Function at 0x1003acfe
Capabilities:
Resume thread
Start service

Disassembly:
mov eax, 0x1007a330
call fcn.10078dd8
sub esp, 0x100
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x1c], ecx
je 0x1003ba6c
push 3
pop edi
mov dword [ebp - 0x10], 0xab27
lea ecx, [ebp - 0xf8]
push edi
call fcn.10028c09
mov dword [ebp + 0x1c], 0x1a35ca42
xor ebx, ebx
mov dword [ebp + 0x1c], 4
mov dword [ebp + 0x1c], ebx
jmp 0x1003ad5f
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0xb9503153
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], edi
jl 0x1003ad4c
mov byte [ebp + 0x1f], bl
cmp byte [ebp + 0x1f], bl
je 0x1003adb9
push 0x1c64
push 0x260c
push 0x1fc0
push 0x7d3
push 0x854
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x2473
push 0x1204
push 0x1d9a
push 0x16ae
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
sub edx, 0x99244325
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, 0x27d2
mov eax, dword [ebp - 0xf8]
setg cl
mov dword [eax + 4], ecx
mov dword [ebp + 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp + 0x1c]
cmp eax, 0xffffffff
setne cl
xor esi, esi
sub ecx, dword [ebp - 0x10]
inc esi
imul ecx, edx
test ecx, ecx
jne 0x1003adff
mov eax, ebx
cmp dword [ebp - 0x10], ebx
je 0x1003ae01
mov eax, esi
mov dword [ebp + 0x1c], eax
lea ecx, [ebp - 0xf8]
call fcn.10028c8b
mov dword [ebp - 0x18], 0xfffffffb
mov ecx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp + 0x1c], 0xfffffff7
mov dword [ebp - 0x24], 0xfffffffd
cmp dword [ebp - 0x18], ebx
cmp dword [ebp - 0x14], ebx
je 0x1003ae34
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18], 0x6c3a
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
je 0x1003ae4a
mov eax, esi
cmp dword [ebp - 0x18], ebx
jne 0x1003ae4c
mov eax, ebx
imul eax, ecx
add eax, dword [ebp - 0x18]
mov dword [ebp + 0x1c], eax
mov dword [ebp - 0x18], 0xffffffeb
jmp 0x1003af94
mov dword [ebp + 0x1c], ebx
jmp 0x1003ae74
mov eax, dword [ebp + 0x1c]
mov dword [ebp + eax*4 - 0x38], 0x6e3e45bb
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], 2
jl 0x1003ae66
mov dword [ebp + 0x1c], esi
cmp dword [ebp + 0x1c], ebx
jl 0x1003aeaf
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1003ae97
mov dword [ebp - 0x2c], 4
dec dword [ebp - 0x10]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1003ae8a
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp + 0x1c]
mov dword [ebp + eax*4 - 0x38], ecx
dec dword [ebp + 0x1c]
jns 0x1003ae82
mov dword [ebp + 0x1c], esi
cmp dword [ebp + 0x1c], ebx
jl 0x1003af91
mov dword [ebp - 0x1c], 7
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x10], esi
push 2
call fcn.10028c09
mov dword [ebp - 0x1c], ebx
jmp 0x1003aee6
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1003aed7
mov eax, dword [ebp + 0x1c]
cmp dword [ebp + eax*4 - 0x38], ebx
je 0x1003af5a
mov eax, dword [ebp + 0x1c]
imul eax, dword [ebp + eax*4 - 0x38], 0xb82
cmp eax, 0x218ad385
jg 0x1003af0e
mov ecx, esi
cmp dword [ebp - 0x24], ebx
jne 0x1003af10
mov ecx, ebx
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp + eax*4 - 0x38]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xec]
xor edx, edx
mov ecx, dword [ebp - 0x34]
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x10]
cmp ecx, eax
lea ecx, [ebp - 0xec]
setle dl
cmp edx, 0x819afca6
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
call fcn.10028c8b
dec dword [ebp + 0x1c]
jns 0x1003aebb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x24
jg 0x1003ae61
push esi
lea ecx, [ebp - 0x4c]
call fcn.10028c09
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0xa4]
mov dword [ebp + 0x1c], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
push esi
call fcn.10028c09
mov dword [ebp + 0x1c], 0x52570e81
mov dword [ebp + 0x1c], 0x9cbc21b0
mov dword [ebp + 0x1c], 0x75761ac7
mov dword [ebp + 0x1c], ebx
jmp 0x1003afee
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x4c]
mov dword [eax + ecx*4], 0x730f94f3
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], esi
jl 0x1003afde
mov dword [ebp + 0x1c], ebx
jmp 0x1003b008
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0xa4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], esi
jl 0x1003aff8
mov eax, dword [ebp - 0x4c]
mov ecx, 0xec2e0cf5
mov dword [eax], ecx
mov dword [ebp + 0x1c], ecx
cmp dword [ebp + 0x1c], ebx
mov edx, dword [ebp - 0x4c]
jne 0x1003b04c
xor ecx, ecx
cmp dword [edx], 0x9b3a
sete cl
sub ecx, 0xa2b82c44
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, dword [edx]
setge al
cmp eax, 0x79cc
jg 0x1003b04c
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0xa4]
xor ecx, ecx
cmp dword [edx], ebx
sete cl
mov dword [eax], ecx
xor eax, eax
cmp dword [edx], ecx
setge al
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp + 0x1c]
sub eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xcb4c23af
mov eax, dword [ebp - 0x4c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp dword [eax], ecx
lea ecx, [ebp - 0xa4]
setg dl
mov dword [ebp + 0x1c], edx
call fcn.10028c8b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.10028c8b
mov dword [ebp + 0x1c], 0x5540d7f8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp + 0x1c], edi
cmp dword [ebp + 0x1c], 0xffffffe8
je 0x1003b104
push 9
pop edi
mov dword [ebp - 0x10], ebx
xor edx, edx
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, esi
setne dl
sub eax, edx
cmp edi, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
dec dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], 0xffffffe8
jne 0x1003b0c6
push 3
pop edi
mov dword [ebp - 0x18], ebx
jmp 0x1003b24e
mov dword [ebp + 0x1c], esi
mov dword [ebp + 0x1c], ebx
jmp 0x1003b122
mov eax, dword [ebp + 0x1c]
mov dword [ebp + eax*4 - 0x78], 0x6695cd1d
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], edi
jl 0x1003b114
mov byte [ebp + 0x1f], bl
cmp byte [ebp + 0x1f], 0
je 0x1003b13d
push ebx
push 0x9b1
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 0x14], edi
jmp 0x1003b241
mov dword [ebp + 0x1c], 0xf0f5ebec
lea ecx, [ebp - 0xbc]
push 4
call fcn.10028c09
mov dword [ebp - 0x1c], ebx
jmp 0x1003b171
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xbc]
mov dword [eax + ecx*4], 0x783de769
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1003b15e
mov eax, dword [ebp + 0x1c]
xor edx, edx
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0xea44
setne al
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp + 0x1c]
cmp dword [ebp - 0x74], ebx
jne 0x1003b1ac
cmp dword [ebp + 0x1c], ebx
je 0x1003b1ae
mov ebx, esi
mov eax, dword [ebp + 0x1c]
xor ecx, ecx
neg ebx
cmp ebx, eax
setle cl
xor edx, edx
mov dword [ebp + 0x1c], ecx
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x78]
add ecx, 0x5371b3ee
cmp eax, ecx
mov eax, dword [ebp - 0x78]
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x78]
setg bl
xor ecx, ecx
cmp ebx, eax
setne cl
sub ecx, 0xa259
je 0x1003b216
xor ebx, ebx
mov byte [ebp + 0x1f], bl
cmp byte [ebp + 0x1f], bl
je 0x1003b233
push 0x2470
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
jmp 0x1003b233
mov dword [ebp - 0x2c], 0xc702b5bd
xor ecx, ecx
mov dword [ebp - 0x2c], 0x5465392f
mov eax, dword [ebp + 0x1c]
cmp eax, esi
setg cl
xor ebx, ebx
mov dword [ebp + 0x1c], ecx
lea ecx, [ebp - 0xbc]
call fcn.10028c8b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
jne 0x1003b145
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 7
jge 0x1003b10c
push 2
lea ecx, [ebp - 0x8c]
call fcn.10028c09
mov dword [ebp + 0x1c], 0xfffffffd
mov dword [ebp + 0x1c], ebx
jmp 0x1003b284
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x8c]
mov dword [eax + ecx*4], 0x6240
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], 2
jl 0x1003b271
mov byte [ebp + 0x1f], bl
cmp byte [ebp + 0x1f], 0
je 0x1003b29a
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp + 0x1c], esi
cmp dword [ebp + 0x1c], ebx
jl 0x1003b2b5
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x8c]
cmp dword [eax + ecx*4], ebx
jne 0x1003b2b5
dec dword [ebp + 0x1c]
jns 0x1003b2a2
lea ecx, [ebp - 0x8c]
call fcn.10028c8b
mov dword [ebp - 0x18], ebx
mov dword [ebp + 0x1c], 0xffffffff
mov dword [ebp + 0x1c], ebx
jmp 0x1003b2dd
mov eax, dword [ebp + 0x1c]
mov dword [ebp + eax*4 - 0x3c], 0xae97
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], esi
jl 0x1003b2cf
mov dword [ebp - 0x18], ebx
jmp 0x1003b2f1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3c], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1003b2e7
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1003b4e3
mov dword [ebp - 0x20], esi
mov dword [ebp + 0x1c], ebx
jmp 0x1003b314
mov eax, dword [ebp + 0x1c]
mov dword [ebp + eax*4 - 0x80], ebx
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], 2
jl 0x1003b30a
mov dword [ebp - 0x20], ebx
jmp 0x1003b4d1
mov dword [ebp - 0x24], 0xfd89d684
mov dword [ebp + 0x1c], ebx
jmp 0x1003b33c
mov eax, dword [ebp + 0x1c]
mov dword [ebp + eax*4 - 0x5c], 0x651328f6
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], 4
jl 0x1003b32e
mov dword [ebp - 0x54], ebx
jmp 0x1003b4c5
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], 0x585fafe4
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1003b4c2
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp + 0x1c], 2
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1003b4a6
mov dword [ebp - 0x1c], 0x7dbf
mov dword [ebp - 0x2c], 0xb506946c
mov dword [ebp + 0x1c], 0x560277ed
mov byte [ebp + 0x1f], bl
cmp byte [ebp + 0x1f], 0
je 0x1003b3a3
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
sub edx, eax
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x80], edx
mov eax, dword [ebp - 0x10]
cmp eax, edx
setle cl
test ecx, ecx
jns 0x1003b3ce
mov edx, esi
cmp dword [ebp - 0x5c], ebx
jne 0x1003b3d0
mov edx, ebx
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp + 0x1c], ecx
cmp dword [ebp + 0x1c], 0xabf8
je 0x1003b3ed
mov edx, ebx
cmp dword [ebp - 0x10], ebx
je 0x1003b3ef
mov edx, esi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x3c]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp + eax*4 - 0x3c]
add edx, dword [ebp - 0x14]
jne 0x1003b433
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, 0xf407293c
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
imul eax, ecx, 0x67a9
test eax, eax
jne 0x1003b463
cmp dword [ebp - 0x2c], ebx
je 0x1003b46a
mov eax, esi
cmp dword [ebp - 0x7c], ebx
jne 0x1003b46c
mov eax, ebx
mov dword [ebp + 0x1c], eax
cmp dword [ebp + 0x1c], ebx
je 0x1003b47b
mov edx, esi
cmp dword [ebp - 0x28], ebx
jne 0x1003b47d
mov edx, ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x5c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
mov eax, dword [ebp + eax*4 - 0x3c]
add eax, edx
mov dword [ebp + 0x1c], eax
dec dword [ebp - 0x28]
jns 0x1003b37e
mov dword [ebp + 0x1c], ebx
cmp dword [ebp + 0x1c], ebx
jl 0x1003b4b9
mov dword [ebp - 0x1c], edi
dec dword [ebp - 0x1c]
dec dword [ebp + 0x1c]
jns 0x1003b4ae
dec dword [ebp - 0x14]
jns 0x1003b364
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], ebx
jle 0x1003b34a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1003b322
dec dword [ebp - 0x18]
jns 0x1003b302
push 2
mov dword [ebp + 0x1c], 0xffffffff
mov dword [ebp + 0x1c], ebx
pop ecx
jmp 0x1003b503
mov eax, dword [ebp + 0x1c]
mov dword [ebp + eax*4 - 0x100], 0x26bdde0b
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], ecx
jl 0x1003b4f2
mov dword [ebp + 0x1c], ebx
jmp 0x1003b51a
mov eax, dword [ebp + 0x1c]
mov dword [ebp + eax*4 - 0x100], ebx
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], ecx
jl 0x1003b50d
mov dword [ebp + 0x1c], 0xffffffff
mov dword [ebp + 0x1c], 0x8adae8c9
mov dword [ebp - 0x10], 0xfffffff9
mov dword [ebp - 0x10], 0x87e3bc4a
push ecx
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0x10], 0xc1031c36
call fcn.10028c09
mov dword [ebp - 0x14], ebx
jmp 0x1003b56b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x10c], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003b55a
mov dword [ebp - 0x14], ebx
jmp 0x1003b588
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc8]
mov dword [eax + ecx*4], 0x9ed7d413
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003b575
mov eax, dword [ebp + 0x1c]
xor ecx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + 0x1c]
cmp eax, 0x3524
mov eax, dword [ebp + 0x1c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x104]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x104], ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
sub eax, 0x5b36
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x1c]
cmp eax, ecx
mov eax, dword [ebp + 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp + 0x1c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp + 0x1c]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp + 0x1c]
setge cl
xor edx, edx
cmp ecx, eax
lea ecx, [ebp - 0xc8]
setle dl
sub edx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc8]
mov dword [eax + 4], edx
call fcn.10028c8b
mov dword [ebp + 0x1c], 0xfffffffe
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0x1c], 0xfff6
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x28], 0x8ef34ea8
mov dword [ebp - 0x14], 7
push esi
call fcn.10028c09
mov dword [ebp + 0x1c], ebx
jmp 0x1003b670
mov eax, dword [ebp + 0x1c]
mov dword [ebp + eax*4 - 0x30], 0x4a6847df
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], esi
jl 0x1003b662
mov dword [ebp + 0x1c], ebx
jmp 0x1003b68d
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0xd4]
mov dword [eax + ecx*4], 0x4ad4db1d
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], esi
jl 0x1003b67a
mov dword [ebp + 0x1c], ebx
push 5
pop eax
cmp dword [ebp + 0x1c], ebx
jg 0x1003b6fa
push 9
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x2c], 0xb9503153
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jl 0x1003b6f2
mov eax, dword [ebp + 0x1c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setl dl
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp + 0x1c]
mov dword [ebp + eax*4 - 0x30], ecx
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x10]
jns 0x1003b6bc
push 5
pop eax
push 9
pop ecx
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], ebx
jle 0x1003b6a0
cmp dword [ebp - 0x30], ebx
je 0x1003b73a
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp dword [ebp + 0x1c], eax
jg 0x1003b72c
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp eax, 0xfffffffa
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, ebx
setge cl
mov dword [ebp + 0x1c], ecx
cmp dword [ebp + 0x1c], ebx
je 0x1003b72e
mov eax, esi
add eax, 0xef90
cmp eax, dword [ebp - 0x24]
mov eax, esi
jl 0x1003b73c
mov eax, ebx
add eax, 9
neg eax
sbb eax, eax
neg eax
neg eax
mov dword [ebp - 0x30], eax
cmp eax, esi
ja 0x1003b751
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
lea ecx, [ebp - 0xd4]
call fcn.10028c8b
push 2
lea ecx, [ebp - 0x98]
call fcn.10028c09
push 2
mov dword [ebp - 0x20], 0xa66fe7d8
mov dword [ebp + 0x1c], ebx
pop edx
jmp 0x1003b798
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x98]
mov dword [eax + ecx*4], edx
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], edx
jl 0x1003b789
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], ebx
jl 0x1003b7dc
mov byte [ebp + 0x1f], bl
cmp byte [ebp + 0x1f], 0
je 0x1003b7c5
push 0xcd
push 0xfff
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x98]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [ebp - 0x20]
jns 0x1003b7a5
lea ecx, [ebp - 0x98]
call fcn.10028c8b
mov dword [ebp - 0x28], 0xa6de
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x18], 7
mov dword [ebp + 0x1c], 0x9e885dc1
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x14], esi
push 4
call fcn.10028c09
mov dword [ebp - 0x1c], ebx
jmp 0x1003b835
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xb0]
mov dword [eax + ecx*4], 0x15db4c2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1003b822
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x1c]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x18]
cmp eax, 0xa37b187b
jae 0x1003b882
mov ecx, esi
cmp dword [ebp + 0x1c], ebx
jne 0x1003b884
mov ecx, ebx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov dword [ebp + 0x1c], ecx
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ebx
jne 0x1003b8b8
mov ecx, ebx
cmp dword [ebp - 0x10], ebx
je 0x1003b8ba
mov ecx, esi
mov eax, dword [ebp - 0x24]
sub ecx, eax
je 0x1003b8d0
mov dword [ebp + 0x1c], 0x7e12fd89
mov dword [ebp + 0x1c], ebx
jmp 0x1003b9aa
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x10], 0x4cde8b73
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp eax, esi
push 5
setg cl
sub ecx, 0xec499e98
neg ecx
pop eax
sbb ecx, ecx
inc ecx
cmp eax, ecx
sbb eax, eax
inc eax
add eax, dword [ebp - 0x14]
jns 0x1003b910
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, 0xfe21
setne cl
sub ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x28]
imul eax, ecx, 0xfffffff9
xor ecx, ecx
cmp ecx, eax
mov ecx, 0xbc1f9c85
sbb eax, eax
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
sub edx, eax
mov dword [ebp - 0x10], edx
cmp dword [ebp + 0x1c], 0xffff
jae 0x1003b95c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp dword [ebp + 0x1c], ebx
jne 0x1003b983
mov ecx, ebx
cmp dword [ebp - 0x10], ebx
je 0x1003b985
mov ecx, esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
imul eax, dword [ebp - 0x14], 0xb150
cmp eax, ecx
jl 0x1003b99d
cmp dword [ebp + 0x1c], ebx
jne 0x1003b99d
mov esi, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp esi, eax
setge cl
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], ebx
jl 0x1003b9d4
mov dword [ebp - 0x18], ebx
jmp 0x1003b9ca
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb0]
mov dword [eax + ecx*4], 0xf7f2bfcf
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x1003b9b7
dec dword [ebp - 0x14]
jns 0x1003b9b2
lea ecx, [ebp - 0xb0]
call fcn.10028c8b
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x20]
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [ecx], eax
cmp dword [ecx], ebx
jne 0x1003ba1c
mov eax, dword [esi]
xor ecx, ecx
mov edx, dword [eax]
cmp edx, 0x9b3a
sete cl
sub ecx, 0xa2b82c44
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setge al
cmp eax, 0x79cc
jg 0x1003ba1c
mov eax, dword [edi]
mov eax, dword [esi]
xor edx, edx
mov ecx, dword [ebp + 0x10]
cmp dword [eax], ebx
mov eax, dword [ecx]
sete dl
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ecx]
mov eax, dword [esi]
mov eax, dword [eax]
cmp eax, dword [ecx]
mov eax, dword [ebp + 8]
setge dl
mov dword [eax], edx
mov eax, dword [eax]
mov edx, dword [ebp - 0x40]
mov dword [edx], eax
mov ecx, dword [edi]
mov eax, dword [edx]
xor edx, edx
cmp eax, ecx
mov eax, dword [esi]
sete dl
cmp edx, 0xcb4c23af
sbb ecx, ecx
xor edx, edx
inc ecx
cmp dword [eax], ecx
mov eax, dword [ebp + 0x18]
setg dl
mov dword [eax], edx
jmp 0x1003bb81
mov eax, 0xa5d6c05b
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x6c], eax
xor esi, esi
mov dword [ebp - 0x68], eax
inc esi
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x10], 0x7eede0b4
push esi
call fcn.10028c09
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp + 0x1c], ebx
jmp 0x1003baac
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], ebx
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], esi
jl 0x1003ba9d
push 3
pop edi
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], ebx
jl 0x1003bb57
mov dword [ebp + 0x1c], 0xc891c553
mov dword [ebp - 0x24], 0xe491ba6b
mov dword [ebp + 0x1c], ebx
jmp 0x1003bb49
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp + 0x1c]
cmp dword [ebp + eax*4 - 0x6c], 0xa1e1c5a3
ja 0x1003baef
cmp dword [ebp + 0x1c], ebx
je 0x1003bafa
mov eax, dword [ebp + 0x1c]
mov edx, esi
cmp dword [ebp + eax*4 - 0x6c], ebx
jne 0x1003bafc
mov edx, ebx
mov eax, dword [ebp - 0xe0]
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp + 0x1c]
setne cl
cmp esi, ecx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], ebx
jne 0x1003bb27
mov eax, ebx
cmp dword [ebp - 0x40], ebx
je 0x1003bb29
mov eax, esi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], ebx
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], edi
jle 0x1003bad3
dec dword [ebp - 0x10]
jns 0x1003bac0
mov byte [ebp + 0x1f], bl
cmp byte [ebp + 0x1f], bl
je 0x1003bb71
push 0x2470
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
lea ecx, [ebp - 0xe0]
call fcn.10028c8b
mov eax, dword [ebp - 0x1c]
dec dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret