Function at 0x10034e0b
Capabilities:
Check os version
Compare security identifiers
Create process on windows
Delete directory
Extract resource via kernel32 functions
Get common file path
Get disk information
Get graphical window text
Get keyboard layout
Parse pe header
Query or enumerate registry key
Query service status

Disassembly:
mov eax, 0x1008d837
call fcn.1008bdc8
mov eax, 0x1744
call fcn.100874f0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x70], ecx
push edi
inc ebx
mov byte [ebp - 0x79], dl
mov dword [ebp - 0x24], ebx
mov esi, 0x64a53aa9
push 2
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
pop ecx
jmp 0x10034e53
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x854], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034e42
mov eax, dword [ebp - 0x24]
mov ecx, 0xffff
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10034efc
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x24]
test eax, eax
jne 0x10034e89
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
xor eax, eax
sub edx, dword [ebp - 0x854]
cmp edx, 0xfffffff7
setge al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xd816
test eax, eax
je 0x10034efc
push 2
mov dword [ebp - 0x14], 0
pop ecx
jmp 0x10034ed6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x854], 0xde1fc657
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10034ec5
mov dword [ebp - 0x14], 0
jmp 0x10034ef5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x854], 0x8bd85027
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10034ee4
jmp 0x10034f14
mov byte [ebp - 0x39], 0
cmp byte [ebp - 0x39], 0
je 0x10034f11
push 0x97c
push 0
push 0
call edi
push 2
pop ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
jmp 0x10034f34
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x700], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034f23
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10034fd7
mov eax, dword [ebp - 0x14]
mov ecx, 0xffff
mov eax, dword [ebp - 0x24]
cmp ecx, eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x24]
test eax, eax
jne 0x10034f64
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
xor eax, eax
sub edx, dword [ebp - 0x700]
cmp edx, 0xfffffff7
setge al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xd816
test eax, eax
je 0x10034fd7
push 2
mov dword [ebp - 0x14], 0
pop ecx
jmp 0x10034fb1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x700], 0xde1fc657
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10034fa0
mov dword [ebp - 0x14], 0
jmp 0x10034fd0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x700], 0x8bd85027
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10034fbf
jmp 0x10034fec
mov byte [ebp - 0x39], 0
cmp byte [ebp - 0x39], 0
je 0x10034fec
push 0x97c
push 0
push 0
call edi
mov dword [ebp - 0x14], 0
mov eax, 0xcfbce008
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0xf08], eax
mov dword [ebp - 0xf04], eax
mov dword [ebp - 0xf00], eax
mov dword [ebp - 0xefc], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
or ecx, 0xffffffff
neg eax
cmp ecx, eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x10035043
cmp dword [ebp - 0x14], 0
je 0x10035043
mov edx, ebx
jmp 0x10035045
xor edx, edx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 0x45c6b9bd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xf08], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x100350b0
mov dword [ebp - 0x14], 4
jmp 0x100350a8
mov dword [ebp - 0x1c], 6
jmp 0x1003509f
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1003509c
push 0x1119
push 0x245a
push eax
push 0xc2d
push eax
call dword [sym.imp.USER32.dll_GetMenuStringW]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe8
jge 0x1003507a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x2a
jg 0x10035071
jmp 0x100350cb
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100350cb
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov dword [ebp - 0x24], ebx
push 2
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
pop ecx
jmp 0x100350ee
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7e8], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100350dd
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10035194
mov eax, dword [ebp - 0x14]
mov ecx, 0xffff
mov eax, dword [ebp - 0x24]
cmp ecx, eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x24]
test eax, eax
jne 0x1003511f
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
xor eax, eax
sub edx, dword [ebp - 0x7e8]
cmp edx, 0xfffffff7
setge al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xd816
test eax, eax
je 0x10035192
push 2
mov dword [ebp - 0x14], 0
pop ecx
jmp 0x1003516c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7e8], 0xde1fc657
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003515b
mov dword [ebp - 0x14], 0
jmp 0x1003518b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7e8], 0x8bd85027
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003517a
jmp 0x100351a6
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100351a6
push 0x97c
push eax
push eax
call edi
push 3
pop esi
push esi
lea ecx, [ebp - 0x8d8]
call fcn.100191fb
xor eax, eax
lea ecx, [ebp - 0xa4c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x5c], 0xeb77278f
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x44], eax
push ebx
call fcn.100191fb
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xbb0]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], ebx
push esi
call fcn.100191fb
push 2
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x38], 0xcc8c9f13
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10035227
push dword [ebp - 0x28]
lea ecx, [ebp - 0x8d8]
call fcn.10019299
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1003520a
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1003524d
push dword [ebp - 0x28]
lea ecx, [ebp - 0xa4c]
call fcn.10019299
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1003522f
xor eax, eax
push 2
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x10035270
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x714], 0xe74b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10035258
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10035292
push dword [ebp - 0x28]
lea ecx, [ebp - 0xbb0]
call fcn.10019299
mov dword [eax], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10035278
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100352a2
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
mov eax, dword [ebp - 0x714]
dec dword [ebp - 0x714]
test eax, eax
jne 0x100352d9
push eax
lea ecx, [ebp - 0xa4c]
call fcn.10019299
push 2
mov esi, eax
lea ecx, [ebp - 0xbb0]
pop eax
push eax
call fcn.10019299
mov ecx, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x5c]
mov dword [esi], ecx
push 0
lea ecx, [ebp - 0xa4c]
call fcn.10019299
xor ecx, ecx
push 2
cmp dword [eax], ecx
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
sub edx, 0x160c6370
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop eax
setle cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x8d8]
push eax
call fcn.10019299
push ebx
lea ecx, [ebp - 0x8d8]
mov esi, eax
call fcn.10019299
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x38]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x44]
setg cl
xor edx, edx
cmp ecx, eax
lea ecx, [ebp - 0xbb0]
setge dl
xor eax, eax
cmp edx, 0xb22c
setg al
mov dword [ebp - 0x2c], eax
call fcn.1001927d
lea ecx, [ebp - 0xa4c]
call fcn.1001927d
or eax, 0xffffffff
lea ecx, [ebp - 0x8d8]
mov dword [ebp - 4], eax
call fcn.1001927d
mov dword [ebp - 0x34], ebx
lea ecx, [ebp - 0x77c]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], 0x44b0bf2
push ebx
call fcn.100191fb
push 2
pop eax
push eax
lea ecx, [ebp - 0xa88]
mov dword [ebp - 4], 3
call fcn.100191fb
mov byte [ebp - 4], 4
mov dword [ebp - 0x38], 0x9873
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x14], 0
jmp 0x100353db
push dword [ebp - 0x14]
lea ecx, [ebp - 0x77c]
call fcn.10019299
mov dword [eax], 0xa421e0be
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100353c4
mov dword [ebp - 0x14], 0
jmp 0x100353f7
push dword [ebp - 0x14]
call fcn.10019299
and dword [eax], 0
inc dword [ebp - 0x14]
push 2
pop eax
lea ecx, [ebp - 0xa88]
cmp dword [ebp - 0x14], eax
jl 0x100353e9
push 0
call fcn.10019299
push 0
pop ecx
push 0
inc dword [eax]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
setne cl
mov esi, dword [ebp - 0x24]
xor eax, eax
cmp ecx, ebx
lea ecx, [ebp - 0x77c]
setge al
sub esi, eax
neg esi
sbb esi, esi
inc esi
call fcn.10019299
mov dword [eax], esi
test esi, esi
jne 0x1003544a
push esi
lea ecx, [ebp - 0x77c]
call fcn.10019299
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
neg edx
push 8
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
pop eax
setge cl
cmp eax, ecx
sbb eax, eax
neg eax
sub eax, 6
mov dword [ebp - 0x10], eax
je 0x10035478
cmp dword [ebp - 0x10], 0
je 0x10035478
mov ecx, ebx
jmp 0x1003547a
xor ecx, ecx
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
imul eax, ecx
add eax, dword [ebp - 0x24]
cmp eax, 0x218f
jl 0x100354b8
mov dword [ebp - 0x10], 0
jmp 0x100354a4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1418], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10035497
mov eax, dword [ebp - 0x1414]
mov dword [ebp - 0x38], eax
jmp 0x1003559b
mov dword [ebp - 0x24], 0xfffffffd
lea ecx, [ebp - 0xda8]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x54], 0xb016fefd
push ebx
call fcn.100191fb
mov byte [ebp - 4], 5
mov dword [ebp - 0x10], 0
jmp 0x100354fd
push dword [ebp - 0x10]
lea ecx, [ebp - 0xda8]
call fcn.10019299
mov dword [eax], 0x6851cc0d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100354e6
dec dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x38]
jl 0x1003551b
mov eax, 0xffff
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x10035521
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x54]
push 0
lea ecx, [ebp - 0x77c]
call fcn.10019299
mov ecx, dword [ebp - 0x24]
inc ecx
cmp ecx, 0xfffe
push 0
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp dword [eax], ecx
lea ecx, [ebp - 0xa88]
setl bl
call fcn.10019299
mov ecx, dword [ebp - 0x54]
mov esi, eax
xor eax, eax
cmp ebx, ecx
push 0
setg al
or ecx, 0xffffffff
imul eax, dword [ebp - 0x48]
xor edx, edx
sub eax, dword [ebp - 0x54]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor ebx, ebx
cmp ecx, dword [esi]
lea ecx, [ebp - 0xda8]
setg bl
call fcn.10019299
lea ecx, [ebp - 0xda8]
mov dword [eax], ebx
call fcn.1001927d
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xa88]
call fcn.1001927d
or eax, 0xffffffff
lea ecx, [ebp - 0x77c]
mov dword [ebp - 4], eax
call fcn.1001927d
mov dword [ebp - 0x14], 0x64a53aa9
mov dword [ebp - 0x28], 0x365653d4
mov dword [ebp - 0x30], 0xe543
mov dword [ebp - 0x10], 0
jmp 0x100355e6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8f0], 0x47d228d5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100355d5
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
push 2
pop ecx
sub eax, ecx
jne 0x10035616
cmp dword [ebp - 0x28], eax
je 0x10035618
mov eax, ebx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x8e8]
jge 0x10035656
mov dword [ebp - 0x10], 0
jmp 0x10035640
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1234], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003562f
mov eax, dword [ebp - 0x1230]
mov dword [ebp - 0x8e8], eax
jmp 0x10035716
push 0xfffffffffffffff7
mov dword [ebp - 0x1c], 0xff4caa5d
xor eax, eax
pop edx
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
je 0x10035696
mov dword [ebp - 0x38], edx
inc dword [ebp - 0x38]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10035716
push 0x148e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 2
pop ecx
jmp 0x10035716
mov dword [ebp - 0x28], 4
cmp dword [ebp - 0x28], 7
je 0x100356df
mov dword [ebp - 0x10], 0x43ec3e1b
cmp dword [ebp - 0x10], eax
jne 0x100356cb
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x8ec]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
xor eax, eax
jmp 0x100356cd
mov ecx, ebx
mov dword [ebp - 0x8f0], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 7
jne 0x100356a3
push 2
pop ecx
mov dword [ebp - 0x28], eax
jmp 0x10035711
mov dword [ebp - 0x1c], eax
jmp 0x10035709
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10035706
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x100356e9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jle 0x100356e4
mov dword [ebp - 0x24], 0x443250e6
xor eax, eax
mov dword [ebp - 0x2c], 0x5d70512a
mov dword [ebp - 0x48], 0x87e91c17
mov dword [ebp - 0x5c], 0xebe1552b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10035754
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1a4], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003573c
xor eax, eax
cmp dword [ebp - 0x1a0], 5
jbe 0x10035764
mov esi, eax
cmp dword [ebp - 0x24], eax
je 0x10035766
mov esi, ebx
mov edx, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x24]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x1a4]
setle cl
xor edx, edx
imul ecx, esi
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp eax, edx
setg cl
imul ecx, dword [ebp - 0x1a0]
cmp ecx, 0xba13b288
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1a4]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x1a0], eax
jg 0x100357ca
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x24]
mov ecx, ebx
mov eax, dword [ebp - 0x48]
sub ecx, eax
mov dword [ebp - 0x5c], ecx
mov eax, 0xcfbce008
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0xf38], eax
mov dword [ebp - 0xf34], eax
mov dword [ebp - 0xf30], eax
mov dword [ebp - 0xf2c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
or esi, 0xffffffff
neg eax
cmp esi, eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x1003582e
cmp dword [ebp - 0x14], 0
je 0x1003582e
mov edx, ebx
jmp 0x10035830
xor edx, edx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 0x45c6b9bd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xf38], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1003589b
mov dword [ebp - 0x14], 4
jmp 0x10035893
mov dword [ebp - 0x1c], 6
jmp 0x1003588a
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10035887
push 0x1119
push 0x245a
push eax
push 0xc2d
push eax
call dword [sym.imp.USER32.dll_GetMenuStringW]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe8
jge 0x10035865
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x2a
jg 0x1003585c
jmp 0x100358b6
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100358b6
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 2
mov dword [ebp - 0x10], 0
pop ecx
jmp 0x100358d3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x884], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100358c2
push ebx
lea ecx, [ebp - 0x550]
call fcn.100191fb
mov dword [ebp - 4], 6
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xe2bfbd3a
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 0xa277ebd0
mov dword [ebp - 0x14], 0
jmp 0x1003591f
push dword [ebp - 0x14]
lea ecx, [ebp - 0x550]
call fcn.10019299
mov dword [eax], 0x24039b64
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10035908
mov dword [ebp - 0x14], 0
jmp 0x1003593e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x394], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1003592d
push 0
lea ecx, [ebp - 0x550]
call fcn.10019299
push 0
lea ecx, [ebp - 0x550]
and dword [eax], 0
call fcn.10019299
cmp dword [eax], 0xffffffe5
jl 0x10035a3d
push 3
pop esi
mov dword [ebp - 0x10], 0xa2961c0f
lea ecx, [ebp - 0x1060]
mov dword [ebp - 0x30], 0xa147b80b
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 0
push 4
call fcn.100191fb
mov byte [ebp - 4], 7
mov dword [ebp - 0x14], 0
jmp 0x100359af
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1700], 0x6ff5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003599e
mov dword [ebp - 0x14], 0
jmp 0x100359d4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1060]
call fcn.10019299
mov dword [eax], 0x2f38d927
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100359bd
push 2
pop eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x10035a06
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], 0x6df7e441
inc dword [ebp - 0x394]
dec dword [ebp - 0x10]
jns 0x100359e6
lea ecx, [ebp - 0x1060]
mov byte [ebp - 4], 6
call fcn.1001927d
push 0
lea ecx, [ebp - 0x550]
call fcn.10019299
push 0
lea ecx, [ebp - 0x550]
dec dword [eax]
call fcn.10019299
cmp dword [eax], 0xffffffe5
jge 0x1003596c
or esi, 0xffffffff
lea ecx, [ebp - 0x550]
mov dword [ebp - 4], esi
call fcn.1001927d
mov eax, dword [ebp - 0x34]
mov esi, 0xe012d2c8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10035fff
mov eax, dword [ebp - 0x14]
mov ecx, 0xffff
mov eax, dword [ebp - 0x34]
cmp ecx, eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x34]
test eax, eax
jne 0x10035a7b
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x34]
cmp ecx, eax
push 0xfffffffffffffff7
setge dl
xor eax, eax
sub edx, dword [ebp - 0x884]
pop ecx
cmp edx, ecx
setge al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xd816
test eax, eax
je 0x10035fff
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x120c]
mov dword [ebp - 0x30], 0xa18885c6
mov dword [ebp - 0x30], 0
push ebx
call fcn.100191fb
push 8
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x30], eax
or edi, 0xffffffff
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x10], eax
jmp 0x10035b0f
push dword [ebp - 0x10]
call fcn.10019299
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x120c]
cmp dword [ebp - 0x10], ebx
jl 0x10035afe
dec dword [ebp - 0x38]
mov dword [ebp - 4], edi
call fcn.1001927d
push 2
mov dword [ebp - 0x14], 0
pop edx
jmp 0x10035c46
mov dword [ebp - 0x28], 0xdce9
xor ecx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
test eax, eax
setns cl
cmp ecx, dword [ebp - 0x28]
jle 0x10035b56
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x28], ebx
je 0x10035b64
mov ecx, ebx
cmp dword [ebp - 0x28], eax
jne 0x10035b66
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x25
je 0x10035c35
mov dword [ebp - 0x34], 0x449e
xor edx, edx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x40], 7
mov dword [ebp - 0x38], 0xfffffff6
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x4c]
je 0x10035ba3
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
sub eax, 7
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xd860
mov eax, dword [ebp - 0x34]
setne cl
xor edx, edx
cmp ecx, eax
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x40]
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
test eax, eax
setle cl
cmp ecx, 0x92fb38a8
ja 0x10035bff
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
neg edx
push 0
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setne cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x25
pop eax
jne 0x10035b76
push 2
pop edx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x884], 0xde1fc657
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10035b34
push 3
pop edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], 0
jmp 0x10035c6f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1078], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10035c5e
mov dword [ebp - 0x1c], 0
jmp 0x10035c9e
mov dword [ebp - 0x48], 0xeac45307
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x1078]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1078], ecx
mov dword [ebp - 0x48], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x10035c7d
mov byte [ebp - 0x39], 0
cmp byte [ebp - 0x39], 0
je 0x10035cbd
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
call esi
push 2
mov esi, 0xe012d2c8
pop edx
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], edx
jge 0x10035fca
mov dword [ebp - 0x24], 7
lea ecx, [ebp - 0x32c]
mov dword [ebp - 0x54], 0xda8ed40a
push edx
call fcn.100191fb
mov dword [ebp - 4], 9
lea ecx, [ebp - 0xea4]
mov eax, 0xf213ed4
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x4d8], eax
mov dword [ebp - 0x4d4], eax
mov dword [ebp - 0x4d0], eax
mov dword [ebp - 0x4cc], eax
push 4
call fcn.100191fb
push edi
lea ecx, [ebp - 0xbc8]
mov byte [ebp - 4], 0xa
call fcn.100191fb
mov byte [ebp - 4], 0xb
push 2
mov dword [ebp - 0x2c], 0x75d1b300
mov dword [ebp - 0x28], 0
pop ecx
jmp 0x10035d57
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1b0], 0x44cf
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10035d46
mov dword [ebp - 0x28], 0
cmp dword [ebp - 0x28], ecx
jge 0x10035d87
push dword [ebp - 0x28]
lea ecx, [ebp - 0x32c]
call fcn.10019299
push 2
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x28]
pop eax
cmp dword [ebp - 0x28], eax
jl 0x10035d68
mov dword [ebp - 0x28], 0
jmp 0x10035da1
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x2fc], 0x255d5800
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10035d90
mov dword [ebp - 0x28], 0
jmp 0x10035dc6
push dword [ebp - 0x28]
lea ecx, [ebp - 0xea4]
call fcn.10019299
mov dword [eax], 0x212aeaf
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10035daf
mov dword [ebp - 0x28], 0
jmp 0x10035de8
push dword [ebp - 0x28]
lea ecx, [ebp - 0xbc8]
call fcn.10019299
mov dword [eax], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10035dd5
mov edx, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x24]
neg edx
push 0xfffffffffffffff9
sbb edx, edx
sub esi, eax
xor eax, eax
neg edx
cmp esi, edx
pop esi
setl al
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x1ac]
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
lea ecx, [ebp - 0x32c]
setge bl
xor edi, edi
inc edi
push edi
call fcn.10019299
xor edx, edx
lea ecx, [ebx - 3]
push edi
mov dword [eax], ebx
mov eax, dword [ebp - 0x54]
cmp eax, ecx
setge dl
xor ebx, ebx
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp edx, 0x164
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor edx, edx
cmp ecx, 0x47f5
lea ecx, [ebp - 0x32c]
setl dl
mov dword [ebp - 0x2fc], edx
mov eax, dword [ebp - 0x24]
imul eax, edx
mov dword [ebp - 0x48], eax
call fcn.10019299
mov ecx, dword [ebp - 0x1ac]
xor edx, edx
mov eax, dword [ebp - 0x1ac]
cmp ecx, eax
push 2
setl dl
lea ecx, [ebp - 0xea4]
mov dword [ebp - 0x4d8], edx
mov eax, dword [ebp - 0x4d4]
mov eax, dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x24]
pop eax
push eax
call fcn.10019299
mov ecx, dword [ebp - 0x1ac]
xor ebx, ebx
push edi
cmp dword [eax], ecx
lea ecx, [ebp - 0xbc8]
setge bl
call fcn.10019299
push 0
lea ecx, [ebp - 0x32c]
mov dword [eax], ebx
call fcn.10019299
mov edx, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4d0]
imul edx, ebx
xor ebx, ebx
cmp edx, ecx
setg bl
sub ebx, esi
neg ebx
sbb ebx, ebx
lea ecx, [ebp - 0x32c]
inc ebx
sub ebx, dword [eax]
neg ebx
push edi
sbb ebx, ebx
inc ebx
call fcn.10019299
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x32c]
add esi, ebx
push edi
imul esi, dword [eax]
call fcn.10019299
mov ecx, dword [ebp - 0x2c]
xor edx, edx
imul ecx, esi
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x2c]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x54]
setge bl
add eax, ebx
xor ebx, ebx
add ecx, eax
cmp ecx, 0xfffffff6
mov ecx, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0x1b0]
setne bl
xor edx, edx
cmp ecx, eax
lea ecx, [ebp - 0x32c]
setl dl
xor eax, eax
cmp edx, ebx
setl al
xor ebx, ebx
inc ebx
mov dword [ebp - 0x4d8], eax
push ebx
call fcn.10019299
lea ecx, [ebp - 0xbc8]
mov dword [eax], 0x7941993e
call fcn.1001927d
lea ecx, [ebp - 0xea4]
call fcn.1001927d
or eax, 0xffffffff
lea ecx, [ebp - 0x32c]
mov dword [ebp - 4], eax
call fcn.1001927d
mov eax, dword [ebp - 0x14]
mov esi, 0xe012d2c8
push 2
pop edx
push 3
mov dword [ebp + eax*4 - 0x884], 0x8bd85027
inc dword [ebp - 0x14]
pop edi
cmp dword [ebp - 0x14], edx
jl 0x10035ccd
or esi, 0xffffffff
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x5c], 0xfffffff8
mov dword [ebp - 0x1c], 0x8f59172d
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x48], 0x989265
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x10], 0
jmp 0x1003654e
push 3
pop esi
mov dword [ebp - 0x24], 0x8bbca631
lea ecx, [ebp - 0x1090]
mov dword [ebp - 0x30], 0xd9e2a8d3
push esi
call fcn.100191fb
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x10], 0
jmp 0x10036043
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1090]
call fcn.10019299
mov dword [eax], 0x8a527335
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003602c
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 0xffffffef
jle 0x10036147
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x38], 0x77904128
mov dword [ebp - 0x10], 0
jmp 0x10036080
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb50], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003606f
mov dword [ebp - 0xb4c], 0
jmp 0x10036127
push 3
lea ecx, [ebp - 0x11a0]
call fcn.100191fb
mov byte [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x10], 0x68044455
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100360d3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x11a0]
call fcn.10019299
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100360b8
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1003610c
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100360fc
push eax
push eax
push 0x1943
push 0x1b23
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10036109
call esi
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x100360d8
lea ecx, [ebp - 0x11a0]
mov byte [ebp - 4], 0xc
call fcn.1001927d
inc dword [ebp - 0xb4c]
cmp dword [ebp - 0xb4c], 0xc
jne 0x10036095
dec dword [ebp - 0x38]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffef
jg 0x1003605f
push 3
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0x1090]
mov dword [ebp - 4], eax
call fcn.1001927d
mov dword [ebp - 0x24], 0x173bf38c
xor eax, eax
mov dword [ebp - 0x1c], 0x1e12
mov dword [ebp - 0x38], 0xfe0cd1b7
mov dword [ebp - 0x48], 0x1bca3396
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xfb8], ebx
mov dword [ebp - 0xfb4], ebx
mov dword [ebp - 0xfb0], ebx
mov dword [ebp - 0xfac], ebx
mov dword [ebp - 0x10], eax
jmp 0x100361a7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x14d8], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10036196
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jg 0x100361e8
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
add ecx, 0x83bc
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x1a6e483b
mov dword [ebp - 0x14d0], ecx
setle al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
push 2
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
or ecx, 0xffffffff
neg eax
mov dword [ebp - 0xfb0], eax
xor eax, eax
mov byte [ebp - 0x39], al
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x38], 0x3843046b
mov dword [ebp - 0x2c], eax
pop eax
mov dword [ebp - 0x54], 0xa42b4837
push eax
call fcn.100191fb
push 0xfffffffffffffffc
mov dword [ebp - 4], 0xe
pop eax
mov dword [ebp - 0x30], eax
push 0xfffffffffffffff9
mov dword [ebp - 0x4c], 0xfffffffe
pop eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 0xbd7a89a4
mov dword [ebp - 0x14], 0
jmp 0x1003628c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x828]
call fcn.10019299
mov dword [eax], 5
inc dword [ebp - 0x14]
push 2
pop eax
cmp dword [ebp - 0x14], eax
jl 0x10036275
mov dword [ebp - 0x14], 0
jmp 0x100362ae
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1264], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003629d
mov dword [ebp - 0x10], 0
jmp 0x100364a3
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x544]
mov dword [ebp - 0x38], 0x9dd952ea
push esi
call fcn.100191fb
push 2
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xbe0]
pop eax
mov dword [ebp - 0x5c], 0xead
mov dword [ebp - 0x48], 0xfffffffd
push eax
call fcn.100191fb
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], esi
jge 0x10036323
push dword [ebp - 0x14]
lea ecx, [ebp - 0x544]
call fcn.10019299
push 2
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10036306
jmp 0x10036326
push 2
pop ecx
mov dword [ebp - 0x14], 0
jmp 0x10036349
push dword [ebp - 0x14]
lea ecx, [ebp - 0xbe0]
call fcn.10019299
push 2
pop ecx
mov dword [eax], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003632f
mov dword [ebp - 0x40], 0xb457102d
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x24]
test eax, eax
je 0x10036479
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x125c]
push ecx
lea ecx, [ebp - 0x544]
call fcn.10019299
push 0
lea ecx, [ebp - 0x544]
mov esi, eax
call fcn.10019299
xor ebx, ebx
push 0
mov ecx, dword [eax]
cmp ecx, dword [esi]
lea ecx, [ebp - 0x544]
setne bl
call fcn.10019299
xor edx, edx
push 2
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp eax, edx
pop eax
setle cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x544]
push eax
call fcn.10019299
xor ebx, ebx
lea ecx, [ebp - 0x828]
push 0
cmp dword [eax], 0x127c80b1
setl bl
call fcn.10019299
mov dword [eax], ebx
mov eax, dword [ebp - 0x2c]
sub ebx, eax
je 0x10036476
mov dword [ebp - 0x1c], 0xfffffff8
lea ecx, [ebp - 0x828]
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
mov eax, dword [ebp - 0x38]
inc ebx
push ebx
call fcn.10019299
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x40]
jne 0x10036426
cmp dword [ebp - 0x1260], eax
je 0x10036428
mov eax, ebx
cmp eax, dword [ebp - 0x1c]
jge 0x10036430
mov eax, dword [ebp - 0x44]
push ebx
lea ecx, [ebp - 0x828]
call fcn.10019299
push ebx
lea ecx, [ebp - 0xbe0]
call fcn.10019299
mov eax, dword [ebp - 0x1c]
mov ecx, 0x87a
sub ecx, eax
mov eax, 0xe52bdabf
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, 0xa76c1e80
setg dl
cmp eax, edx
sbb eax, eax
neg eax
mov dword [ebp - 0x54], eax
jmp 0x10036483
xor ebx, ebx
inc ebx
mov dword [ebp - 0x38], 9
inc dword [ebp - 0x38]
lea ecx, [ebp - 0xbe0]
call fcn.1001927d
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], 0xe
call fcn.1001927d
dec dword [ebp - 0x10]
push 3
pop esi
cmp dword [ebp - 0x10], 0xfffffff2
jl 0x100362bf
or esi, 0xffffffff
lea ecx, [ebp - 0x828]
mov dword [ebp - 4], esi
call fcn.1001927d
cmp byte [ebp - 0x39], 0
je 0x10036535
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x100364e9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x338], 0xcff0ea75
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100364d1
xor eax, eax
mov dword [ebp - 0x334], eax
jmp 0x10036523
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x10], 0x11
jmp 0x10036517
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10036514
push eax
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffd
jl 0x10036501
dec dword [ebp - 0x334]
cmp dword [ebp - 0x334], 0xffffffec
jne 0x100364f1
push 0x97c
push eax
push eax
call edi
push 3
pop edi
jmp 0x10035fcd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10a8], 0x2c6eed1e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003653d
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10a4]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10036587
mov dword [ebp - 0x48], 0x748a
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
jmp 0x100365f1
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x2c], 0x69a4575f
mov dword [ebp - 0x40], 0x299b
cmp dword [ebp - 0x1c], eax
je 0x100365a0
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xa660
push 0xfffffffffffffff9
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x34]
cmp edx, eax
pop eax
setl cl
cmp eax, ecx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
add edx, 0x26d35df9
cmp edx, eax
setne cl
mov dword [ebp - 0x10a4], ecx
mov dword [ebp - 0x34], 0x44bf8e16
lea ecx, [ebp - 0x908]
push edi
call fcn.100191fb
mov dword [ebp - 4], 0x11
lea ecx, [ebp - 0x8c0]
xor eax, eax
mov dword [ebp - 0x5c], 0xeb77278f
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x44], eax
push ebx
call fcn.100191fb
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xdc0]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], ebx
push edi
call fcn.100191fb
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x38], 0xcc8c9f13
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x10036676
push dword [ebp - 0x28]
lea ecx, [ebp - 0x908]
call fcn.10019299
mov dword [eax], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1003665c
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1003669c
push dword [ebp - 0x28]
lea ecx, [ebp - 0x8c0]
call fcn.10019299
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1003667e
xor eax, eax
push 2
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x100366bf
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x728], 0xe74b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x100366a7
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x100366e1
push dword [ebp - 0x28]
lea ecx, [ebp - 0xdc0]
call fcn.10019299
mov dword [eax], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x100366c7
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100366f1
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
mov eax, dword [ebp - 0x728]
dec dword [ebp - 0x728]
test eax, eax
jne 0x10036728
push eax
lea ecx, [ebp - 0x8c0]
call fcn.10019299
push 2
mov esi, eax
lea ecx, [ebp - 0xdc0]
pop eax
push eax
call fcn.10019299
mov ecx, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x5c]
mov dword [esi], ecx
push 0
lea ecx, [ebp - 0x8c0]
call fcn.10019299
xor ecx, ecx
push 2
cmp dword [eax], ecx
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
sub edx, 0x160c6370
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop eax
setle cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x908]
push eax
call fcn.10019299
push ebx
lea ecx, [ebp - 0x908]
mov esi, eax
call fcn.10019299
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x38]
setg bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x44]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xb22c
lea ecx, [ebp - 0xdc0]
setg al
mov dword [ebp - 0x2c], eax
call fcn.1001927d
lea ecx, [ebp - 0x8c0]
call fcn.1001927d
or eax, 0xffffffff
lea ecx, [ebp - 0x908]
mov dword [ebp - 4], eax
call fcn.1001927d
mov dword [ebp - 0x20], 0x73bf38c0
lea ecx, [ebp - 0xbf8]
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x4c], 0xe2632c5
push edi
call fcn.100191fb
mov dword [ebp - 4], 0x14
lea ecx, [ebp - 0x11b8]
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x7374489b
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x30], 0x5ec7e011
push 4
call fcn.100191fb
xor edi, edi
mov byte [ebp - 4], 0x15
inc edi
push 3
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x14], 0
pop esi
jmp 0x1003684e
push dword [ebp - 0x14]
lea ecx, [ebp - 0xbf8]
call fcn.10019299
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003683a
mov dword [ebp - 0x14], 0
jmp 0x10036870
push dword [ebp - 0x14]
lea ecx, [ebp - 0x11b8]
call fcn.10019299
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1003685c
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, edi
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
push 2
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setle cl
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0xbf8]
pop eax
setge bl
sub ebx, dword [ebp - 0x20]
neg ebx
push eax
sbb ebx, ebx
inc ebx
call fcn.10019299
xor edx, edx
mov dword [eax], ebx
mov eax, dword [ebp - 0x4c]
cmp ebx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x11b8]
inc dword [ebp - 0x40]
call fcn.1001927d
or ebx, 0xffffffff
lea ecx, [ebp - 0xbf8]
mov dword [ebp - 4], ebx
call fcn.1001927d
push esi
lea ecx, [ebp - 0x920]
call fcn.100191fb
mov dword [ebp - 4], 0x16
lea ecx, [ebp - 0xaa0]
xor eax, eax
mov dword [ebp - 0x5c], 0xeb77278f
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x44], eax
push edi
call fcn.100191fb
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xed4]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], edi
push esi
call fcn.100191fb
mov byte [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x38], 0xcc8c9f13
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1003697d
push dword [ebp - 0x28]
lea ecx, [ebp - 0x920]
call fcn.10019299
mov dword [eax], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10036963
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x100369a3
push dword [ebp - 0x28]
lea ecx, [ebp - 0xaa0]
call fcn.10019299
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10036985
xor eax, eax
push 2
mov dword [ebp - 0x28], eax
pop ebx
cmp dword [ebp - 0x28], ebx
jge 0x100369c6
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x7fc], 0xe74b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x100369ae
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x100369e8
push dword [ebp - 0x28]
lea ecx, [ebp - 0xed4]
call fcn.10019299
mov dword [eax], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x100369ce
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100369f8
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
mov eax, dword [ebp - 0x7fc]
dec dword [ebp - 0x7fc]
test eax, eax
jne 0x10036a2c
push eax
lea ecx, [ebp - 0xaa0]
call fcn.10019299
push ebx
lea ecx, [ebp - 0xed4]
mov esi, eax
call fcn.10019299
mov ecx, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x5c]
mov dword [esi], ecx
push 0
lea ecx, [ebp - 0xaa0]
call fcn.10019299
xor ecx, ecx
push ebx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
sub edx, 0x160c6370
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x920]
call fcn.10019299
push edi
lea ecx, [ebp - 0x920]
mov esi, eax
call fcn.10019299
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x38]
setg bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x44]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xb22c
lea ecx, [ebp - 0xed4]
setg al
mov dword [ebp - 0x2c], eax
call fcn.1001927d
lea ecx, [ebp - 0xaa0]
call fcn.1001927d
or eax, 0xffffffff
lea ecx, [ebp - 0x920]
mov dword [ebp - 4], eax
call fcn.1001927d
mov dword [ebp - 0x14], 0xe8cff0ea
mov dword [ebp - 0x24], edi
push 0xfffffffffffffff9
mov dword [ebp - 0x54], 6
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0x14f16367
push 0xfffffffffffffffd
pop esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x4c], 0x33d73c12
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x30], esi
push 2
mov dword [ebp - 0x5c], 0x49d95921
mov dword [ebp - 0x14], 0x13
pop ebx
cmp dword [ebp - 0x14], 0xffffffee
jg 0x10036b50
push 8
pop eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x14], 0
je 0x10036b35
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2c], 0
jne 0x10036b41
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x14], ebx
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x14]
jmp 0x10036b14
mov dword [ebp - 0x14], 0x537c57f3
xor edx, edx
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x54]
js 0x10036b7e
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x24]
sub eax, 9
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub ecx, eax
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x24]
test edx, edx
je 0x10036bf7
mov dword [ebp - 0x30], 0x161e
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x14], 0
jmp 0x10036bc7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x171c], 0xeda781b5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10036bb6
mov dword [ebp - 0x14], 0
jmp 0x10036be7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb40], 0xe520c3d8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10036bd6
dec dword [ebp - 0xb40]
jmp 0x10036cff
mov dword [ebp - 0x38], edi
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x38], 0x9421a0e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xb
jge 0x10036c3d
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10036c2e
push eax
push 0x12b5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [ebp - 0x4c]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xb
push 0
pop eax
jl 0x10036c12
push 0xfffffffffffffff9
mov dword [ebp - 0x20], 0x19
pop ecx
cmp dword [ebp - 0x20], ecx
jl 0x10036cff
jmp 0x10036c54
xor eax, eax
mov dword [ebp - 0x38], 0x6751
mov dword [ebp - 0x44], 0xf5756627
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10036c81
push edi
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x38]
setle cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
cmp eax, 0x58b5
jge 0x10036cac
cmp dword [ebp - 0x40], 0
je 0x10036cac
mov edx, edi
jmp 0x10036cae
xor edx, edx
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
push 0xfffffffffffffff9
sete cl
cmp edi, ecx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x5c]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setg dl
xor ecx, ecx
cmp eax, edx
pop eax
setg cl
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jge 0x10036c52
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x5c], 0xfffffff8
mov dword [ebp - 0x1c], 0x8f59172d
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x48], 0x989265
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x10], 0
jmp 0x10036d3b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10c0], 0x2c6eed1e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10036d2a
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10bc]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10036d75
mov dword [ebp - 0x48], 0x748a
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
jmp 0x10036ddf
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x2c], 0x69a4575f
mov dword [ebp - 0x40], 0x299b
cmp dword [ebp - 0x1c], eax
je 0x10036d8e
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xa660
push 0xfffffffffffffff9
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x34]
cmp edx, eax
pop eax
setl cl
cmp eax, ecx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
add edx, 0x26d35df9
cmp edx, eax
setne cl
mov dword [ebp - 0x10bc], ecx
mov dword [ebp - 0x34], 0x44bf8e16
lea ecx, [ebp - 0x470]
push ebx
call fcn.100191fb
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x10], 0
jmp 0x10036e13
push dword [ebp - 0x10]
call fcn.10019299
mov dword [eax], 0x57fd5464
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x470]
cmp dword [ebp - 0x10], ebx
jl 0x10036e02
push 0
call fcn.10019299
push 0
lea ecx, [ebp - 0x470]
mov dword [eax], 6
call fcn.10019299
push 0xfffffffffffffff6
pop esi
jmp 0x10036e9e