Function at 0x1003380f
Capabilities:
Accept command line arguments
Allocate thread local storage
Connect pipe
Contain obfuscated stackstrings
Create thread
Enumerate files on windows
Get common file path
Get graphical window text
Get keyboard layout
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x100823cd
call fcn.10081d58
mov eax, 0x13e4
call fcn.1007e140
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x64], ecx
inc ebx
mov byte [ebp - 0x7d], dl
mov esi, 0xfe0a8eac
xor eax, eax
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x48], eax
push 3
mov dword [ebp - 0x48], 0xffffffff
pop edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x48], 0x3e469209
mov dword [ebp - 0x48], ebx
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10033879
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6f8], 0xfffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10033861
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10033899
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd20], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10033881
xor eax, eax
mov dword [ebp - 0x5c], eax
jmp 0x10033a54
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x48], 0xf1e283d1
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0xc237
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100338d9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x444], 0x514faf14
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100338c1
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jg 0x10033a51
mov dword [ebp - 0x880], 0x64896e6a
mov dword [ebp - 0x87c], 0x64896e6a
mov dword [ebp - 0x878], 0x64896e6a
mov dword [ebp - 0x874], 0x64896e6a
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], 0x757a8360
mov dword [ebp - 0x18], eax
jmp 0x1003392d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6b8], 0x505b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003391c
mov eax, dword [ebp - 0x5c]
xor edx, edx
mov dword [ebp - 0x880], eax
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x6b8]
mov ecx, dword [ebp - 0x880]
mov eax, dword [ebp - 0x6b4]
add ecx, 0x6bca
cmp ecx, eax
setne dl
add edx, 4
mov dword [ebp - 0x38], edx
je 0x10033976
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x6f8], 0
je 0x10033976
mov edx, ebx
jmp 0x1003397a
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x880]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
cmp ecx, 0x3e24
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x6f8]
setge cl
cmp edi, ecx
sbb ecx, ecx
xor ebx, ebx
neg ecx
sub ecx, 0x2b6367af
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setle bl
sub ebx, 0xfffffff6
mov eax, dword [ebp + eax*4 - 0x6f8]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp eax, ebx
mov eax, dword [ebp - 0x6b4]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xb8ee
setle al
xor ecx, ecx
test eax, eax
setle cl
xor eax, eax
mov dword [ebp - 0x444], ecx
test ecx, ecx
je 0x10033a23
push 2
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10033a12
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcbc], 0xf3632e6b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10033a01
mov dword [ebp - 0xcbc], 0x9815c87e
jmp 0x10033a35
cmp dword [ebp - 0x444], eax
jne 0x10033a49
push 2
mov dword [ebp - 0x38], 0xa4aa3e85
pop ecx
inc dword [ebp - 0x30]
xor ebx, ebx
inc ebx
push 0
pop eax
cmp dword [ebp - 0x30], ebx
jle 0x100338e5
jmp 0x10033a4c
xor ebx, ebx
inc ebx
push 2
xor eax, eax
pop ecx
dec dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 0xfffffff5
jge 0x100338a1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10033a74
push 0x1d41
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 0xe00f6802
mov dword [ebp - 0x38], 0xfffffffe
push 2
mov dword [ebp - 0x18], eax
pop edx
cmp dword [ebp - 0x18], edx
jge 0x10033aa4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1fc], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10033a90
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x10033b20
mov dword [ebp - 0x38], 0x50a4ba31
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1fc]
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1fc]
cmp eax, edx
mov eax, dword [ebp - 0x14]
setne cl
sub ecx, dword [ebp + eax*4 - 0x1fc]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebp + eax*4 - 0x1fc]
mov eax, dword [ebp - 0x1c]
dec eax
add eax, ecx
xor ecx, ecx
cmp eax, ebx
setg cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x1fc]
imul ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebp + eax*4 - 0x1fc]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
dec dword [ebp - 0x14]
jns 0x10033aac
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x44], 0x8c45cdbe
mov dword [ebp - 0x1c], 0xb63e8e1b
mov dword [ebp - 0x4c], 0x33f23e93
mov ecx, dword [ebp - 0x1c]
sub ecx, 0xfff8
mov esi, dword [sym.imp.USER32.dll_CreateCaret]
neg ecx
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0xfffffffffffffff6
sbb ecx, ecx
inc ecx
pop eax
sub eax, ecx
xor ecx, ecx
cmp eax, 0x77278fa8
setl cl
xor edx, edx
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffc
cmp ecx, eax
setg dl
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
sub eax, 0xb548
imul eax, dword [ebp - 0x44]
cmp dword [ebp - 0x44], eax
jle 0x10033b98
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10033bb4
push eax
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
jmp 0x10033bb2
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10033bb2
push 0xb96
push 0x33a
push eax
call edi
push eax
call esi
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x48], eax
push 3
mov dword [ebp - 0x48], 0xffffffff
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x48], 0x3e469209
mov dword [ebp - 0x48], ebx
push 2
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x10033bf4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x710], 0xfffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10033bdc
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10033c14
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc94], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10033bfc
xor eax, eax
mov dword [ebp - 0x5c], eax
jmp 0x10033dc7
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x48], 0xf1e283d1
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0xc237
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10033c54
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3c8], 0x514faf14
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10033c3c
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jg 0x10033dc4
mov ecx, 0x64896e6a
mov dword [ebp - 0x820], ecx
mov dword [ebp - 0x81c], ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], 0x757a8360
mov dword [ebp - 0x18], eax
jmp 0x10033c9d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6c8], 0x505b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10033c8c
mov eax, dword [ebp - 0x5c]
xor edx, edx
mov dword [ebp - 0x820], eax
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x6c8]
mov ecx, dword [ebp - 0x820]
mov eax, dword [ebp - 0x6c4]
add ecx, 0x6bca
cmp ecx, eax
setne dl
add edx, 4
mov dword [ebp - 0x38], edx
je 0x10033ce6
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x710], 0
je 0x10033ce6
mov edx, ebx
jmp 0x10033cea
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x820]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
push 3
setle cl
xor edx, edx
cmp ecx, 0x3e24
setg dl
xor ecx, ecx
cmp edx, eax
pop eax
setge cl
cmp eax, ecx
mov eax, dword [ebp - 0x710]
sbb ecx, ecx
xor ebx, ebx
neg ecx
sub ecx, 0x2b6367af
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setle bl
sub ebx, 0xfffffff6
mov eax, dword [ebp + eax*4 - 0x710]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp eax, ebx
mov eax, dword [ebp - 0x6c4]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xb8ee
setle al
xor ecx, ecx
test eax, eax
setle cl
xor eax, eax
mov dword [ebp - 0x3c8], ecx
test ecx, ecx
je 0x10033d96
push 2
mov dword [ebp - 0x18], eax
pop edx
jmp 0x10033d85
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xda8], 0xf3632e6b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10033d74
mov dword [ebp - 0xda8], 0x9815c87e
jmp 0x10033da8
cmp dword [ebp - 0x3c8], eax
jne 0x10033dbc
push 2
mov dword [ebp - 0x38], 0xa4aa3e85
pop edx
inc dword [ebp - 0x30]
xor ebx, ebx
inc ebx
push 0
pop eax
cmp dword [ebp - 0x30], ebx
jle 0x10033c60
jmp 0x10033dbf
xor ebx, ebx
inc ebx
push 2
xor eax, eax
pop edx
dec dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 0xfffffff5
jge 0x10033c1c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10033de7
push 0x1d41
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push 0xfffffffffffffff8
mov dword [ebp - 0x40], 0xacdff905
pop ecx
mov dword [ebp - 0x5c], 0x684a5798
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x44], ecx
push 3
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10033e1b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x170], 0x1c76d7be
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10033e0a
mov eax, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x168]
mov edx, dword [ebp - 0x170]
sub edx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x170]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, ebx
setl cl
xor eax, eax
cmp edx, ecx
setle al
imul eax, eax, 0x4081
sub eax, 0xe03
je 0x10034039
mov dword [ebp - 0x34], 0x67101392
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10033e94
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x954], 0x47fce3ba
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10033e7b
xor eax, eax
push 2
pop ecx
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], eax
jl 0x10033fb1
mov dword [ebp - 0x24], 0xa421e0be
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10033eca
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x278], 0x97618de0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10033eb2
xor eax, eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x10033fa2
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x170]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x170]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10033f45
mov esi, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x34]
neg esi
sbb esi, esi
add esi, 0xffffbad7
mov edx, dword [ebp + eax*4 - 0x170]
neg esi
mov eax, dword [ebp - 0x34]
sbb esi, esi
xor ecx, ecx
inc esi
cmp esi, eax
setne cl
xor eax, eax
cmp ecx, edx
setge al
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp + eax*4 - 0x170]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x5b48
setg cl
add edx, ecx
jne 0x10033f45
xor eax, eax
mov ecx, eax
jmp 0x10033f47
mov ecx, ebx
xor eax, eax
cmp ecx, ebx
setg al
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x278]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x170]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x170], ecx
test ecx, ecx
jne 0x10033f87
mov eax, dword [ebp - 0x278]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, ebx
setge cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x24]
jns 0x10033ed6
push 2
xor eax, eax
pop ecx
dec dword [ebp - 0x34]
jns 0x10033ea3
mov esi, dword [sym.imp.USER32.dll_CreateCaret]
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 0x94c]
mov eax, dword [ebp - 0x5c]
cmp ecx, eax
mov eax, dword [ebp - 0x94c]
mov eax, dword [ebp - 0x1c]
setne dl
imul eax, dword [ebp - 0x34]
push 2
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp edx, eax
mov eax, dword [ebp - 0x948]
setg cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov ecx, 0xffff
setg dl
xor eax, eax
cmp edx, 0x52c2
setge al
cmp eax, ecx
mov eax, dword [ebp - 0x950]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x948]
mov ecx, dword [ebp - 0x170]
setge dl
sub edx, eax
mov eax, dword [ebp - 0x5c]
add ecx, edx
xor edx, edx
cmp ecx, eax
pop ecx
sete dl
mov dword [ebp - 0x40], edx
jmp 0x10034124
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x1003411b
mov dword [ebp - 0x4c], 0xd11c
mov dword [ebp - 0x5c], ecx
cmp dword [ebp - 0x5c], eax
jl 0x10034118
mov dword [ebp - 0x38], 0xfffffff6
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003407e
push 0xb96
push 0x33a
push eax
call edi
push eax
call esi
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x40], eax
jmp 0x10034106
mov dword [ebp - 0x30], 0x850227cd
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jl 0x10034103
mov dword [ebp - 0x44], 0x5525c537
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x170]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x100340cf
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
push 0xfffffffffffffff7
pop edx
sub edx, eax
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4c]
cmp edx, eax
setl cl
neg ecx
je 0x100340cd
mov ecx, ebx
jmp 0x100340d1
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x30b1
setl al
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x30]
jns 0x10034095
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ecx
jle 0x10034086
dec dword [ebp - 0x5c]
jns 0x10034059
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x10034046
mov dword [ebp - 0x20], 0xfe0a8eac
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x5c], 0xb26bdde0
mov dword [ebp - 0x4c], 0x9cadcda6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1003415e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x71c], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10034146
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10034181
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1080], 0xccfdef05
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10034169
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x5c], 0xfffffffe
cmp dword [ebp - 0x5c], 0x17
jge 0x10034368
xor edx, edx
inc edx
mov dword [ebp - 0x30], 0xfb023ed1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100341bf
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
xor edx, edx
xor eax, eax
push 3
inc edx
pop ecx
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], eax
jl 0x10034359
mov dword [ebp - 0x24], 0x585b7f37
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jg 0x10034350
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1003420c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x22c], 0x46cdead9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100341f4
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x1003422c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x618], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10034214
xor eax, eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], edx
jg 0x100342f7
jmp 0x10034242
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10034258
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3d0], 0xfffffff7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10034247
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x228]
push 2
mov eax, dword [ebp + eax*4 - 0x71c]
test eax, eax
pop eax
setne cl
cmp eax, ecx
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x24]
cmp eax, 0xfffffffe
jne 0x10034299
mov eax, dword [ebp - 0x228]
cmp dword [ebp + eax*4 - 0x71c], 0
jne 0x10034299
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x228]
setl cl
cmp ecx, 0xe24307a3
mov eax, dword [ebp + eax*4 - 0x71c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x228]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
imul eax, ecx, 0x5a12
inc edx
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp - 0x3d0]
inc dword [ebp - 0x228]
cmp dword [ebp - 0x228], edx
jle 0x10034240
push 3
pop ecx
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10034320
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x5c]
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x618], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
sub eax, 5
neg eax
push 0
sbb eax, eax
neg eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x1078], eax
inc dword [ebp - 0x24]
pop eax
cmp dword [ebp - 0x24], edx
jle 0x100341ec
dec dword [ebp - 0x30]
jns 0x100341cb
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 0x17
jl 0x1003419b
jmp 0x1003436b
xor edx, edx
inc edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x48], 0x3e469209
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x100343a6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8fc], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003438e
xor eax, eax
mov dword [ebp - 0x28], 0x10
cmp dword [ebp - 0x28], 0x1c
jle 0x100344a0
push 2
pop ecx
mov dword [ebp - 0x30], 0x39924432
mov dword [ebp - 0x4c], 0xf29c8dda
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jl 0x10034493
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x38], 0xbb2f
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x1003448a
mov dword [ebp - 0x4c], 0xe4f9dbc9
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x8fc], 0
jne 0x10034485
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1003446f
cmp dword [ebp - 0x28], eax
jne 0x10034461
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x38]
jl 0x10034435
xor eax, eax
cmp dword [ebp - 0x8fc], eax
je 0x10034437
jmp 0x10034439
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x8f8]
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x8fc]
imul eax, dword [ebp - 0x4c]
test eax, eax
jne 0x10034460
inc edx
jmp 0x10034463
inc edx
mov eax, edx
mov dword [ebp - 0x4c], eax
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x4c], eax
je 0x10034471
mov ecx, edx
push 8
pop eax
sub eax, ecx
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x24]
jns 0x100343ed
push 2
xor eax, eax
pop ecx
dec dword [ebp - 0x30]
jns 0x100343d4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1c
jg 0x100343ba
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffe5
jle 0x100344d1
mov dword [ebp - 0x38], 0x1434a938
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x4c], 0xfffffffb
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe5
jg 0x100344a9
xor eax, eax
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x4c], 4
mov dword [ebp - 0x28], 0x18
jmp 0x10034509
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10034506
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
xor eax, eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe2
je 0x100344ef
mov dword [ebp - 0x28], 0x13
cmp dword [ebp - 0x28], 0xfffffff4
jge 0x10034646
jmp 0x10034524
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x40], 0xffffffef
cmp dword [ebp - 0x40], 0xc
je 0x100345db
jmp 0x10034547
xor eax, eax
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x18], eax
jmp 0x10034564
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11b4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10034553
mov dword [ebp - 0x30], 0x1af7
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ecx
setg dl
imul eax, dword [ebp - 0x30], 0x7975
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x11b4], ecx
mov dword [ebp - 0x24], 5
cmp dword [ebp - 0x24], 0xfffffffb
jg 0x100345ce
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100345c5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffb
jle 0x100345b2
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xc
jne 0x10034545
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor edx, edx
inc edx
cmp ecx, edx
sbb eax, eax
inc eax
cmp eax, 0xffffffff
sbb eax, eax
neg eax
add eax, dword [ebp - 0x30]
jne 0x10034615
cmp dword [ebp - 0x30], eax
je 0x10034617
mov eax, edx
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], 0x42b4cf22
jne 0x1003462a
cmp dword [ebp - 0x4c], eax
jne 0x1003462c
mov edx, eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
add eax, edx
add ecx, eax
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff4
jl 0x10034522
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x14], 0xa4f833fc
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x48], 0x6cc9ca31
push 3
mov dword [ebp - 0x18], eax
pop edx
cmp dword [ebp - 0x18], edx
jge 0x10034689
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1044], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10034675
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x100346af
push 2
pop ecx
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x1044], 0
jne 0x100346aa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x10034695
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x14], 0xffffffe5
cmp dword [ebp - 0x14], 0x1c
mov dword [ebp - 0x5c], 0x8708ef6b
je 0x1003476d
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x558], ecx
mov dword [ebp - 0x554], ecx
mov dword [ebp - 0x550], ecx
mov dword [ebp - 0x54c], ecx
mov dword [ebp - 0x48], 0x6f65e790
mov dword [ebp - 0x48], 0xe6a3735b
mov dword [ebp - 0x48], 0x8047d203
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x10034717
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1360], 0x76e5b14f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100346ff
xor eax, eax
mov dword [ebp - 0x550], 0xffffffeb
cmp dword [ebp - 0x550], 0xfffffff6
jge 0x1003475d
mov dword [ebp - 0x4c], 4
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10034745
call edi
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
xor eax, eax
dec dword [ebp - 0x4c]
inc dword [ebp - 0x550]
cmp dword [ebp - 0x550], 0xfffffff6
jl 0x1003472a
mov ecx, dword [ebp - 0x5c]
push 3
pop edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1c
jne 0x100346ca
xor ecx, ecx
inc ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], 0xffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10034797
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd0], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003477f
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x100348fa
mov dword [ebp - 0x1c], 0xba339924
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x100348f4
mov dword [ebp - 0x24], 0xab274bf9
mov dword [ebp - 0x24], eax
jmp 0x100348df
mov dword [ebp - 0x50], 0xfffffffb
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], eax
jl 0x100348bb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x100347f4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x378], 0x315362d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100347dc
xor eax, eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], eax
jl 0x1003489b
mov dword [ebp - 0x20], 0x3f17e2f9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x1003488f
mov eax, dword [ebp - 0x378]
mov eax, dword [ebp + eax*4 - 0xd0]
mov eax, dword [ebp - 0x378]
cmp dword [ebp + eax*4 - 0xd0], 0
je 0x1003485d
mov eax, dword [ebp - 0x378]
mov eax, dword [ebp + eax*4 - 0xd0]
imul eax, dword [ebp - 0x40]
neg eax
jne 0x1003484a
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x378]
mov eax, dword [ebp + eax*4 - 0xd0]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp + eax*4 - 0xd0]
imul eax, dword [ebp - 0x30], 0xfffc
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setge dl
mov dword [ebp + eax*4 - 0xd0], edx
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x10034815
dec dword [ebp - 0x378]
jns 0x10034806
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100348af
call edi
push eax
call dword [sym.imp.USER32.dll_GetParent]
xor eax, eax
dec dword [ebp - 0x50]
push 3
pop edx
jns 0x100347d4
mov dword [ebp - 0x30], eax
jmp 0x100348d4
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100348d1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x100348c0
inc dword [ebp - 0x24]
push 3
pop edx
cmp dword [ebp - 0x24], eax
jle 0x100347c1
dec dword [ebp - 0x1c]
push 3
pop edx
jns 0x100347b2
inc dword [ebp - 0x40]
push 3
pop edx
cmp dword [ebp - 0x40], eax
jle 0x1003479f
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10034917
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1003493a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6d8], 0xfffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10034922
xor eax, eax
xor edx, edx
mov dword [ebp - 0x14], eax
inc edx
cmp dword [ebp - 0x14], edx
jge 0x1003495d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe24], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10034945
xor eax, eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], 0xe00f6802
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10034993
push 3
pop ecx
push 2
pop edx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x21c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003497c
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], eax
jl 0x10034a12
mov dword [ebp - 0x38], 0x50a4ba31
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x21c]
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x21c]
cmp eax, 2
mov eax, dword [ebp - 0x14]
setne cl
sub ecx, dword [ebp + eax*4 - 0x21c]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebp + eax*4 - 0x21c]
mov eax, dword [ebp - 0x1c]
dec eax
add eax, ecx
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x21c]
imul ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebp + eax*4 - 0x21c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
dec dword [ebp - 0x14]
jns 0x1003499b
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff5
jl 0x10034bdd
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x48], 0xf1e283d1
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0xc237
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x10034a57
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3d8], 0x514faf14
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10034a3f
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edx
jg 0x10034bca
push 2
pop ebx
mov ecx, 0x64896e6a
mov dword [ebp - 0x860], ecx
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 0x858], ecx
mov dword [ebp - 0x854], ecx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], 0x757a8360
mov dword [ebp - 0x18], eax
jmp 0x10034aa3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x728], 0x505b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10034a92
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x860], eax
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x728]
mov ecx, dword [ebp - 0x860]
mov eax, dword [ebp - 0x724]
add ecx, 0x6bca
cmp ecx, eax
setne dl
add edx, 4
mov dword [ebp - 0x38], edx
je 0x10034aef
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x6d8], 0
je 0x10034aef
xor eax, eax
lea edx, [eax + 1]
jmp 0x10034af3
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x860]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
push 3
setle cl
xor edx, edx
cmp ecx, 0x3e24
setg dl
xor ecx, ecx
cmp edx, eax
pop eax
setge cl
cmp eax, ecx
mov eax, dword [ebp - 0x6d8]
sbb ecx, ecx
xor ebx, ebx
neg ecx
sub ecx, 0x2b6367af
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setle bl
sub ebx, 0xfffffff6
mov eax, dword [ebp + eax*4 - 0x6d8]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp eax, ebx
mov eax, dword [ebp - 0x724]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xb8ee
setle al
xor ecx, ecx
test eax, eax
setle cl
xor eax, eax
mov dword [ebp - 0x3d8], ecx
test ecx, ecx
je 0x10034b9f
push 2
mov dword [ebp - 0x18], eax
pop ebx
jmp 0x10034b8e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcc8], 0xf3632e6b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10034b7d
mov dword [ebp - 0xcc8], 0x9815c87e
jmp 0x10034bb1
cmp dword [ebp - 0x3d8], eax
jne 0x10034bc5
push 2
mov dword [ebp - 0x38], 0xa4aa3e85
pop ebx
inc dword [ebp - 0x30]
xor edx, edx
inc edx
push 0
pop eax
cmp dword [ebp - 0x30], edx
jle 0x10034a66
jmp 0x10034bc8
xor edx, edx
inc edx
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff5
jge 0x10034a1f
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x44], 0x8c45cdbe
mov dword [ebp - 0x1c], 0xb63e8e1b
mov dword [ebp - 0x4c], 0x33f23e93
mov ecx, dword [ebp - 0x1c]
sub ecx, 0xfff8
neg ecx
push 0xfffffffffffffff6
sbb ecx, ecx
inc ecx
pop eax
sub eax, ecx
xor ecx, ecx
cmp eax, 0x77278fa8
setl cl
xor edx, edx
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffc
cmp ecx, eax
setg dl
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
sub eax, 0xb548
imul eax, dword [ebp - 0x44]
cmp dword [ebp - 0x44], eax
jle 0x10034c46
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10034c62
push eax
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
jmp 0x10034c60
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10034c60
push 0xb96
push 0x33a
push eax
call edi
push eax
call esi
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10034c78
push 0x1d41
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x38], 0x2cd8491f
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10034ca9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe50], 0xd06721f7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10034c91
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10034da8
mov dword [ebp - 0x24], 0x53aa9ac7
mov dword [ebp - 0xbd4], eax
mov dword [ebp - 0xbd0], eax
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10034cf1
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe08], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10034cdc
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffffe
jl 0x10034da5
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x38], 0x193e0566
mov dword [ebp - 0x1c], 0xd9e177c4
cmp dword [ebp - 0x4c], eax
je 0x10034d92
cmp dword [ebp - 0x30], eax
jne 0x10034d25
mov eax, dword [ebp - 0xdfc]
inc dword [ebp - 0xdfc]
mov eax, dword [ebp - 0xe4c]
mov eax, dword [ebp - 0x30]
imul edx, dword [ebp - 0x1c], 0xd5fb
mov eax, dword [ebp - 0xbcc]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, 0xffff
sete cl
cmp ecx, eax
mov eax, dword [ebp - 0x24]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
add eax, 0x7e3b
xor ecx, ecx
cmp eax, edx
setge cl
imul eax, ecx, 0x63e9
cmp eax, 0x930509b9
ja 0x10034d7f
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x10034d82
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp dword [ebp - 0x38], eax
jl 0x10034d92
xor eax, eax
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffe
push 0
pop eax
jge 0x10034cfe
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe7
jge 0x10034cb1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10034dd4
xor eax, eax
inc eax
push eax
push 0x1dbc
push 0xa2d
call edi
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
xor eax, eax
push 0xfffffffffffffff8
mov dword [ebp - 0x40], 0xacdff905
pop ecx
mov dword [ebp - 0x20], 0x684a5798
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x44], ecx
push 3
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10034e08
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x188], 0x1c76d7be
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10034df7
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp - 0x180]
mov edx, dword [ebp - 0x188]
sub edx, dword [ebp - 0x188]
mov eax, dword [ebp - 0x188]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, 1
setl cl
xor eax, eax
cmp edx, ecx
setle al
imul eax, eax, 0x4081
sub eax, 0xe03
je 0x10035028
mov dword [ebp - 0x34], 0x67101392
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10034e82
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x96c], 0x47fce3ba
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10034e69
xor eax, eax
push 2
pop ecx
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], eax
jl 0x10034fa0
xor edx, edx
inc edx
mov dword [ebp - 0x24], 0xa421e0be
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x10034ebb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x240], 0x97618de0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10034ea3
xor eax, eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x10034f97
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x188]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x188]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10034f3a
mov esi, dword [ebp - 0x184]
mov eax, dword [ebp - 0x34]
neg esi
sbb esi, esi
add esi, 0xffffbad7
mov edx, dword [ebp + eax*4 - 0x188]
neg esi
mov eax, dword [ebp - 0x34]
sbb esi, esi
xor ecx, ecx
inc esi
cmp esi, eax
setne cl
xor eax, eax
cmp ecx, edx
setge al
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp + eax*4 - 0x188]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x5b48
setg cl
add edx, ecx
jne 0x10034f37
xor eax, eax
inc edx
mov ecx, eax
jmp 0x10034f3c
xor edx, edx
inc edx
mov ecx, edx
xor eax, eax
cmp ecx, edx
setg al
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x188]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x188], ecx
test ecx, ecx
jne 0x10034f7c
mov eax, dword [ebp - 0x240]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x24]
jns 0x10034ec7
push 2
xor eax, eax
pop ecx
dec dword [ebp - 0x34]
jns 0x10034e94
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 0x964]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x964]
mov eax, dword [ebp - 0x1c]
setne dl
imul eax, dword [ebp - 0x34]
push 2
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp edx, eax
mov eax, dword [ebp - 0x960]
setg cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov ecx, 0xffff
setg dl
xor eax, eax
cmp edx, 0x52c2
setge al
cmp eax, ecx
mov eax, dword [ebp - 0x968]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x960]
mov ecx, dword [ebp - 0x188]
setge dl
sub edx, eax
mov eax, dword [ebp - 0x20]
add ecx, edx
xor edx, edx
cmp ecx, eax
sete dl
mov dword [ebp - 0x40], edx
pop edx
jmp 0x1003510f
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop edx
jmp 0x10035106
mov dword [ebp - 0x4c], 0xd11c
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jl 0x10035103
mov dword [ebp - 0x38], 0xfffffff6
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003506d
push 0xb96
push 0x33a
push eax
call edi
push eax
call esi
push 2
xor eax, eax
pop edx
mov dword [ebp - 0x40], eax
jmp 0x100350f1
mov dword [ebp - 0x30], 0x850227cd
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], eax
jl 0x100350ee
mov dword [ebp - 0x44], 0x5525c537
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x188]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x100350ba
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
push 0xfffffffffffffff7
pop edx
sub edx, eax
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4c]
cmp edx, eax
setl cl
xor eax, eax
neg ecx
lea ecx, [eax + 1]
jne 0x100350bc
mov ecx, eax
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x30b1
setl al
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x30]
jns 0x10035081
push 2
xor eax, eax
pop edx
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edx
jle 0x10035072
dec dword [ebp - 0x20]
jns 0x10035048
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x10035035
mov dword [ebp - 0x20], 0xb26bdde0
xor eax, eax
mov dword [ebp - 0x4c], 0x9cadcda6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x1003513f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6e8], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10035127
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10035162
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1038], 0xccfdef05
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003514a
xor eax, eax
xor esi, esi
mov dword [ebp - 0x20], 0xfffffffe
inc esi
cmp dword [ebp - 0x20], 0x17
jge 0x1003534b
mov dword [ebp - 0x30], 0xfb023ed1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003519a
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 3
pop ecx
push 2
xor eax, eax
pop edx
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x30], eax
jl 0x1003533b
mov dword [ebp - 0x24], 0x585b7f37
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jg 0x1003532f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x100351e7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x23c], 0x46cdead9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100351cf
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10035207
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x654], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100351ef
xor eax, eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], esi
jg 0x100352d3
jmp 0x1003521d
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10035233
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3e0], 0xfffffff7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10035222
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x238]
mov eax, dword [ebp + eax*4 - 0x6e8]
test eax, eax
setne cl
cmp edx, ecx
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x24]
cmp eax, 0xfffffffe
jne 0x10035273
mov eax, dword [ebp - 0x238]
cmp dword [ebp + eax*4 - 0x6e8], 0
jne 0x10035273
xor eax, eax
mov edx, eax
jmp 0x10035275
mov edx, esi
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x238]
push 2
setl cl
cmp ecx, 0xe24307a3
mov eax, dword [ebp + eax*4 - 0x6e8]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x238]
setne dl
xor ecx, ecx
cmp edx, eax
pop edx
setge cl
imul eax, ecx, 0x5a12
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x3e0]
inc dword [ebp - 0x238]
cmp dword [ebp - 0x238], esi
jle 0x1003521b
push 3
pop ecx
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x100352fc
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x654], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
sub eax, 5
neg eax
push 0
sbb eax, eax
neg eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x1030], eax
inc dword [ebp - 0x24]
pop eax
push 2
pop edx
cmp dword [ebp - 0x24], esi
jle 0x100351c7
dec dword [ebp - 0x30]
push 2
pop edx
jns 0x100351a6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x17
push 2
pop edx
jl 0x10035176
mov dword [ebp - 0x50], 0xfe0a8eac
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10035379
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x914], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10035361
xor eax, eax
mov dword [ebp - 0x28], 0x10
jmp 0x10035459
mov dword [ebp - 0x30], 0x39924432
mov dword [ebp - 0x4c], 0xf29c8dda
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], eax
jl 0x10035456
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], 0xbb2f
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], eax
jl 0x1003544d
mov dword [ebp - 0x4c], 0xe4f9dbc9
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x914], 0
jne 0x10035448
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10035432
cmp dword [ebp - 0x28], eax
jne 0x10035424
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x38]
jl 0x100353fe
xor eax, eax
cmp dword [ebp - 0x914], eax
je 0x10035400
mov edx, esi
jmp 0x10035402
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x910]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x914]
imul eax, dword [ebp - 0x4c]
test eax, eax
je 0x10035426
mov eax, esi
mov dword [ebp - 0x4c], eax
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x4c], eax
je 0x10035434
mov ecx, esi
push 8
pop eax
sub eax, ecx
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x24]
jns 0x100353b8
push 2
xor eax, eax
pop edx
dec dword [ebp - 0x30]
jns 0x1003539f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1c
jg 0x10035385
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffe5
jle 0x10035494
mov dword [ebp - 0x38], 0x1434a938
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x4c], 0xfffffffb
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe5
jg 0x1003546c
xor eax, eax
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x4c], 4
mov dword [ebp - 0x28], 0x18
jmp 0x100354cc
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100354c9
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
xor eax, eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe2
je 0x100354b2
mov dword [ebp - 0x28], 0x13
cmp dword [ebp - 0x28], 0xfffffff4
jge 0x10035605
jmp 0x100354e7
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x40], 0xffffffef
cmp dword [ebp - 0x40], 0xc
je 0x1003559e
jmp 0x1003550a
xor eax, eax
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x18], eax
jmp 0x10035527
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11cc], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10035516
mov dword [ebp - 0x30], 0x1af7
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ecx
setg dl
imul eax, dword [ebp - 0x30], 0x7975
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x11cc], ecx
mov dword [ebp - 0x24], 5
cmp dword [ebp - 0x24], 0xfffffffb
jg 0x10035591
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035588
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffb
jle 0x10035575
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xc
jne 0x10035508
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, esi
sbb eax, eax
inc eax
cmp eax, 0xffffffff
sbb eax, eax
neg eax
add eax, dword [ebp - 0x30]
jne 0x100355d2
cmp dword [ebp - 0x30], eax
je 0x100355d4
mov eax, esi
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], 0x42b4cf22
jne 0x100355e9
mov edx, esi
cmp dword [ebp - 0x4c], eax
jne 0x100355eb
mov edx, eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
add eax, edx
add ecx, eax
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff4
jl 0x100354e5
mov dword [ebp - 0x38], esi
xor eax, eax
mov dword [ebp - 0x14], 0xa4f833fc
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x48], 0x6cc9ca31
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10035645
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf9c], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10035631
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jg 0x10035667
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xf9c], 0
jne 0x10035665
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x10035650
xor eax, eax
mov dword [ebp - 0x14], 0xffffffe5
cmp dword [ebp - 0x14], 0x1c
je 0x1003571b
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x5b8], edx
mov dword [ebp - 0x5b4], edx
mov dword [ebp - 0x5b0], edx
mov dword [ebp - 0x5ac], edx
mov dword [ebp - 0x48], 0x6f65e790
mov dword [ebp - 0x48], 0xe6a3735b
mov dword [ebp - 0x48], 0x8047d203
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x100356c8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x12e8], 0x76e5b14f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100356b0
xor eax, eax
mov dword [ebp - 0x5b0], 0xffffffeb
cmp dword [ebp - 0x5b0], 0xfffffff6
jge 0x1003570e
mov dword [ebp - 0x4c], 4
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100356f6
call edi
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
xor eax, eax
dec dword [ebp - 0x4c]
inc dword [ebp - 0x5b0]
cmp dword [ebp - 0x5b0], 0xfffffff6
jl 0x100356db
mov edx, dword [ebp - 0x5c]
push 3
pop ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1c
jne 0x1003567b
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], 0xffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10035748
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcc], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10035730
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x100358ab
mov dword [ebp - 0x1c], 0xba339924
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x100358a5
mov dword [ebp - 0x24], 0xab274bf9
mov dword [ebp - 0x24], eax
jmp 0x10035890
mov dword [ebp - 0x50], 0xfffffffb
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], eax
jl 0x1003586c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x100357a5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x39c], 0x315362d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003578d
xor eax, eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], eax
jl 0x1003584c
mov dword [ebp - 0x20], 0x3f17e2f9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x10035840
mov eax, dword [ebp - 0x39c]
mov eax, dword [ebp + eax*4 - 0xcc]
mov eax, dword [ebp - 0x39c]
cmp dword [ebp + eax*4 - 0xcc], 0
je 0x1003580e
mov eax, dword [ebp - 0x39c]
mov eax, dword [ebp + eax*4 - 0xcc]
imul eax, dword [ebp - 0x40]
neg eax
jne 0x100357fb
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x39c]
mov eax, dword [ebp + eax*4 - 0xcc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x39c]
mov ecx, dword [ebp + eax*4 - 0xcc]
imul eax, dword [ebp - 0x30], 0xfffc
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setge dl
mov dword [ebp + eax*4 - 0xcc], edx
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x100357c6
dec dword [ebp - 0x39c]
jns 0x100357b7
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035860
call edi
push eax
call dword [sym.imp.USER32.dll_GetParent]
xor eax, eax
dec dword [ebp - 0x50]
push 3
pop ecx
jns 0x10035785
mov dword [ebp - 0x30], eax
jmp 0x10035885
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035882
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x10035871
inc dword [ebp - 0x24]
push 3
pop ecx
cmp dword [ebp - 0x24], eax
jle 0x10035772
dec dword [ebp - 0x1c]
push 3
pop ecx
jns 0x10035763
inc dword [ebp - 0x40]
push 3
pop ecx
cmp dword [ebp - 0x40], eax
jle 0x10035750
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100358c8
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
xor eax, eax
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x14], esi
push 2
mov dword [ebp - 0x1c], 0xe00f6802
pop ecx
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x18], eax
push 3
pop edx
cmp dword [ebp - 0x18], ecx
jge 0x10035902
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x254], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100358ee
xor eax, eax
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x1003597f
mov dword [ebp - 0x38], 0x50a4ba31
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x254]
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x254]
cmp eax, 2
mov eax, dword [ebp - 0x14]
setne cl
sub ecx, dword [ebp + eax*4 - 0x254]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebp + eax*4 - 0x254]
mov eax, dword [ebp - 0x1c]
dec eax
add eax, ecx
xor ecx, ecx
cmp eax, esi
setg cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x254]
imul ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebp + eax*4 - 0x254]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
dec dword [ebp - 0x14]
jns 0x1003590a
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x44], 0x8c45cdbe
mov dword [ebp - 0x1c], 0xb63e8e1b
mov dword [ebp - 0x4c], 0x33f23e93
mov ecx, dword [ebp - 0x1c]
sub ecx, 0xfff8
neg ecx
push 0xfffffffffffffff6
sbb ecx, ecx
inc ecx
pop eax
sub eax, ecx
xor ecx, ecx
cmp eax, 0x77278fa8
setl cl
xor edx, edx
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffc
cmp ecx, eax
setg dl
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
sub eax, 0xb548
imul eax, dword [ebp - 0x44]
cmp dword [ebp - 0x44], eax
jle 0x100359eb
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10035a09
push eax
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
jmp 0x10035a09
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10035a09
push 0xb96
push 0x33a
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
mov dword [ebp - 0x48], 0x3e469209
mov dword [ebp - 0x24], 0xfeba
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jl 0x10035a48
xor eax, eax
push 3
mov dword [ebp - 0x24], eax
pop ecx
jmp 0x10035a41
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035a3e
push eax
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
push 3
xor eax, eax
pop ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jg 0x10035a29
jmp 0x10035a62
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10035a64
push eax
push eax
push 0x2362
call edi
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10035a84
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xfc], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10035a6c
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035a96
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov dword [ebp - 0xfc], eax
jmp 0x10035abe
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035ab8
push eax
push eax
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
xor eax, eax
inc dword [ebp - 0xfc]
cmp dword [ebp - 0xfc], 9
jne 0x10035a9e
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x48], 0xc4530722
push 2
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x10035afb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x11ec], 0x2eb90da1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10035ae3
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x10035b1a
push 3
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xcd4], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10035b06
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x10035c00
mov ecx, 0xffff
mov dword [ebp - 0x1c], 0x23b1a956
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x48], 0xec7516a2
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], 0xbdd7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x10035b66
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa24], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10035b52
xor eax, eax
dec dword [ebp - 0x4c]
cmp dword [ebp - 0xa20], eax
jne 0x10035c00
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x10035bf7
mov dword [ebp - 0x44], 0x8f92
mov dword [ebp - 0x4c], 0x5f27a412
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x18], eax
jmp 0x10035ba8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5d0], 0x8c9a01c7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10035b97
inc dword [ebp - 0x5d0]
mov eax, dword [ebp - 0x5d0]
je 0x10035bc1
mov eax, dword [ebp - 0xa20]
mov dword [ebp - 0x4c], esi
xor edx, edx
mov ecx, dword [ebp - 0xcd0]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov eax, dword [ebp - 0x44]
setg dl
sub edx, eax
je 0x10035be2
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x10035be4
mov eax, esi
push 0
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x1c]
pop eax
push 2
pop edx
jns 0x10035b7d
mov ecx, 0xffff
dec dword [ebp - 0x20]
jns 0x10035b2b
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x40], 0xaa810d21
mov dword [ebp - 0x4c], 0x283066c9
mov dword [ebp - 0x44], 0x39cb61d2
mov dword [ebp - 0x1c], 0x5613717b
mov dword [ebp - 0x54], 0xb323fa9d
mov dword [ebp - 0x24], esi
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10035c50
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa94], 0xffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10035c38
xor eax, eax
inc dword [ebp - 0xa94]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffeb
je 0x10035d52
jmp 0x10035c68
push 2
pop edx
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x50], 0xfffffffc
mov dword [ebp - 0x38], 0xb6fb96f
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
jmp 0x10035c96
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdbc], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10035c85
dec dword [ebp - 0x1c]
mov ecx, 0xffff
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
inc eax
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
cmp eax, ecx
jb 0x10035cc2
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10035cc4
mov eax, esi
mov dword [ebp - 0x38], eax
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xa94]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov eax, dword [ebp - 0x54]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x30]
imul ecx, dword [ebp - 0x4c]
imul eax, ecx, 0xe83a
test eax, eax
je 0x10035cff
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, 0x7290b1c5
mov eax, dword [ebp - 0x50]
setne cl
xor edx, edx
cmp ecx, eax
push 2
setle dl
xor ecx, ecx
pop eax
sub edx, eax
mov eax, dword [ebp - 0x40]
cmp eax, edx
push 0
setl cl
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xdb8], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffeb
pop eax
jne 0x10035c65
push 3
pop ecx
push 2
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x10035d75
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5d8], 0xfffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10035d5d
xor eax, eax
mov dword [ebp - 0x44], 0xf85024d8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ecx
jge 0x10035d9f
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1ec], 4
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ecx
jl 0x10035d87
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ecx
jge 0x10035dbf
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xb24], 0xa3399244
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ecx
jl 0x10035da7
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ecx
jge 0x10035ddf
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x10e0], 0xc82f744e
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ecx
jl 0x10035dc7
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], esi
jge 0x10035dff
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x438], 0xd1a6
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jl 0x10035de7
xor eax, eax
mov dword [ebp - 0x1ec], eax
jmp 0x10035f72
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x4c], 0x976d9935
mov dword [ebp - 0x44], 0x80254f8d
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], eax
jl 0x10035f6c
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x38], 0xb816e149
cmp dword [ebp - 0x28], eax
jne 0x10035e60
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x28], eax
je 0x10035e60
xor eax, eax
jmp 0x10035e62
mov eax, esi
add eax, 0x453710cc
mov dword [ebp - 0x10d8], eax
mov ecx, dword [ebp - 0x4c]
imul ecx, eax
neg ecx
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x1ec]
mov ecx, dword [ebp - 0x44]
sub ecx, eax
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1ec]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x44]
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setle cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp + eax*4 - 0xb24]
mov eax, dword [ebp - 0x44]
cmp eax, 0xffffffff
setne cl
xor eax, eax
cmp ecx, edx
setg al
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x44], eax
je 0x10035ef0
xor eax, eax
cmp dword [ebp - 0x1ec], eax
jne 0x10035ef9
jmp 0x10035ef2
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x20], eax
je 0x10035efb
mov edx, esi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
push 2
mov eax, dword [ebp + eax*4 - 0xb24]
cmp eax, edx
pop eax
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1e4]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, esi
setg cl
sub eax, ecx
je 0x10035f34
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10035f36
mov ecx, esi
jmp 0x10035f38
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x1e8]
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x1e8]
mov eax, dword [ebp - 0x28]
setge dl
imul ecx, edx
push 0
mov eax, dword [ebp + eax*4 - 0xb24]
add eax, ecx
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x28]
pop eax
jns 0x10035e32
push 2
pop edx
inc dword [ebp - 0x1ec]
cmp dword [ebp - 0x1ec], 0xe
jge 0x10035e0a
inc dword [ebp - 0x438]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10035fa5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc84], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10035f8d
xor eax, eax
mov dword [ebp - 0x4c], eax
or ecx, 0xffffffff
mov dword [ebp - 0x77c], ecx
mov dword [ebp - 0x778], ecx
mov dword [ebp - 0x774], ecx
mov dword [ebp - 0x770], ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x54], 0xfc6088b9
mov dword [ebp - 0x4c], 0x77eb
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], 0xb597857
mov dword [ebp - 0x38], 0x41791e6e
push 0xfffffffffffffff8
pop ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x38], 0x5f4b3f4b
mov dword [ebp - 0x38], 0xcd17cd95
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003600f
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0xfffffffffffffff8
pop ecx
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
sub eax, 5
jne 0x10036049
mov eax, dword [ebp - 0x54]
sub eax, 4
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x778]
mov eax, dword [ebp - 0x770]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], 0xa1fa
mov ecx, dword [ebp - 0x770]
mov eax, dword [ebp - 0x4c]
imul ecx, eax
mov eax, dword [ebp - 0x44]
sub ecx, eax
mov dword [ebp - 0x38], ecx
jne 0x1003606f
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x44], eax
je 0x10036071
mov edx, esi
mov eax, dword [ebp - 0x54]
xor ecx, ecx
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp edx, eax
mov edx, 0xfffa
setne cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xfffffff5
jl 0x100378ff
jmp 0x100360ac
mov dword [ebp - 0x4c], 0x57b1a094
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x100360d6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3b4], 0x2e91a049
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100360be
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x100360f9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9dc], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100360e1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10036120
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x14], 0xfffffff6
cmp dword [ebp - 0x14], 0xa
jge 0x10037a7d
push 2
mov edi, 0xb61d2250
mov ebx, 0x34caa8e5
pop ecx
mov dword [ebp - 0x24], 0xf782a183
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10037959
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xeac], 0xd69f4288
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10037941
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jg 0x10037a67
mov dword [ebp - 0x50], 0xdfe4b283
mov dword [ebp - 0x20], 0x5ee56e31
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10037993
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa
push 0
pop eax
jl 0x1003792b
mov dword [ebp - 0x38], 0xfffffd79
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
push 2
setne dl
xor eax, eax
imul edx, dword [ebp - 0x14]
pop ebx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], 0xd2250db8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10037ac4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2f8], 0x24a8c6a5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10037aac
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10037ae4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1184], 0x8a137b18
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10037acc
mov dword [ebp - 0x2f8], 0xffffffe3
cmp dword [ebp - 0x2f8], 0xc
jg 0x10037b64