Function at 0x10035a8e
Capabilities:
Accept command line arguments
Allocate thread local storage
Create pipe
Delete file
Get graphical window text
Get thread local storage value
Parse pe header
Query environment variable
Set thread local storage value
Terminate process

Disassembly:
mov eax, 0x1008f6aa
call fcn.1008ddf8
mov eax, 0x15b4
call fcn.10076f60
push ebx
push esi
push edi
mov edi, 0x6fe6d39c
mov byte [ebp - 0x55], dl
xor eax, eax
mov dword [ebp - 0x18], edi
push 3
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x10], eax
pop esi
jmp 0x10035ace
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x294], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10035abd
mov eax, dword [ebp - 0x28c]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x294]
mov eax, dword [ebp - 0x28c]
cmp eax, ecx
mov eax, dword [ebp - 0x294]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
push 2
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x290]
mov ecx, dword [ebp - 0x28c]
setne dl
imul edx, eax
mov eax, dword [ebp - 0x294]
pop ebx
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, 0x6e87
setg dl
xor ecx, ecx
cmp edx, 0x8064
setg cl
sub eax, ecx
mov ecx, 0xfff9
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x4d
setle cl
xor eax, eax
mov dword [ebp - 0x28c], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x10035b86
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x294], 0
jne 0x10035b84
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x294]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x294], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10035b5b
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], eax
jmp 0x10035b9f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2a4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10035b8e
mov eax, dword [ebp - 0x29c]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2a4]
mov eax, dword [ebp - 0x29c]
cmp eax, ecx
mov eax, dword [ebp - 0x2a4]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [ebp - 0x29c]
setne dl
imul edx, eax
mov eax, dword [ebp - 0x2a4]
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, 0x6e87
setg dl
xor ecx, ecx
cmp edx, 0x8064
setg cl
sub eax, ecx
mov ecx, 0xfff9
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x4d
setle cl
xor eax, eax
mov dword [ebp - 0x29c], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x10035c54
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x2a4], 0
jne 0x10035c52
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x2a4]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2a4], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10035c29
xor eax, eax
mov dword [ebp - 0x10], 0xd6c05baf
or edx, 0xffffffff
mov dword [ebp - 0x4c], 0x4c8d3c89
mov dword [ebp - 0x34], edx
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10035c83
push eax
push eax
push 0x122d
call dword [sym.imp.ADVAPI32.dll_CopySid]
xor eax, eax
or edx, 0xffffffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x15
jg 0x10035cae
xor eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x4c], 0x8c66
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x15
jle 0x10035c8c
xor eax, eax
mov dword [ebp - 0x38], edi
mov ecx, 0x4a87fce6
mov dword [ebp - 0x20], 0x20452a26
push 9
pop esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x10], 0x3bfa32a1
mov dword [ebp - 0x80c], ecx
mov dword [ebp - 0x808], ecx
mov dword [ebp - 0x804], ecx
mov dword [ebp - 0x800], ecx
mov dword [ebp - 0x34], 0x3f29c8dd
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x10], eax
jmp 0x10035cff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x68], edx
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10035cf5
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x20]
sub ecx, eax
cmp dword [ebp - 0x68], ecx
jge 0x10035d29
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x20], eax
jge 0x10035d29
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10035d2c
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x68], eax
je 0x10035d41
cmp dword [ebp - 0x20], eax
jne 0x10035d4a
cmp dword [ebp - 0x24], eax
jne 0x10035d4a
mov ecx, eax
jmp 0x10035d4f
xor eax, eax
lea ecx, [eax + 1]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
cmp ecx, 0xa4c
setle al
mov dword [ebp - 0x80c], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x804]
sub ecx, eax
mov eax, dword [ebp - 0x10]
add eax, ecx
je 0x10035d8f
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10035def
inc eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
jmp 0x10035def
xor eax, eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
neg edx
push 0xfffffffffffffffc
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x80c]
setle cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
pop eax
setne dl
sub edx, eax
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x4c], 0xb1d70f3f
push ebx
lea ecx, [ebp - 0x198]
call fcn.1001a25e
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10035e23
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd4], 0x3342eb9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10035e0b
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10035e39
push dword [ebp - 0x18]
call fcn.1001a2cf
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x198]
cmp dword [ebp - 0x18], ebx
jl 0x10035e28
xor eax, eax
inc eax
push eax
call fcn.1001a2cf
xor esi, esi
inc esi
mov dword [eax], esi
jmp 0x10036063
or eax, 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x44], eax
inc ebx
xor eax, eax
mov dword [ebp - 0x2c], 0xb0b4ef66
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ebx
jg 0x10035f34
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0xd4], 0
je 0x10035eee
xor eax, eax
lea ecx, [ebp - 0x198]
inc eax
push eax
call fcn.1001a2cf
lea ecx, [ebp - 0x198]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xd4]
xor eax, eax
inc eax
push eax
call fcn.1001a2cf
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xd4]
cmp eax, 0xc218
setg cl
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp eax, 0xfffffffd
setle cl
sub ecx, 0x8558
neg ecx
sbb ecx, ecx
add ecx, 0xcce3a785
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x10035eee
xor eax, eax
inc eax
mov esi, eax
jmp 0x10035ef3
xor eax, eax
mov esi, eax
inc eax
push eax
lea ecx, [ebp - 0x198]
call fcn.1001a2cf
mov eax, dword [eax]
mov ecx, dword [ebp + eax*4 - 0xd4]
xor eax, eax
cmp esi, 0xb89b
setg al
imul ecx, eax
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xd4], ecx
xor eax, eax
inc dword [ebp - 0x44]
inc eax
cmp dword [ebp - 0x44], eax
jle 0x10035e75
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], eax
jl 0x10036052
mov dword [ebp - 0x34], 0xf7c295a5
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10035f66
push eax
push 0x256e
push 0x2362
call edi
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
xor eax, eax
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x10036049
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xd44f
mov dword [ebp - 0x3c], 0x41b0ce7a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jg 0x10036040
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0xd4]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10035fa3
mov eax, dword [ebp - 0x20]
xor eax, eax
lea ecx, [ebp - 0x198]
inc eax
push eax
call fcn.1001a2cf
mov ecx, dword [ebp - 0x2c]
mov esi, eax
xor eax, eax
mov edx, dword [ebp + ecx*4 - 0xd4]
mov ecx, dword [ebp - 0x20]
cmp ecx, edx
mov ecx, dword [ebp - 0x2c]
setne al
sub eax, dword [ebp + ecx*4 - 0xd4]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esi]
jl 0x1003600e
xor eax, eax
mov dword [ebp - 0x20], eax
inc eax
cmp dword [ebp - 0x20], eax
jg 0x10036028
push eax
lea ecx, [ebp - 0x198]
call fcn.1001a2cf
mov ecx, dword [ebp - 0x34]
sub ecx, 4
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0xd4], ecx
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jle 0x10035fe6
jmp 0x10036025
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10036025
push 0xc25
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
inc eax
mov dword [ebp - 0x3c], 0xa7221ebc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x10035f8f
xor ebx, ebx
xor eax, eax
inc ebx
dec dword [ebp - 0x2c]
jns 0x10035f72
dec dword [ebp - 0x44]
jns 0x10035f40
xor eax, eax
lea ecx, [ebp - 0x198]
inc eax
push eax
call fcn.1001a2cf
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x198]
inc eax
push eax
call fcn.1001a2cf
cmp dword [eax], 0
jge 0x10035e57
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
jl 0x100360b3
push dword [ebp - 0x20]
lea ecx, [ebp - 0x198]
call fcn.1001a2cf
push dword [ebp - 0x20]
xor ebx, ebx
lea ecx, [ebp - 0x198]
cmp dword [eax], 5
sete bl
call fcn.1001a2cf
mov dword [eax], ebx
dec dword [ebp - 0x20]
jns 0x10036088
or esi, 0xffffffff
lea ecx, [ebp - 0x198]
mov dword [ebp - 4], esi
call fcn.1001a2ca
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100360dc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2b4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100360cb
mov eax, dword [ebp - 0x2ac]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x2b4]
mov eax, dword [ebp - 0x2ac]
cmp eax, ecx
mov eax, dword [ebp - 0x2b4]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
push 2
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2b0]
mov ecx, dword [ebp - 0x2ac]
setne dl
imul edx, eax
mov eax, dword [ebp - 0x2b4]
pop ebx
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, 0x6e87
setg dl
xor ecx, ecx
cmp edx, 0x8064
setg cl
sub eax, ecx
mov ecx, 0xfff9
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x4d
setle cl
xor eax, eax
mov dword [ebp - 0x2ac], ecx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jg 0x100363e0
push 4
pop eax
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x75c]
mov dword [ebp - 0x10], 0x1fc80ae7
push eax
call fcn.1001a25e
xor eax, eax
lea ecx, [ebp - 0xa68]
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], 0x8d2ca8e1
push ebx
call fcn.1001a25e
xor eax, eax
mov byte [ebp - 4], bl
xor esi, esi
mov dword [ebp - 0x1c], eax
inc esi
cmp dword [ebp - 0x1c], esi
jge 0x100361cb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x114], 0x32384b6d
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x100361b0
xor eax, eax
push 4
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jge 0x100361f4
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x75c]
call fcn.1001a2cf
mov dword [eax], 0xcdab0b82
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100361d6
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003621a
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa68]
call fcn.1001a2cf
mov dword [eax], 0xb5ad8edc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100361fc
xor eax, eax
mov dword [ebp - 0x18], 0xffffffea
cmp dword [ebp - 0x18], 0x1a
jge 0x1003632d
jmp 0x1003622f
xor eax, eax
mov dword [ebp - 0x48], 0xf0a290be
mov dword [ebp - 0x24], 0xa22e974a
mov dword [ebp - 0x4c], 0x889e
mov dword [ebp - 0x40], 0x94ad8a0f
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x10], eax
jmp 0x10036264
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf20], 0x94fb389f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10036253
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
add edx, 6
cmp edx, eax
setg cl
xor eax, eax
cmp dword [ebp - 0x18], ecx
jg 0x1003628b
cmp dword [ebp - 0x18], eax
je 0x10036293
cmp dword [ebp - 0x18], eax
je 0x10036293
xor eax, eax
inc eax
cmp eax, dword [ebp - 0x4c]
jge 0x100362a2
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100362a2
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x75c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
neg eax
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x114]
push 3
call fcn.1001a2cf
mov dword [eax], esi
test esi, esi
je 0x100362d6
push 3
lea ecx, [ebp - 0x75c]
call fcn.1001a2cf
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
jne 0x100362ed
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x100362ef
inc eax
jmp 0x100362ef
xor eax, eax
cmp eax, dword [ebp - 0xf1c]
je 0x10036302
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10036302
mov ecx, eax
jmp 0x10036307
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x18]
sub ecx, eax
add ecx, dword [ebp - 0x34]
xor eax, eax
cmp ecx, 0x59458d81
push 4
setg al
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1a
pop esi
jl 0x1003622d
mov eax, dword [ebp - 0x28]
mov ecx, 0xb34d7aeb
cmp ecx, eax
lea ecx, [ebp - 0x75c]
push ebx
sbb esi, esi
inc esi
call fcn.1001a2cf
lea ecx, [ebp - 0xa68]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.1001a2cf
mov ecx, dword [ebp - 0x114]
xor edx, edx
imul ecx, esi
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
or eax, 0xffffffff
add ecx, 6
cmp eax, ecx
mov ecx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x114]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
lea ecx, [ebp - 0xa68]
setg dl
imul esi, edx
mov dword [ebp - 0x28], esi
call fcn.1001a2ca
or esi, 0xffffffff
lea ecx, [ebp - 0x75c]
mov dword [ebp - 4], esi
call fcn.1001a2ca
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x2b4], 0
jne 0x100363de
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp + eax*4 - 0x2b4]
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x2b4], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x1003616e
xor eax, eax
mov dword [ebp - 0x10], 0xd6c05baf
mov dword [ebp - 0x4c], 0x4c8d3c89
mov dword [ebp - 0x34], esi
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10036409
push eax
push eax
push 0x122d
call dword [sym.imp.ADVAPI32.dll_CopySid]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x15
jg 0x10036434
xor eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x4c], 0x8c66
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x15
jle 0x10036412
xor eax, eax
mov dword [ebp - 0x20], 0x20452a26
mov ecx, 0x4a87fce6
mov dword [ebp - 0x24], 9
mov dword [ebp - 0x10], 0x3bfa32a1
mov dword [ebp - 0x7ec], ecx
mov dword [ebp - 0x7e8], ecx
mov dword [ebp - 0x7e4], ecx
mov dword [ebp - 0x7e0], ecx
mov dword [ebp - 0x34], 0x3f29c8dd
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x10], eax
jmp 0x10036483
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x78], esi
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10036479
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x20]
sub ecx, eax
cmp dword [ebp - 0x78], ecx
jge 0x100364ad
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x20], eax
jge 0x100364ad
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100364b0
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x78], eax
je 0x100364c5
cmp dword [ebp - 0x20], eax
jne 0x100364ce
cmp dword [ebp - 0x24], eax
jne 0x100364ce
mov ecx, eax
jmp 0x100364d3
xor eax, eax
lea ecx, [eax + 1]
xor eax, eax
cmp ecx, 0xa4c
setle al
mov dword [ebp - 0x7ec], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x7e4]
sub ecx, eax
mov eax, dword [ebp - 0x10]
add eax, ecx
je 0x1003650d
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1003656d
inc eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
jmp 0x1003656d
xor eax, eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
neg edx
push 0xfffffffffffffffc
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x7ec]
setle cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
pop eax
setne dl
sub edx, eax
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x4c], 0xb1d70f3f
mov dword [ebp - 0x38], 0x6fe6d39c
lea ecx, [ebp - 0x204]
push ebx
call fcn.1001a25e
mov dword [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100365b0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14c], 0x3342eb9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10036598
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100365c6
push dword [ebp - 0x18]
call fcn.1001a2cf
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x204]
cmp dword [ebp - 0x18], ebx
jl 0x100365b5
xor eax, eax
inc eax
push eax
call fcn.1001a2cf
xor esi, esi
lea ecx, [ebp - 0x204]
inc esi
mov dword [eax], esi
xor eax, eax
inc eax
push eax
call fcn.1001a2cf
xor ebx, ebx
inc ebx
cmp dword [eax], 0
jl 0x10036811
or eax, 0xffffffff
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x2c], 0xb0b4ef66
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ebx
jg 0x100366d4
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x14c], 0
je 0x1003668e
xor eax, eax
lea ecx, [ebp - 0x204]
inc eax
push eax
call fcn.1001a2cf
lea ecx, [ebp - 0x204]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x14c]
xor eax, eax
inc eax
push eax
call fcn.1001a2cf
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x14c]
cmp eax, 0xc218
setg cl
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp eax, 0xfffffffd
setle cl
sub ecx, 0x8558
neg ecx
sbb ecx, ecx
add ecx, 0xcce3a785
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x1003668e
xor eax, eax
inc eax
mov esi, eax
jmp 0x10036693
xor eax, eax
mov esi, eax
inc eax
push eax
lea ecx, [ebp - 0x204]
call fcn.1001a2cf
mov eax, dword [eax]
mov ecx, dword [ebp + eax*4 - 0x14c]
xor eax, eax
cmp esi, 0xb89b
setg al
imul ecx, eax
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x14c], ecx
xor eax, eax
inc dword [ebp - 0x44]
inc eax
cmp dword [ebp - 0x44], eax
jle 0x10036615
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], eax
jl 0x100367f2
mov dword [ebp - 0x34], 0xf7c295a5
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10036706
push eax
push 0x256e
push 0x2362
call edi
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
xor eax, eax
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x100367e9
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xd44f
mov dword [ebp - 0x3c], 0x41b0ce7a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jg 0x100367e0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x14c]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10036743
mov eax, dword [ebp - 0x20]
xor eax, eax
lea ecx, [ebp - 0x204]
inc eax
push eax
call fcn.1001a2cf
mov ecx, dword [ebp - 0x2c]
mov esi, eax
xor eax, eax
mov edx, dword [ebp + ecx*4 - 0x14c]
mov ecx, dword [ebp - 0x20]
cmp ecx, edx
mov ecx, dword [ebp - 0x2c]
setne al
sub eax, dword [ebp + ecx*4 - 0x14c]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esi]
jl 0x100367ae
xor eax, eax
mov dword [ebp - 0x20], eax
inc eax
cmp dword [ebp - 0x20], eax
jg 0x100367c8
push eax
lea ecx, [ebp - 0x204]
call fcn.1001a2cf
mov ecx, dword [ebp - 0x34]
sub ecx, 4
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x14c], ecx
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jle 0x10036786
jmp 0x100367c5
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100367c5
push 0xc25
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
inc eax
mov dword [ebp - 0x3c], 0xa7221ebc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x1003672f
xor ebx, ebx
xor eax, eax
inc ebx
dec dword [ebp - 0x2c]
jns 0x10036712
dec dword [ebp - 0x44]
jns 0x100366e0
push ebx
lea ecx, [ebp - 0x204]
call fcn.1001a2cf
push ebx
lea ecx, [ebp - 0x204]
dec dword [eax]
call fcn.1001a2cf
jmp 0x100365f1
mov dword [ebp - 0x20], ebx
xor eax, eax
cmp dword [ebp - 0x20], eax
jl 0x10036849
push dword [ebp - 0x20]
lea ecx, [ebp - 0x204]
call fcn.1001a2cf
push dword [ebp - 0x20]
xor ebx, ebx
lea ecx, [ebp - 0x204]
cmp dword [eax], 5
sete bl
call fcn.1001a2cf
mov dword [eax], ebx
dec dword [ebp - 0x20]
jns 0x1003681b
xor ebx, ebx
inc ebx
or esi, 0xffffffff
lea ecx, [ebp - 0x204]
mov dword [ebp - 4], esi
call fcn.1001a2ca
push 4
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x694]
pop esi
mov dword [ebp - 0x10], 0x1fc80ae7
push esi
call fcn.1001a25e
push 2
mov dword [ebp - 4], esi
lea ecx, [ebp - 0xbb8]
pop esi
mov dword [ebp - 0x28], 0x8d2ca8e1
push esi
call fcn.1001a25e
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100368b8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf0], 0x32384b6d
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1003689a
xor ebx, ebx
xor eax, eax
inc ebx
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x100368e6
push ecx
pop ebx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x694]
call fcn.1001a2cf
mov dword [eax], 0xcdab0b82
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100368c5
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1003690c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbb8]
call fcn.1001a2cf
mov dword [eax], 0xb5ad8edc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100368ee
xor eax, eax
mov dword [ebp - 0x18], 0xffffffea
cmp dword [ebp - 0x18], 0x1a
jge 0x10036a25
jmp 0x10036921
xor eax, eax
mov dword [ebp - 0x48], 0xf0a290be
mov dword [ebp - 0x24], 0xa22e974a
mov dword [ebp - 0x4c], 0x889e
push 4
mov dword [ebp - 0x40], 0x94ad8a0f
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x10], eax
jmp 0x10036959
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe20], 0x94fb389f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10036948
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
add edx, 6
cmp edx, eax
setg cl
xor eax, eax
cmp dword [ebp - 0x18], ecx
jg 0x10036980
cmp dword [ebp - 0x18], eax
je 0x10036987
cmp dword [ebp - 0x18], eax
je 0x10036987
mov eax, ebx
cmp eax, dword [ebp - 0x4c]
jge 0x10036996
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10036996
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x694]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
neg eax
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0xf0]
push 3
call fcn.1001a2cf
mov dword [eax], esi
test esi, esi
je 0x100369ca
push 3
lea ecx, [ebp - 0x694]
call fcn.1001a2cf
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
jne 0x100369e2
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x100369e4
mov eax, ebx
jmp 0x100369e4
xor eax, eax
cmp eax, dword [ebp - 0xe1c]
je 0x100369f7
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100369f7
mov ecx, eax
jmp 0x100369fc
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x18]
sub ecx, eax
add ecx, dword [ebp - 0x34]
xor eax, eax
cmp ecx, 0x59458d81
push 1
setg al
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1a
pop ebx
push 2
pop esi
jl 0x1003691f
mov eax, dword [ebp - 0x28]
mov ecx, 0xb34d7aeb
cmp ecx, eax
lea ecx, [ebp - 0x694]
push 2
pop ebx
sbb esi, esi
push ebx
inc esi
call fcn.1001a2cf
lea ecx, [ebp - 0xbb8]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.1001a2cf
mov ecx, dword [ebp - 0xf0]
xor edx, edx
imul ecx, esi
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
or eax, 0xffffffff
add ecx, 6
cmp eax, ecx
mov ecx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf0]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
lea ecx, [ebp - 0xbb8]
setg dl
imul esi, edx
mov dword [ebp - 0x28], esi
call fcn.1001a2ca
or esi, 0xffffffff
lea ecx, [ebp - 0x694]
mov dword [ebp - 4], esi
call fcn.1001a2ca
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10036ad0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2c4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10036ab7
xor eax, eax
mov dword [ebp - 0x18], 0x19d29be1
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x2c], 0x2c78ef8a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10036b01
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x218], 0x8261
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10036ae9
xor eax, eax
push 4
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10036b24
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x150c], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10036b0c
xor eax, eax
xor esi, esi
mov dword [ebp - 0x18], eax
inc esi
cmp dword [ebp - 0x18], esi
jg 0x10036c80
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x44], 0x9ba87a5e
mov eax, dword [ebp - 0x18]
sub eax, 0xf3ccd246
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x20]
imul eax, eax, 0x5245
add eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x218]
jle 0x10036b71
xor eax, eax
cmp dword [ebp - 0x214], eax
jne 0x10036b71
mov ecx, eax
jmp 0x10036b76
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x214]
xor edx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x44], edx
inc ecx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], eax
jl 0x10036c6f
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x10036c66
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x4c], 0x27db4043
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jl 0x10036bee
xor eax, eax
inc eax
mov dword [ebp - 0x150c], eax
dec dword [ebp - 0x2c]
jns 0x10036be3
mov eax, dword [ebp - 0x44]
xor edx, edx
cmp eax, 0xa4ef
mov eax, dword [ebp - 0x44]
push 0
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x218]
cmp edx, eax
mov eax, 0x46d7
setle cl
xor edx, edx
sub eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setge dl
mov dword [ebp - 0x4c], edx
xor edx, edx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setg dl
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x218]
imul eax, dword [ebp - 0x4c]
neg eax
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x20]
pop eax
push 1
pop ecx
jns 0x10036bca
dec dword [ebp - 0x44]
jns 0x10036bbe
inc dword [ebp - 0x18]
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jle 0x10036b33
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10036c9c
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x2bc]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x2c4]
mov eax, dword [ebp - 0x2bc]
cmp eax, ecx
mov eax, dword [ebp - 0x2c4]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c0]
mov ecx, dword [ebp - 0x2bc]
setne dl
imul edx, eax
mov eax, dword [ebp - 0x2c4]
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, 0x6e87
setg dl
xor ecx, ecx
cmp edx, 0x8064
setg cl
sub eax, ecx
mov ecx, 0xfff9
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x4d
setle cl
mov dword [ebp - 0x2bc], ecx
mov dword [ebp - 0x18], 0x7571177e
mov dword [ebp - 0x4c], 0x231fbf68
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x24], 0x3388a019
mov dword [ebp - 0x18], 0x10
jmp 0x10036de2
mov dword [ebp - 0x10], 0x8f6efba1
mov dword [ebp - 0x4c], 0x6b7a7bc6
mov dword [ebp - 0x34], 0x7507
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10036d73
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 5
setne cl
xor eax, eax
lea esi, [eax + 1]
add ecx, dword [ebp - 0x18]
jne 0x10036d75
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, esi
setg al
xor edx, edx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setge dl
xor ebx, ebx
imul edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp edx, 0x89f7
setl bl
xor ecx, ecx
cmp ebx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg bl
xor ecx, ecx
cmp ebx, eax
setle cl
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe7
jle 0x10036d3f
xor eax, eax
xor ebx, ebx
push 2
mov dword [ebp - 0x38], eax
inc ebx
pop esi
cmp dword [ebp - 0x38], esi
jg 0x100370b5
jmp 0x10036e04
xor eax, eax
mov dword [ebp - 0x34], 0xfffffff9
lea ecx, [ebp - 0xa80]
mov dword [ebp - 0x4c], 0x93ee3274
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov dword [ebp - 0x10], eax
push ebx
call fcn.1001a25e
push 6
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10036e61
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa80]
call fcn.1001a2cf
mov dword [eax], 0x17be9fb1
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10036e3d
xor ebx, ebx
xor eax, eax
inc ebx
dec dword [ebp - 0x24]
lea ecx, [ebp - 0xa80]
push eax
call fcn.1001a2cf
xor edx, edx
push 0xfffffffffffffffc
cmp dword [eax], ebx
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp eax, edx
pop eax
setle cl
cmp eax, ecx
mov eax, dword [ebp - 0x34]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
setne dl
xor eax, eax
test edx, edx
sets al
add eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], 0xf
cmp dword [ebp - 0x10], 9
jg 0x10036ec8
xor eax, eax
mov dword [ebp - 0x34], 0x3700
cmp dword [ebp - 0x34], eax
jne 0x10036ec8
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 9
jle 0x10036eb3
or eax, 0xffffffff
lea ecx, [ebp - 0xa80]
mov dword [ebp - 4], eax
call fcn.1001a2ca
mov dword [ebp - 0x20], 0x43d837bc
xor eax, eax
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x3c], 0x9193c1de
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10036f15
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc60], 0x624039b6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10036efc
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10036f3b
push 0xe93
push 0x871
push 0x2073
push 0x452
push eax
call dword [sym.imp.USER32.dll_SetRect]
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x10036fa7
jmp 0x10036f47
xor eax, eax
mov dword [ebp - 0x10], 0xe1ca2961
xor ecx, ecx
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x10036f69
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xc60], ecx
jne 0x10036f69
dec dword [ebp - 0x10]
jns 0x10036f58
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xc60], 0x2f38d927
jl 0x10036f89
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xc60], ecx
je 0x10036f89
mov eax, ebx
jmp 0x10036f8b
xor eax, eax
mov ecx, 0xe3cf9575
cmp ecx, eax
mov eax, dword [ebp - 0x34]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0x20]
jns 0x10036f45
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x2c4], 0
jne 0x100370b5
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x16
jne 0x10037076
xor eax, eax
mov dword [ebp - 0x28], 0x1d69f428
cmp dword [ebp - 0x18], eax
jne 0x10037076
mov dword [ebp - 0x28], 8
cmp dword [ebp - 0x28], 0xffffffe7
jg 0x10037069
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10037010
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xfec], 0xb03629aa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10036ff8
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x10037060
mov dword [ebp - 0x20], 8
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10037039
push 0x248b
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10037058
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xfec], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10037044
xor eax, eax
dec dword [ebp - 0x24]
jns 0x10037018
push 0xfffffffffffffffc
pop ecx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe7
jle 0x10036fed
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x16
je 0x10036fcd
mov eax, dword [ebp - 0x18]
dec eax
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x18]
jg 0x10037090
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10037092
mov eax, ebx
jmp 0x10037092
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp + eax*4 - 0x2c4]
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x2c4], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jle 0x10036e02
push ebx
lea ecx, [ebp - 0x8d8]
call fcn.1001a25e
mov dword [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x20], 0x52061f66
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100370fa
push dword [ebp - 0x10]
lea ecx, [ebp - 0x8d8]
call fcn.1001a2cf
mov dword [eax], 0x8d327cb3
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x100370d9
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1003712b
push dword [ebp - 0x20]
lea ecx, [ebp - 0x8d8]
call fcn.1001a2cf
push dword [ebp - 0x20]
lea ecx, [ebp - 0x8d8]
mov esi, eax
call fcn.1001a2cf
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x20]
jns 0x10037102
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10037150
push 0x24b9
push eax
push 0x250c
call ebx
push eax
call edi
or eax, 0xffffffff
lea ecx, [ebp - 0x8d8]
mov dword [ebp - 4], eax
call fcn.1001a2ca
xor esi, esi
lea ecx, [ebp - 0x8f0]
inc esi
push esi
call fcn.1001a25e
mov dword [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x20], 0x52061f66
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100371af
xor edi, edi
inc edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x8f0]
call fcn.1001a2cf
mov dword [eax], 0x8d327cb3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003718b
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x100371e0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x8f0]
call fcn.1001a2cf
push dword [ebp - 0x20]
lea ecx, [ebp - 0x8f0]
mov esi, eax
call fcn.1001a2cf
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x20]
jns 0x100371b7
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100371f9
push 0x24b9
push eax
push 0x250c
call ebx
push eax
call edi
or eax, 0xffffffff
lea ecx, [ebp - 0x8f0]
mov dword [ebp - 4], eax
call fcn.1001a2ca
push 2
pop esi
push esi
lea ecx, [ebp - 0x55c]
call fcn.1001a25e
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x20], 0xd3650dfa
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10037260
xor esi, esi
push 2
inc esi
pop edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x55c]
call fcn.1001a2cf
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003723e
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor eax, eax
jmp 0x10037263
xor esi, esi
inc esi
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x100373a0
xor edi, edi
inc edi
mov dword [ebp - 0x1c], 0x2a2c7c8a
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x1003733e
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100372a8
push 0x23c5
push 0x1a04
push 0x953
push 0x26eb
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x18]
je 0x100372c6
push dword [ebp - 0x18]
lea ecx, [ebp - 0x55c]
call fcn.1001a2cf
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x63a7
setge cl
add ecx, 0xde65903
cmp ecx, 0xb8ce
jge 0x100372ed
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x18], eax
je 0x100372ef
mov esi, edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x55c]
call fcn.1001a2cf
cmp dword [eax], esi
jge 0x1003730c
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1003730e
mov esi, edi
jmp 0x10037310
xor eax, eax
mov esi, eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x55c]
call fcn.1001a2cf
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp esi, ecx
push 0
sete dl
xor ecx, ecx
cmp dword [eax], edx
pop eax
sete cl
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0x1c]
jns 0x10037285
mov dword [ebp - 0x20], eax
jmp 0x10037389
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x10037386
push dword [ebp - 0x18]
lea ecx, [ebp - 0x55c]
call fcn.1001a2cf
cmp dword [eax], 0
jne 0x10037384
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1003737f
push eax
push 0x26f2
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
dec dword [ebp - 0x1c]
jns 0x1003734b
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x10037343
dec dword [ebp - 0x18]
jns 0x10037272
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor esi, esi
inc esi
or eax, 0xffffffff
lea ecx, [ebp - 0x55c]
mov dword [ebp - 4], eax
call fcn.1001a2ca
push esi
lea ecx, [ebp - 0x98c]
call fcn.1001a25e
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x20], 0x52061f66
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100373fc
xor edi, edi
inc edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x98c]
call fcn.1001a2cf
mov dword [eax], 0x8d327cb3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100373d8
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1003742d
push dword [ebp - 0x20]
lea ecx, [ebp - 0x98c]
call fcn.1001a2cf
push dword [ebp - 0x20]
lea ecx, [ebp - 0x98c]
mov esi, eax
call fcn.1001a2cf
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x20]
jns 0x10037404
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10037446
push 0x24b9
push eax
push 0x250c
call ebx
push eax
call edi
or eax, 0xffffffff
lea ecx, [ebp - 0x98c]
mov dword [ebp - 4], eax
call fcn.1001a2ca
xor esi, esi
lea ecx, [ebp - 0xe38]
inc esi
xor eax, eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x20], eax
push 3
call fcn.1001a25e
xor eax, eax
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100374a0
push dword [ebp - 0x10]
lea ecx, [ebp - 0xe38]
call fcn.1001a2cf
mov dword [eax], 0x4ebb0cb8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10037481
xor eax, eax
cmp dword [ebp - 0x4c], 6
mov ebx, dword [sym.imp.KERNEL32.dll_GetACP]
ja 0x100374b6
cmp dword [ebp - 0x4c], eax
je 0x100374b6
inc dword [ebp - 0x20]
jmp 0x100374e8
mov dword [ebp - 0x20], eax
jmp 0x100374c8
cmp byte [ebp - 0x2d], 0
je 0x100374c5
call ebx
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
mov byte [ebp - 0x2d], al
jle 0x100374bb
cmp byte [ebp - 0x2d], 0
je 0x100374e8
push 0xc06
push 0x122d
push eax
call dword [sym.imp.USER32.dll_DeleteMenu]
or eax, 0xffffffff
lea ecx, [ebp - 0xe38]
mov dword [ebp - 4], eax
call fcn.1001a2ca
push 2
pop eax
push eax
lea ecx, [ebp - 0x4fc]
call fcn.1001a25e
mov dword [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x20], 0xd3650dfa
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003754b
push 2
pop edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4fc]
call fcn.1001a2cf
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003752b
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor eax, eax
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x1003768c
xor edi, edi
inc edi
mov dword [ebp - 0x1c], 0x2a2c7c8a
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x10037626
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10037590
push 0x23c5
push 0x1a04
push 0x953
push 0x26eb
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x18]
je 0x100375ae
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4fc]
call fcn.1001a2cf
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x63a7
setge cl
add ecx, 0xde65903
cmp ecx, 0xb8ce
jge 0x100375d5
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x18], eax
je 0x100375d7
mov esi, edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4fc]
call fcn.1001a2cf
cmp dword [eax], esi
jge 0x100375f4
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100375f6
mov esi, edi
jmp 0x100375f8
xor eax, eax
mov esi, eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x4fc]
call fcn.1001a2cf
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp esi, ecx
push 0
sete dl
xor ecx, ecx
cmp dword [eax], edx
pop eax
sete cl
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0x1c]
jns 0x1003756d
mov dword [ebp - 0x20], eax
jmp 0x10037675
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x10037672
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4fc]
call fcn.1001a2cf
cmp dword [eax], 0
jne 0x10037670
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1003766b
push eax
push 0x26f2
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
dec dword [ebp - 0x1c]
jns 0x10037633
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x1003762b
dec dword [ebp - 0x18]
jns 0x1003755a
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor esi, esi
inc esi
or eax, 0xffffffff
lea ecx, [ebp - 0x4fc]
mov dword [ebp - 4], eax
call fcn.1001a2ca
push 2
pop eax
push eax
lea ecx, [ebp - 0x5bc]
call fcn.1001a25e
mov dword [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x20], 0xd3650dfa
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100376ef
push 2
pop edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5bc]
call fcn.1001a2cf
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100376cf
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor eax, eax
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x10037830
xor edi, edi
inc edi
mov dword [ebp - 0x1c], 0x2a2c7c8a
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x100377ca
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10037734
push 0x23c5
push 0x1a04
push 0x953
push 0x26eb
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x18]
je 0x10037752
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5bc]
call fcn.1001a2cf
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x63a7
setge cl
add ecx, 0xde65903
cmp ecx, 0xb8ce
jge 0x10037779
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x18], eax
je 0x1003777b
mov esi, edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5bc]
call fcn.1001a2cf
cmp dword [eax], esi
jge 0x10037798
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1003779a
mov esi, edi
jmp 0x1003779c
xor eax, eax
mov esi, eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x5bc]
call fcn.1001a2cf
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp esi, ecx
push 0
sete dl
xor ecx, ecx
cmp dword [eax], edx
pop eax
sete cl
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0x1c]
jns 0x10037711
mov dword [ebp - 0x20], eax
jmp 0x10037819
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x10037816
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5bc]
call fcn.1001a2cf
cmp dword [eax], 0
jne 0x10037814
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1003780f
push eax
push 0x26f2
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
dec dword [ebp - 0x1c]
jns 0x100377d7
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x100377cf
dec dword [ebp - 0x18]
jns 0x100376fe
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor esi, esi
inc esi
or eax, 0xffffffff
lea ecx, [ebp - 0x5bc]
mov dword [ebp - 4], eax
call fcn.1001a2ca
xor eax, eax
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10037866
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1164], 0xbcd8c45c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003784e
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10037878
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
xor eax, eax
dec dword [ebp - 0x115c]
lea ecx, [ebp - 0xf38]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x20], eax
push 3
call fcn.1001a25e
xor eax, eax
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100378c2
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf38]
call fcn.1001a2cf
mov dword [eax], 0x4ebb0cb8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100378a3
xor eax, eax
cmp dword [ebp - 0x4c], 6
ja 0x100378d2
cmp dword [ebp - 0x4c], eax
je 0x100378d2
inc dword [ebp - 0x20]
jmp 0x10037906
push 2
mov dword [ebp - 0x20], eax
pop esi
jmp 0x100378e7
cmp byte [ebp - 0x2d], 0
je 0x100378e4
call ebx
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
mov byte [ebp - 0x2d], al
jle 0x100378da
cmp byte [ebp - 0x2d], 0
je 0x10037906
push 0xc06
push 0x122d
push eax
call dword [sym.imp.USER32.dll_DeleteMenu]
or ebx, 0xffffffff
lea ecx, [ebp - 0xf38]
mov dword [ebp - 4], ebx
call fcn.1001a2ca
xor eax, eax
mov dword [ebp - 0x20], 0xdf99ff60
push 4
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x10037935
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1524], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10037928
xor ebx, ebx
mov dword [ebp - 0x20], 0xfffffff7
inc ebx
cmp dword [ebp - 0x20], 0xd
jg 0x10037977
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x4c], 0x1813f1a0
imul eax, dword [ebp - 0x34], 0xffff
test eax, eax
jne 0x10037964
cmp dword [ebp - 0x20], eax
je 0x10037966
mov eax, ebx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1518], eax
inc dword [ebp - 0x20]
jmp 0x10037944
xor eax, eax
mov dword [ebp - 0x40], 0x3b4e
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10037997
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100379b8
push 0x428
push 0x1029
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
push ebx
lea ecx, [ebp - 0x938]
call fcn.1001a25e
lea eax, [ebp - 0x1034]
mov dword [ebp - 4], 0xf
movdqa xmm0, xmmword [0x1000ce80]
lea ecx, [ebp - 0x14ec]
push eax
lea eax, [ebp - 0x1044]
push eax
movdqu xmmword [ebp - 0x1044], xmm0
call fcn.1001a2de
lea ecx, [ebp - 0x305]
mov esi, eax
call fcn.1000e0f3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x71c]
push dword [esi]
call fcn.1001a2a0
lea eax, [ebp - 0x11f4]
mov byte [ebp - 4], 0x10
movdqa xmm0, xmmword [0x1000cf40]
lea ecx, [ebp - 0x14bc]
push eax
lea eax, [ebp - 0x1204]
push eax
movdqu xmmword [ebp - 0x1204], xmm0
call fcn.1001a2de
lea ecx, [ebp - 0x2b5]
mov esi, eax
call fcn.1000e0f3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x250]
push dword [esi]
call fcn.1001a2a0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x250]
push ebx
mov dword [ebp - 0x34], 0xf196
call fcn.1001a2cf
push ebx
lea ecx, [ebp - 0x250]
and dword [eax], 0
call fcn.1001a2cf
push 3
pop esi
jmp 0x10037b0e
mov dword [ebp - 0x24], 0x708ef6b8
xor eax, eax
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jl 0x10037ad3
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10037ab8
push 0xd0c
push 0x642
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10037ace
push 0x219d
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
dec dword [ebp - 0x24]
jns 0x10037a9c
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10037af4
push eax
push 0xb49
push 0x71f
push 0x137a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push ebx
lea ecx, [ebp - 0x250]
call fcn.1001a2cf
push ebx
lea ecx, [ebp - 0x250]
inc dword [eax]
call fcn.1001a2cf
cmp dword [eax], esi
jle 0x10037a8b
push 2
pop esi
push esi
lea ecx, [ebp - 0x250]
call fcn.1001a2cf
push esi
lea ecx, [ebp - 0x71c]
call fcn.1001a2cf
xor eax, eax
lea ecx, [ebp - 0x250]
push eax
call fcn.1001a2cf
push ebx
lea ecx, [ebp - 0x250]
call fcn.1001a2cf
xor eax, eax
lea ecx, [ebp - 0x71c]
push eax
call fcn.1001a2cf
cmp dword [eax], 0xfffffffb
jae 0x10037b6a
push esi
lea ecx, [ebp - 0x250]
call fcn.1001a2cf
push ebx
lea ecx, [ebp - 0x250]
call fcn.1001a2cf
push ebx
lea ecx, [ebp - 0x250]
call fcn.1001a2cf
push ebx
lea ecx, [ebp - 0x71c]
call fcn.1001a2cf
mov ecx, dword [ebp - 0x34]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x71c]
setne dl
xor eax, eax
push eax
mov dword [ebp - 0x34], edx
call fcn.1001a2cf
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x250]
setge bl
xor esi, esi
inc esi
push esi
call fcn.1001a2cf
lea ecx, [ebp - 0x250]
mov dword [eax], ebx
call fcn.1001a2ca
lea ecx, [ebp - 0x71c]
mov byte [ebp - 4], 0xf
call fcn.1001a2ca
mov dword [ebp - 0x2c], 0x52061f66
or ecx, 0xffffffff
mov dword [ebp - 0x20], 0xfffffff8
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10037c1d
xor edi, edi
inc edi
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x404], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10037bff
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x10037cdf
xor edi, edi
inc edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10037c4c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x268], 0x1245c810
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10037c34
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10037c68
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x648], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10037c54
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10037c7f
push 0x2152
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10037c8a
mov eax, dword [ebp - 0x404]
mov eax, dword [ebp - 0x404]
xor edx, edx
mov eax, dword [ebp - 0x268]
test eax, eax
mov eax, dword [ebp - 0x20]
sets dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x648], ecx
imul eax, dword [ebp - 0x268], 9
cmp eax, 0xcdb8faaa
jb 0x10037cc1
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x34], 0xbb94d0f
xor eax, eax
inc dword [ebp - 0x20]
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x20], eax
jle 0x10037c2c
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10037d1b
push 0xa81
push 0x2104
push 0x23b0
push 0x1149
push 0xa25
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x24], 0x3a5bed85
inc ebx
mov dword [ebp - 0x10], ebx
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10037d47
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9d8], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10037d33
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jge 0x10037d66
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x514], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10037d52
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10037d7c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9e0], 0x87a912e7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10037d6b
mov ecx, dword [ebp - 0x514]
xor edx, edx
mov eax, dword [ebp - 0x50c]
cmp ecx, eax
setle dl
cmp dword [ebp - 0x510], edx
jne 0x10037da2
mov eax, dword [ebp - 0x514]
mov eax, 0xed1
xor ecx, ecx
sub eax, dword [ebp - 0x9d8]
mov dword [ebp - 0x9d8], eax
mov dword [ebp - 0x510], ebx
mov eax, dword [ebp - 0x9dc]
cmp eax, 0xfffffffd
setge cl
mov dword [ebp - 0x9e0], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10037e19
xor edi, edi
inc edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x938]
call fcn.1001a2cf
mov dword [eax], 0x8d327cb3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10037df2
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], 0xa5d6c05b
mov dword [ebp - 0x20], 0xfffffff9
cmp dword [ebp - 0x20], 0xffffffe2
jg 0x10037e91
or ebx, 0xffffffff
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x34], 0x8aaf0a9b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10037e59
push 0xfffffffffffffffc
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x908], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10037e45
xor eax, eax
cmp dword [ebp - 0x900], eax
jne 0x10037e73
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x900]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x900]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe2
push 0
pop eax
jle 0x10037e30
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x10037feb
jmp 0x10037ea3
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x24], 0x2466e9f0
mov dword [ebp - 0x10], 0xbf5f40e1
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10037ece
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg eax
push ebx
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0xafb5d1cb
sbb ecx, ecx
xor eax, eax
neg ecx
sub ecx, dword [ebp - 0x10]
cmp ecx, 0xffffffff
setle al
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 5
setl cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x920]
call fcn.1001a25e
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x20], 0x52061f66
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10037f63
xor edi, edi
inc edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x920]
call fcn.1001a2cf
mov dword [eax], 0x8d327cb3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10037f3c
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x10037f94
push dword [ebp - 0x20]
lea ecx, [ebp - 0x920]
call fcn.1001a2cf
push dword [ebp - 0x20]
lea ecx, [ebp - 0x920]
mov esi, eax
call fcn.1001a2cf
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x20]
jns 0x10037f6b
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10037fb1
push 0x24b9
push eax
push 0x250c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
lea ecx, [ebp - 0x920]
mov byte [ebp - 4], 0xf
call fcn.1001a2ca
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x938]
call fcn.1001a2cf
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x938]
mov esi, eax
call fcn.1001a2cf
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x2c]
jns 0x10037ea1
mov dword [ebp - 0x28], 0x75dc
lea ecx, [ebp - 0x3e4]
mov dword [ebp - 0x10], 0x4bedcc59
push ebx
call fcn.1001a25e
xor eax, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003803a
xor edi, edi
inc edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x3e4]
call fcn.1001a2cf
mov dword [eax], 0xe64e6dc6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10038016
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10038058
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10038133
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x10038133
or eax, 0xffffffff
lea ecx, [ebp - 0x3e4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x10], 0x6715f0ed
push eax
call fcn.1001a2cf
mov edi, dword [ebp - 0x10]
lea ecx, [ebp - 0x3e4]
sub edi, dword [eax]
xor eax, eax
push eax
call fcn.1001a2cf
mov edx, dword [ebp - 0x18]
xor ebx, ebx
mov ecx, dword [ebp - 0x28]
mov esi, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x18]
setne bl
xor edx, edx
cmp edi, ecx
setle dl
xor eax, eax
add ebx, edx
cmp ebx, dword [esi]
setge al
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1003812a
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x3e4]
xor eax, eax
push eax
call fcn.1001a2cf
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x10]
test edx, edx
jne 0x100380de
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x3e4]
mov eax, dword [ebp - 0x28]
xor eax, eax
push eax
call fcn.1001a2cf
xor eax, eax
lea ecx, [ebp - 0x3e4]
push eax
call fcn.1001a2cf
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x3e4]
xor eax, eax
push eax
call fcn.1001a2cf
xor ecx, ecx
inc ecx
cmp dword [eax], ecx
je 0x10038124
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10038124
cmp dword [ebp - 0x18], eax
je 0x10038128
mov eax, ecx
jmp 0x1003812a
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x3e4]
mov byte [ebp - 4], 0xf
call fcn.1001a2ca
mov dword [ebp - 0x24], 0xffff
lea ecx, [ebp - 0xa98]
mov dword [ebp - 0x28], 0xbf2121f9
mov dword [ebp - 0x10], 0x49aaed6b
mov dword [ebp - 0x4c], 0x203bd652
mov dword [ebp - 0x4c], 0x8531d14c
push 3
call fcn.1001a25e
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100381a0
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa98]
call fcn.1001a2cf
mov dword [eax], 0xaf0a9b27
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10038181
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x18], eax
inc ebx
cmp dword [ebp - 0x18], ebx
jge 0x100381cf
xor edi, edi
inc edi
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x78c], 0xd7f19125
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100381ae
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor ebx, ebx
xor eax, eax
inc ebx
cmp dword [ebp - 0x24], eax
jne 0x100381fd
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0x891c
setle cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x100381ff
mov eax, ebx
push 2
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0xa98]
mov eax, dword [ebp - 0x4c]
pop esi
mov dword [ebp - 0x4c], eax
push esi
call fcn.1001a2cf
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
lea ecx, [ebp - 0xa98]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x78c], eax
mov byte [ebp - 4], 0xf
call fcn.1001a2ca
xor eax, eax
lea ecx, [ebp - 0x574]
mov byte [ebp - 0x11], al
push esi
call fcn.1001a25e
mov byte [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x2c], 0xdf1febae
mov dword [ebp - 0x18], 0x1fbf6859
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003827f
push dword [ebp - 0x10]
lea ecx, [ebp - 0x574]
call fcn.1001a2cf
mov dword [eax], 3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10038261
xor eax, eax
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x10038371
xor edi, edi
inc edi
or ecx, 0xffffffff
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jg 0x1003835f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x574]
call fcn.1001a2cf
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x574]
call fcn.1001a2cf
push dword [ebp - 0x2c]
xor ebx, ebx
lea ecx, [ebp - 0x574]
cmp dword [eax], 0x61bf0796
setle bl
call fcn.1001a2cf
mov ecx, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, ebx
add ecx, eax
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x574]
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x2c]
call fcn.1001a2cf
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], 0x11
cmp dword [ebp - 0x18], 6
jne 0x1003834e
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003832e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10038345
push eax
push 0x82a
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 6
je 0x10038316
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x100382a7
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x2c]
jns 0x10038291
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 0xf
call fcn.1001a2ca
cmp byte [ebp - 0x11], 0
je 0x1003861a
push esi
lea ecx, [ebp - 0x9c]
call fcn.1001a25e
mov byte [ebp - 4], 0x16
push 5
pop eax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x16c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100383dd
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9c]
call fcn.1001a2cf
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100383bf
xor eax, eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], ebx
jg 0x100385f9
xor edi, edi
inc edi
jmp 0x100383f6
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x9c]
push dword [ebp - 0x170]
call fcn.1001a2cf
push dword [ebp - 0x170]
lea ecx, [ebp - 0x9c]
mov esi, eax
call fcn.1001a2cf
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x10038467
push dword [ebp - 0x170]
lea ecx, [ebp - 0x9c]
call fcn.1001a2cf
push dword [ebp - 0x170]
lea ecx, [ebp - 0x9c]
call fcn.1001a2cf
push dword [ebp - 0x170]
lea ecx, [ebp - 0x9c]
call fcn.1001a2cf
push dword [ebp - 0x170]
lea ecx, [ebp - 0x9c]
call fcn.1001a2cf
push dword [ebp - 0x170]
lea ecx, [ebp - 0x9c]
call fcn.1001a2cf
mov ecx, dword [ebp - 0x20]
imul ecx, dword [eax]
xor eax, eax
test ecx, ecx
je 0x1003849c
lea ecx, [ebp - 0x9c]
call fcn.1001a2ca
push 0x24b9
xor eax, eax
push eax
push 0x250c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
or esi, 0xffffffff
lea ecx, [ebp - 0x938]
mov dword [ebp - 4], esi
call fcn.1001a2ca
push 2
pop ebx
push ebx
lea ecx, [ebp - 0xe50]
call fcn.1001a25e
mov dword [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003866c
push dword [ebp - 0x10]
lea ecx, [ebp - 0xe50]
call fcn.1001a2cf
mov dword [eax], 0x9f9b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003864e
xor eax, eax
xor edi, edi
mov dword [ebp - 0x10], eax
inc edi
jmp 0x1003868d
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003868a
push 0x24db
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x10038674
lea ecx, [ebp - 0xe50]
mov dword [ebp - 4], esi
call fcn.1001a2ca
xor eax, eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0xfb0]
push 3
call fcn.1001a25e
xor eax, eax
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100386e6
push dword [ebp - 0x10]
lea ecx, [ebp - 0xfb0]
call fcn.1001a2cf
mov dword [eax], 0x4ebb0cb8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100386c7
cmp dword [ebp - 0x4c], 6
ja 0x100386f6