Function at 0x10031439
Capabilities:
Accept command line arguments
Allocate thread local storage
Create directory
Create pipe
Create process on windows
Create two anonymous pipes
Delete directory
Delete file
Delete registry key
Get common file path
Get geographical location
Get system information on windows
Identify system language via api
Log keystrokes via polling
Parse pe header
Query environment variable
Query or enumerate registry value
Read .ini file
Set environment variable
Start service
Terminate process

Disassembly:
mov eax, 0x100815a8
call fcn.1007fd14
mov eax, 0x15b4
call fcn.1007b540
push ebx
push esi
mov dword [ebp - 0x68], ecx
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x10], eax
push edi
inc ecx
mov byte [ebp - 0x61], dl
push 3
pop esi
cmp dword [ebp - 0x10], ecx
jge 0x1003147a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xfc4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10031466
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10031494
push 0x21a
push eax
push eax
call ebx
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100314a7
call edi
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
cmp dword [ebp - 0x10], ecx
jge 0x100314c6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcc4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100314b2
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100314da
push 0x21a
push eax
push eax
call ebx
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100314e7
call edi
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x18], eax
jmp 0x10031532
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10031518
push eax
push 0x1a86
push 0xfdc
call esi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003152f
push 0x19a0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x15
jle 0x100314f9
or eax, 0xffffffff
cmp dword [ebp - 0x18], eax
jge 0x10031543
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x1c], 0xfe387fb0
mov dword [ebp - 0x44], 0xd9dcee34
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3c], 0x4caa5d73
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10031587
mov edx, eax
jmp 0x1003158c
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
inc ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10031655
push 2
lea ecx, [ebp - 0xf3c]
call fcn.10017ff2
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003160b
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf3c]
call fcn.1001807e
mov ecx, 0xffff
mov dword [eax], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100315eb
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x23
jge 0x10031642
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], eax
jmp 0x10031634
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10031631
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
xor eax, eax
inc ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x1003161c
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x23
jl 0x10031617
or eax, 0xffffffff
lea ecx, [ebp - 0xf3c]
mov dword [ebp - 4], eax
call fcn.10018079
jmp 0x1003167b
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10031665
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003167d
push eax
push eax
push 0xb6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
cmp dword [ebp - 0x10], ecx
jge 0x100316a0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf40], 3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10031688
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100316b4
push 0x21a
push eax
push eax
call ebx
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100316c1
call edi
xor eax, eax
mov dword [ebp - 0x20], 0x6b8f3d42
xor edi, edi
mov dword [ebp - 0x44], 0x836b16b4
inc edi
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x44], 0x4f4e7975
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x10], eax
jmp 0x100316fc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf64], 0x4caf14c9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100316eb
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0x76942a1e
setl cl
xor eax, eax
mov dword [ebp - 0xf60], ecx
cmp ecx, 0xe60f
setle al
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
cmp eax, 0xc9ca
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setne dl
sub eax, edx
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x18], eax
jmp 0x100317ac
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10031792
push eax
push 0x1a86
push 0xfdc
call esi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100317a9
push 0x19a0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x15
jle 0x10031773
or esi, 0xffffffff
cmp dword [ebp - 0x18], esi
jge 0x100317bd
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xa9c]
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x20], esi
push edi
call fcn.10017ff2
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10031804
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa9c]
call fcn.1001807e
mov dword [eax], esi
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x100317e9
mov dword [ebp - 0x20], 0x18
cmp dword [ebp - 0x20], 0x1c
push 4
pop eax
jl 0x100318c4
jmp 0x1003181d
push 4
pop eax
mov dword [ebp - 0x38], 0x38c0
lea ecx, [ebp - 0x8d4]
mov dword [ebp - 0x44], 0xfffffffe
push eax
call fcn.10017ff2
push 4
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], 0
pop edi
jmp 0x1003185e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x8d4]
call fcn.1001807e
mov dword [eax], 0xa5f9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10031847
push 0
lea ecx, [ebp - 0xa9c]
call fcn.1001807e
push 0
lea ecx, [ebp - 0x8d4]
mov dword [eax], 6
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
call fcn.1001807e
xor edi, edi
xor edx, edx
xor ecx, ecx
inc edx
mov dword [eax], edi
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
cmp eax, edx
setle cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x8d4]
mov byte [ebp - 4], dl
call fcn.10018079
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1c
jge 0x1003181a
lea ecx, [ebp - 0xa9c]
mov dword [ebp - 4], esi
call fcn.10018079
xor edi, edi
mov dword [ebp - 0x38], 0x62d5e48d
inc edi
lea ecx, [ebp - 0x6dc]
push edi
call fcn.10017ff2
push 3
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x1430]
movdqa xmm0, xmmword [0x10007c40]
lea eax, [ebp - 0x1054]
push eax
mov dword [ebp - 0x44], 0x72c40a98
lea eax, [ebp - 0x1064]
mov dword [ebp - 0x34], 0xadb5
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], 9
push eax
movdqu xmmword [ebp - 0x1064], xmm0
call fcn.1001808d
lea ecx, [ebp - 0x185]
mov esi, eax
call fcn.10008d03
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1314]
push dword [esi]
call fcn.10018053
push 4
pop eax
mov byte [ebp - 4], al
mov dword [ebp - 0x28], 0x778d402a
mov dword [ebp - 0x10], 0
jmp 0x1003197a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x6dc]
call fcn.1001807e
mov dword [eax], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10031963
mov dword [ebp - 0x38], 0
jmp 0x10031b09
mov dword [ebp - 0x18], 0xc04ee7d2
lea ecx, [ebp - 0xdf8]
push 2
call fcn.10017ff2
mov byte [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x34], 0x7a32987c
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100319d7
push dword [ebp - 0x10]
lea ecx, [ebp - 0xdf8]
call fcn.1001807e
mov dword [eax], 0x5423
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100319b8
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x10031af5
or ecx, 0xffffffff
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0xf4aca62e
mov dword [ebp - 0x34], 0xdec53312
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x10031ae9
mov dword [ebp - 0x1c], 0xb8f5f499
mov dword [ebp - 0x30], 0x1940c9ba
mov dword [ebp - 0x50], 0xfffffff6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x10031a57
push dword [ebp - 0x20]
lea ecx, [ebp - 0x6dc]
call fcn.1001807e
push dword [ebp - 0x18]
lea ecx, [ebp - 0x6dc]
mov esi, eax
call fcn.1001807e
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0
jle 0x10031a2a
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x10031add
mov dword [ebp - 0x58], 0xd86bdae8
cmp dword [ebp - 0x18], eax
je 0x10031ac0
xor ecx, ecx
mov dword [ebp - 0x44], 0x23edb395
mov eax, dword [ebp - 0x1c]
cmp eax, 0xee9
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
setle cl
sub ecx, 0x76e1
neg ecx
sbb ecx, ecx
inc ecx
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
cmp ecx, 0xb5af9f7c
jne 0x10031aaf
cmp dword [ebp - 0x18], 0
je 0x10031aaf
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x18], eax
jle 0x10031abe
mov eax, edi
jmp 0x10031ac0
xor eax, eax
imul eax, eax, 0x864b
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x50], edi
cmp dword [ebp - 0x58], eax
jne 0x10031adb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10031a5f
xor eax, eax
dec dword [ebp - 0x20]
jns 0x10031a0d
or ecx, 0xffffffff
dec dword [ebp - 0x28]
dec dword [ebp - 0x18]
jns 0x100319e6
push 4
pop eax
lea ecx, [ebp - 0xdf8]
mov byte [ebp - 4], al
call fcn.10018079
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff9
jg 0x1003198b
lea ecx, [ebp - 0x1314]
call fcn.10018079
or edi, 0xffffffff
lea ecx, [ebp - 0x6dc]
mov dword [ebp - 4], edi
call fcn.10018079
movdqa xmm0, xmmword [0x10007c10]
lea eax, [ebp - 0x1084]
push eax
lea eax, [ebp - 0x1094]
push eax
lea ecx, [ebp - 0x14a0]
movdqu xmmword [ebp - 0x1094], xmm0
call fcn.1001808d
lea ecx, [ebp - 0x187]
mov esi, eax
call fcn.10008d03
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x808]
push dword [esi]
call fcn.10018053
mov dword [ebp - 4], 6
xor ecx, ecx
inc ecx
xor eax, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x1c], 0x94bb489f
mov dword [ebp - 0x34], eax
push 4
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], ecx
push 9
mov dword [ebp - 0x34], ecx
pop eax
mov dword [ebp - 0x48], 0xed6c34f1
push ecx
mov dword [ebp - 0x34], 0xfffffff6
lea ecx, [ebp - 0xf4c]
mov dword [ebp - 0x44], eax
call fcn.10017ff2
xor eax, eax
mov byte [ebp - 4], 7
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
cmp dword [ebp - 0x10], ecx
jge 0x10031bef
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf4c]
call fcn.1001807e
xor ecx, ecx
inc ecx
mov dword [eax], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10031bd2
xor eax, eax
push 3
mov dword [ebp - 0x20], eax
pop esi
jmp 0x10031d4c
mov dword [ebp - 0x3c], 0xe2c0d37a
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x50], 0xa2b441a6
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0x819d3388
mov dword [ebp - 0x54], 0x8af066b
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 0xd96456cf
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x3c], eax
jl 0x10031c97
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10031c62
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1534], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10031c4a
xor eax, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x38], eax
jl 0x10031c92
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10031c8a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcd4], 0x3a88e00f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10031c72
xor eax, eax
dec dword [ebp - 0x44]
dec dword [ebp - 0x38]
jns 0x10031c6a
dec dword [ebp - 0x3c]
jns 0x10031c3f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jg 0x10031d49
mov dword [ebp - 0x28], 0xb4ea65d3
lea ecx, [ebp - 0x808]
push dword [ebp - 0x18]
call fcn.1001807e
push dword [ebp - 0x18]
lea ecx, [ebp - 0x808]
call fcn.1001807e
mov eax, dword [ebp - 0x30]
sub eax, 7
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
jne 0x10031cf1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x808]
call fcn.1001807e
xor edi, edi
cmp dword [eax], edi
jne 0x10031cf1
xor eax, eax
jmp 0x10031cf4
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], 0
jl 0x10031d35
mov dword [ebp - 0x58], 0xfffffffe
mov dword [ebp - 0x28], 6
cmp dword [ebp - 0x28], 0
je 0x10031d1a
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
test eax, eax
setg cl
mov dword [ebp - 0x58], ecx
dec dword [ebp - 0x10]
jns 0x10031d00
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10031ca3
xor ecx, ecx
xor eax, eax
inc ecx
or edi, 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10031bfa
lea ecx, [ebp - 0xf4c]
call fcn.10018079
lea ecx, [ebp - 0x808]
mov dword [ebp - 4], edi
call fcn.10018079
xor eax, eax
mov dword [ebp - 0x20], 0x17571177
mov dword [ebp - 0x20], eax
jmp 0x10031dc5
mov dword [ebp - 0x10], 0xe3245f1d
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10031d95
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10031dbc
mov dword [ebp - 0x48], 0xf9e923e6
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10031db4
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x10031dc2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x14
jl 0x10031d9a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xe
je 0x10031d7c
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
cmp dword [ebp - 0x10], ecx
jge 0x10031dea
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x100c], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10031dd6
xor eax, eax
mov dword [ebp - 0x38], 0xea5d6c05
push 8
mov dword [ebp - 0x34], eax
pop edi
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x38], 0x15
jg 0x10031ed6
or esi, 0xffffffff
push 2
lea ecx, [ebp - 0xe10]
call fcn.10017ff2
push 9
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10031e45
xor edi, edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0xe10]
call fcn.1001807e
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10031e2a
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10031e57
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
xor eax, eax
xor edi, edi
inc edi
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], eax
jl 0x10031e89
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10031e84
push 0x2691
push 0x1f85
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x10031e62
lea ecx, [ebp - 0xe10]
mov dword [ebp - 4], esi
call fcn.10018079
mov byte [ebp - 0x3d], 0
cmp byte [ebp - 0x3d], 0
je 0x10032034
mov dword [ebp - 0x20], 0x51d69f42
lea ecx, [ebp - 0x8ec]
push 2
call fcn.10017ff2
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x48], 0x55a44198
mov dword [ebp - 0x10], 0
jmp 0x10031fc2
xor ecx, ecx
inc ecx
push ecx
lea ecx, [ebp - 0x6a0]
call fcn.10017ff2
mov dword [ebp - 4], edi
xor eax, eax
xor esi, esi
mov dword [ebp - 0x20], 0x66f5a9c4
mov dword [ebp - 0x10], eax
inc esi
cmp dword [ebp - 0x10], esi
jge 0x10031f17
push dword [ebp - 0x10]
lea ecx, [ebp - 0x6a0]
call fcn.1001807e
mov dword [eax], 0xe0b4074d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10031ef9
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10031f87
mov dword [ebp - 0x3c], 0xf0aa6e6f
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10031f3f
push eax
push 0x2307
push 0x14bb
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jl 0x10031f84
mov dword [ebp - 0x10], 0x188e17b8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x10031f7f
push dword [ebp - 0x10]
lea ecx, [ebp - 0x6a0]
call fcn.1001807e
push dword [ebp - 0x20]
lea ecx, [ebp - 0x6a0]
mov esi, eax
call fcn.1001807e
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x10]
jns 0x10031f56
xor eax, eax
dec dword [ebp - 0x3c]
jns 0x10031f47
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x10031f1c
or esi, 0xffffffff
lea ecx, [ebp - 0x6a0]
mov dword [ebp - 4], esi
call fcn.10018079
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x15
jg 0x10031ed3
jmp 0x10031e07
push dword [ebp - 0x10]
lea ecx, [ebp - 0x8ec]
call fcn.1001807e
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10031faf
cmp dword [ebp - 0x20], 0xa137b189
jne 0x10032006
cmp dword [ebp - 0x20], 0
je 0x10032006
mov eax, dword [ebp - 0x20]
mov ecx, 0x2b000cd8
mov esi, dword [ebp - 0x20]
sub ecx, eax
sub esi, ecx
lea ecx, [ebp - 0x8ec]
neg esi
push edi
sbb esi, esi
inc esi
call fcn.1001807e
push 3
mov dword [eax], esi
pop eax
cmp esi, eax
jg 0x10032003
mov eax, dword [ebp - 0x20]
or esi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x48], edi
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1003201b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea ecx, [ebp - 0x8ec]
mov dword [ebp - 4], esi
call fcn.10018079
push 0x21a
xor eax, eax
push eax
push eax
call ebx
mov dword [ebp - 0x1c], 0xfe387fb0
xor ebx, ebx
mov dword [ebp - 0x44], 0xd9dcee34
inc ebx
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3c], 0x4caa5d73
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x10032071
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x44], ecx
mov ecx, ebx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1003212c
push 2
lea ecx, [ebp - 0xf5c]
call fcn.10017ff2
xor eax, eax
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100320ef
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf5c]
call fcn.1001807e
mov ecx, 0xffff
mov dword [eax], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100320cf
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x10032116
mov dword [ebp - 0x1c], eax
jmp 0x1003210e
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003210b
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x100320f9
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x23
jl 0x100320f4
lea ecx, [ebp - 0xf5c]
mov dword [ebp - 4], esi
call fcn.10018079
jmp 0x10032152
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1003213c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10032152
push eax
push eax
push 0xb6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 4
pop eax
push eax
lea ecx, [ebp - 0x28c]
call fcn.10017ff2
mov dword [ebp - 4], 0xc
mov eax, 0xffff
mov dword [ebp - 0x18], 0xaa32b1ce
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], 0x6ff609d7
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], 0
jmp 0x100321ab
push dword [ebp - 0x10]
lea ecx, [ebp - 0x28c]
call fcn.1001807e
mov dword [eax], 6
inc dword [ebp - 0x10]
push 4
pop eax
cmp dword [ebp - 0x10], eax
jl 0x10032194
push 3
mov dword [ebp - 0x18], 0
pop edi
jmp 0x1003230a
mov dword [ebp - 0x34], 0xdedc87a9
mov dword [ebp - 0x34], 0xa4b38b4b
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x48], 0xe69d0863
mov dword [ebp - 0x34], 0x9989a98e
mov dword [ebp - 0x10], 0
jmp 0x100321fb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xce4], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100321ea
push ebx
lea ecx, [ebp - 0x28c]
call fcn.1001807e
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28c]
push 0
call fcn.1001807e
push 0
lea ecx, [ebp - 0x28c]
call fcn.1001807e
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov eax, dword [ebp - 0x44]
test eax, eax
sets cl
xor eax, eax
cmp ecx, 0x3439
lea ecx, [ebp - 0x28c]
setle al
mov dword [ebp - 0x28], eax
push dword [ebp - 0x18]
call fcn.1001807e
mov ecx, dword [ebp - 0x28]
xor ebx, ebx
push dword [ebp - 0x18]
cmp dword [eax], ecx
lea ecx, [ebp - 0x28c]
setl bl
call fcn.1001807e
xor ecx, ecx
cmp dword [eax], ebx
setle cl
neg ecx
je 0x100322af
mov dword [ebp - 0x10], 0
jmp 0x1003228f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd18], 0xf8f9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003227e
push 0
lea ecx, [ebp - 0x28c]
call fcn.1001807e
mov ecx, dword [ebp - 0xd18]
xor ebx, ebx
inc ebx
mov dword [eax], ecx
jmp 0x10032304
xor ebx, ebx
mov dword [ebp - 0x34], esi
inc ebx
mov dword [ebp - 0x34], 0x5d088182
mov dword [ebp - 0x34], 0x5540fff0
lea ecx, [ebp - 0xe20]
push ebx
call fcn.10017ff2
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x10], 0
jmp 0x100322ed
push dword [ebp - 0x10]
call fcn.1001807e
mov dword [eax], 5
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xe20]
cmp dword [ebp - 0x10], ebx
jl 0x100322dc
dec dword [ebp - 0x20]
mov byte [ebp - 4], 0xc
call fcn.10018079
mov eax, dword [ebp - 0x48]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x100321c2
lea ecx, [ebp - 0x28c]
mov dword [ebp - 4], esi
call fcn.10018079
xor eax, eax
mov ecx, 0xffff
mov byte [ebp - 0x11], al
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x54], 0xc3707822
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10032354
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1480], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10032340
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003236a
push 0xd81
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x147c], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x48]
cmp eax, 0x5052061f
setg cl
mov dword [ebp - 0x54], ecx
cmp byte [ebp - 0x11], 0
je 0x10032460
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x34], 0x5d16df25
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x44], 0x891f782a
mov dword [ebp - 0x28], 0xb03629aa
push 9
pop eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], 0xfffffffd
mov dword [ebp - 0x54], 0x4d92
inc dword [ebp - 0x44]
mov dword [ebp - 0x20], 0x19
jmp 0x10032450
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x10], 0
jmp 0x100323ed
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x330], 0x7392715e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100323dc
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x32c]
mov eax, dword [ebp - 0x330]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x38]
push 0
pop eax
sets al
xor ecx, ecx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x330]
mov eax, dword [ebp - 0x330]
cmp eax, 0xcea2
setle cl
xor edx, edx
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x32c]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x54], ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff4
jl 0x100323d0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ebx, 0x6b8f3d42
mov esi, 0x836b16b4
mov dword [ebp - 0x20], ebx
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x28], edi
xor edi, edi
mov dword [ebp - 0x44], 0x4f4e7975
inc edi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x10], eax
jmp 0x1003249b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1034], 0x4caf14c9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003248a
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0x76942a1e
setl cl
xor eax, eax
mov dword [ebp - 0x1030], ecx
cmp ecx, 0xe60f
setle al
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
cmp eax, 0xc9ca
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setne dl
sub eax, edx
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x20], 0xfffffff6
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003251d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff4
jle 0x1003253e
mov dword [ebp - 0x48], 0x32bb11ac
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff4
jg 0x10032526
xor eax, eax
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x18], eax
jmp 0x10032587
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003256d
push eax
push 0x1a86
push 0xfdc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032584
push 0x19a0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x15
jle 0x1003254a
or eax, 0xffffffff
cmp dword [ebp - 0x18], eax
jge 0x10032598
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x2c], 7
push 4
mov dword [ebp - 0x1c], edi
pop eax
mov dword [ebp - 0x3c], 0x3b0a6d08
mov dword [ebp - 0x28], 0xe834ab46
mov dword [ebp - 0x48], 5
push eax
call fcn.10017ff2
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x10], 0
jmp 0x100325fe
push dword [ebp - 0x10]
lea ecx, [ebp - 0x218]
call fcn.1001807e
mov dword [eax], 0x5cbf7935
inc dword [ebp - 0x10]
push 4
pop eax
cmp dword [ebp - 0x10], eax
jl 0x100325e7
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
push 9
setg dl
inc edx
neg edx
sbb edx, edx
inc edx
cmp edx, 0xc9105fa2
sbb eax, eax
or ecx, 0xffffffff
inc eax
cmp ecx, eax
pop ecx
sbb eax, eax
inc eax
cmp ecx, eax
push 3
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
test eax, eax
mov eax, dword [ebp - 0x2c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x985
pop ecx
setle al
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
push 3
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setg cl
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x48], ecx
pop ecx
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jl 0x10032809
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x10032800
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.1001807e
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.1001807e
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x218]
mov eax, dword [ebp - 0x44]
push dword [ebp - 0x1c]
call fcn.1001807e
push edi
lea ecx, [ebp - 0xb98]
call fcn.10017ff2
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], edi
jge 0x10032743
xor edi, edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb98]
call fcn.1001807e
mov dword [eax], edi
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10032725
xor edi, edi
inc edi
push 0
lea ecx, [ebp - 0x218]
call fcn.1001807e
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x218]
push dword [ebp - 0x1c]
call fcn.1001807e
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x218]
push dword [ebp - 0x1c]
call fcn.1001807e
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xb98]
push 0
call fcn.1001807e
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.1001807e
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp ecx, edi
mov ecx, dword [ebp - 0x2c]
setge dl
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [eax]
xor eax, eax
cmp ecx, 0x34d7
setne al
or ecx, 0xffffffff
cmp eax, ecx
ja 0x100327d4
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.1001807e
xor edi, edi
cmp dword [eax], edi
je 0x100327d1
inc edi
mov edx, edi
jmp 0x100327d6
xor edi, edi
inc edi
xor edx, edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0xb98]
mov byte [ebp - 4], 0xe
call fcn.10018079
dec dword [ebp - 0x1c]
jns 0x100326d7
push 3
xor eax, eax
pop ecx
dec dword [ebp - 0x3c]
jns 0x100326c1
or eax, 0xffffffff
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], eax
call fcn.10018079
mov dword [ebp - 0x20], ebx
xor eax, eax
mov dword [ebp - 0x44], esi
xor ebx, ebx
push 3
pop esi
mov dword [ebp - 0x28], esi
inc ebx
mov dword [ebp - 0x44], 0x4f4e7975
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x10], eax
jmp 0x1003284e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd2c], 0x4caf14c9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003283d
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0x76942a1e
push 4
setl cl
xor eax, eax
mov dword [ebp - 0xd28], ecx
cmp ecx, 0xe60f
setle al
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
cmp eax, 0xc9ca
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x564]
setne dl
sub eax, edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], 0xd562b994
pop eax
mov dword [ebp - 0x20], 0xfc35327
mov dword [ebp - 0x48], 8
mov dword [ebp - 0x28], 0xd681
push eax
call fcn.10017ff2
xor eax, eax
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1003290d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x108], 0x71b18d40
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100328f4
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1003292d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc4], 0xe7937d8e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10032915
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10032955
xor edi, edi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x564]
call fcn.1001807e
push 4
mov dword [eax], edi
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], eax
jl 0x10032938
xor eax, eax
mov dword [ebp - 0xc4], ebx
cmp dword [ebp - 0xc4], eax
jl 0x10032ac9
push esi
lea ecx, [ebp - 0x760]
call fcn.10017ff2
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x44], 0x56a218f0
mov dword [ebp - 0x10], 0
jmp 0x1003299e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x760]
call fcn.1001807e
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10032987
mov eax, dword [ebp - 0xc4]
xor edi, edi
cmp dword [ebp + eax*4 - 0x108], edi
jne 0x10032ab8
mov eax, dword [ebp - 0xc4]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x108]
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp + eax*4 - 0x108]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
mov ecx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x3c]
setl dl
add ecx, edx
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0x760]
sete bl
xor eax, eax
inc eax
push eax
call fcn.1001807e
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp + eax*4 - 0x108]
cmp ebx, eax
mov eax, dword [ebp - 0xc4]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc4]
setg dl
sub edx, eax
jne 0x10032a36
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10032a36
xor ebx, ebx
inc ebx
jmp 0x10032a3b
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x44], eax
xor edx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp + eax*4 - 0x108]
mov eax, dword [ebp - 0xc4]
cmp eax, ebx
setle dl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
add edx, 0x7e2c101d
jne 0x10032a73
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp + eax*4 - 0x108]
mov ecx, dword [ebp - 0x108]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x3ae5685e
lea ecx, [ebp - 0x760]
setne al
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 0x10
call fcn.10018079
dec dword [ebp - 0xc4]
jns 0x10032967
jmp 0x10032ac7
lea ecx, [ebp - 0x760]
mov byte [ebp - 4], 0x10
call fcn.10018079
xor eax, eax
cmp dword [ebp - 0x104], eax
je 0x10032b67
cmp dword [ebp - 0xc0], eax
je 0x10032ae4
cmp dword [ebp - 0x3c], eax
je 0x10032ae4
mov eax, ebx
mov ecx, dword [ebp - 0xbc]
imul ecx, eax
mov eax, dword [ebp - 0xc0]
push 2
sub eax, ecx
lea ecx, [ebp - 0x564]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
call fcn.1001807e
push ebx
lea ecx, [ebp - 0x564]
call fcn.1001807e
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x564]
push 0
call fcn.1001807e
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp ecx, dword [eax]
setge dl
cmp edx, dword [ebp - 0x3c]
jne 0x10032b3c
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x10032b3e
mov ecx, ebx
mov eax, dword [ebp - 0x3c]
sub ecx, eax
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc4]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, eax
mov eax, dword [ebp - 0x20]
imul eax, ecx
cmp eax, 0x9123ebaa
jb 0x10032b65
mov edx, ebx
jmp 0x10032b69
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x108]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x104]
neg eax
cmp eax, edx
setne cl
or eax, 0xffffffff
mov dword [ebp - 0xc4], ecx
lea ecx, [ebp - 0x564]
mov dword [ebp - 4], eax
call fcn.10018079
xor eax, eax
mov dword [ebp - 0x20], 0xfffffff6
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10032bb0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff4
jle 0x10032bd1
mov dword [ebp - 0x48], 0x32bb11ac
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff4
jg 0x10032bb9
xor eax, eax
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x44], 0x919c44d4
cmp dword [ebp - 0x24], eax
je 0x10032bf5
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
je 0x10032bf3
mov eax, ebx
jmp 0x10032bf5
xor eax, eax
add eax, 0xffffc62a
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10032c09
cmp dword [ebp - 0x24], eax
jne 0x10032c0e
cmp dword [ebp - 0x24], eax
je 0x10032c11
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x10], 0
jne 0x10032c23
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setg dl
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10032cb0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10032c70
mov ecx, 0xffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12cc], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10032c5c
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10032ca8
mov eax, dword [ebp - 0x24]
xor edi, edi
cmp dword [ebp + eax*4 - 0x12cc], edi
jne 0x10032cd0
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10032ca5
push 0xe5c
push eax
push 0x175b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x10032c75
jmp 0x10032cd0
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10032cd0
push eax
push 0x2030
push 0x170b
push 0xdeb
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 2
lea ecx, [ebp - 0x2a0]
call fcn.10017ff2
mov dword [ebp - 4], 0x12
or eax, 0xffffffff
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], 0x2aa0a5de
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x54], 0xfffffff9
mov dword [ebp - 0x24], 0
jmp 0x10032d17
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2a0]
call fcn.1001807e
mov dword [eax], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10032d04
push 4
mov dword [ebp - 0x24], 0
pop ecx
jmp 0x10032d3a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xec8], 0xab76d609
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10032d29
mov dword [ebp - 0x24], 0
jmp 0x10032d59
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x864], 0x59ea4d59
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10032d48
mov dword [ebp - 0x24], 0
jmp 0x10032d78
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x318], 0xbd907c4e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10032d67
dec dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xec8], eax
mov eax, dword [ebp - 0x85c]
dec dword [ebp - 0x85c]
cmp eax, 0xa83d
jne 0x10032da0