Function at 0x100335d7
Capabilities:
Check os version
Compare security identifiers
Create directory
Delete directory
Delete file
Enumerate gui resources
Get common file path
Get disk information
Get disk size
Get file system object information
Get keyboard layout
Get session user name
Parse pe header
Start service
Suspend thread

Disassembly:
mov eax, 0x1008d90a
call fcn.1008bf3c
mov eax, 0x1524
call fcn.10088000
push ebx
push esi
push edi
mov dword [ebp - 0x74], ecx
mov edi, 0x3ed15de0
mov dword [ebp - 0x20], edi
lea ecx, [ebp - 0x14c]
push 3
mov byte [ebp - 0x7d], dl
call fcn.10018a69
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], 0x720348f4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1003363d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x14c]
call fcn.10018b0a
mov dword [eax], 0xbacc5d9b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1003361e
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10033666
inc dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
sub ecx, 0x307a
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
test eax, eax
je 0x10033664
xor eax, eax
lea esi, [eax + 1]
jmp 0x10033668
xor eax, eax
mov esi, eax
push 2
lea ecx, [ebp - 0x14c]
call fcn.10018b0a
xor ecx, ecx
cmp esi, dword [eax]
setne cl
neg ecx
je 0x1003369a
xor eax, eax
lea ecx, [ebp - 0x14c]
push eax
call fcn.10018b0a
cmp dword [eax], 0
je 0x1003369a
xor eax, eax
inc eax
mov esi, eax
jmp 0x1003369f
xor eax, eax
mov esi, eax
inc eax
push eax
lea ecx, [ebp - 0x14c]
call fcn.10018b0a
push 2
mov dword [eax], esi
xor eax, eax
pop esi
mov dword [ebp - 0x20], eax
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x20], esi
jg 0x10033833
xor ebx, ebx
inc ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x18], 0x90707e29
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jg 0x10033827
push dword [ebp - 0x20]
lea ecx, [ebp - 0x14c]
call fcn.10018b0a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x14c]
mov esi, dword [eax]
add esi, 0xbfe90eee
neg esi
sbb esi, esi
inc esi
call fcn.10018b0a
mov dword [eax], esi
test esi, esi
je 0x1003371d
mov eax, dword [ebp - 0x38]
add eax, 0x2db756fd
je 0x1003371d
mov eax, ebx
jmp 0x1003371f
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop esi
jmp 0x1003380d
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x58], 0x513e67dc
mov dword [ebp - 0x38], eax
jmp 0x10033801
mov dword [ebp - 0x10], 0xded1456b
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x100337fe
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14c]
call fcn.10018b0a
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x14c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
push dword [ebp - 0x20]
call fcn.10018b0a
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x14c]
push dword [ebp - 0x18]
call fcn.10018b0a
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x14c]
push dword [ebp - 0x18]
call fcn.10018b0a
push esi
lea ecx, [ebp - 0x14c]
call fcn.10018b0a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x14c]
call fcn.10018b0a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14c]
call fcn.10018b0a
cmp dword [eax], 0x6264a05a
jl 0x100337de
push ebx
lea ecx, [ebp - 0x14c]
call fcn.10018b0a
mov eax, dword [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x48], 0x5f37d796
inc eax
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x10]
push eax
pop ebx
jns 0x10033758
xor ebx, ebx
xor eax, eax
inc ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jle 0x10033745
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1003372f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x100336e0
xor eax, eax
or ecx, 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x100336c4
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x14c]
call fcn.10018aee
mov dword [ebp - 0x20], edi
lea ecx, [ebp - 0x134]
push 3
call fcn.10018a69
xor eax, eax
inc eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], 0x720348f4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10033888
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x134]
call fcn.10018b0a
mov dword [eax], 0xbacc5d9b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10033869
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x100338b1
inc dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
sub ecx, 0x307a
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
test eax, eax
je 0x100338af
xor eax, eax
lea esi, [eax + 1]
jmp 0x100338b3
xor eax, eax
mov esi, eax
push 2
lea ecx, [ebp - 0x134]
call fcn.10018b0a
xor ecx, ecx
cmp esi, dword [eax]
setne cl
neg ecx
je 0x100338e5
xor eax, eax
lea ecx, [ebp - 0x134]
push eax
call fcn.10018b0a
cmp dword [eax], 0
je 0x100338e5
xor eax, eax
inc eax
mov esi, eax
jmp 0x100338ea
xor eax, eax
mov esi, eax
inc eax
push eax
lea ecx, [ebp - 0x134]
call fcn.10018b0a
push 2
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x20], eax
pop esi
cmp dword [ebp - 0x20], esi
jg 0x10033a7e
xor ebx, ebx
inc ebx
or ecx, 0xffffffff
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x18], 0x90707e29
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jg 0x10033a72
push dword [ebp - 0x20]
lea ecx, [ebp - 0x134]
call fcn.10018b0a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x134]
mov esi, dword [eax]
add esi, 0xbfe90eee
neg esi
sbb esi, esi
inc esi
call fcn.10018b0a
mov dword [eax], esi
test esi, esi
je 0x10033968
mov eax, dword [ebp - 0x38]
add eax, 0x2db756fd
je 0x10033968
mov eax, ebx
jmp 0x1003396a
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop esi
jmp 0x10033a58
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x58], 0x513e67dc
mov dword [ebp - 0x38], eax
jmp 0x10033a4c
mov dword [ebp - 0x10], 0xded1456b
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x10033a49
push dword [ebp - 0x18]
lea ecx, [ebp - 0x134]
call fcn.10018b0a
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x134]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
push dword [ebp - 0x20]
call fcn.10018b0a
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x134]
push dword [ebp - 0x18]
call fcn.10018b0a
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x134]
push dword [ebp - 0x18]
call fcn.10018b0a
push esi
lea ecx, [ebp - 0x134]
call fcn.10018b0a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x134]
call fcn.10018b0a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x134]
call fcn.10018b0a
cmp dword [eax], 0x6264a05a
jl 0x10033a29
push ebx
lea ecx, [ebp - 0x134]
call fcn.10018b0a
mov eax, dword [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x48], 0x5f37d796
inc eax
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x10]
push eax
pop ebx
jns 0x100339a3
xor ebx, ebx
xor eax, eax
inc ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jle 0x10033990
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1003397a
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x1003392b
xor eax, eax
or ecx, 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x1003390f
or ebx, 0xffffffff
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], ebx
call fcn.10018aee
xor eax, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff2
jle 0x10033bae
xor ebx, ebx
inc ebx
jmp 0x10033aab
xor eax, eax
mov dword [ebp - 0x58], 0xc86695cd
mov dword [ebp - 0x58], 0x1f06e85f
mov dword [ebp - 0x58], 0xaba9a984
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
jmp 0x10033ad9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x110], 0x4b25b3b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10033ac8
mov eax, dword [ebp - 0x10c]
xor edx, edx
imul eax, dword [ebp - 0x10c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x24]
cmp eax, 0x39d2
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xfffffffa
mov eax, dword [ebp - 0x24]
sbb edx, edx
xor ecx, ecx
add edx, 2
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xffffffff
setle al
xor ecx, ecx
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10c]
cmp eax, ebx
mov eax, dword [ebp - 0x110]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10c]
setge cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
setl dl
sub ecx, eax
mov eax, dword [ebp - 0x38]
add eax, ecx
cmp eax, edx
jl 0x10033b93
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10033b95
mov eax, ebx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x10c], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff2
jg 0x10033aa9
push 3
pop ebx
mov dword [ebp - 0x20], edi
lea ecx, [ebp - 0x158]
push ebx
call fcn.10018a69
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x28], 0x720348f4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10033bf2
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x158]
call fcn.10018b0a
mov dword [eax], 0xbacc5d9b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10033bd4
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10033c1b
inc dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
sub ecx, 0x307a
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
test eax, eax
je 0x10033c19
xor eax, eax
lea esi, [eax + 1]
jmp 0x10033c1d
xor eax, eax
mov esi, eax
push 2
lea ecx, [ebp - 0x158]
call fcn.10018b0a
xor ecx, ecx
cmp esi, dword [eax]
setne cl
neg ecx
je 0x10033c4f
xor eax, eax
lea ecx, [ebp - 0x158]
push eax
call fcn.10018b0a
cmp dword [eax], 0
je 0x10033c4f
xor eax, eax
inc eax
mov esi, eax
jmp 0x10033c54
xor eax, eax
mov esi, eax
inc eax
push eax
lea ecx, [ebp - 0x158]
call fcn.10018b0a
push 2
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x20], eax
pop esi
cmp dword [ebp - 0x20], esi
jg 0x10033deb
xor ebx, ebx
inc ebx
or ecx, 0xffffffff
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x18], 0x90707e29
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jg 0x10033ddc
push dword [ebp - 0x20]
lea ecx, [ebp - 0x158]
call fcn.10018b0a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x158]
mov esi, dword [eax]
add esi, 0xbfe90eee
neg esi
sbb esi, esi
inc esi
call fcn.10018b0a
mov dword [eax], esi
test esi, esi
je 0x10033cd2
mov eax, dword [ebp - 0x38]
add eax, 0x2db756fd
je 0x10033cd2
mov eax, ebx
jmp 0x10033cd4
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop esi
jmp 0x10033dc2
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x58], 0x513e67dc
mov dword [ebp - 0x38], eax
jmp 0x10033db6
mov dword [ebp - 0x10], 0xded1456b
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x10033db3
push dword [ebp - 0x18]
lea ecx, [ebp - 0x158]
call fcn.10018b0a
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x158]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
push dword [ebp - 0x20]
call fcn.10018b0a
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x158]
push dword [ebp - 0x18]
call fcn.10018b0a
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x158]
push dword [ebp - 0x18]
call fcn.10018b0a
push esi
lea ecx, [ebp - 0x158]
call fcn.10018b0a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x158]
call fcn.10018b0a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x158]
call fcn.10018b0a
cmp dword [eax], 0x6264a05a
jl 0x10033d93
push ebx
lea ecx, [ebp - 0x158]
call fcn.10018b0a
mov eax, dword [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x48], 0x5f37d796
inc eax
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x10]
push eax
pop ebx
jns 0x10033d0d
xor ebx, ebx
xor eax, eax
inc ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jle 0x10033cfa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10033ce4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x10033c95
xor eax, eax
or ecx, 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10033c79
push 3
pop ebx
or eax, 0xffffffff
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], eax
call fcn.10018aee
push 4
lea ecx, [ebp - 0xe98]
call fcn.10018a69
or eax, 0xffffffff
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10033e3c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xe98]
call fcn.10018b0a
mov dword [eax], 0xb9b5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10033e1d
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10033e6b
mov dword [ebp - 0x10], 0xf2000252
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x10033e68
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10033e63
push eax
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x10033e50
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10033e41
or ebx, 0xffffffff
lea ecx, [ebp - 0xe98]
mov dword [ebp - 4], ebx
call fcn.10018aee
mov dword [ebp - 0x38], 0xfffffffd
lea ecx, [ebp - 0xeb0]
mov dword [ebp - 0x30], 0xd058a835
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x2c], 0xbacde9e8
mov dword [ebp - 0x30], ebx
xor ebx, ebx
mov dword [ebp - 0x30], 0xfadf6285
inc ebx
mov dword [ebp - 0x30], 0x8b78acc4
mov dword [ebp - 0x30], 0xb15e314a
mov dword [ebp - 0x30], 0xc6d21cd4
mov dword [ebp - 0x30], esi
push ebx
call fcn.10018a69
push 4
pop ecx
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [ebp - 0x30], 0x5a2e712c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x10033efd
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1420], 0xdc85
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10033ee5
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10033f26
push dword [ebp - 0x20]
lea ecx, [ebp - 0xeb0]
call fcn.10018b0a
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x10033f05
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x10033fd3
push 5
pop ebx
mov dword [ebp - 0x1c], 0x2ffab8c3
lea ecx, [ebp - 0xf3c]
mov dword [ebp - 0x30], 0x6f8c7b5c
push esi
call fcn.10018a69
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10033f7e
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xf3c]
call fcn.10018b0a
mov dword [eax], 0xde0369bd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10033f60
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10033f9b
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10033f98
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x10033f83
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0xf3c]
mov eax, dword [ebp + eax*4 - 0x1420]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x40]
mov byte [ebp - 4], 4
call fcn.10018aee
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jle 0x10033f36
xor ebx, ebx
inc ebx
or esi, 0xffffffff
lea ecx, [ebp - 0xeb0]
mov dword [ebp - 4], esi
call fcn.10018aee
mov dword [ebp - 0x44], edi
lea ecx, [ebp - 0x53c]
push ebx
call fcn.10018a69
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x9f0]
mov dword [ebp - 0x58], ebx
push 4
call fcn.10018a69
push 7
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x2c], 0x1fbc9fa8
push 0xfffffffffffffff6
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 0xd700698
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0xc8], ecx
mov dword [ebp - 0xc4], ecx
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x3c], 0xacdd711a
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1003407f
push dword [ebp - 0x20]
lea ecx, [ebp - 0x53c]
call fcn.10018b0a
mov dword [eax], ebx
xor eax, eax
inc dword [ebp - 0x20]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x20], eax
jl 0x10034060
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x100340a3
push dword [ebp - 0x20]
lea ecx, [ebp - 0x9f0]
call fcn.10018b0a
mov dword [eax], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10034088
xor eax, eax
push eax
lea ecx, [ebp - 0x53c]
call fcn.10018b0a
xor eax, eax
lea ecx, [ebp - 0x53c]
push eax
call fcn.10018b0a
mov eax, dword [eax]
inc eax
jne 0x100340c5
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x9f0]
xor eax, eax
push eax
call fcn.10018b0a
mov esi, eax
lea ecx, [ebp - 0x53c]
xor eax, eax
push eax
call fcn.10018b0a
lea ecx, [ebp - 0x53c]
mov edi, dword [eax]
xor eax, eax
sub edi, dword [esi]
push eax
call fcn.10018b0a
xor ebx, ebx
lea ecx, [ebp - 0x9f0]
mov eax, dword [eax]
add eax, edi
cmp eax, 0x631615e8
setge bl
xor esi, esi
inc esi
push esi
call fcn.10018b0a
xor ecx, ecx
cmp ebx, dword [eax]
setl cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x9f0]
inc dword [ebp - 0x3c]
call fcn.10018aee
or ebx, 0xffffffff
lea ecx, [ebp - 0x53c]
mov dword [ebp - 4], ebx
call fcn.10018aee
push 3
lea ecx, [ebp - 0x164]
call fcn.10018a69
mov dword [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff2
push 2
pop edi
jle 0x10034270
jmp 0x1003416e
xor eax, eax
mov dword [ebp - 0x58], 0xc86695cd
mov dword [ebp - 0x58], 0x1f06e85f
mov dword [ebp - 0x58], 0xaba9a984
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
jmp 0x1003419c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x100], 0x4b25b3b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003418b
mov eax, dword [ebp - 0xfc]
xor edx, edx
imul eax, dword [ebp - 0xfc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0x24]
cmp eax, 0x39d2
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xfffffffa
mov eax, dword [ebp - 0x24]
sbb edx, edx
xor ecx, ecx
add edx, 2
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, ebx
setle al
xor ecx, ecx
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xfc]
cmp eax, esi
mov eax, dword [ebp - 0x100]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xfc]
setge cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0xfc]
mov eax, dword [ebp - 0xfc]
setl dl
sub ecx, eax
mov eax, dword [ebp - 0x38]
add eax, ecx
cmp eax, edx
jl 0x10034255
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10034257
mov eax, esi
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xfc], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff2
jg 0x1003416c
mov dword [ebp - 0x18], 0x720348f4
lea ecx, [ebp - 0x9cc]
mov dword [ebp - 0x28], 0x24ec2e0c
mov dword [ebp - 0x58], 6
mov dword [ebp - 0x58], 0x70d8ac50
push esi
call fcn.10018a69
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100342ca
push dword [ebp - 0x20]
lea ecx, [ebp - 0x9cc]
call fcn.10018b0a
mov dword [eax], 6
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x100342a9
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x100342ea
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa38], 0xf0db1262
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100342d2
xor eax, eax
mov dword [ebp - 0x28], 0xffffffe3
cmp dword [ebp - 0x28], 0x1d
jge 0x1003448b
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x1c], 0x5da2
mov dword [ebp - 0x1c], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jge 0x1003432d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x76c], 0xfffffffe
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x10034314
mov dword [ebp - 0x20], 0x11
cmp dword [ebp - 0x20], 0xfffffffd
je 0x10034470
push 7
pop ecx
jmp 0x10034346
xor eax, eax
inc eax
mov dword [ebp - 0x24], 0x4c23afc3
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], edi
jle 0x10034463
jmp 0x10034361
xor eax, eax
inc eax
push eax
lea ecx, [ebp - 0xa08]
call fcn.10018a69
xor eax, eax
mov byte [ebp - 4], 0xa
xor edx, edx
mov dword [ebp - 0x1c], eax
inc edx
cmp dword [ebp - 0x1c], edx
jge 0x1003439f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa08]
call fcn.10018b0a
mov dword [eax], 0x382bdb97
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1003437e
xor eax, eax
push eax
lea ecx, [ebp - 0xa08]
call fcn.10018b0a
mov dword [ebp - 0x76c], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, ebx
setne cl
xor edx, edx
add ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, ebx
setl dl
sub edx, 0x859b
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
add eax, 0x6aac
cmp eax, dword [ebp - 0x24]
jg 0x10034408
xor eax, eax
lea ecx, [ebp - 0xa08]
push eax
call fcn.10018b0a
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
jmp 0x10034445
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x1003443f
mov dword [ebp - 0x1c], eax
jmp 0x10034436
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
jne 0x10034480
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10034433
push 0x14b6
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x21
jg 0x10034414
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff1
jge 0x1003440f
lea ecx, [ebp - 0xa08]
mov byte [ebp - 4], 9
call fcn.10018aee
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jg 0x1003435e
push 7
pop ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffd
jne 0x10034343
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1d
jge 0x1003448b
xor eax, eax
jmp 0x100342fb
push 0x11b6
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x9cc]
mov dword [ebp - 0x58], eax
xor eax, eax
mov esi, dword [ebp - 0x28]
push eax
call fcn.10018b0a
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x28]
cmp esi, eax
mov eax, dword [ebp - 0x10]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xa38], eax
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x100344f5
push eax
lea ecx, [ebp - 0x9cc]
call fcn.10018b0a
cmp dword [eax], 0
jne 0x100344f5
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x100344f5
xor ebx, ebx
inc ebx
jmp 0x100344fa
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x58], 0x71808adc
xor edx, edx
mov ecx, dword [ebp - 0x58]
add ecx, dword [ebp - 0x28]
imul ecx, eax
mov eax, dword [ebp - 0x28]
push 4
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
add edx, edi
cmp edx, eax
setge cl
imul eax, ecx, 0xfa7a
pop ecx
sub ecx, eax
add ecx, dword [ebp - 0x28]
jne 0x10034536
mov eax, dword [ebp - 0xa38]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x9cc]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 8
call fcn.10018aee
mov dword [ebp - 0x24], 0xa48bbca6
xor eax, eax
mov dword [ebp - 0x20], 0x8a527335
mov dword [ebp - 0x3c], 0x452fa814
mov dword [ebp - 0x58], 0xc3f30b91
mov dword [ebp - 0x24], eax
jmp 0x10034586
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10034583
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xf
jl 0x10034571
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
neg edx
push 7
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
sete cl
imul ecx, dword [ebp - 0x20]
mov dword [ebp - 0x58], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x58]
imul edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
neg edx
cmp edx, eax
pop eax
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setle dl
xor eax, eax
sub edx, dword [ebp - 0x24]
sub edx, 3
cmp edx, 0x65ab3e90
setge al
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10034624
push dword [ebp - 0x10]
lea ecx, [ebp - 0x164]
call fcn.10018b0a
mov dword [eax], 0xbacc5d9b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10034605
xor eax, eax
mov dword [ebp - 0x20], 0xddc85f70
push 6
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x4c], 0xa20b2878
mov dword [ebp - 0x28], 0xffff
mov dword [ebp - 0x3c], 0x961cae46
mov dword [ebp - 0x50], 0x7f042724
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10034670
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x820], 0x64a90c6d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10034658
xor eax, eax
or esi, 0xffffffff
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], 0xfffffff8
jg 0x10034779
jmp 0x10034684
xor eax, eax
mov dword [ebp - 0x58], 0x3de0
xor edx, edx
mov dword [ebp - 0x10], 0x8b15e314
mov dword [ebp - 0x1c], 0x2e40c18a
mov dword [ebp - 0x30], 0xd64ea33a
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x38], edx
dec dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], 9
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x17a68fa
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
sub edx, 0x3212
cmp edx, eax
setl cl
cmp ecx, 0xf874
je 0x10034716
mov dword [ebp - 0x2c], 0x6f85
mov dword [ebp - 0x4c], 0xfffffffb
mov eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
jmp 0x1003476c
mov dword [ebp - 0x24], ebx
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffe7
jge 0x1003476c
push 7
pop ebx
mov dword [ebp - 0x1c], edi
jmp 0x1003475b
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, 0x44f8a3d3
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x24]
jne 0x10034755
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jg 0x1003472f
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe7
jl 0x1003472a
xor ebx, ebx
inc ebx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff8
jle 0x10034682
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
test eax, eax
jne 0x100347ca
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x81c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x81c]
mov eax, dword [ebp - 0x4c]
cmp eax, 0x9e5f
setge cl
cmp ecx, dword [ebp - 0x38]
jge 0x100347b8
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x100347ba
mov eax, ebx
cmp dword [ebp - 0x3c], eax
jne 0x100347ca
xor eax, eax
cmp dword [ebp - 0x50], eax
jne 0x100347ca
mov edx, eax
jmp 0x100347cf
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x50]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x81c], ecx
cmp dword [ebp - 0x44], eax
je 0x1003480a
inc dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
sub ecx, 0x307a
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
test eax, eax
je 0x10034808
xor eax, eax
lea esi, [eax + 1]
jmp 0x1003480c
xor eax, eax
mov esi, eax
push edi
lea ecx, [ebp - 0x164]
call fcn.10018b0a
xor ecx, ecx
cmp esi, dword [eax]
setne cl
neg ecx
je 0x1003483d
xor eax, eax
lea ecx, [ebp - 0x164]
push eax
call fcn.10018b0a
cmp dword [eax], 0
je 0x1003483d
xor eax, eax
inc eax
mov esi, eax
jmp 0x10034842
xor eax, eax
mov esi, eax
inc eax
push eax
lea ecx, [ebp - 0x164]
call fcn.10018b0a
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x24], 0xf01c
mov dword [ebp - 0x58], 0x68cd5467
mov dword [ebp - 0x38], 0x2e607d19
mov dword [ebp - 0x2c], 0xf9c32812
cmp dword [ebp - 0x24], eax
je 0x100349b0
push 3
pop ebx
or eax, 0xffffffff
mov dword [ebp - 0x3c], 0x93cc2542
mov dword [ebp - 0x58], eax
lea ecx, [ebp - 0xadc]
push ebx
call fcn.10018a69
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x100348b9
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x4a4], 0xfffffff7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x100348a1
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x100348d5
push dword [ebp - 0x20]
lea ecx, [ebp - 0xadc]
call fcn.10018b0a
mov dword [eax], 0x1fb9a31c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x100348be
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4a0], eax
test eax, eax
jne 0x10034976
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x4a0]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ebx, ebx
cmp edx, eax
setge bl
sub ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x49c]
setg cl
sub eax, ecx
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x49c]
mov eax, dword [ebp - 0x4a0]
mov eax, dword [ebp - 0x49c]
cmp eax, 0xcc01
setge cl
lea eax, [ecx + 0xef33]
mov ecx, dword [ebp - 0x24]
imul ecx, eax
cmp ecx, 0x56e6
jne 0x10034976
xor eax, eax
mov esi, eax
jmp 0x1003497b
xor eax, eax
lea esi, [eax + 1]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0xadc]
xor ebx, ebx
sub esi, eax
inc ebx
push ebx
call fcn.10018b0a
lea ecx, [ebp - 0xadc]
mov dword [eax], esi
xor eax, eax
cmp esi, 0x4d4b
setl al
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 8
call fcn.10018aee
jmp 0x10034a13
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100349d2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1440], 0x9afca862
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100349b9
xor eax, eax
mov dword [ebp - 0x1434], 0xd88101ae
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffeb
jne 0x10034a10
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10034a0b
push 0x1a70
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
xor eax, eax
dec dword [ebp - 0x38]
jmp 0x100349df
xor ebx, ebx
inc ebx
mov edi, dword [sym.imp.GDI32.dll_TextOutA]
xor eax, eax
push 2
mov dword [ebp - 0x44], eax
pop esi
cmp dword [ebp - 0x44], esi
jg 0x100362d3
jmp 0x10034a2e
xor eax, eax
mov dword [ebp - 0x18], 0x83c8
or ecx, 0xffffffff
mov dword [ebp - 0x58], 0x66c1932e
mov dword [ebp - 0x30], 0xf6f49c23
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x4c], 0xffff
mov dword [ebp - 0x50], 0xe7a32987
push 3
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x10034a7a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1260], 0x595ad338
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10034a62
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10034a93
push eax
push eax
push 0x1858
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10034a9b
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jg 0x10034b5a
mov dword [ebp - 0x40], 0x8213af72
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x10], eax
inc eax
cmp dword [ebp - 0x10], eax
jge 0x10034aee
xor edi, edi
inc edi
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3e8], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10034ad2
mov edi, dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x3e8]
mov eax, dword [ebp - 0x58]
add ecx, eax
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x4c]
inc dword [ebp - 0x4c]
cmp eax, ecx
jle 0x10034b47
mov edx, dword [ebp - 0x3c]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1260]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x50]
setge cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x50]
jne 0x10034b47
xor eax, eax
inc eax
jmp 0x10034b49
xor eax, eax
cmp eax, 0xffff
sbb eax, eax
neg eax
mov dword [ebp - 0x3e8], eax
jmp 0x10034bd9
push ebx
lea ecx, [ebp - 0xc08]
call fcn.10018a69
xor eax, eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10034b9b
xor edi, edi
inc edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc08]
call fcn.10018b0a
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10034b77
mov edi, dword [sym.imp.GDI32.dll_TextOutA]
xor eax, eax
push eax
lea ecx, [ebp - 0xc08]
call fcn.10018b0a
mov dword [eax], 0xe972ce3c
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10034bca
push eax
push eax
push 0x1f3d
push 0x1ac7
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
lea ecx, [ebp - 0xc08]
mov byte [ebp - 4], 8
call fcn.10018aee
xor eax, eax
lea ecx, [ebp - 0x170]
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0x3ed15de0
push esi
call fcn.10018a69
mov byte [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x28], 0x720348f4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10034c25
push dword [ebp - 0x10]
lea ecx, [ebp - 0x170]
call fcn.10018b0a
mov dword [eax], 0xbacc5d9b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10034c07
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10034c4e
inc dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
sub ecx, 0x307a
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
test eax, eax
je 0x10034c4c
xor eax, eax
lea esi, [eax + 1]
jmp 0x10034c50
xor eax, eax
mov esi, eax
push 2
lea ecx, [ebp - 0x170]
call fcn.10018b0a
xor ecx, ecx
cmp esi, dword [eax]
setne cl
neg ecx
je 0x10034c82
xor eax, eax
lea ecx, [ebp - 0x170]
push eax
call fcn.10018b0a
cmp dword [eax], 0
je 0x10034c82
xor eax, eax
inc eax
mov esi, eax
jmp 0x10034c87
xor eax, eax
mov esi, eax
inc eax
push eax
lea ecx, [ebp - 0x170]
call fcn.10018b0a
push 2
xor ebx, ebx
inc ebx
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x20], eax
pop esi
cmp dword [ebp - 0x20], esi
jg 0x10034e13
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0x90707e29
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jg 0x10034e07
push dword [ebp - 0x20]
lea ecx, [ebp - 0x170]
call fcn.10018b0a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x170]
mov esi, dword [eax]
add esi, 0xbfe90eee
neg esi
sbb esi, esi
inc esi
call fcn.10018b0a
mov dword [eax], esi
test esi, esi
je 0x10034d05
mov eax, dword [ebp - 0x1c]
add eax, 0x2db756fd
je 0x10034d05
mov eax, ebx
jmp 0x10034d07
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop esi
jmp 0x10034ded
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x58], 0x513e67dc
mov dword [ebp - 0x1c], eax
jmp 0x10034de1
mov dword [ebp - 0x4c], 0xded1456b
mov dword [ebp - 0x4c], esi
cmp dword [ebp - 0x4c], eax
jl 0x10034dde
push dword [ebp - 0x18]
lea ecx, [ebp - 0x170]
call fcn.10018b0a
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x170]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
push dword [ebp - 0x20]
call fcn.10018b0a
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x170]
push dword [ebp - 0x18]
call fcn.10018b0a
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x170]
push dword [ebp - 0x18]
call fcn.10018b0a
push esi
lea ecx, [ebp - 0x170]
call fcn.10018b0a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x170]
call fcn.10018b0a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x170]
call fcn.10018b0a
cmp dword [eax], 0x6264a05a
jl 0x10034dc6
push ebx
lea ecx, [ebp - 0x170]
call fcn.10018b0a
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x48], 0x5f37d796
mov dword [ebp - 0x48], ebx
dec dword [ebp - 0x4c]
jns 0x10034d40
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10034d2d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10034d17
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x10034cc8
xor eax, eax
or ecx, 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10034cac
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 8
call fcn.10018aee
mov dword [ebp - 0x28], 0x90707e29
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xcb314b81
mov dword [ebp - 0x1c], 0x69867f5d
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10034e5e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x88], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10034e4a
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10034e89
push 0x202
push eax
push 0xf97
push 0x23d4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x88], 4
cmp dword [ebp - 0x88], ebx
jge 0x10034ffb
jmp 0x10034ea3
xor eax, eax
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x2f8]
push ebx
call fcn.10018a69
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x48], 0x97756eb3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10034ee5
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2f8]
call fcn.10018b0a
mov dword [eax], 0x9531defc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10034ec7
xor eax, eax
mov dword [ebp - 0x40], eax
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, 3
setl cl
imul eax, ecx, 0xfffa
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x24]
jg 0x10034f24
mov eax, dword [ebp - 0x40]
xor eax, eax
lea ecx, [ebp - 0x2f8]
push eax
call fcn.10018b0a
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2f8]
mov eax, dword [ebp - 0x88]
xor eax, eax
push eax
call fcn.10018b0a
xor eax, eax
mov dword [ebp - 0x4c], 0xb476
push eax
lea ecx, [ebp - 0x2f8]
call fcn.10018b0a
mov ecx, dword [ebp - 0x24]
imul ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x88]
add ecx, dword [eax]
mov eax, dword [ebp - 0x24]
imul edx, ecx
sub edx, eax
je 0x10034f90
xor eax, eax
lea ecx, [ebp - 0x2f8]
push eax
call fcn.10018b0a
cmp dword [eax], 0
je 0x10034f90
mov esi, ebx
xor eax, eax
jmp 0x10034f94
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x2f8]
call fcn.10018b0a
sub esi, dword [eax]
sub esi, 8
je 0x10034faa
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x2f8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10018b0a
xor eax, eax
lea ecx, [ebp - 0x2f8]
push eax
call fcn.10018b0a
lea ecx, [ebp - 0x2f8]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 8
call fcn.10018aee
dec dword [ebp - 0x88]
cmp dword [ebp - 0x88], ebx
jl 0x10034ea1
or eax, 0xffffffff
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0x3061ece3
mov dword [ebp - 0x30], 0xa37b
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x10], eax
jmp 0x10035037
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd0], 0x6951ad38
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10035026
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xd0], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x10035349
mov edi, 0x803f40bd
mov dword [ebp - 0x4c], 0x9a57b5bf
lea ecx, [ebp - 0x498]
push ebx
call fcn.10018a69
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x18], 0x3e5e
mov dword [ebp - 0x2c], 0xd6c8400b
mov dword [ebp - 0x40], 0x27488f
mov dword [ebp - 0x3c], 0x5d31
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], eax
jmp 0x100350a6
push dword [ebp - 0x10]
call fcn.10018b0a
mov dword [eax], 0x47c4d14
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x498]
cmp dword [ebp - 0x10], ebx
jl 0x10035095
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xd0]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
xor eax, eax
push eax
call fcn.10018b0a
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp dword [eax], ecx
setne dl
cmp dword [ebp - 0x1c], edx
jne 0x100350e6
xor eax, eax
lea ecx, [ebp - 0x498]
push eax
call fcn.10018b0a
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x498]
xor eax, eax
push eax
call fcn.10018b0a
mov dword [eax], 0xb151
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0xd0], ecx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
inc dword [ebp - 0x40]
cmp ecx, eax
jge 0x10035311
mov dword [ebp - 0x40], 0x2568
xor eax, eax
mov dword [ebp - 0x64], 0x5a44896b
mov dword [ebp - 0x50], 0x113c509c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10035151
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x210], 0x458b9948
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10035139
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], eax
jl 0x100351ac
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0xf54]
mov dword [ebp - 0x30], 0x465c3015
push 3
call fcn.10018a69
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x10], eax
jmp 0x1003518f
push dword [ebp - 0x10]
call fcn.10018b0a
mov dword [eax], 0x546ec709
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0xf54]
jl 0x1003517e
inc dword [ebp - 0x58]
mov byte [ebp - 4], 0xf
call fcn.10018aee
dec dword [ebp - 0x4c]
jns 0x10035159
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x498]
xor eax, eax
push eax
call fcn.10018b0a
mov edx, dword [ebp - 0x3c]
xor ebx, ebx
mov ecx, dword [ebp - 0x1c]
cmp ecx, edx
setg bl
sub ebx, dword [eax]
mov eax, dword [ebp - 0x64]
neg ebx
sbb ebx, ebx
inc ebx
sub eax, ebx
neg eax
sbb eax, eax
inc eax
js 0x100351eb
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x100351ed
xor ebx, ebx
mov esi, eax
inc ebx
jmp 0x100351f2
xor eax, eax
xor ebx, ebx
inc ebx
mov esi, ebx
push eax
lea ecx, [ebp - 0x498]
call fcn.10018b0a
xor ecx, ecx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x24]
setle cl
sub ecx, eax
cmp ecx, 0xaa48cc3a
sbb eax, eax
inc eax
cmp edi, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x6d36
setge cl
xor eax, eax
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x498]
push eax
call fcn.10018b0a
mov ecx, dword [ebp - 0x50]
sub ecx, 0xfff9
neg ecx
push 5
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd0], ecx
mov ecx, 0x9a11d30d
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
pop eax
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
imul eax, dword [ebp - 0x210]
neg eax
cmp eax, 0x829e
jne 0x10035290
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10035292
mov ecx, ebx
jmp 0x10035294
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x210]
sete dl
sub edx, 0xf83fa7b1
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0x20]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x1c]
sub edx, 0x669e62ad
neg edx
sbb edx, edx
xor eax, eax
inc edx
add edx, dword [ebp - 0x18]
je 0x100352e1
mov edx, ebx
cmp dword [ebp - 0x48], eax
jne 0x100352e3
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x28]
jg 0x1003530a
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1003530a
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xd0], 0
jne 0x1003530a
xor eax, eax
jmp 0x1003530c
mov eax, ebx
mov dword [ebp - 0x64], eax
jmp 0x10035329
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10035329
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [ebp - 0x498]
mov byte [ebp - 4], 8
call fcn.10018aee
dec dword [ebp - 0x20]
jns 0x10035058
mov edi, dword [sym.imp.GDI32.dll_TextOutA]
xor eax, eax
mov dword [ebp - 0x2c], eax
xor ecx, ecx
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, ebx
setle cl
xor eax, eax
sub ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x18]
cmp ecx, 0xb4456e34
setne al
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, ebx
setge cl
sub ecx, 6
cmp ecx, 3
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x20]
je 0x100353c8
mov dword [ebp - 0x20], 0x12
xor eax, eax
cmp dword [ebp - 0x20], 0x36
jl 0x10035415
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100353bd
push eax
push 0x912
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x36
jge 0x100353a5
jmp 0x10035413
mov dword [ebp - 0x18], 0xffffffe2
xor eax, eax
cmp dword [ebp - 0x18], 0x18
jg 0x100353f5
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x20], eax
jmp 0x100353e7
cmp dword [ebp - 0x20], eax
jne 0x100353ed
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x3a
jl 0x100353df
dec dword [ebp - 0x58]
inc dword [ebp - 0x18]
jmp 0x100353d1
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10035415
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop esi
jmp 0x100362be
push 3
lea ecx, [ebp - 0x1c4]
call fcn.10018a69
push 3
pop ecx
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x24], ecx
push 5
pop eax
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x2c], 0xbfeb1ec6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1003546d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
mov dword [eax], 0x2fd4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003544e
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100356c4
push esi
lea ecx, [ebp - 0x6fc]
call fcn.10018a69
mov byte [ebp - 4], 0x12
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x3c], 0xbfc75daa
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x100354b2
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1a0], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1003549d
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100354d8
push dword [ebp - 0x20]
lea ecx, [ebp - 0x6fc]
call fcn.10018b0a
mov dword [eax], 0xc3d6c1df
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100354ba
xor eax, eax
mov dword [ebp - 0x198], esi
cmp dword [ebp - 0x198], eax
jl 0x100355b2
mov dword [ebp - 0x58], 0x3d97867a
lea ecx, [ebp - 0x6fc]
mov dword [ebp - 0x2c], 0xbbe26b5c
mov esi, dword [ebp - 0x198]
neg esi
push ebx
sbb esi, esi
neg esi
call fcn.10018b0a
cmp dword [ebp - 0x198], 0xfffffff8
mov dword [eax], esi
jne 0x10035537
push dword [ebp - 0x198]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
cmp dword [eax], 0
jne 0x10035537
xor eax, eax
mov esi, eax
jmp 0x10035539
mov esi, ebx
push dword [ebp - 0x198]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
xor ecx, ecx
cmp esi, dword [eax]
setge cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x1c4]
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x198]
call fcn.10018b0a
mov edx, dword [ebp - 0x3c]
mov esi, eax
inc edx
sub edx, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x1a0]
neg edx
sbb edx, edx
inc edx
add ecx, edx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x198]
add edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp dword [esi], ecx
sete al
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x198]
jns 0x100354ea
push 2
pop esi
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
cmp dword [eax], 0
jne 0x100356cf
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jg 0x100356b2
jmp 0x100355db
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100355f8
push eax
push 0xb9f
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebp - 0x198]
lea ecx, [ebp - 0x6fc]
push ebx
call fcn.10018b0a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
mov edx, dword [ebp - 0x3c]
xor ebx, ebx
mov ecx, dword [ebp - 0x24]
cmp edx, ecx
lea ecx, [ebp - 0x1c4]
setge bl
sub ebx, dword [eax]
neg ebx
sbb ebx, ebx
xor edi, edi
inc edi
inc ebx
push edi
call fcn.10018b0a
mov eax, dword [eax]
inc eax
add eax, ebx
jne 0x1003567a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
cmp dword [eax], 0
jne 0x1003567a
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
jmp 0x1003567f
xor ebx, ebx
inc ebx
mov esi, ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c4]
call fcn.10018b0a
xor ecx, ecx
push 2
cmp dword [eax], esi
pop esi
sete cl
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x100355d9
mov edi, dword [sym.imp.GDI32.dll_TextOutA]
lea ecx, [ebp - 0x6fc]
mov byte [ebp - 4], 0x11
call fcn.10018aee
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10035475
jmp 0x100356da
lea ecx, [ebp - 0x6fc]
call fcn.10018aee
lea ecx, [ebp - 0x1c4]
mov byte [ebp - 4], 8
call fcn.10018aee
push dword [ebp - 0x44]
lea ecx, [ebp - 0x164]
call fcn.10018b0a
push dword [ebp - 0x44]
lea ecx, [ebp - 0x164]
mov esi, dword [eax]
add esi, 0xbfe90eee
neg esi
sbb esi, esi
inc esi
call fcn.10018b0a
mov dword [eax], esi
test esi, esi
je 0x10035726
mov eax, dword [ebp - 0x38]
add eax, 0x2db756fd
je 0x10035726
mov eax, ebx
jmp 0x10035728
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], 0xa48bbca6
mov dword [ebp - 0x20], 0x8a527335
mov dword [ebp - 0x3c], 0x452fa814
mov dword [ebp - 0x58], 0xc3f30b91
mov dword [ebp - 0x24], eax
jmp 0x10035763
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10035760
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xf
jl 0x1003574e
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
neg edx
push 7
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
sete cl
imul ecx, dword [ebp - 0x20]
mov dword [ebp - 0x58], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x58]
imul edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
neg edx
cmp edx, eax
pop eax
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
push 2
setg dl
xor ecx, ecx
cmp edx, eax
pop esi
setne cl
xor edx, edx
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setle dl
xor eax, eax
sub edx, dword [ebp - 0x24]
sub edx, 3
cmp edx, 0x65ab3e90
setge al
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jg 0x100362bb
or edi, 0xffffffff
push 5
mov dword [ebp - 0x24], 0xf30cc2fd
lea ecx, [ebp - 0x5f0]
pop eax
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x58], eax
push 3
call fcn.10018a69
push ebx
lea ecx, [ebp - 0xad0]
mov byte [ebp - 4], 0x13
call fcn.10018a69
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10035850
push dword [ebp - 0x20]
lea ecx, [ebp - 0x5f0]
call fcn.10018b0a
mov dword [eax], 0xb32e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10035831
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10035873
push dword [ebp - 0x20]
lea ecx, [ebp - 0xad0]
call fcn.10018b0a
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10035858
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10035894
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setle dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x691f
jge 0x100358db
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10035905
push 0xf99
push 0x15f3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x10035903
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], eax
jmp 0x100358f4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1458], 3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100358e3
mov eax, dword [ebp - 0x1458]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1003596d
push dword [ebp - 0x20]
lea ecx, [ebp - 0x5f0]
call fcn.10018b0a
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xad0]
xor eax, eax
push eax
call fcn.10018b0a
mov eax, dword [eax]
neg eax
je 0x10035967
push dword [ebp - 0x20]
lea ecx, [ebp - 0x5f0]
call fcn.10018b0a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x5f0]
mov esi, eax
call fcn.10018b0a
mov esi, dword [esi]
lea ecx, [ebp - 0x5f0]
push ebx
add esi, dword [eax]
call fcn.10018b0a
push 2
cmp esi, dword [eax]
pop esi
jne 0x10035967
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x2c], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x1003590a
lea ecx, [ebp - 0xad0]
call fcn.10018aee
lea ecx, [ebp - 0x5f0]
mov byte [ebp - 4], 8
call fcn.10018aee
mov dword [ebp - 0x60], 0xfffffff6
lea ecx, [ebp - 0x4e0]
mov dword [ebp - 0x1c], ebx
push esi
call fcn.10018a69
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x960]
mov dword [ebp - 0x2c], esi
push 4
call fcn.10018a69
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x40], 0x857289c0
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], 0xfffffffd
mov dword [ebp - 0x2c], 0x402095d7
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100359fa
push dword [ebp - 0x20]
lea ecx, [ebp - 0x4e0]
call fcn.10018b0a
mov dword [eax], 0x8b42
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100359dc
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10035a16
push dword [ebp - 0x20]
lea ecx, [ebp - 0x960]
call fcn.10018b0a
mov dword [eax], 0x73196e86
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x100359ff
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x4e0]
xor eax, eax
push eax
call fcn.10018b0a
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, 0xfffffff6
mov esi, eax
mov ecx, dword [ebp - 0x1c]
setge dl
xor eax, eax
cmp edx, ecx
setl al
add eax, dword [ebp - 0x1c]
sub eax, dword [esi]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
je 0x10035a66
xor eax, eax
lea ecx, [ebp - 0x4e0]
push eax
call fcn.10018b0a
cmp dword [eax], 0
jne 0x10035a7f
xor eax, eax
lea ecx, [ebp - 0x4e0]
push eax
call fcn.10018b0a
cmp dword [eax], 0
jne 0x10035a7f
xor eax, eax
mov esi, eax
jmp 0x10035a81
mov esi, ebx
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x960]
push 2
call fcn.10018b0a
push 2
lea ecx, [ebp - 0x960]
mov dword [eax], esi
pop esi
push esi
call fcn.10018b0a
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x4e0]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10018b0a
xor eax, eax
lea ecx, [ebp - 0x4e0]
push eax
call fcn.10018b0a
mov ecx, dword [ebp - 0x48]
xor edx, edx
add ecx, dword [eax]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setle dl
neg edx
jne 0x10035ae6
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x4c], eax
je 0x10035ae8
mov ecx, ebx
mov eax, dword [ebp - 0x4c]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x960]
call fcn.10018aee
lea ecx, [ebp - 0x4e0]
mov byte [ebp - 4], 8
call fcn.10018aee
mov dword [ebp - 0x54], 0x513e67dc
lea ecx, [ebp - 0xec8]
push 4
call fcn.10018a69
mov byte [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10035b4f
push dword [ebp - 0x10]
lea ecx, [ebp - 0xec8]
call fcn.10018b0a
mov dword [eax], 0xb9b5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10035b30
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10035b82
mov dword [ebp - 0x4c], 0xf2000252
mov dword [ebp - 0x4c], 3
cmp dword [ebp - 0x4c], eax
jl 0x10035b7f
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10035b7a
push eax
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
xor eax, eax
dec dword [ebp - 0x4c]
jns 0x10035b67
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x10035b54
lea ecx, [ebp - 0xec8]
mov byte [ebp - 4], 8
call fcn.10018aee
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x100362a0
push 4
lea ecx, [ebp - 0x7e8]
call fcn.10018a69
mov byte [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x20], 0xe76f5020
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10035bdf
push dword [ebp - 0x20]
lea ecx, [ebp - 0x7e8]
call fcn.10018b0a
mov dword [eax], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10035bc4
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10035bff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1018], 0x2e40c18a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10035be7
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x10035c95
mov dword [ebp - 0x4c], 0xb3152c58
mov dword [ebp - 0x58], 0xa835a23e
mov dword [ebp - 0x10], eax
jmp 0x10035c30
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xde0], 0x7b5c6eff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10035c1f
push dword [ebp - 0x20]
lea ecx, [ebp - 0x7e8]
call fcn.10018b0a
cmp dword [eax], 0
jne 0x10035c93
mov dword [ebp - 0x4c], 3
xor eax, eax
cmp dword [ebp - 0x4c], eax
jl 0x10035c83
mov dword [ebp - 0x58], edi
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xddc], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10035c7e
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
dec dword [ebp - 0x4c]
jns 0x10035c56
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
push 0
pop eax
jle 0x10035c0c
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10035ca0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x7e8]
mov eax, dword [ebp - 0x20]
push esi
call fcn.10018b0a
xor eax, eax
lea ecx, [ebp - 0x7e8]
push eax
call fcn.10018b0a
mov dword [ebp - 0x20], 0xfffffff7
lea ecx, [ebp - 0x7e8]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1014], eax
mov byte [ebp - 4], 8
call fcn.10018aee
mov dword [ebp - 0x24], 0xded1456b
lea ecx, [ebp - 0x858]
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x24], 0xd513c61c
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x40], 0x7563ffaf
mov dword [ebp - 0x1c], edi
push esi
call fcn.10018a69
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10035d33
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2a4], 0x182b4746
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10035d1b
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10035d4b
push dword [ebp - 0x20]
lea ecx, [ebp - 0x858]
call fcn.10018b0a
mov dword [eax], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10035d38
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10035dd1
mov eax, dword [ebp - 0x2a0]
xor edx, edx
cmp eax, 0x1260
mov eax, dword [ebp - 0x2a0]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setg cl
xor edx, edx
cmp ecx, 0x85e1
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x2a4], ecx
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10035dd1
mov ecx, eax
cmp dword [ebp - 0x2a4], eax
je 0x10035dd3
mov ecx, ebx
xor eax, eax
cmp ecx, esi
mov ecx, dword [ebp - 0x1c]
setne al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
jne 0x10035dec
mov eax, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x24], ebx
push eax
lea ecx, [ebp - 0x858]
call fcn.10018b0a
mov ecx, dword [ebp - 0x24]
mov edx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub edx, ecx
add eax, edx
je 0x10035e19
xor eax, eax
cmp dword [ebp - 0x2a0], eax
je 0x10035e1b
mov esi, ebx
jmp 0x10035e1d
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x858]
call fcn.10018b0a
cmp esi, dword [eax]
jle 0x10035e44
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10035e4b
push 0x13c1
call dword [sym.imp.USER32.dll_GetKeyboardType]
jmp 0x10035e4b
mov dword [ebp - 0x40], 0xfffffff6
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 8
call fcn.10018aee
push 2
pop esi
mov dword [ebp - 0x24], esi
xor eax, eax
cmp dword [ebp - 0x24], eax
jl 0x1003629d
jmp 0x10035e6f
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x1c], 0x10
jmp 0x10035ea1
mov dword [ebp - 0x10], 0xb96ca2cb
mov dword [ebp - 0x10], eax
jmp 0x10035e98
mov dword [ebp - 0x2c], 0xc4ab274b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x17
jne 0x10035e8e
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffee
jl 0x10035e82
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10035ec0
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0x3061ece3
mov dword [ebp - 0x30], 0xa37b
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x64], 0xfffffff6
mov dword [ebp - 0x10], eax
jmp 0x10035ef4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd4], 0x6951ad38
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10035ee3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xd4], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x10036201
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jle 0x10035ba1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x100357eb
mov edi, dword [sym.imp.GDI32.dll_TextOutA]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10035420
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jle 0x10034a2c
or eax, 0xffffffff
lea ecx, [ebp - 0x164]
mov dword [ebp - 4], eax
call fcn.10018aee
mov dword [ebp - 0x6c], 0xc692
lea ecx, [ebp - 0x714]
mov dword [ebp - 0x58], 0xc6338430
push 3
mov dword [ebp - 0x1c], ebx
pop eax
mov dword [ebp - 0x78], 0x16efa42b
mov dword [ebp - 0x4c], 0x9253a34c
mov dword [ebp - 0x50], eax
push eax
call fcn.10018a69
mov dword [ebp - 4], 0x1c
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x64], 0xec00
mov dword [ebp - 0x60], 0xfffffff6
mov dword [ebp - 0x2c], 0xca1d25f
mov dword [ebp - 0x48], 0x79c0213a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10036365
push dword [ebp - 0x10]
lea ecx, [ebp - 0x714]
call fcn.10018b0a
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10036346
xor eax, eax
mov ecx, 0xb674
mov ebx, dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
cmp dword [ebp - 0x6c], eax
je 0x10036511
mov dword [ebp - 0x2c], ecx
xor esi, esi
mov dword [ebp - 0x54], 0x82abbf9a
inc esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x7c], 0xd81479b6
mov dword [ebp - 0x48], 0xc1747346
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], eax
jmp 0x100363b0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x554], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003639f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x554]
mov eax, dword [ebp - 0x64]
dec dword [ebp - 0x64]
cmp eax, 0x4b72
jg 0x100363dc
mov edx, esi
jmp 0x100363e0
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp eax, edx
setge cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x550]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54c]
cmp eax, 0xfffffffa
mov eax, dword [ebp - 0x78]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
sub ecx, dword [ebp - 0x4c]
je 0x10036425
cmp dword [ebp - 0x550], eax
je 0x10036425
mov eax, esi
cmp dword [ebp - 0x24], eax
jg 0x10036433
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x7c], eax
je 0x10036435
mov edx, esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x550]
setg cl
xor edx, edx
imul ecx, ecx, 0x5217
cmp eax, ecx
mov eax, dword [ebp - 0x6c]
setl dl
xor ecx, ecx
add eax, edx
cmp eax, 0x230a264
setle cl
imul eax, ecx, 0x9ea4
sub eax, 0x35f93cc
cmp eax, dword [ebp - 0x7c]
jge 0x100364b6
mov dword [ebp - 0x4c], 0xffff
lea ecx, [ebp - 0x714]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
push esi
call fcn.10018b0a
mov ecx, dword [ebp - 0x4c]
xor edx, edx
cmp ecx, 0xfffffff8
setge dl
sub edx, dword [ebp - 0x60]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x7c]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x50]
mov dword [eax], edx
jmp 0x100365ea
mov dword [ebp - 0x24], 2
xor eax, eax
cmp dword [ebp - 0x24], eax
jl 0x100365ea
jmp 0x100364cc
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100364f6
push 0x1932
push eax
push 0xefd
push 0x683
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x554], 0
jne 0x100365ea
dec dword [ebp - 0x24]
jns 0x100364ca
jmp 0x100365ea
push 3
lea ecx, [ebp - 0x5e4]
call fcn.10018a69
mov byte [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x54], 0xcc384641
mov dword [ebp - 0x10], eax
jmp 0x10036541
push dword [ebp - 0x10]
call fcn.10018b0a
mov dword [eax], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0x5e4]
jl 0x10036530
push esi
call fcn.10018b0a
mov edx, dword [ebp - 0x2c]
mov esi, eax
mov ecx, dword [ebp - 0x3c]
xor eax, eax
cmp ecx, edx
push 2
setg al
xor ecx, ecx
cmp dword [esi], eax
setge cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x5e4]
call fcn.10018b0a
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x714]
add esi, dword [eax]
xor eax, eax
inc eax
push eax
call fcn.10018b0a
push 2
lea ecx, [ebp - 0x5e4]
mov dword [eax], esi
call fcn.10018b0a
xor eax, eax
lea ecx, [ebp - 0x5e4]
push eax
call fcn.10018b0a
mov dword [ebp - 0x54], 0x3fa0
xor edx, edx
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x78]
cmp ecx, eax
setl dl
imul eax, dword [ebp - 0x4c], 0x6add
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
test ecx, ecx
jne 0x100365d8
cmp dword [ebp - 0x58], eax
je 0x100365d8
inc eax
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x5e4]
mov byte [ebp - 4], 0x1c
call fcn.10018aee
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0x714]
push 2
call fcn.10018b0a
lea ecx, [ebp - 0x714]
mov dword [eax], esi
or eax, 0xffffffff
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], eax
call fcn.10018aee
mov dword [ebp - 0x6c], 0xc692
lea ecx, [ebp - 0x7a8]
mov dword [ebp - 0x58], 0xc6338430
xor esi, esi
push 3
inc esi
mov dword [ebp - 0x1c], esi
pop eax
mov dword [ebp - 0x78], 0x16efa42b
mov dword [ebp - 0x4c], 0x9253a34c
mov dword [ebp - 0x50], eax
push eax
call fcn.10018a69
mov dword [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x64], 0xec00
mov dword [ebp - 0x60], 0xfffffff6
mov dword [ebp - 0x2c], 0xca1d25f
mov dword [ebp - 0x48], 0x79c0213a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10036694
push dword [ebp - 0x10]
lea ecx, [ebp - 0x7a8]
call fcn.10018b0a
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10036675
xor eax, eax
cmp dword [ebp - 0x6c], eax
je 0x10036837
mov ecx, 0xb674
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x54], 0x82abbf9a
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x7c], 0xd81479b6
mov dword [ebp - 0x48], 0xc1747346
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], eax
jmp 0x100366d6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x56c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100366c5
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x56c]
mov eax, dword [ebp - 0x64]
dec dword [ebp - 0x64]
cmp eax, 0x4b72
jg 0x10036702
mov edx, esi
jmp 0x10036706
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp eax, edx
setge cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x568]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x564]
cmp eax, 0xfffffffa
mov eax, dword [ebp - 0x78]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
sub ecx, dword [ebp - 0x4c]
je 0x1003674b
cmp dword [ebp - 0x568], eax
je 0x1003674b
mov eax, esi
cmp dword [ebp - 0x24], eax
jg 0x10036759
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x7c], eax
je 0x1003675b
mov edx, esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x568]
setg cl
xor edx, edx
imul ecx, ecx, 0x5217
cmp eax, ecx
mov eax, dword [ebp - 0x6c]
setl dl
xor ecx, ecx
add eax, edx
cmp eax, 0x230a264
setle cl
imul eax, ecx, 0x9ea4
sub eax, 0x35f93cc
cmp eax, dword [ebp - 0x7c]
jge 0x100367dc
mov dword [ebp - 0x4c], 0xffff
lea ecx, [ebp - 0x7a8]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
push esi
call fcn.10018b0a
mov ecx, dword [ebp - 0x4c]
xor edx, edx
cmp ecx, 0xfffffff8
setge dl
sub edx, dword [ebp - 0x60]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x7c]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x50]
mov dword [eax], edx
jmp 0x10036912
mov dword [ebp - 0x24], 2
xor eax, eax
cmp dword [ebp - 0x24], eax
jl 0x10036912
jmp 0x100367f2
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1003681c
push 0x1932
push eax
push 0xefd
push 0x683
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x56c], 0
jne 0x10036912
dec dword [ebp - 0x24]
jns 0x100367f0
jmp 0x10036912
push 3
lea ecx, [ebp - 0x614]
call fcn.10018a69
mov byte [ebp - 4], 0x1f
xor eax, eax
mov dword [ebp - 0x54], 0xcc384641
mov dword [ebp - 0x10], eax
jmp 0x10036867
push dword [ebp - 0x10]
call fcn.10018b0a
mov dword [eax], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0x614]
jl 0x10036856
push 2
call fcn.10018b0a
mov edx, dword [ebp - 0x2c]
mov esi, eax
mov ecx, dword [ebp - 0x3c]
xor eax, eax
cmp ecx, edx
push 2
setg al
xor ecx, ecx
cmp dword [esi], eax
setge cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x614]
call fcn.10018b0a
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x7a8]
xor ebx, ebx
inc ebx
add esi, dword [eax]
push ebx
call fcn.10018b0a
push 2
lea ecx, [ebp - 0x614]
mov dword [eax], esi
call fcn.10018b0a
xor eax, eax
lea ecx, [ebp - 0x614]
push eax
call fcn.10018b0a
mov dword [ebp - 0x54], 0x3fa0
xor edx, edx
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x78]
cmp ecx, eax
setl dl
imul eax, dword [ebp - 0x4c], 0x6add
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
test ecx, ecx
jne 0x10036900
cmp dword [ebp - 0x58], eax
je 0x10036900
mov eax, ebx
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x614]
mov byte [ebp - 4], 0x1e
call fcn.10018aee
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0x7a8]
push 2
call fcn.10018b0a
lea ecx, [ebp - 0x7a8]
mov dword [eax], esi
or eax, 0xffffffff
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], eax
call fcn.10018aee
mov ebx, dword [sym.imp.GDI32.dll_GetDIBits]
mov dword [ebp - 0x38], 0x68206240
mov dword [ebp - 0x38], 0xffffffeb
cmp dword [ebp - 0x38], 0xd
jle 0x1003699f
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 0x19
jmp 0x10036990
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1003698d
push 0x431
push eax
push eax
push 0x126e
push 0x2244
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff7
jle 0x10036960
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xd
jg 0x10036954
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x72c]
mov dword [ebp - 0x38], eax
xor esi, esi
mov dword [ebp - 0x6c], 0xc692
inc esi
mov dword [ebp - 0x58], 0xc6338430
push 3
mov dword [ebp - 0x1c], esi
pop eax
mov dword [ebp - 0x78], 0x16efa42b
mov dword [ebp - 0x4c], 0x9253a34c
mov dword [ebp - 0x50], eax
push eax
call fcn.10018a69
mov dword [ebp - 4], 0x20
xor eax, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x64], 0xec00
mov dword [ebp - 0x60], 0xfffffff6
mov dword [ebp - 0x2c], 0xca1d25f
mov dword [ebp - 0x48], 0x79c0213a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10036a29
push dword [ebp - 0x10]
lea ecx, [ebp - 0x72c]
call fcn.10018b0a
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10036a0a
xor eax, eax
cmp dword [ebp - 0x6c], eax
je 0x10036bd0
mov ecx, 0xb674
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x54], 0x82abbf9a
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x7c], 0xd81479b6
mov dword [ebp - 0x48], 0xc1747346
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], eax
jmp 0x10036a6b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x584], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10036a5a
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x584]
mov eax, dword [ebp - 0x64]
dec dword [ebp - 0x64]
cmp eax, 0x4b72
jg 0x10036a97
mov edx, esi
jmp 0x10036a9b
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp eax, edx
setge cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x580]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x57c]
cmp eax, 0xfffffffa
mov eax, dword [ebp - 0x78]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
sub ecx, dword [ebp - 0x4c]
je 0x10036ae0
cmp dword [ebp - 0x580], eax
je 0x10036ae0
mov eax, esi
cmp dword [ebp - 0x24], eax
jg 0x10036aee
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x7c], eax
je 0x10036af0
mov edx, esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x580]
setg cl
xor edx, edx
imul ecx, ecx, 0x5217
cmp eax, ecx
mov eax, dword [ebp - 0x6c]
setl dl
xor ecx, ecx
add eax, edx
cmp eax, 0x230a264
setle cl
imul eax, ecx, 0x9ea4
sub eax, 0x35f93cc
cmp eax, dword [ebp - 0x7c]
jge 0x10036b71
mov dword [ebp - 0x4c], 0xffff
lea ecx, [ebp - 0x72c]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
push esi
call fcn.10018b0a
mov ecx, dword [ebp - 0x4c]
xor edx, edx
cmp ecx, 0xfffffff8
setge dl
sub edx, dword [ebp - 0x60]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x7c]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x50]
mov dword [eax], edx
jmp 0x10036caa
mov dword [ebp - 0x24], 2
xor eax, eax
cmp dword [ebp - 0x24], eax
jl 0x10036caa
jmp 0x10036b87
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10036bb5
push 0x1932
push eax
push 0xefd
push 0x683
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x584], 0
jne 0x10036caa
dec dword [ebp - 0x24]
jns 0x10036b85
jmp 0x10036caa
push 3
lea ecx, [ebp - 0x5fc]
call fcn.10018a69
mov byte [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x54], 0xcc384641
mov dword [ebp - 0x10], eax
jmp 0x10036c00
push dword [ebp - 0x10]
call fcn.10018b0a
mov dword [eax], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0x5fc]
jl 0x10036bef
push 2
call fcn.10018b0a
mov edx, dword [ebp - 0x2c]
mov esi, eax
mov ecx, dword [ebp - 0x3c]
xor eax, eax
cmp ecx, edx
push 2
setg al
xor ecx, ecx
cmp dword [esi], eax
setge cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x5fc]
call fcn.10018b0a
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x72c]
add esi, dword [eax]
xor eax, eax
inc eax
push eax
call fcn.10018b0a
push 2
lea ecx, [ebp - 0x5fc]
mov dword [eax], esi
call fcn.10018b0a
xor eax, eax
lea ecx, [ebp - 0x5fc]
push eax
call fcn.10018b0a
mov dword [ebp - 0x54], 0x3fa0
xor edx, edx
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x78]
cmp ecx, eax
setl dl
imul eax, dword [ebp - 0x4c], 0x6add
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
test ecx, ecx
jne 0x10036c98
cmp dword [ebp - 0x58], eax
je 0x10036c98
inc eax
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x5fc]
mov byte [ebp - 4], 0x20
call fcn.10018aee
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0x72c]
push 2
call fcn.10018b0a
lea ecx, [ebp - 0x72c]
mov dword [eax], esi
or eax, 0xffffffff
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], eax
call fcn.10018aee
mov dword [ebp - 0x38], 0x68206240
mov dword [ebp - 0x38], 0xffffffeb
cmp dword [ebp - 0x38], 0xd
jle 0x10036d31
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 0x19
jmp 0x10036d22
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10036d1f
push 0x431
push eax
push eax
push 0x126e
push 0x2244
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff7
jle 0x10036cf2
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xd
jg 0x10036ce6
mov eax, dword [ebp - 0x38]
xor esi, esi
mov dword [ebp - 0x38], eax
inc esi
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x30], 0xd8530de9
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x1c], 0xfffffff6
cmp dword [ebp - 0x1c], 0x1c
jne 0x10036d8e
xor eax, eax
mov dword [ebp - 0x10], 0x59e57ad9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe4
je 0x10036d85
mov dword [ebp - 0x64], 0xc3a0b8ee
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x64], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe4
jne 0x10036d6a
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1c
je 0x10036d5a
dec dword [ebp - 0x54]
mov dword [ebp - 0x38], 0x68206240
mov dword [ebp - 0x38], 0xffffffeb
cmp dword [ebp - 0x38], 0xd
jle 0x10036df2
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 0x19
jmp 0x10036de3
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10036de0
push 0x431
push eax
push eax
push 0x126e
push 0x2244
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff7
jle 0x10036db3
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xd
jg 0x10036da7
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x24], 0xc45cdbe8
mov dword [ebp - 0x30], 0x7c04
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10036e31
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1380], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10036e18
xor eax, eax
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jl 0x10036e82
mov dword [ebp - 0x2c], 0xb99
cmp dword [ebp - 0x2c], eax
jne 0x10036e82
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10036e7d
push 0x1bb8
push 0x694
push 0x1908
push 0x8f6
push 0x45a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
xor eax, eax
dec dword [ebp - 0x24]
jns 0x10036e39
mov dword [ebp - 0x24], esi
push 3
pop ebx
cmp dword [ebp - 0x24], eax
jl 0x10036f2d
or edi, 0xffffffff
mov dword [ebp - 0x30], 0xcc5d9b4e
lea ecx, [ebp - 0xf84]
mov dword [ebp - 0x30], 0xf545ee28
mov dword [ebp - 0x30], 0x3cfce294
mov dword [ebp - 0x30], 0x23e93d0b
mov dword [ebp - 0x30], esi
push ebx
call fcn.10018a69
mov dword [ebp - 4], 0x22
xor eax, eax
mov dword [ebp - 0x54], 0x756fd8c6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10036ef2
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf84]
call fcn.10018b0a
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10036ed7
xor eax, eax
inc dword [ebp - 0x54]
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10036f10
push eax
push 0x953
push 0x1c45
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
lea ecx, [ebp - 0xf84]
mov dword [ebp - 4], edi
call fcn.10018aee
dec dword [ebp - 0x24]
jns 0x10036e94
mov edi, dword [sym.imp.GDI32.dll_TextOutA]
mov dword [ebp - 0x24], 0xf30cc2fd
lea ecx, [ebp - 0x59c]
or eax, 0xffffffff
mov dword [ebp - 0x18], 0xfffffff8
push 5
mov dword [ebp - 0x1c], eax
pop eax
mov dword [ebp - 0x54], eax
push ebx
call fcn.10018a69
push esi
lea ecx, [ebp - 0xcb0]
mov dword [ebp - 4], 0x23
call fcn.10018a69
xor eax, eax
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10036f95
push dword [ebp - 0x18]
lea ecx, [ebp - 0x59c]
call fcn.10018b0a
mov dword [eax], 0xb32e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10036f77
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10036fb8
push dword [ebp - 0x18]
lea ecx, [ebp - 0xcb0]
call fcn.10018b0a
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10036f9d
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10036fd9
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setle dl
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x691f
jge 0x10037022
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1003704e
push 0xf99
push 0x15f3
call ebx
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x1003704c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], eax
jmp 0x10037037
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1470], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003702a
mov eax, dword [ebp - 0x1470]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x100370cc
xor edi, edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x59c]
call fcn.10018b0a
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xcb0]
push edi
call fcn.10018b0a
mov eax, dword [eax]
neg eax
je 0x100370b4
push dword [ebp - 0x18]
lea ecx, [ebp - 0x59c]
call fcn.10018b0a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x59c]
mov esi, eax
call fcn.10018b0a
mov esi, dword [esi]
lea ecx, [ebp - 0x59c]
add esi, dword [eax]
xor eax, eax
inc eax
push eax
call fcn.10018b0a
cmp esi, dword [eax]
jne 0x100370b4
mov eax, dword [ebp - 0x54]
or eax, 0xffffffff
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x10037059
mov edi, dword [sym.imp.GDI32.dll_TextOutA]
xor esi, esi
inc esi
lea ecx, [ebp - 0xcb0]
call fcn.10018aee
or eax, 0xffffffff
lea ecx, [ebp - 0x59c]
mov dword [ebp - 4], eax
call fcn.10018aee
mov dword [ebp - 0x3c], 0xc692
or eax, 0xffffffff
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x6c], 0xcb314b81
mov dword [ebp - 0x7c], 0x69867f5d
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10037124
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x84], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10037110
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1003714b
push 0x202
push eax
push 0xf97
push 0x23d4
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
xor edi, edi
mov dword [ebp - 0x84], 4
inc edi
cmp dword [ebp - 0x84], edi
jge 0x100372b6
jmp 0x10037168
xor eax, eax
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x358]
push edi
call fcn.10018a69
mov dword [ebp - 4], 0x25
xor eax, eax
mov dword [ebp - 0x48], 0x97756eb3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x100371ad
push dword [ebp - 0x10]
lea ecx, [ebp - 0x358]
call fcn.10018b0a
mov dword [eax], 0x9531defc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003718f
xor eax, eax
mov dword [ebp - 0x64], eax
xor ecx, ecx
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, 3
setl cl
imul eax, ecx, 0xfffa
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x24]
jg 0x100371ec
mov eax, dword [ebp - 0x64]
xor esi, esi
lea ecx, [ebp - 0x358]
push esi
call fcn.10018b0a
mov eax, dword [ebp - 0x7c]
lea ecx, [ebp - 0x358]
mov eax, dword [ebp - 0x84]
push esi
call fcn.10018b0a
mov dword [ebp - 0x6c], 0xb476
lea ecx, [ebp - 0x358]
push esi
call fcn.10018b0a
mov ecx, dword [ebp - 0x24]
imul ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x84]
add ecx, dword [eax]
mov eax, dword [ebp - 0x24]
imul edx, ecx
sub edx, eax
je 0x1003724d
push esi
lea ecx, [ebp - 0x358]
call fcn.10018b0a
cmp dword [eax], esi
je 0x1003724d
mov esi, edi
xor eax, eax
lea ecx, [ebp - 0x358]
push eax
call fcn.10018b0a
sub esi, dword [eax]
sub esi, 8
je 0x10037265
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x84]
lea ecx, [ebp - 0x358]
mov eax, dword [ebp - 0x24]
xor esi, esi
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
push esi
call fcn.10018b0a
push esi
lea ecx, [ebp - 0x358]
call fcn.10018b0a
lea ecx, [ebp - 0x358]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10018aee
dec dword [ebp - 0x84]
cmp dword [ebp - 0x84], edi
jl 0x10037166
mov dword [ebp - 0x48], 0xc6338430
xor eax, eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x60], 0x16efa42b
mov dword [ebp - 0x1c], 0x1824a8c6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100372f2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1488], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100372d9
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x17
jg 0x100373b3
push 3
pop esi
mov dword [ebp - 0x38], 0xb1891f78
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10037345
push eax
push 0x884
push 0x1bd9
push 0x1f62
push 0x1eb
push 0x2b7
push 0x1672
push 0x17b2
push 0x16d
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jg 0x100373a6
push esi
lea ecx, [ebp - 0xae8]
call fcn.10018a69
xor eax, eax
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x10], eax
jmp 0x10037378
push dword [ebp - 0x10]
call fcn.10018b0a
mov dword [eax], 0xfff9
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xae8]
cmp dword [ebp - 0x10], esi
jl 0x10037367
push edi
call fcn.10018b0a
lea ecx, [ebp - 0xae8]
mov dword [eax], edi
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10018aee
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jle 0x1003734d
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
jle 0x10037302
mov eax, dword [ebp - 0x1488]
lea ecx, [ebp - 0xc20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x40], 0x9253a34c
mov dword [ebp - 0x24], 0xf6af1124
push edi
call fcn.10018a69
mov dword [ebp - 4], 0x27
xor eax, eax
mov dword [ebp - 0x2c], 0x32fd2d1a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10037409
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc20]
call fcn.10018b0a
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100373ee
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10037457
mov dword [ebp - 0x2c], 0x91df82
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x24]
xor eax, eax
push eax
inc esi
call fcn.10018b0a
mov ecx, dword [ebp - 0x24]
imul ecx, esi
mov dword [eax], esi
xor eax, eax
add ecx, dword [ebp - 0x24]
cmp ecx, 0x14f9
setne al
mov dword [ebp - 0x2c], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10037454
push eax
push 0x69c
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
lea ecx, [ebp - 0xc20]
jle 0x1003740e
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10018aee
push 3
pop esi
or eax, 0xffffffff
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0xd28]
push edi
call fcn.10018a69
mov dword [ebp - 4], 0x28
xor eax, eax
mov dword [ebp - 0x5c], 0xeba4d3ec
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100374bc
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd28]
call fcn.10018b0a
mov dword [eax], 0xa3df
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1003749e
xor eax, eax
mov dword [ebp - 0x18], eax
or ecx, 0xffffffff
cmp dword [ebp - 0x18], esi
jge 0x100374db
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14f4], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100374c7
xor eax, eax
push 0xfffffffffffffff9
mov dword [ebp - 0x38], eax
pop edx
jmp 0x100375c5
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x5c], 0x82d83d78
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x5c], 0xe703026d
mov dword [ebp - 0x5c], 0xd1a4e665
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x5c], 0x467356a0
mov dword [ebp - 0x5c], 0xcdedfc3e
mov dword [ebp - 0x5c], 0xfffffff7
mov dword [ebp - 0x5c], 0xf3392002
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x100375c2
mov dword [ebp - 0x5c], edi
lea ecx, [ebp - 0xb00]
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x5c], 0x12e1dfe
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x5c], 0x785b6478
mov dword [ebp - 0x5c], 0xfffffffc
mov dword [ebp - 0x5c], edi
push 4
call fcn.10018a69
mov byte [ebp - 4], 0x29
xor eax, eax
mov dword [ebp - 0x54], 0x93dd61fb
mov dword [ebp - 0x10], eax
jmp 0x1003757f
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb00]
call fcn.10018b0a
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003756c
inc dword [ebp - 0x54]
lea ecx, [ebp - 0xd28]
push dword [ebp - 0x1c]
call fcn.10018b0a
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0xb00]
cmp dword [eax], 0
jne 0x100375b5
call fcn.10018aee
dec dword [ebp - 0x1c]
jns 0x1003752c
jmp 0x100375ba
call fcn.10018aee
push 0xfffffffffffffff9
xor eax, eax
or ecx, 0xffffffff
pop edx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x10
je 0x100374e6
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0xd28]
call fcn.10018aee
push esi
lea ecx, [ebp - 0x7c0]
call fcn.10018a69
mov dword [ebp - 4], 0x2a
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x2c], 0x65ab3e90
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10037612
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetParent]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1003762a
mov dword [ebp - 0x2c], 0xfffa
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x16
je 0x10037617
mov dword [ebp - 0x2c], edi
lea ecx, [ebp - 0xb18]
mov dword [ebp - 0x1c], 0xef20fe6e
mov dword [ebp - 0x78], 4
mov dword [ebp - 0x54], 0x928fbc78
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x54], 0xfffffffb
push 2
call fcn.10018a69
xor eax, eax
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x10], eax
jmp 0x10037681
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb18]
call fcn.10018b0a
mov dword [eax], 0x388a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003766a
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x1c], edi
ja 0x1003769d
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1003769d
mov edx, eax
cmp dword [ebp - 0x4c], eax
je 0x1003769f
mov edx, edi
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp edx, eax
setge cl
imul eax, ecx, 7
test eax, eax
jne 0x100376b7
mov ecx, eax
cmp dword [ebp - 0x54], eax
je 0x100376b9
mov ecx, edi
xor eax, eax
cmp ecx, 0x9bea
setl al
cmp dword [ebp - 0x1c], eax
jl 0x100376d4
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x100376d6
mov edx, edi
jmp 0x100376d8
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x78]
xor ecx, ecx
cmp eax, 0x51cd
setle cl
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
sub eax, edx
cmp dword [ebp - 0x1c], eax
jne 0x10037707
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1003771f
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
jmp 0x1003771f
xor eax, eax
lea ecx, [ebp - 0xb18]
push eax
call fcn.10018b0a
xor ecx, ecx
cmp dword [eax], edi
setge cl
mov dword [ebp - 0x78], ecx
lea ecx, [ebp - 0xb18]
mov byte [ebp - 4], 0x2a
call fcn.10018aee
mov dword [ebp - 0x50], 0xec00
xor eax, eax
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1003775e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x368], 0xd95e17ca
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10037746
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100377a4
mov dword [ebp - 0x4c], 0xfffffffa
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1003778c
push 0xa6e
push 0xb
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], eax
jl 0x100377a1
cmp dword [ebp - 0x368], eax
jne 0x100377a1
dec dword [ebp - 0x4c]
jns 0x10037794
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe2
jg 0x10037763
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x100377c6
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x368], 0
jne 0x100377c4
dec dword [ebp - 0x18]
jns 0x100377b2
xor eax, eax
mov dword [ebp - 0x5c], 0xfffffff6
or ecx, 0xffffffff
mov dword [ebp - 0x64], 0x8261f9c2
mov dword [ebp - 0x68], 0x9be1d925
mov dword [ebp - 0x54], 0x37d45db3
mov dword [ebp - 0x68], 6
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x58], 0xe30f5872
mov dword [ebp - 0x7c], 0x97412df3
mov dword [ebp - 0x68], 0x7d8cf4c5
mov dword [ebp - 0x6c], 0xddca
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x10], eax
jmp 0x1003782a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xee4], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10037819
inc dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0xedc]
mov eax, dword [ebp - 0xedc]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x7c]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, dword [ebp - 0x4c]
jle 0x10037868
cmp dword [ebp - 0x4c], eax
je 0x10037868
mov eax, edi
xor ecx, ecx
dec eax
push 5
sets cl
sub ecx, 0x4fef5379
mov dword [ebp - 0x78], ecx
lea ecx, [ebp - 0x10a0]
mov dword [ebp - 0x68], 0xca1d25f
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x864896e6
mov dword [ebp - 0x78], 0xfffffffa
mov dword [ebp - 0x70], 0x23e46920
mov dword [ebp - 0x70], 0x514faf14
mov dword [ebp - 0x70], 0x59f451db
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x70], 0x4cf22a1e
mov dword [ebp - 0x70], 0x782ecc90
push 0xfffffffffffffff9
mov dword [ebp - 0x70], 0x21692869
pop eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x70], 6
mov dword [ebp - 0x70], 0xf0aeacb2
mov dword [ebp - 0x70], 0x98072f25
push esi
call fcn.10018a69
mov byte [ebp - 4], 0x2c
xor eax, eax
mov dword [ebp - 0x70], 0x9107
mov dword [ebp - 0x54], 0x58d3
mov dword [ebp - 0x10], eax
jmp 0x10037916
push dword [ebp - 0x10]
lea ecx, [ebp - 0x10a0]
call fcn.10018b0a
mov dword [eax], 0xfe1f230b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100378ff
mov eax, dword [ebp - 0x20]
xor ebx, ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
setg bl
xor edx, edx
cmp eax, ecx
setle dl
lea eax, [edx - 5]
add eax, ebx
jne 0x10037951
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x20]
jge 0x10037962
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x10a0]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x78], eax
dec dword [ebp - 0x54]
mov byte [ebp - 4], 0x2a
call fcn.10018aee
movdqa xmm0, xmmword [0x10008390]
lea eax, [ebp - 0x10c4]
push eax
lea eax, [ebp - 0x10d4]
mov dword [ebp - 0x70], 0x79c0213a
push eax
lea ecx, [ebp - 0x1390]
movdqu xmmword [ebp - 0x10d4], xmm0
call fcn.10018b19
lea ecx, [ebp - 0x209]
mov esi, eax
call fcn.10009523
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x194]
push dword [esi]
call fcn.10018ac8
mov byte [ebp - 4], 0x2d
xor eax, eax
mov dword [ebp - 0x28], 0x18885c6f
mov dword [ebp - 0x78], 0xfff7
mov dword [ebp - 0x54], 0x88afb1ca
mov dword [ebp - 0x28], eax
jmp 0x10037b14
mov dword [ebp - 0x54], 0x20b275cf
mov dword [ebp - 0x64], 0xa907865e
mov dword [ebp - 0x54], 0x4f2a6ca0
mov dword [ebp - 0x54], 0xde0d6158
push dword [ebp - 0x28]
call fcn.10018b0a
push dword [ebp - 0x28]
lea ecx, [ebp - 0x194]
call fcn.10018b0a
xor ebx, ebx
cmp dword [eax], ebx
je 0x10037a32
push esi
lea ecx, [ebp - 0x194]
call fcn.10018b0a
push dword [ebp - 0x28]
lea ecx, [ebp - 0x194]
call fcn.10018b0a
mov ecx, dword [ebp - 0x78]
cmp dword [eax], ecx
jl 0x10037a55
push dword [ebp - 0x28]
lea ecx, [ebp - 0x194]
call fcn.10018b0a
push dword [ebp - 0x28]
lea ecx, [ebp - 0x194]
call fcn.10018b0a
cmp dword [eax], ebx
je 0x10037a72
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10037a74
mov esi, edi
jmp 0x10037a76
xor eax, eax
mov esi, eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x194]
call fcn.10018b0a
push 7
pop ecx
cmp ecx, esi
sbb ecx, ecx
neg ecx
cmp ecx, 0x9683648b
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x194]
setge dl
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
push dword [ebp - 0x28]
call fcn.10018b0a
push edi
lea ecx, [ebp - 0x194]
call fcn.10018b0a
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x194]
mov eax, dword [ebp - 0x78]
push dword [ebp - 0x28]
call fcn.10018b0a
push dword [ebp - 0x28]
lea ecx, [ebp - 0x194]
call fcn.10018b0a
push dword [ebp - 0x28]
lea ecx, [ebp - 0x194]
mov esi, dword [eax]
inc esi
call fcn.10018b0a
xor edx, edx
mov dword [eax], esi
mov dword [ebp - 0x54], esi
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setg dl
mov dword [ebp - 0x54], edx
inc dword [ebp - 0x28]
push 3
pop esi
lea ecx, [ebp - 0x194]
cmp dword [ebp - 0x28], esi
jle 0x100379ee
mov byte [ebp - 4], 0x2a
call fcn.10018aee
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10037b4d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x7c0]
call fcn.10018b0a
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10037b36
mov dword [ebp - 0x24], 0xfffffffc
lea ecx, [ebp - 0x48c]
push esi
call fcn.10018a69
mov byte [ebp - 4], 0x2e
xor eax, eax
mov dword [ebp - 0x54], 0xe481db3a
mov dword [ebp - 0x10], eax
jmp 0x10037b8b