Function at 0x10032c04
Capabilities:
Get file attributes
Get file size
Get file system object information
Get session user name
Log keystrokes via polling
Modify service

Disassembly:
mov eax, 0x1006c763
call fcn.1006b3c4
sub esp, 0xc8c
push ebx
push esi
push edi
push 0
pop ebx
mov dword [ebp - 0x28], 0x19fc
cmp dword [ebp - 0x28], 0x1314
push 1
mov byte [ebp - 0x5d], dl
mov dword [ebp - 0x5c], ecx
pop eax
jge 0x10032ced
push 0x10ce4848
push 0x10ce4844
push 0x10007814
call fcn.1005459b
mov eax, dword [0x10ce4844]
add esp, 0xc
mov edi, ebx
test eax, eax
jle 0x10032c7a
mov esi, 0x10ce4850
push esi
push 0x100077e0
call fcn.1005459b
pop ecx
pop ecx
push 4
pop eax
add esi, eax
inc edi
mov eax, dword [0x10ce4844]
cmp edi, eax
jl 0x10032c5e
mov ecx, dword [0x10ce4848]
mov esi, ecx
test eax, eax
jle 0x10032cdd
mov eax, dword [ebx*4 + 0x10ce4850]
xor edi, edi
cmp eax, esi
jl 0x10032ca8
jne 0x10032c9b
xor eax, eax
mov esi, ecx
jmp 0x10032cbc
xor edx, edx
sub eax, esi
mov esi, ecx
lea edi, [edx + 1]
cmp eax, esi
jge 0x10032cac
sub esi, eax
jmp 0x10032cbf
jne 0x10032cb7
push 2
pop eax
mov edi, eax
mov esi, ecx
jmp 0x10032cbf
cdq
idiv esi
sub esi, edx
lea edi, [eax + 1]
push edi
push 0x10007940
call fcn.10054c24
inc ebx
pop ecx
pop ecx
cmp ebx, dword [0x10ce4844]
jge 0x10032cdd
mov ecx, dword [0x10ce4848]
jmp 0x10032c86
push 0x1000774d
call fcn.10055012
xor eax, eax
xor ebx, ebx
pop ecx
inc eax
mov dword [ebp - 0x1c], 0xffff
lea ecx, [ebp - 0x4e0]
mov dword [ebp - 0x30], 0x6917
push eax
call fcn.1002c487
push 3
pop eax
push eax
lea ecx, [ebp - 0x710]
mov dword [ebp - 4], ebx
call fcn.1002c487
xor edx, edx
inc edx
push 0xffffffffffffffff
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x20], ebx
pop edi
jmp 0x10032d34
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8c], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10032d27
mov dword [ebp - 0x20], ebx
jmp 0x10032d4d
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4e0]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10032d3e
mov dword [ebp - 0x20], ebx
jmp 0x10032d6a
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x710]
mov dword [eax + ecx*4], 0xd9e177c4
inc dword [ebp - 0x20]
push 3
pop ecx
cmp dword [ebp - 0x20], ecx
jl 0x10032d57
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x10032d89
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], 0xf
jle 0x10032e65
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x28], 0x281c1d99
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x28], 0xb6930509
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x24], 0xc7fd579
mov dword [ebp - 0x14], ebx
jmp 0x10032dfc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x92c], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10032deb
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
je 0x10032e13
mov edi, edx
cmp dword [ebp - 0x8c], ebx
jne 0x10032e15
mov edi, ebx
mov ecx, dword [ebp - 0x1c]
mov esi, edx
mov eax, dword [ebp - 0x4e0]
push 1
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x8c]
cmovle esi, ebx
xor edx, edx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
pop edx
setle cl
sub esi, ecx
add esi, edi
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xf
push 3
pop ecx
jg 0x10032db3
or edi, 0xffffffff
lea ecx, [ebp - 0x710]
call fcn.1002c55e
lea ecx, [ebp - 0x4e0]
mov dword [ebp - 4], edi
call fcn.1002c55e
xor esi, esi
mov dword [ebp - 0x1c], 0xffff
inc esi
mov dword [ebp - 0x30], 0x6917
push esi
lea ecx, [ebp - 0x360]
call fcn.1002c487
push 3
pop ecx
push ecx
lea ecx, [ebp - 0x5a0]
mov dword [ebp - 4], esi
call fcn.1002c487
xor edx, edx
inc edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x20], ebx
jmp 0x10032ec5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x9c], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10032eb8
mov dword [ebp - 0x20], ebx
jmp 0x10032ede
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x360]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10032ecf
mov dword [ebp - 0x20], ebx
jmp 0x10032efb
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5a0]
mov dword [eax + ecx*4], 0xd9e177c4
inc dword [ebp - 0x20]
push 3
pop ecx
cmp dword [ebp - 0x20], ecx
jl 0x10032ee8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x10032f1a
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], 0xf
jle 0x10032ff6
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x28], 0x281c1d99
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x28], 0xb6930509
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x24], 0xc7fd579
mov dword [ebp - 0x14], ebx
jmp 0x10032f8d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8b4], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10032f7c
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
je 0x10032fa4
mov edi, edx
cmp dword [ebp - 0x9c], ebx
jne 0x10032fa6
mov edi, ebx
mov ecx, dword [ebp - 0x1c]
mov esi, edx
mov eax, dword [ebp - 0x360]
push 1
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x9c]
cmovle esi, ebx
xor edx, edx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
pop edx
setle cl
sub esi, ecx
add esi, edi
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xf
push 3
pop ecx
jg 0x10032f44
or edi, 0xffffffff
lea ecx, [ebp - 0x5a0]
call fcn.1002c55e
lea ecx, [ebp - 0x360]
mov dword [ebp - 4], edi
call fcn.1002c55e
push 3
pop ecx
push ecx
mov dword [ebp - 0x1c], 0x11c15747
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x34], 0xcf1d65f4
call fcn.1002c487
mov dword [ebp - 0x34], 0x73046773
mov dword [ebp - 0x34], 0xe85ec415
push 3
mov dword [ebp - 0x34], 0x5bed8572
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x1003305c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x468]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10033049
push 2
mov dword [ebp - 0x18], ebx
pop esi
jmp 0x1003307a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5d8], 0xd2f55126
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10033069
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
neg edx
mov eax, dword [ebp - 0x1c]
sbb edx, edx
neg edx
add eax, edx
add ecx, eax
xor eax, eax
test ecx, ecx
mov ecx, dword [ebp - 0x468]
setle al
cmp eax, 0xfffc
sbb eax, eax
inc eax
mov dword [ecx], eax
jne 0x100330c0
cmp dword [ecx + 4], ebx
jne 0x100330c0
xor edi, edi
mov ecx, ebx
inc edi
jmp 0x100330c5
xor edi, edi
inc edi
mov ecx, edi
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x1c]
sub eax, 0x44ad72d7
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0x314e
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
lea ecx, [ebp - 0x468]
setg dl
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x5d8], eax
call fcn.1002c55e
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x30], 0x7374489b
mov dword [ebp - 0x24], 0xde6eab3a
mov dword [ebp - 0x2c], ebx
jmp 0x10033430
push 3
pop ecx
push ecx
lea ecx, [ebp - 0x224]
call fcn.1002c487
mov dword [ebp - 0x18], 0x2edc7555
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], 0x2d63d2c8
push 3
mov dword [ebp - 0x28], 0xde97ee8c
mov dword [ebp - 0x20], ebx
pop edx
jmp 0x1003318f
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x224]
mov dword [eax + ecx*4], 0x7e8b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1003317c
mov dword [ebp - 0x20], ebx
jmp 0x100331aa
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x728], 0xa1f05067
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10033199
mov dword [ebp - 0x28], 0x1fc3
cmp dword [ebp - 0x28], 0x1359
jge 0x100332fe
push 0x144
lea eax, [ebp - 0xad4]
mov dword [ebp - 0xad8], ebx
push ebx
push eax
call fcn.10054ce0
add esp, 0xc
mov dword [ebp - 0x7c], ebx
lea eax, [ebp - 0x7c]
xorps xmm0, xmm0
mov esi, edi
movsd qword [ebp - 0x48], xmm0
push eax
push 0x100077e4
call fcn.1005459b
pop ecx
pop ecx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x80], ebx
jmp 0x100332ec
dec eax
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x80]
push eax
push 0x100077e0
call fcn.1005459b
pop ecx
pop ecx
cmp dword [ebp - 0x80], edi
jne 0x10033270
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x100078ec
call fcn.1005459b
mov ecx, dword [ebp - 0x110]
add esp, 0xc
mov edx, dword [ebp - 0x118]
mov eax, ebx
test ecx, ecx
jle 0x10033267
add dword [ebp + eax*4 - 0xad8], edx
inc eax
cmp eax, ecx
jl 0x1003325b
imul ecx, edx
movd xmm0, ecx
jmp 0x1003329d
push 2
pop eax
cmp dword [ebp - 0x80], eax
jne 0x100332a8
lea eax, [ebp - 0x114]
push eax
push 0x100077e4
call fcn.1005459b
mov eax, dword [ebp - 0x114]
pop ecx
mov dword [ebp + esi*4 - 0xad8], eax
inc esi
pop ecx
movd xmm0, eax
cvtdq2pd xmm1, xmm0
addsd xmm1, qword [ebp - 0x48]
jmp 0x100332c7
movsd xmm1, qword [ebp - 0x48]
push 3
pop eax
cmp dword [ebp - 0x80], eax
jne 0x100332cc
movd xmm0, dword [ebp + esi*4 - 0xadc]
dec esi
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm0
movsd qword [ebp - 0x48], xmm1
movd xmm0, esi
cvtdq2pd xmm0, xmm0
push ecx
push ecx
divsd xmm1, xmm0
movsd qword [esp], xmm1
push 0x100079ec
call fcn.10054c24
add esp, 0xc
mov eax, dword [ebp - 0x7c]
test eax, eax
jne 0x10033215
dec eax
push 2
mov dword [ebp - 0x7c], eax
pop esi
mov dword [ebp - 0x20], ebx
jmp 0x10033314
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x750], 5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10033303
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x1003338c
or edi, 0xffffffff
mov dword [ebp - 0x14], ebx
xor edx, edx
push 4
pop eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x728], 0x5b641b44
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, edi
setge cl
xor edx, edx
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x18]
imul edx, dword [ebp - 0x2c]
sub edx, 7
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x30], edx
imul eax, dword [ebp - 0x30], 6
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x74c]
dec dword [ebp - 0x18]
jns 0x10033324
xor edi, edi
inc edi
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x10033422
mov esi, dword [ebp - 0x224]
xor ecx, ecx
mov dword [ebp - 0x14], ebx
inc ecx
jmp 0x100333b7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa4], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100333a6
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xa4], ebx
jne 0x100333ca
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x728], ecx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
add eax, 0x771fda66
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x224]
mov ecx, dword [esi + 4]
mov dword [eax + edx*4], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xa4]
sub eax, 2
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setne dl
mov dword [ebp - 0x28], edx
dec dword [ebp - 0x18]
jns 0x1003339e
xor edi, edi
push 2
inc edi
pop esi
lea ecx, [ebp - 0x224]
call fcn.1002c55e
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x11
jle 0x1003314d
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x1c], 0xfffffffa
push 0xfffffffffffffffe
mov dword [ebp - 0x2c], 0xdd5d0881
pop eax
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x1c], 0x13
mov dword [ebp - 0x44], eax
jmp 0x100335de
mov dword [ebp - 0x24], 0x9feb
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0xa3de81d5
mov dword [ebp - 0x34], 0x6982b357
mov dword [ebp - 0x34], 0x11ca4b38
mov dword [ebp - 0x34], 0x28cbd6cd
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x30], ebx
jne 0x1003354b
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
mov dword [ebp - 0x2c], edx
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setg dl
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0xf888c554
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
shl eax, 3
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setg dl
mov dword [ebp - 0x34], edx
xor edx, edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setne dl
cmp edx, dword [ebp - 0x30]
jle 0x1003350c
mov eax, edi
cmp dword [ebp - 0x14], ebx
jne 0x1003350e
mov eax, ebx
xor ecx, ecx
cmp eax, 0x3a34
setg cl
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
imul ecx, dword [ebp - 0x14]
cmp ecx, 0x2e0c
setl al
xor ecx, ecx
cmp eax, 0xffff
mov eax, ebx
setne cl
sub ecx, 0xe45a
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x1c]
je 0x1003354d
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0x1ce2
cmp dword [ebp - 0x28], 0x55a
jge 0x100335cf
push 0x10da7d54
push 0x10da7d58
push 0x10da7e14
push 0x100078f4
call fcn.1005459b
mov edi, dword [0x10da7e14]
add esp, 0x10
mov eax, edi
cdq
idiv dword [0x10da7d58]
lea esi, [eax + 1]
imul esi, dword [0x10da7d58]
cmp esi, dword [0x10da7d54]
jg 0x100335c4
mov eax, esi
sub eax, edi
push eax
push 0x10007940
call fcn.10054c24
add esi, dword [0x10da7d58]
pop ecx
pop ecx
cmp esi, dword [0x10da7d54]
jg 0x100335cf
mov edi, dword [0x10da7e14]
jmp 0x1003359d
push 0x10007834
call fcn.10055012
pop ecx
mov eax, dword [ebp - 0x1c]
push 1
pop edi
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x1c]
push 0xfffffffffffffffe
pop eax
cmp dword [ebp - 0x1c], 0xfffffff1
jle 0x10033468
mov dword [ebp - 0x3c], 0x7e8e
lea ecx, [ebp - 0x378]
push 3
mov dword [ebp - 0x3c], 8
pop eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0xdbeccce1
mov dword [ebp - 0x3c], 0xfffffffc
push eax
call fcn.1002c487
push 3
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x10033631
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x378]
mov dword [eax + ecx*4], 0x3f9e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003361e
mov eax, dword [ebp - 0x378]
lea ecx, [ebp - 0x378]
inc dword [eax + 8]
call fcn.1002c55e
xor edi, edi
mov dword [ebp - 0x24], 0x6917
inc edi
lea ecx, [ebp - 0x480]
push edi
call fcn.1002c487
push 2
pop esi
push 3
pop eax
push eax
lea ecx, [ebp - 0x650]
mov dword [ebp - 4], esi
call fcn.1002c487
push 3
pop eax
mov byte [ebp - 4], al
or eax, 0xffffffff
mov dword [ebp - 0x1c], 0xbca63185
mov dword [ebp - 0x34], eax
push 5
pop eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], eax
push 0xf
pop eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1003373a
mov dword [ebp - 0x2c], 0x5950
xor edx, edx
mov dword [ebp - 0x34], 0x100c4307
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], 0x977a
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setl dl
xor ecx, ecx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x2c]
cmp eax, 0xdd01
setne cl
cmp dword [ebp - 0x14], ecx
jl 0x100336e1
mov edx, edi
cmp dword [ebp - 0x14], ebx
jne 0x100336e3
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, edx
mov esi, dword [ebp - 0x2c]
setg cl
sub esi, ecx
neg esi
sbb esi, esi
xor edx, edx
inc esi
sub esi, dword [ebp - 0x2c]
sub esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp esi, eax
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003372a
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
jge 0x100336a0
push 2
pop esi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], 0xbdde0bcd
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10033753
call dword [sym.imp.USER32.dll_GetCapture]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003376c
push 0x154c
push 0x1ce1
call dword [sym.imp.GDI32.dll_SetLayout]
mov dword [ebp - 0x14], ebx
jmp 0x10033782
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x10c], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10033771
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003379d
push ebx
push 0xe3
push ebx
call dword [sym.imp.GDI32.dll_GetBitmapBits]
mov dword [ebp - 0x10c], ebx
jmp 0x100337c9
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100337c3
push 0xcef
push 0x2264
push 0x247e
call dword [sym.imp.KERNEL32.dll_MulDiv]
inc dword [ebp - 0x10c]
cmp dword [ebp - 0x10c], 0x15
jg 0x100337a5
xor edx, edx
mov dword [ebp - 0x20], ebx
inc edx
or edi, 0xffffffff
cmp dword [ebp - 0x20], edx
jge 0x100337ef
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb0], edi
inc dword [ebp - 0x20]
jmp 0x100337db
mov dword [ebp - 0x2c], 0x7e2799ac
mov dword [ebp - 0x28], 0x4f4fcf42
mov dword [ebp - 0x2c], 0xffffffe6
cmp dword [ebp - 0x2c], edi
jge 0x100339fb
push esi
lea ecx, [ebp - 0x160]
call fcn.1002c487
push 4
pop eax
mov byte [ebp - 4], al
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x1c], ebx
jmp 0x10033838
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x304], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003382b
mov dword [ebp - 0x1c], ebx
jmp 0x10033855
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x160]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10033842
mov eax, dword [ebp - 0x160]
mov dword [eax], ebx
xor eax, eax
lea ecx, [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x1c], eax
push eax
call fcn.1002c487
xor edx, edx
mov dword [ebp - 0x34], 0x37e8f884
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x10033892
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c0]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10033883
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], edx
jg 0x1003399d
mov esi, dword [ebp - 0x160]
push 2
mov dword [ebp - 0x20], 0x89a69576
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], ebx
jmp 0x100338ee
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100338d4
push 0x2505
push ebx
push ebx
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
xor edx, edx
inc edx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100338eb
push 0x1d86
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
xor edx, edx
inc edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x100338bb
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x304]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x304]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c0]
cmp dword [eax], edx
setge cl
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], ebx
je 0x10033938
cmp dword [ebp - 0x28], ebx
jne 0x1003393a
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x160]
setne cl
cmp ecx, dword [eax]
jl 0x1003395c
mov eax, dword [ebp - 0x2c0]
cmp dword [eax], ebx
jne 0x1003395c
mov ecx, ebx
jmp 0x10033961
xor eax, eax
lea ecx, [eax + 1]
xor eax, eax
cmp ecx, 0x538fd232
setne al
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x2c]
setns cl
xor edx, edx
cmp ecx, 0xb0bb
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
sub ecx, dword [esi + 4]
inc edx
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x100338a9
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100339b4
push ebx
push edx
push 0x643
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
lea ecx, [ebp - 0x2c0]
call fcn.1002c55e
mov eax, dword [ebp - 0x160]
xor ecx, ecx
inc ecx
inc dword [eax]
cmp dword [eax], ecx
jle 0x10033862
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x28], eax
push 3
pop eax
mov byte [ebp - 4], al
call fcn.1002c55e
inc dword [ebp - 0x2c]
push 2
pop esi
cmp dword [ebp - 0x2c], edi
jl 0x1003380d
xor edx, edx
inc edx
mov dword [ebp - 0x20], ebx
jmp 0x10033a0f
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x480]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10033a00
push edx
lea ecx, [ebp - 0x2a8]
call fcn.1002c487
mov dword [ebp - 0x2c], ebx
xor edx, edx
push 4
mov dword [ebp - 0x1c], 0x8ce3e63e
inc edx
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], ebx
jmp 0x10033a47
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2a8]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10033a38
mov dword [ebp - 0x1c], ebx
jmp 0x10033a5e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x848], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10033a51
mov eax, dword [ebp - 0x2a8]
push 0xfffffffffffffff9
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
pop eax
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2a8]
add ecx, dword [eax]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x1c], 0x18
jmp 0x10033ae1
mov dword [ebp - 0x30], 0xffff
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edi
jmp 0x10033ad8
mov dword [ebp - 0x2c], ebx
jmp 0x10033acf
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10033acc
push 0x12ae
push ebx
push 0x319
push 0x27d
push ebx
push 0x139b
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff6
je 0x10033aa7
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x38
je 0x10033aa2
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xb
je 0x10033a90
lea ecx, [ebp - 0x2a8]
call fcn.1002c55e
push 3
mov dword [ebp - 0x20], ebx
pop edx
jmp 0x10033b0d
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x650]
mov dword [eax + ecx*4], 0xd9e177c4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10033afa
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0x18], ebx
jne 0x10033b29
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0xf
jle 0x10034622
lea edi, [ebp - 0x568]
jmp 0x10033b5e
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10033b87
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x803
push 0x1398
push 0x1edb
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10033b9c
push 0x1e12
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
xor eax, eax
mov dword [ebp - 0x28], 9
inc eax
lea ecx, [ebp - 0x324]
push eax
call fcn.1002c487
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x10033bcd
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x324]
mov dword [eax + ecx*4], 0x1928c176
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10033bba
mov eax, dword [ebp - 0x324]
push 0xfffffffffffffffe
pop ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x324]
call fcn.1002c55e
mov dword [ebp - 0x4c], 0x281c1d99
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x30], 0x7b1891f7
mov dword [ebp - 0x34], 8
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10033c28
push 0x18f5
push ebx
push 0x1e3e
push 0xfc7
push 0x1941
call dword [sym.imp.GDI32.dll_ExtFloodFill]
cmp dword [ebp - 0x14], ebx
je 0x10033c41
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
xor eax, eax
inc eax
jmp 0x10033cb9
mov dword [ebp - 0x2c], 0x9d01
mov dword [ebp - 0x34], 0xfa1a8f1e
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x14], ebx
je 0x10033c60
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, 0x9150
mov eax, dword [ebp - 0x14]
push 3
setg cl
xor edx, edx
cmp ecx, 0x4082
setge dl
xor ebx, ebx
add edx, 0xffff
cmp edx, eax
setl bl
xor ecx, ecx
sub ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
cmp ebx, eax
mov eax, dword [ebp - 0x2c]
setg cl
xor edx, edx
cmp ecx, eax
pop eax
setge dl
add edx, dword [ebp - 0x2c]
cmp eax, edx
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
xor eax, eax
inc eax
xor ebx, ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], eax
xor edx, edx
mov dword [ebp - 0x20], 7
or eax, 0xffffffff
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], 0x86d6dbc1
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x34], 0xfc53d8b3
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x50], 0x6aa1dd5c
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
add ecx, 0x2fe81720
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
je 0x10033e5b
push 3
pop ecx
jmp 0x10033d7f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x510], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10033d6e
mov dword [ebp - 0x1c], 0xfffffff2
jmp 0x10033dfa
mov dword [ebp - 0x2c], ebx
jmp 0x10033dde
mov dword [ebp - 0x20], ebx
jmp 0x10033db0
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x510], ebx
jne 0x10033db5
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x510]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10033d97
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x30], ebx
jl 0x10033ddb
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], ebx
jl 0x10033dd6
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x510], ebx
jne 0x10033dd6
dec dword [ebp - 0x20]
jns 0x10033dc5
dec dword [ebp - 0x30]
jns 0x10033dbd
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x10033d92
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10033df7
push 0x209c
call dword [sym.imp.USER32.dll_PostQuitMessage]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x18
je 0x10033d8d
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x50]
dec dword [ebp - 0x50]
test eax, eax
je 0x10033e14
mov esi, ecx
cmp dword [ebp - 0x38], ebx
jne 0x10033e16
mov esi, ebx
cmp dword [ebp - 0x1c], ebx
jne 0x10033e7d
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, 0xfff9
setg dl
cmp eax, edx
sbb ecx, ecx
xor eax, eax
inc ecx
imul ecx, dword [ebp - 0x30]
cmp ecx, 0x3978
setge al
cmp eax, 0xb00b7228
jb 0x10033e7d
mov eax, ebx
jmp 0x10033e80
push 4
xor ecx, ecx
pop edx
inc ecx
cmp dword [ebp - 0x14], edx
jge 0x10033e75
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x858], ecx
inc dword [ebp - 0x14]
jmp 0x10033e61
mov dword [ebp - 0x854], ecx
jmp 0x10033e03
xor eax, eax
inc eax
xor edx, edx
cmp esi, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x4c], 0xb6930509
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x38], 0x7374489b
mov dword [ebp - 0x30], 0xde6eab3a
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], 0x11
jg 0x1003406c
or edi, 0xffffffff
push 3
pop eax
push eax
lea ecx, [ebp - 0x248]
call fcn.1002c487
mov dword [ebp - 0x1c], 0x2edc7555
xor edx, edx
inc edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], 0x2d63d2c8
mov dword [ebp - 0x54], 0xde97ee8c
push 3
mov dword [ebp - 0x20], ebx
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x10033f15
push ecx
pop edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x248]
mov dword [eax + ecx*4], 0x7e8b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10033ef7
xor edx, edx
push 3
inc edx
pop ecx
mov dword [ebp - 0x20], ebx
jmp 0x10033f2b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x5b0], 0xa1f05067
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10033f1a
push 2
mov dword [ebp - 0x20], ebx
pop esi
jmp 0x10033f49
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x5ec], 5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10033f38
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], ebx
jl 0x10033fbe
mov dword [ebp - 0x14], ebx
xor edx, edx
push 4
pop eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x5b0], 0x5b641b44
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, edi
setge cl
xor edx, edx
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x1c]
imul edx, dword [ebp - 0x2c]
sub edx, 7
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x38], edx
imul eax, dword [ebp - 0x38], 6
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x5e8]
dec dword [ebp - 0x1c]
jns 0x10033f56
xor edx, edx
inc edx
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], ebx
jl 0x1003404e
mov esi, dword [ebp - 0x248]
mov dword [ebp - 0x14], ebx
jmp 0x10033fe6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa0], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10033fd5
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xa0], ebx
jne 0x10033ff9
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x5b0], edx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
add eax, 0x771fda66
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x248]
mov ecx, dword [esi + 4]
push 1
mov dword [eax + edx*4], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xa0]
sub eax, 2
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setne dl
mov dword [ebp - 0x54], edx
dec dword [ebp - 0x1c]
pop edx
jns 0x10033fd0
lea ecx, [ebp - 0x248]
call fcn.1002c55e
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x11
jle 0x10033ec0
lea edi, [ebp - 0x568]
push 3
xor esi, esi
lea ecx, [ebp - 0x614]
pop eax
inc esi
mov dword [ebp - 0x3c], esi
push eax
call fcn.1002c487
mov dword [ebp - 0x30], esi
push 3
mov dword [ebp - 0x14], ebx
pop edx
cmp dword [ebp - 0x14], edx
jge 0x100340a6
push 0xfffffffffffffffe
pop esi
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x614]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10034092
push 2
mov dword [ebp - 0x30], ebx
pop esi
jmp 0x100340cf
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x14], ebx
jmp 0x100340c7
mov dword [ebp - 0x54], 0x65121ac4
mov dword [ebp - 0x54], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x100340ba
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x100340ae
lea ecx, [ebp - 0x614]
call fcn.1002c55e
mov dword [ebp - 0x3c], 0xfffffff6
or eax, 0xffffffff
mov dword [ebp - 0x1c], eax
push 4
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x10034108
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x784], 0x53f0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100340f7
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jne 0x10034153
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
sub edx, 0x5c6f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
inc ecx
neg ecx
sbb ecx, ecx
add ecx, 0xf
cmp ecx, dword [ebp - 0x1c]
je 0x10034153
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
jmp 0x10034168
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10034168
push ebx
push 0xd23
call dword [sym.imp.USER32.dll_EndDialog]
push 3
pop eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jl 0x100341cd
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jl 0x100341c8
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100341ac
push 0x423
push 0x160b
push 0x1322
push 0x1ca0
push 0x19ec
push ebx
push ebx
push ebx
push ebx
push 0x1ffa
call dword [sym.imp.USER32.dll_DrawStateW]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x784]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x784], ecx
dec dword [ebp - 0x2c]
jns 0x1003417b
push 3
pop eax
dec dword [ebp - 0x1c]
jns 0x10034173
movdqa xmm0, xmmword [0x10007fc0]
or eax, 0xffffffff
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x558]
push ecx
push eax
mov dword [ebp - 0x50], 0xe85a7b05
lea ecx, [ebp - 0x5c0]
push edi
movdqu xmmword [ebp - 0x568], xmm0
call fcn.1002c538
push 4
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x10034221
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x218], 0xa8eac8b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10034210
push 3
mov dword [ebp - 0x1c], ebx
pop edx
cmp dword [ebp - 0x1c], edx
jg 0x10034250
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x218], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x10034231
push 4
pop ecx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xffffffe7
je 0x1003431a
mov edi, dword [ebp - 0x5c0]
or eax, 0xffffffff
xor edx, edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x34], 0x3d188047
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0xd9a54e58
mov dword [ebp - 0x54], 0xc23782ec
mov eax, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x214]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
push 4
setg cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x218]
cmp ecx, eax
mov eax, dword [ebp - 0x218]
setle dl
xor ecx, ecx
add eax, edx
xor edx, edx
mov dword [ebp - 0x34], eax
inc edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
mov esi, dword [edi + 8]
setl cl
xor edx, edx
cmp ecx, esi
pop ecx
setne dl
xor eax, eax
cmp edx, esi
setg al
mov dword [ebp - 0x54], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe7
jne 0x10034263
push 2
pop esi
lea ecx, [ebp - 0x5c0]
call fcn.1002c55e
push 3
pop eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x638]
mov dword [ebp - 0x148], 0x2d5e48d3
xor eax, eax
mov dword [ebp - 0x144], 0x2d5e48d3
inc eax
mov dword [ebp - 0x140], 0x2d5e48d3
mov dword [ebp - 0x13c], 0x2d5e48d3
mov dword [ebp - 0x1c], 0x52061f6
mov dword [ebp - 0x34], eax
push eax
call fcn.1002c487
xor edx, edx
mov byte [ebp - 4], 5
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1003438b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x638]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10034378
push 3
mov dword [ebp - 0x1c], ebx
pop ecx
jmp 0x100343f4
push edx
lea ecx, [ebp - 0x2cc]
call fcn.1002c487
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x100343bb
cmp dword [ebp - 0x1c], ecx
jle 0x10034398
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
je 0x10034407
lea ecx, [ebp - 0x650]
call fcn.1002c55e
lea ecx, [ebp - 0x480]
mov dword [ebp - 4], edi
call fcn.1002c55e
movdqa xmm0, xmmword [0x10008010]
lea ecx, [ebp - 0x7c4]
mov dword [ebp - 0x4c], 0xffff
lea eax, [ebp - 0x7b4]
push ecx
mov dword [ebp - 0x38], edi
mov edi, 0x2443ac46
push eax
mov dword [ebp - 0x34], edi
push ecx
mov dword [ebp - 0x28], 0x6652d0da
lea ecx, [ebp - 0x7e0]
mov dword [ebp - 0x2c], ebx
movdqu xmmword [ebp - 0x7c4], xmm0
call fcn.1002c538
mov dword [ebp - 0x54], 0xe4b0ad8e
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x4c], 0x351f2000
jl 0x100346af
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x38]
jne 0x100346af
xor esi, esi
mov eax, ebx
inc esi
jmp 0x100346b4
xor esi, esi
inc esi
mov eax, esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], ebx
mov ebx, dword [sym.imp.USER32.dll_DrawMenuBar]
jmp 0x100346ee
mov dword [ebp - 0x24], 0xc
jmp 0x100346e5
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x100346e2
push 0x22fc
call ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x14
jge 0x100346d1
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x34
jl 0x100346c8
lea ecx, [ebp - 0x7e0]
call fcn.1002c55e
movdqa xmm0, xmmword [0x10008010]
lea ecx, [ebp - 0x794]
mov dword [ebp - 0x4c], 0xffff
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x784]
push ecx
push eax
mov dword [ebp - 0x34], edi
push ecx
mov dword [ebp - 0x28], 0x6652d0da
lea ecx, [ebp - 0x7f8]
mov dword [ebp - 0x2c], 0
movdqu xmmword [ebp - 0x794], xmm0
call fcn.1002c538
xor ecx, ecx
mov dword [ebp - 0x54], 0xe4b0ad8e
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x4c], 0x351f2000
jl 0x10034772
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x24]
mov eax, ecx
je 0x10034774
mov eax, esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], ecx
jmp 0x100347a9
mov dword [ebp - 0x24], 0xc
jmp 0x100347a0
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x1003479d
push 0x22fc
call ebx
xor ecx, ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x14
jge 0x1003478b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x34
jl 0x10034782
lea ecx, [ebp - 0x7f8]
call fcn.1002c55e
mov edi, 0x1f7e2799
xor ebx, ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x34], 0x6046e74a
mov dword [ebp - 0x24], ebx
jmp 0x100348a4
push esi
lea ecx, [ebp - 0x3a8]
call fcn.1002c487
mov dword [ebp - 0x14], 0xedc7555b
xor edx, edx
mov dword [ebp - 0x4c], 0xa9d01274
inc edx
mov dword [ebp - 0x14], ebx
jmp 0x10034808
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3a8]
mov dword [eax + ecx*4], 0xb72f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100347f5
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x10034890
xor esi, esi
inc esi
mov dword [ebp - 0x1c], 0x9cc14173
mov dword [ebp - 0x28], 0x6eab3ae5
mov dword [ebp - 0x1c], ebx
jmp 0x10034883
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, esi
mov eax, dword [ebp - 0x3a8]
setg cl
xor ebx, ebx
cmp ecx, 0xbfe7374
setl bl
sub ebx, dword [eax + edx*4]
mov eax, dword [ebp - 0x24]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
sete cl
xor ebx, ebx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], ebx
cmp dword [ebp - 0x1c], ebx
jne 0x10034888
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1003482b
dec dword [ebp - 0x14]
jns 0x10034818
xor edx, edx
inc edx
mov dword [ebp - 0x34], edx
lea ecx, [ebp - 0x3a8]
call fcn.1002c55e
dec dword [ebp - 0x24]
push 1
pop esi
cmp dword [ebp - 0x24], 0xffffffe6
jge 0x100347d3
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x34], 0x6046e74a
mov dword [ebp - 0x24], ebx
jmp 0x10034991
xor eax, eax
lea ecx, [ebp - 0x4f8]
inc eax
push eax
call fcn.1002c487
mov dword [ebp - 0x14], 0xedc7555b
xor edx, edx
mov dword [ebp - 0x4c], 0xa9d01274
inc edx
mov dword [ebp - 0x14], ebx
jmp 0x100348f8
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4f8]
mov dword [eax + ecx*4], 0xb72f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100348e5
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x10034980
xor esi, esi
inc esi
mov dword [ebp - 0x1c], 0x9cc14173
mov dword [ebp - 0x28], 0x6eab3ae5
mov dword [ebp - 0x1c], ebx
jmp 0x10034973
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, esi
mov eax, dword [ebp - 0x4f8]
setg cl
xor ebx, ebx
cmp ecx, 0xbfe7374
setl bl
sub ebx, dword [eax + edx*4]
mov eax, dword [ebp - 0x24]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
sete cl
xor ebx, ebx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], ebx
cmp dword [ebp - 0x1c], ebx
jne 0x10034978
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1003491b
dec dword [ebp - 0x14]
jns 0x10034908
xor edx, edx
inc edx
mov dword [ebp - 0x34], edx
lea ecx, [ebp - 0x4f8]
call fcn.1002c55e
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe6
jge 0x100348c0
push 3
pop eax
push eax
lea ecx, [ebp - 0x3d8]
call fcn.1002c487
mov dword [ebp - 4], 6
push 3
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x100349d3
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3d8]
mov dword [eax + ecx*4], 0x62d5e48d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100349c0
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100349f0
xor eax, eax
inc eax
push eax
push 0x265b
call dword [sym.imp.USER32.dll_EnableWindow]
mov esi, dword [ebp - 0x3d8]
xor edx, edx
inc edx
or edi, 0xffffffff
mov dword [esi + 4], edx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x4c], 0x2e6e7f73
mov dword [ebp - 0x54], 0xce3c
push 3
mov dword [ebp - 0x34], 0x2e3ca369
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x10034a30
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x498], 0x3c8fc558
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10034a1f
push 2
pop eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jl 0x10034a9b
push edx
lea ecx, [ebp - 0x3c0]
call fcn.1002c487
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x10034a67
imul eax, dword [esi + 4], 3
mov ecx, dword [ebp - 0x498]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [ebp - 0x4c], ecx
je 0x10034ab8