
movdqa xmm0, xmmword [0x10008140]
lea eax, [ebp - 0x7fc]
push ecx
push eax
push ecx
mov dword [ebp - 0x20], 0x17ca4e86
lea ecx, [ebp - 0x71c]
mov dword [ebp - 0x30], 0x4795ed7c
movdqu xmmword [ebp - 0x80c], xmm0
call fcn.10028a3a
mov dword [ebp - 0x14], 0x855eec80
mov dword [ebp - 0x28], 0x60d64c9d
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x1c], ebx
jmp 0x1003a063
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x254]
mov dword [eax + ecx*4], 0x5925ef2c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003a050
push 2
mov dword [ebp - 0x1c], ebx
pop edi
jmp 0x1003a081
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2f8], 0xfffffff7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003a070
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2f4]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x71c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov edx, dword [esi + 0xc]
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, edx
setg al
mov dword [esi + 0xc], eax
test eax, eax
jne 0x1003a0d4
cmp dword [ebp - 0x20], ebx
jne 0x1003a0d4
xor edx, edx
mov ecx, ebx
inc edx
jmp 0x1003a0d9
xor edx, edx
inc edx
mov ecx, edx
mov eax, dword [ebp - 0x254]
mov dword [eax], edx
xor eax, eax
cmp ecx, edx
setl al
add eax, 0x50ba1bf2
cmp eax, dword [ebp - 0x14]
jg 0x1003a0fe
mov eax, dword [ebp - 0x254]
cmp dword [eax], ebx
mov eax, ebx
je 0x1003a100
mov eax, edx
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
test eax, eax
setle cl
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], ebx
je 0x1003a12e
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003a1ac
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x1003a1ac
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x20], ebx
jmp 0x1003a14b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd4], 0x96e60be6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1003a13a
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
je 0x1003a165
mov eax, dword [ebp - 0x254]
mov ecx, edx
cmp dword [eax + 4], ebx
jne 0x1003a167
mov ecx, ebx
xor eax, eax
cmp ecx, edx
sete al
add eax, dword [ebp - 0xd4]
je 0x1003a17d
mov ecx, edx
cmp dword [ebp - 0x24], ebx
jne 0x1003a17f
mov ecx, ebx
xor eax, eax
cmp ecx, 0x9063
setne al
inc eax
neg eax
sbb eax, eax
neg eax
neg eax
mov dword [ebp - 0xd4], eax
neg eax
je 0x1003a1a7
mov eax, edx
cmp dword [ebp - 0xd4], ebx
jne 0x1003a1a9
mov eax, ebx
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x71c]
call fcn.10028c5d
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 7
call fcn.10028c5d
push 3
mov dword [ebp - 0x3c], ebx
pop esi
cmp dword [ebp - 0x3c], ebx
jg 0x1003aa6c
mov dword [ebp - 0x20], ebx
jmp 0x1003a1eb
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x264], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1003a1da
mov dword [ebp - 0x260], ebx
jmp 0x1003a26d
mov dword [ebp - 0x34], 0xffffffff
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003a214
push ebx
push 0x13af
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [ebp - 0x34], ebx
jmp 0x1003a261
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x20], ebx
jmp 0x1003a258
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003a240
push ebx
push 0xd64
push ebx
push 0xae3
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003a255
push 0x142
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 6
jl 0x1003a225
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x10
jl 0x1003a219
dec dword [ebp - 0x260]
cmp dword [ebp - 0x260], 0xffffffe8
je 0x1003a1f8
mov dword [ebp - 0x2c], ebx
jmp 0x1003aa5b
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0xfffffff6
jmp 0x1003a2ef
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x34], ebx
jmp 0x1003a2e6
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x20], ebx
jmp 0x1003a2ae
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x7b0], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1003a2a1
mov dword [ebp - 0x20], 6
jmp 0x1003a2dd
cmp dword [ebp - 0x20], 0xffffffff
jge 0x1003a2bc
cmp dword [ebp - 0x34], 0xffffffee
jne 0x1003a299
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe6
jne 0x1003a28d
push 4
pop eax
push eax
lea ecx, [ebp - 0x570]
call fcn.10028987
mov byte [ebp - 4], 0xa
xor edx, edx
mov dword [ebp - 0x4c], 8
inc edx
mov dword [ebp - 0x18], 0x3a34c865
mov dword [ebp - 0x44], 0xed065768
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x20], 0x5a519d81
mov dword [ebp - 0x38], 0xc8d4675
mov dword [ebp - 0x28], 0x7e434392
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x24], 0x8c55
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x30], 0xd7151502
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], esi
jge 0x1003a36b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1f0], edx
inc dword [ebp - 0x20]
jmp 0x1003a357
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x34]
test eax, eax
je 0x1003a3b9
cmp dword [ebp - 0x28], ebx
jne 0x1003a387
mov eax, dword [ebp - 0x1ec]
mov eax, ebx
cmp dword [ebp - 0x4c], ebx
je 0x1003a389
mov eax, edx
mov dword [ebp - 0x24], eax
imul eax, dword [ebp - 0x24], 0xfffd
add eax, dword [ebp - 0x1c]
jne 0x1003a39f
mov ecx, ebx
mov eax, dword [ebp - 0x38]
imul eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
je 0x1003a3d2
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1c], ebx
jne 0x1003a3e4
cmp dword [ebp - 0x2c], ebx
jle 0x1003a27e
inc dword [ebp - 0x3c]
jmp 0x1003a1cc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x678]
call fcn.10028c5d
mov dword [ebp - 0x19c], ebx
xor ecx, ecx
mov dword [ebp - 0x198], ebx
inc ecx
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0x190], ebx
mov dword [ebp - 0x28], 0xe13a6c9c
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x34], 0xbcb1a7a8
mov dword [ebp - 0x24], 0xc3fa
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x19c]
je 0x1003aaf8
mov eax, dword [ebp - 0x28]
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x28]
jl 0x1003aad8
mov eax, ecx
cmp dword [ebp - 0x28], ebx
jne 0x1003aada
mov eax, ebx
cmp eax, esi
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0x5018
setg cl
shl ecx, 3
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x19c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x19c]
mov eax, dword [ebp - 0x24]
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x19c]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xffff
setle cl
cmp ecx, eax
jne 0x1003ab49
cmp dword [ebp - 0x3c], ebx
je 0x1003ab49
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1003ab4b
mov ecx, ebx
mov eax, dword [ebp - 0x3c]
imul eax, ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x19c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x219f
setl al
xor edx, edx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setg dl
cmp edx, dword [ebp - 0x194]
je 0x1003ab8e
cmp dword [ebp - 0x28], ebx
jne 0x1003ab8e
mov eax, ebx
jmp 0x1003ab91
xor eax, eax
inc eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x398]
mov dword [ebp - 0x14], 0x36f914a1
push esi
call fcn.10028987
xor eax, eax
mov dword [ebp - 4], 0xf
inc eax
lea ecx, [ebp - 0x410]
mov edi, 0xb02971c
mov dword [ebp - 0x1c], edi
push eax
call fcn.10028987
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x1003abe0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x398]
mov dword [eax + ecx*4], 0x2e91a049
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003abcd
mov dword [ebp - 0x44], 0x1d09
cmp dword [ebp - 0x44], 0xc77
jge 0x1003ac80
lea eax, [ebp - 0xc0]
push eax
push 0x10007b04
call fcn.1004d62b
pop ecx
pop ecx
mov esi, ebx
jmp 0x1003ac5f
dec eax
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x2b0]
push eax
push 0x10007b70
call fcn.1004d62b
mov ecx, dword [ebp - 0x2d0]
add esp, 0x14
sub ecx, dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x30c]
inc ecx
sub eax, dword [ebp - 0x244]
inc eax
imul ecx, eax
add esi, ecx
mov eax, dword [ebp - 0xc0]
test eax, eax
jne 0x1003ac10
dec eax
push esi
push 0x10007adc
mov dword [ebp - 0xc0], eax
call fcn.1004dfbc
pop ecx
pop ecx
push 3
pop esi
xor edx, edx
mov dword [ebp - 0x1c], ebx
inc edx
jmp 0x1003ac97
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x410]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1003ac88
mov dword [ebp - 0x1c], ebx
jmp 0x1003acb4
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x398]
mov dword [eax + ecx*4], 0xc2db2212
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003aca1
cmp dword [ebp - 0x1c], ebx
je 0x1003acd0
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x410]
cmp dword [edx], ebx
je 0x1003acd6
xor eax, eax
inc eax
jmp 0x1003acd8
mov edx, dword [ebp - 0x410]
mov eax, ebx
mov edx, dword [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x398]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
lea ecx, [ebp - 0x410]
setl al
add eax, edx
mov dword [ebp - 0x44], eax
call fcn.10028c5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x398]
call fcn.10028c5d
mov dword [ebp - 0x30], ebx
xor ecx, ecx
mov dword [ebp - 0x30], 0xa964a90c
inc ecx
mov dword [ebp - 0x14], ebx
jmp 0x1003ad33
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x60], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003ad25
mov dword [ebp - 0x60], 5
cmp dword [ebp - 0x60], 0xfffffff2
jle 0x1003ae09
mov dword [ebp - 0x308], ecx
mov dword [ebp - 0x304], ecx
mov dword [ebp - 0x300], ecx
push 4
mov dword [ebp - 0x2fc], ecx
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x1003ad7a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x92c], 0x364d64ea
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003ad69
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
je 0x1003ad91
mov edx, ecx
cmp dword [ebp - 0x60], ebx
jne 0x1003ad93
mov edx, ebx
mov eax, dword [ebp - 0x308]
xor ecx, ecx
mov eax, dword [ebp - 0x60]
add eax, 2
cmp eax, 0x7008b15e
setg cl
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], ebx
je 0x1003adc0
cmp dword [ebp - 0x304], ebx
je 0x1003adc0
xor eax, eax
inc eax
mov ecx, eax
jmp 0x1003adc5
xor eax, eax
mov ecx, ebx
inc eax
sub eax, ecx
dec eax
neg eax
push 1
sbb eax, eax
xor ecx, ecx
neg eax
imul eax, dword [ebp - 0x300]
cmp edx, eax
mov eax, dword [ebp - 0x60]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x308]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x928], ecx
dec dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0xfffffff2
pop ecx
jg 0x1003ad49
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1a8], ebx
mov dword [ebp - 0x1a4], ebx
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x28], 0xe13a6c9c
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x34], 0xbcb1a7a8
mov dword [ebp - 0x24], 0xc3fa
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x1ac]
je 0x1003ae83
mov eax, dword [ebp - 0x28]
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x28]
jl 0x1003ae63
mov eax, ecx
cmp dword [ebp - 0x28], ebx
jne 0x1003ae65
mov eax, ebx
cmp eax, esi
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0x5018
setg cl
shl ecx, 3
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x24]
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1ac]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xffff
setle cl
cmp ecx, eax
jne 0x1003aed4
cmp dword [ebp - 0x3c], ebx
je 0x1003aed4
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1003aed6
mov ecx, ebx
mov eax, dword [ebp - 0x3c]
imul eax, ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x1ac]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x219f
setl al
xor edx, edx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setg dl
cmp edx, dword [ebp - 0x1a4]
je 0x1003af19
cmp dword [ebp - 0x28], ebx
jne 0x1003af19
mov eax, ebx
jmp 0x1003af1c
xor eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], 0x36f914a1
mov dword [ebp - 0x18], 0x5c96dd1e
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x30], 0xa36a77d7
mov dword [ebp - 0x44], 0xfffc
cmp dword [ebp - 0x18], ebx
je 0x1003b014
push 2
lea ecx, [ebp - 0x588]
call fcn.10028987
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1003af70
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x588]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003af60
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003af96
mov dword [ebp - 0x44], 0xe520c3d8
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], ebx
xor ecx, ecx
mov dword [ebp - 0x30], 0xa964a90c
inc ecx
mov dword [ebp - 0x14], ebx
jmp 0x1003b041
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x68], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003b033
mov dword [ebp - 0x68], 5
cmp dword [ebp - 0x68], 0xfffffff2
jle 0x1003b119