Function at 0x1003b393
Capabilities:
Authenticate hmac
Create pipe
Encode data using xor
Encrypt data using speck
Get common file path
Get session user name
Identify system language via api
Query environment variable
Query service status

Disassembly:
mov eax, 0x10060421
call fcn.1005f250
sub esp, 0x824
push ebx
push esi
mov dword [ebp - 0x14], 0xffffffff
xor esi, esi
mov dword [ebp - 0x40], 7
inc esi
push edi
mov dword [ebp - 0x30], 0xff8cd3be
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x2f8]
mov dword [ebp - 0x2c], 0xa0cd95f
mov dword [ebp - 0x48], 0x98b94be3
mov dword [ebp - 0x38], 0xfffffff8
push esi
mov byte [ebp - 0x60], dl
call fcn.1002c4d4
xor ebx, ebx
mov dword [ebp - 0x24], ebx
jmp 0x1003b3fe
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2f8]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1003b3ef
cmp dword [ebp - 0x40], 0xf7cd
je 0x1003b44a
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x40]
push 0xfffffffffffffff7
pop edi
cmp edi, eax
mov eax, dword [ebp - 0x30]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
add ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp - 0x2c]
mov ecx, esi
je 0x1003b44c
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x2c], eax
je 0x1003b476
mov eax, esi
cmp dword [ebp - 0x30], ebx
jne 0x1003b478
mov eax, ebx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2f8]
mov dword [eax], ecx
lea ecx, [ebp - 0x2f8]
call fcn.1002c556
mov dword [ebp - 0x20], 0xffffffff
lea ecx, [ebp - 0x3a0]
mov dword [ebp - 0x40], 7
mov dword [ebp - 0x30], 0xff8cd3be
mov dword [ebp - 0x2c], 0xa0cd95f
mov dword [ebp - 0x48], 0x98b94be3
mov dword [ebp - 0x38], 0xfffffff8
push esi
call fcn.1002c4d4
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], 0x3c60
cmp dword [ebp - 0x24], 0x3e2a
jle 0x1003b540
mov edi, ebx
mov dword [ebp - 0x28], ebx
mov esi, ebx
mov dword [ebp - 0x14], edi
mov ecx, esi
mov eax, ebx
shl edi, cl
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], edi
mov ecx, eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x18], ebx
shl edi, cl
mov eax, edi
mov ecx, 0x10607df8
xor eax, ebx
cdq
push edx
push eax
call fcn.1002c3bf
inc ebx
cmp ebx, 0x3906
jl 0x1003b4fa
mov eax, dword [ebp - 0x38]
mov edi, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x38], eax
push 0
pop ebx
cmp eax, 0xe07
jl 0x1003b4f0
mov edi, dword [ebp - 0x28]
inc esi
cmp esi, 0x3388
jl 0x1003b4e1
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x3c2d
jl 0x1003b4df
xor edx, edx
inc edx
mov byte [ebp - 4], dl
cmp dword [ebp - 0x24], 0x3bfc
jge 0x1003b582
mov edx, 0x1000ab00
mov ecx, 0x10607df8
call fcn.1002de69
xor edx, edx
inc edx
jmp 0x1003b582
push 0xfffffffffffffff7
pop esi
mov dword [ebp - 0x24], ebx
jmp 0x1003b599
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3a0]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1003b58a
cmp dword [ebp - 0x40], 0xf7cd
je 0x1003b5e5
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x40]
cmp esi, eax
mov eax, dword [ebp - 0x30]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x40], ecx
inc edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
add ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp - 0x2c]
mov ecx, edx
je 0x1003b5e7
mov ecx, ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x2c], eax
je 0x1003b611
mov eax, edx
cmp dword [ebp - 0x30], ebx
jne 0x1003b613
mov eax, ebx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3a0]
or dword [ebp - 4], 0xffffffff
mov dword [eax], ecx
lea ecx, [ebp - 0x3a0]
call fcn.1002c556
push 2
mov dword [ebp - 0x24], ebx
pop esi
jmp 0x1003b646
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x7c], 0xddc85f70
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1003b638
mov dword [ebp - 0x7c], ebx
jmp 0x1003b663
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1003b660
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
dec dword [ebp - 0x7c]
cmp dword [ebp - 0x7c], 0xfffffffc
jge 0x1003b650
mov eax, dword [ebp - 0x7c]
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x7c], eax
xor eax, eax
mov dword [ebp - 0x28], 0xffffffff
inc eax
mov dword [ebp - 0x38], 0xe469ad59
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x390197f0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0x1b66bafc
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x1ba028e
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x3c], ebx
push esi
call fcn.1002c4d4
push 3
mov dword [ebp - 0x18], ebx
pop edi
jmp 0x1003b6d9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6b8], 0x15fdc8df
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1003b6c8
mov dword [ebp - 0x18], ebx
jmp 0x1003b6f4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x808], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1003b6e3
mov dword [ebp - 0x18], ebx
jmp 0x1003b70d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x310]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1003b6fe
inc dword [ebp - 0x38]
lea ecx, [ebp - 0x310]
mov eax, dword [ebp - 0x310]
dec dword [eax]
call fcn.1002c556
mov dword [ebp - 0x40], 7
lea ecx, [ebp - 0xfc]
push esi
call fcn.1002c4d4
xor edx, edx
inc edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 0xbc35240c
mov dword [ebp - 0x44], ebx
jmp 0x1003b75d
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0xfc]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jl 0x1003b74d
mov dword [ebp - 0x44], ebx
jmp 0x1003b778
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x64c], 0xfffffff8
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 4
jl 0x1003b767
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x1003b83a
mov dword [ebp - 0x38], 0xffffffff
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xfc]
cmp dword [eax + ecx*4], ebx
je 0x1003b811
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x648], edx
mov eax, dword [ebp - 0x18]
cmp eax, 0x8528
setge cl
xor eax, eax
cmp ecx, edx
setle al
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ecx + edx*4]
jl 0x1003b7e0
mov eax, dword [ebp - 0xfc]
cmp dword [eax + 4], ebx
je 0x1003b7e0
xor eax, eax
inc eax
jmp 0x1003b7e2
mov eax, ebx
mov dword [ebp - 0x38], eax
xor edx, edx
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x38]
cmp dword [ecx + esi*4], eax
mov eax, dword [ebp - 0xfc]
setne dl
sub edx, dword [eax + edi*4]
je 0x1003b80e
xor edx, edx
inc edx
mov eax, edx
jmp 0x1003b813
xor edx, edx
inc edx
mov eax, ebx
cmp eax, dword [ebp - 0x18]
je 0x1003b81d
cmp dword [ebp - 0x14], ebx
jne 0x1003b81f
mov edx, ebx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xfc]
push 1
mov dword [eax + ecx*4], edx
dec dword [ebp - 0x18]
pop edx
jns 0x1003b78a
push 3
pop edi
lea ecx, [ebp - 0xfc]
call fcn.1002c556
mov dword [ebp - 0x18], 0xff8cd3be
mov dword [ebp - 0x24], 0x2c03342e
mov dword [ebp - 0x24], ebx
jmp 0x1003b867
mov dword [ebp - 0x38], 0xf54c3c69
cmp dword [ebp - 0x38], ebx
jne 0x1003b86d
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffeb
jl 0x1003b858
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1003b882
push ebx
push 0x15d8
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [ebp - 0x20], 0xa0cd95f
mov dword [ebp - 0x24], 0x5d6c05ba
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1003b8aa
push ebx
push 0x2701
push 0x26d8
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov dword [ebp - 0x24], ebx
jmp 0x1003b8d4
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x48], 0xffffffe4
jmp 0x1003b8cb
mov dword [ebp - 0x38], 0x8f0aa6e6
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xfffffffe
jle 0x1003b8bb
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe2
jne 0x1003b8af
xor esi, esi
mov dword [ebp - 0x30], 0x98b94be3
inc esi
mov dword [ebp - 0x38], 0xfffffff8
push esi
lea ecx, [ebp - 0x2d4]
call fcn.1002c4d4
mov dword [ebp - 4], edi
mov dword [ebp - 0x44], 0x68ec0ae9
mov dword [ebp - 0x44], edi
jmp 0x1003b954
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x24], ebx
jmp 0x1003b923
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6dc], 9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1003b912
inc dword [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
jmp 0x1003b94b
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1003b948
push ebx
push ebx
push 0x25f2
push ebx
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jle 0x1003b930
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xa
je 0x1003b906
mov dword [ebp - 0x44], 0x13
jmp 0x1003b96b
cmp dword [ebp - 0x44], ebx
jne 0x1003b971
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x14
jle 0x1003b963
mov dword [ebp - 0x24], 8
lea ecx, [ebp - 0x3b8]
mov dword [ebp - 0x48], 0xdedb5cab
mov dword [ebp - 0x14], 0x6f62939c
push esi
call fcn.1002c4d4
push 2
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 4
call fcn.1002c4d4
mov byte [ebp - 4], 5
mov dword [ebp - 0x44], ebx
jmp 0x1003b9bf
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3b8]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jl 0x1003b9ac
mov dword [ebp - 0x44], ebx
jmp 0x1003b9dc
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x328]
mov dword [eax + ecx*4], 0x68169b2b
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 2
jl 0x1003b9c9
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1003b9f7
push ebx
push 0x1b5a
call dword [sym.imp.USER32.dll_BeginPaint]
mov dword [ebp - 0x24], 7
cmp dword [ebp - 0x24], 0x1c
jge 0x1003bc7d
mov dword [ebp - 0x14], 0x13ec752f
mov dword [ebp - 0x44], 0x3a78
cmp dword [ebp - 0x44], 0x3aca
jle 0x1003ba90
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov edi, ebx
mov dword [ebp - 0x38], ebx
mov ecx, edi
mov dword [ebp - 0x4c], eax
mov edi, eax
mov esi, ebx
shl edi, cl
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x7e4]
cdq
push edx
push eax
call fcn.1000d0f0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003ba52
mov eax, dword [eax]
push eax
call fcn.10049f86
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x7e4]
call fcn.1002c860
inc esi
cmp esi, 0x5b9f
jl 0x1003ba34
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
inc edi
mov dword [ebp - 0x38], edi
cmp edi, 0x3451
jl 0x1003ba29
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x449
jl 0x1003ba24
xor esi, esi
inc esi
cmp dword [ebp - 0x44], 0x38bf
jge 0x1003baa4
push 0x1000ab38
call fcn.10049f86
pop ecx
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x418]
mov dword [ebp - 0x4c], 0xab6d
push 4
call fcn.1002c4d4
mov dword [ebp - 0x44], ebx
jmp 0x1003bad5
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x170], 0xdca8fecf
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 2
jl 0x1003bac4
mov dword [ebp - 0x44], ebx
jmp 0x1003baf3
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x418]
mov dword [eax + ecx*4], 0x8cdb5cf
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 4
jl 0x1003bae0
cmp dword [ebp - 0x24], ebx
jne 0x1003bb08
mov eax, dword [ebp - 0x14]
mov edx, ebx
cmp eax, dword [ebp - 0x14]
je 0x1003bb0a
mov edx, esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x170], ecx
mov eax, dword [ebp - 0x48]
add eax, ecx
cmp eax, dword [ebp - 0x48]
jge 0x1003bb2b
mov edx, ebx
cmp dword [ebp - 0x4c], ebx
je 0x1003bb2d
mov edx, esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x4c]
jne 0x1003bb79
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1003bc6a
push 0x11eb
push ebx
push 0x7ee
push 0xf83
push 0x1be2
push ebx
push 0xf9b
push 0x16bd
push 0x12c
call dword [sym.imp.USER32.dll_DrawIconEx]
jmp 0x1003bc6a
mov dword [ebp - 0x2c], 0x95520f30
mov dword [ebp - 0x38], 0xb87c2657
mov dword [ebp - 0x14], 0x1153aa9
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1003bb9e
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0x14]
jle 0x1003bbee
mov ecx, dword [ebp - 0x2c]
xor edx, edx
add ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x16c]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setge dl
xor ecx, ecx
cmp edx, 0x3523
setge cl
xor edx, edx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3b8]
neg edx
sbb edx, edx
inc edx
imul edx, dword [eax]
mov eax, esi
test edx, edx
jne 0x1003bbf0
mov eax, ebx
mov dword [ebp - 0x38], eax
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
setne dl
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
mov eax, dword [ebp - 0x16c]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x2c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x418]
setle dl
xor ecx, ecx
cmp edx, dword [eax + 0xc]
setle cl
imul eax, ecx, 0x585c
test eax, eax
jne 0x1003bc5d
mov ecx, ebx
cmp dword [ebp - 0x14], ebx
je 0x1003bc5f
mov ecx, esi
mov eax, dword [ebp - 0x328]
neg ecx
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x418]
call fcn.1002c556
inc dword [ebp - 0x24]
jmp 0x1003b9fe
lea ecx, [ebp - 0x328]
call fcn.1002c556
lea ecx, [ebp - 0x3b8]
call fcn.1002c556
xor edx, edx
mov dword [ebp - 0x24], ebx
inc edx
jmp 0x1003bcaa
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2d4]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1003bc9b
cmp dword [ebp - 0x40], 0xf7cd
je 0x1003bcf9
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x40]
push 0xfffffffffffffff7
pop esi
cmp esi, eax
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x40], ecx
inc edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
add ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x20]
mov ecx, edx
je 0x1003bcfb
mov ecx, ebx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x20], eax
je 0x1003bd25
mov eax, edx
cmp dword [ebp - 0x18], ebx
jne 0x1003bd27
mov eax, ebx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2d4]
or dword [ebp - 4], 0xffffffff
mov dword [eax], ecx
lea ecx, [ebp - 0x2d4]
call fcn.1002c556
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x24], 0x9c7c6f1f
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x38], 0x67f5aee0
mov dword [ebp - 0x38], 0x5f22
cmp dword [ebp - 0x38], 0x6019
jle 0x1003bdcc
mov ecx, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov esi, ebx
lea eax, [esi + edi]
xor eax, ecx
lea ecx, [ebp - 0x694]
cdq
push edx
push eax
call fcn.1000d0f0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003bd96
mov eax, dword [eax]
push eax
call fcn.10049f86
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x694]
call fcn.1002c860
mov ecx, dword [ebp - 0x14]
inc esi
cmp esi, 0x177
jl 0x1003bd79
inc edi
cmp edi, 0x2f1
jl 0x1003bd77
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x50ac
jl 0x1003bd75
mov byte [ebp - 0x31], bl
cmp dword [ebp - 0x38], 0x5d88
jge 0x1003bde3
push 0x1000abc8
call fcn.10049f86
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x31], 0
je 0x1003bdf9
push ebx
push 0x2490
call dword [sym.imp.GDI32.dll_RectVisible]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
neg edx
push 3
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop edi
setg cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
cmp eax, edi
setne cl
imul eax, ecx, 0x2967
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x24], 0x9c7c6f1f
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x38], 0x67f5aee0
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1003be76
push ebx
push 0x2490
call dword [sym.imp.GDI32.dll_RectVisible]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
cmp eax, edi
setne cl
xor edi, edi
imul eax, ecx, 0x2967
inc edi
push edi
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x24], eax
call fcn.1002c4d4
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x24], ebx
jmp 0x1003bef4
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x340]
mov dword [eax + ecx*4], 0xa439beb0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1003bee1
mov dword [ebp - 0x38], 0x65a9
cmp dword [ebp - 0x38], 0x67e7
jle 0x1003bf31
mov esi, ebx
mov edi, esi
mov ebx, 0x6e7b
mov eax, edi
mov ecx, 0x10607df8
cdq
push edx
push eax
call fcn.1002c3bf
dec edi
dec ebx
jne 0x1003bf12
inc esi
cmp esi, 0x8d6
jl 0x1003bf0b
xor edi, edi
inc edi
mov eax, dword [ebp - 0x340]
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x38], 0x6275
mov dword [eax], 0x8bbca631
jge 0x1003bf7a
mov edx, 0x1000ac20
mov ecx, 0x10607df8
call fcn.1002de69
jmp 0x1003bf7a
push 0xfffffffffffffff7
pop esi
mov dword [ebp - 0x24], 0x18
jmp 0x1003bf98
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1003bf95
call dword [sym.imp.USER32.dll_GetMessageTime]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff3
je 0x1003bf86
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x340]
call fcn.1002c556
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x14], 0x61ece305
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x38], 0x431fadac
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x24], 0x542afa01
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], 0xfffffffa
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1003bfef
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_UnionRect]
mov eax, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
add ecx, 0xfffb
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
add ecx, dword [ebp - 0x40]
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x40]
sub ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setl dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x48]
setge bl
xor ecx, ecx
cmp eax, ebx
setl cl
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x40], 0x4320e32c
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x28], 0x5bef
mov dword [ebp - 0x14], esi
xor esi, esi
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x24], esi
jmp 0x1003c0a4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x664], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1003c093
mov eax, dword [ebp - 0x40]
neg eax
je 0x1003c0c3
cmp dword [ebp - 0x40], esi
jne 0x1003c0b9
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, edi
cmp dword [ebp - 0x38], esi
jne 0x1003c0c5
mov eax, esi
mov ecx, dword [ebp - 0x40]
xor edx, edx
imul ecx, eax
mov ebx, 0xd8da8e97
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x660], ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
neg eax
cmp ebx, eax
sbb eax, eax
neg eax
add eax, 0x53b1dab5
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], 0x7e98
cmp dword [ebp - 0x38], 0x8057
jle 0x1003c17b
mov edx, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov edi, esi
mov ebx, esi
mov esi, dword [ebp - 0x28]
mov ecx, ebx
lea eax, [edi + esi]
sar eax, cl
mov ecx, 0x10607df8
and eax, edx
cdq
push edx
push eax
call fcn.1002c3bf
mov edx, dword [ebp - 0x24]
inc ebx
cmp ebx, 0x43b5
jl 0x1003c123
inc edi
push 0
pop esi
cmp edi, 0xaf1
jl 0x1003c11e
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x50c1
jl 0x1003c11c
inc edx
mov dword [ebp - 0x24], edx
cmp edx, 0x6dce
jl 0x1003c119
push esi
push 0x19a7
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
xor edi, edi
inc edi
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 4], 0xd
cmp dword [ebp - 0x38], 0x7cf2
jge 0x1003c1a1
mov edx, 0x1000ac80
mov ecx, 0x10607df8
call fcn.1002de69
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x9c7c6f1f
lea ecx, [ebp - 0x400]
mov dword [ebp - 0x20], 0x136951ad
mov dword [ebp - 0x40], 7
push 2
call fcn.1002c4d4
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x38], 0xfbf646d9
mov dword [ebp - 0x18], esi
jmp 0x1003c21e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1c0], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003c20d
mov dword [ebp - 0x18], esi
jmp 0x1003c23c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x400]
mov dword [eax + ecx*4], 0xfadacd7d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1003c229
mov dword [ebp - 0x18], esi
jmp 0x1003c258
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x44c], 0x2071694a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1003c247
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setge bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor eax, eax
cmp ecx, 0x53061ece
setle al
xor ebx, ebx
cmp eax, 7
jne 0x1003c29d
mov edx, edi
cmp dword [ebp - 0x20], ebx
jne 0x1003c29f
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, edx
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x400]
setl cl
mov dword [eax + 4], ecx
mov dword [ebp - 0x2c], 0x1ddf
cmp dword [ebp - 0x2c], 0x205d
jle 0x1003c322
push 0x1b
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov esi, ebx
mov edi, ebx
mov eax, esi
mov ecx, 0x10607df8
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.1002c3bf
inc edi
cmp edi, 0x662a
jl 0x1003c2db
inc esi
cmp esi, 0x7efb
jl 0x1003c2d9
push ebx
push ebx
push 0x16cf
push ebx
push 0xa41
push ebx
push 0x1aaa
push 0x942
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor edi, edi
inc edi
cmp dword [ebp - 0x1bc], ebx
je 0x1003c336
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x28]
sub eax, 0x3cc9d6c8
je 0x1003c3b7
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], 0x83200138
mov dword [ebp - 0x38], 0xffffffff
cmp dword [ebp - 0x40], ebx
jne 0x1003c370
mov eax, dword [ebp - 0x24]
neg eax
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
setne dl
or ecx, 0xffffffff
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
sub ecx, eax
add ecx, dword [ebp - 0x24]
jne 0x1003c3a3
mov ecx, ebx
cmp dword [ebp - 0x24], ebx
je 0x1003c3a5
mov ecx, edi
mov eax, dword [ebp - 0x24]
imul eax, ecx
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
jmp 0x1003c3e5
mov dword [ebp - 0x3c], 0xfffffffc
inc dword [ebp - 0x38]
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1003c3e5
push 0x508
push 0x1553
push 0x13a9
push 0x79b
push ebx
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x2c], 0x1b8d
jge 0x1003c422
mov edx, 0x1000ad00
mov ecx, 0x10607df8
call fcn.1002de69
jmp 0x1003c422
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x400]
call fcn.1002c556
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x38], 0x67f5aee0
mov dword [ebp - 0x2c], 0x468c
cmp dword [ebp - 0x2c], 0x47c9
jle 0x1003c493
mov eax, ebx
mov dword [ebp - 0x28], ebx
mov esi, ebx
mov edi, ebx
mov ebx, esi
and ebx, eax
mov eax, edi
mov ecx, 0x10607df8
or eax, ebx
cdq
push edx
push eax
call fcn.1002c3bf
inc edi
cmp edi, 0x2d9a
jl 0x1003c45c
mov eax, dword [ebp - 0x28]
inc esi
push 0
pop ebx
cmp esi, 0x6ec
jl 0x1003c456
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x54ea
jl 0x1003c454
xor edi, edi
inc edi
mov dword [ebp - 0x28], 0x606de713
lea ecx, [ebp - 0x358]
push 2
call fcn.1002c4d4
mov dword [ebp - 0x44], 0xc7dc
mov dword [ebp - 0x40], 0x3dc0e3e7
mov dword [ebp - 0x48], 0x661fbc9f
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x38], 0x62a04f77
mov dword [ebp - 0x38], 0xbd29
mov dword [ebp - 0x24], ebx
jmp 0x1003c4e5
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x358]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1003c4d6
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x28], 0x6d6dbc1c
je 0x1003c50b
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x358]
mov dword [eax], ecx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x40]
jle 0x1003c51c
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
lea ecx, [ebp - 0x358]
setne dl
mov dword [ebp - 0x38], edx
call fcn.1002c556
mov dword [ebp - 4], 0x12
cmp dword [ebp - 0x2c], 0x4443
jge 0x1003c559
mov edx, 0x1000ad78
mov ecx, 0x10607df8
call fcn.1002de69
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x3c], 0xc05baf43
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1003c574
push edi
call dword [sym.imp.USER32.dll_ShowCursor]
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1003c5b0
push 0xc32
push 0x118a
push 0x9cd
push 0x231d
push 0x2318
push 0x288
push 0x1d9e
push 0x2f1
push 0x1d32
call dword [sym.imp.GDI32.dll_Arc]
mov byte [ebp - 0x31], bl
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x4c], 0x1124f01c
mov dword [ebp - 0x38], 0xe101eae8
push 2
call fcn.1002c4d4
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x18], ebx
jmp 0x1003c613
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x228], 0xcaaf7cc7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003c602
mov dword [ebp - 0x18], ebx
jmp 0x1003c62e
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x218]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1003c61e
mov dword [ebp - 0x18], ebx
jmp 0x1003c64a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x160], 0x199d3281
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1003c639
inc dword [ebp - 0x4c]
mov dword [ebp - 0x4c], 0x15
cmp dword [ebp - 0x4c], 0x1b
jge 0x1003c940
mov dword [ebp - 0x24], 0xffff
lea ecx, [ebp - 0x1d4]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x28], edi
push edi
call fcn.1002c4d4
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x44], ebx
jmp 0x1003c6a1
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x4fc], 0x5eb5a40a
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 4
jl 0x1003c690
xor edx, edx
mov dword [ebp - 0x44], ebx
inc edx
jmp 0x1003c6c2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x218]
call fcn.1002c556
cmp byte [ebp - 0x31], 0
je 0x1003cace
mov dword [ebp - 0x38], 0x513f
cmp dword [ebp - 0x38], 0x538f
jle 0x1003c990
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x10607df8
and eax, esi
cdq
push edx
push eax
call fcn.1002c3bf
inc edi
cmp edi, 0x3c37
jl 0x1003c96d
mov dword [ebp - 4], 0x16
cmp dword [ebp - 0x38], 0x5000
jge 0x1003c9af
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x38], 0xe53e58bf
mov dword [ebp - 0x38], 0x1c6e
cmp dword [ebp - 0x38], 0x1edf
jle 0x1003cb37
push 0x206a
push 0x1271
push 0x23e4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x10607df8
cdq
push edx
push eax
call fcn.1002c3bf
inc edi
cmp edi, 0x774a
jl 0x1003cb02
mov dword [ebp - 0x40], 0xd2703d9b
mov dword [ebp - 4], 0x1a
cmp dword [ebp - 0x38], 0x1b76
jge 0x1003cb5d