Function at 0x10030da8
Capabilities:
Accept command line arguments
Check os version
Contain obfuscated stackstrings
Create pipe
Create process on windows
Delete directory
Delete file
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file attributes
Get system information on windows
Get thread local storage value
Log keystrokes
Parse pe header
Query environment variable
Query or enumerate registry value
Read .ini file
Set registry value
Set thread local storage value
Start service
Terminate process

Disassembly:
mov eax, 0x100764e6
call fcn.10075180
mov eax, 0x14ac
call fcn.10071930
push ebx
push esi
push edi
mov dword [ebp - 0x90], ecx
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x18], 0x7cf2
push 2
mov byte [ebp - 0x75], dl
call fcn.1001737c
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x3c], 0x3fe662db
mov dword [ebp - 0x20], 0x43ddca27
mov dword [ebp - 0x28], 0xfffe
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
jmp 0x10030e0f
push dword [ebp - 0x10]
call fcn.1001740a
mov dword [eax], 0xfe30f587
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
lea ecx, [ebp - 0xb8]
jl 0x10030dfe
mov eax, dword [ebp - 0x20]
xor eax, eax
push eax
call fcn.1001740a
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xb8]
xor edi, edi
inc edi
push edi
call fcn.1001740a
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
je 0x10030e64
push eax
lea ecx, [ebp - 0xb8]
call fcn.1001740a
cmp dword [eax], 0
je 0x10030e62
mov esi, edi
xor eax, eax
jmp 0x10030e66
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xb8]
call fcn.1001740a
sub esi, dword [eax]
jne 0x10030e7d
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10030e7f
mov eax, edi
add eax, 0x437
imul eax, eax, 0xffff
test eax, eax
jne 0x10030e91
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xb8]
dec dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
push edi
call fcn.1001740a
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0xb8]
sub esi, dword [eax]
neg esi
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.1001740a
xor ecx, ecx
push edi
cmp esi, dword [eax]
setg cl
dec ecx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0xb8]
call fcn.1001740a
mov ecx, dword [ebp - 0x20]
add ecx, 4
mov dword [eax], ecx
xor eax, eax
push eax
lea ecx, [ebp - 0xb8]
call fcn.1001740a
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xb8]
push edi
call fcn.1001740a
xor eax, eax
lea ecx, [ebp - 0xb8]
push eax
call fcn.1001740a
xor ebx, ebx
lea ecx, [ebp - 0xb8]
push edi
cmp dword [eax], edi
setne bl
call fcn.1001740a
lea ecx, [ebp - 0xb8]
mov esi, dword [eax]
sub esi, ebx
xor ebx, ebx
inc ebx
push ebx
call fcn.1001740a
mov ecx, dword [eax]
xor eax, eax
add ecx, esi
mov esi, dword [ebp - 0x20]
add esi, ecx
lea ecx, [ebp - 0xb8]
push eax
call fcn.1001740a
mov dword [eax], esi
xor eax, eax
cmp esi, 0xaef2d6a3
sete al
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10030f64
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x28], 0x17
jmp 0x10030fef
mov dword [ebp - 0x34], 0xfedea8f4
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10030f90
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
xor eax, eax
mov dword [ebp - 0x18], 0x13
jmp 0x10030fe6
mov dword [ebp - 0x3c], eax
jmp 0x10030fde
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x10030fdb
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xb8]
call fcn.1001740a
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xb8]
mov esi, eax
call fcn.1001740a
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10030fa6
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jle 0x10030f9e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x3a
jle 0x10030f99
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x20
jg 0x10030f74
or edi, 0xffffffff
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], edi
call fcn.10017405
mov dword [ebp - 0x38], 0xcdb8faaa
xor eax, eax
mov dword [ebp - 0x18], 0x9fe387fb
mov dword [ebp - 0x10], eax
jmp 0x1003102c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x548], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003101f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x548], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x100310b3
mov dword [ebp - 0x30], 0x54c97515
xor ecx, ecx
mov eax, dword [ebp - 0x544]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x548]
cmp eax, 0x67e6aa14
setle cl
mov dword [ebp - 0x30], ecx
mov ecx, 0x18d9
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + eax*4 - 0x548]
mov eax, dword [ebp - 0x30]
sub ecx, eax
xor eax, eax
cmp edx, ecx
setne al
xor edx, edx
cmp eax, 0xfffffffc
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x548]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
mov dword [ebp + eax*4 - 0x548], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x10031046
xor eax, eax
mov dword [ebp - 0x34], 0x1852
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x10], eax
jmp 0x100310d7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xebc], 0x47dc4b4e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100310c6
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x10031106
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xebc]
mov dword [ebp - 0xeb4], eax
dec dword [ebp - 0x1c]
jns 0x100310f1
push 3
lea ecx, [ebp - 0xa54]
call fcn.1001737c
push 2
lea ecx, [ebp - 0x31c]
mov dword [ebp - 4], ebx
call fcn.1001737c
push 4
lea ecx, [ebp - 0x804]
mov byte [ebp - 4], 2
call fcn.1001737c
xor eax, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10031162
push dword [ebp - 0x18]
lea ecx, [ebp - 0x31c]
call fcn.1001740a
mov dword [eax], 0xdf99ff60
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10031143
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1003117a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x804]
call fcn.1001740a
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10031167
push ebx
lea ecx, [ebp - 0x31c]
call fcn.1001740a
and dword [eax], 0
jmp 0x10031276
mov dword [ebp - 0x34], 0xec79cf18
xor eax, eax
mov dword [ebp - 0x38], 0x6887e0
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], 0xc73f
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x100311d1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x384], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100311b9
xor eax, eax
mov dword [ebp - 0x37c], ecx
jmp 0x10031258
mov dword [ebp - 0x10], 0xfffffffd
cmp dword [ebp - 0x37c], eax
je 0x100311f0
mov dword [ebp - 0x38], edi
dec dword [ebp - 0x10]
jmp 0x10031207
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10031202
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10031252
push ebx
lea ecx, [ebp - 0x31c]
call fcn.1001740a
cmp dword [eax], 0
jne 0x1003123c
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x804]
mov eax, dword [ebp - 0x10]
push ebx
call fcn.1001740a
mov eax, dword [ebp - 0x37c]
lea ecx, [ebp - 0x31c]
push ebx
call fcn.1001740a
mov esi, dword [ebp - 0x37c]
lea ecx, [ebp - 0x804]
push ebx
call fcn.1001740a
mov dword [eax], esi
xor eax, eax
inc dword [ebp - 0x37c]
cmp dword [ebp - 0x37c], 0x1c
je 0x100311d9
inc dword [ebp - 0x30]
lea ecx, [ebp - 0x31c]
push ebx
call fcn.1001740a
inc dword [eax]
push ebx
lea ecx, [ebp - 0x31c]
call fcn.1001740a
cmp dword [eax], 0x11
jl 0x10031194
lea ecx, [ebp - 0x804]
call fcn.10017405
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], bl
call fcn.10017405
mov dword [ebp - 0x38], 0x3c67ee39
lea ecx, [ebp - 0x81c]
push 2
call fcn.1001737c
push 2
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 4
call fcn.1001737c
mov byte [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x30], 0x2aa61fc2
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100312fe
push dword [ebp - 0x18]
lea ecx, [ebp - 0x81c]
call fcn.1001740a
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100312e2
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10031314
push dword [ebp - 0x18]
call fcn.1001740a
mov dword [eax], 0x25d16df2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
lea ecx, [ebp - 0xf4]
jl 0x10031303
push ebx
call fcn.1001740a
xor ebx, ebx
xor esi, esi
inc esi
mov dword [eax], ebx
jmp 0x1003135a
push esi
lea ecx, [ebp - 0xf4]
call fcn.1001740a
lea ecx, [ebp - 0x81c]
push dword [eax]
call fcn.1001740a
cmp dword [eax], ebx
jne 0x1003136a
push esi
lea ecx, [ebp - 0xf4]
call fcn.1001740a
inc dword [eax]
push esi
lea ecx, [ebp - 0xf4]
call fcn.1001740a
cmp dword [eax], esi
jle 0x1003132f
push esi
lea ecx, [ebp - 0xf4]
call fcn.1001740a
push esi
lea ecx, [ebp - 0xf4]
call fcn.1001740a
mov dword [ebp - 0x30], edi
lea ecx, [ebp - 0xf4]
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.1001740a
push esi
lea ecx, [ebp - 0xf4]
call fcn.1001740a
xor eax, eax
lea ecx, [ebp - 0xf4]
push eax
call fcn.1001740a
push esi
lea ecx, [ebp - 0xf4]
call fcn.1001740a
mov ecx, dword [ebp - 0x44]
xor ebx, ebx
push esi
cmp dword [eax], ecx
lea ecx, [ebp - 0x81c]
setg bl
call fcn.1001740a
xor ecx, ecx
cmp ebx, dword [eax]
setne cl
xor ebx, ebx
mov dword [ebp - 0x34], ecx
inc ebx
push ebx
lea ecx, [ebp - 0xf4]
call fcn.1001740a
mov ecx, dword [ebp - 0x44]
mov esi, eax
xor eax, eax
cmp dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x44]
setle al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0xf4]
setl dl
mov dword [esi], edx
call fcn.10017405
lea ecx, [ebp - 0x81c]
mov byte [ebp - 4], bl
call fcn.10017405
movdqa xmm0, xmmword [0x10007a40]
lea eax, [ebp - 0xfc0]
push eax
lea eax, [ebp - 0xfd0]
push eax
lea ecx, [ebp - 0x1344]
movdqu xmmword [ebp - 0xfd0], xmm0
call fcn.10017419
lea ecx, [ebp - 0x16d]
mov esi, eax
call fcn.100088c3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xa90]
push dword [esi]
call fcn.100173db
push 6
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x38], 0xe0cf5720
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1003148a
push eax
push 0x19db
push eax
call dword [sym.imp.GDI32.dll_GetRegionData]
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x100314ab
push 0x1d75
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov dword [ebp - 0x38], 0x9a13
mov dword [ebp - 0x3c], 0x2e08
mov dword [ebp - 0x10], 0xb0befcdf
mov dword [ebp - 0x18], 0xc1dfe936
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x44], 0xc0de450b
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100314f6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcd0], 0x80095520
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100314dd
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x100314fe
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
neg eax
push 0xfffffffffffffff7
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
cmp eax, 0xfc9b
pop esi
setle cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xcd0], ebx
mov dword [ebp - 0x3c], 0x17
cmp dword [ebp - 0x3c], 0xfffffff5
jge 0x100316dc
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x30], 0x4499c77e
mov dword [ebp - 0x1c], 0x5493a50e
mov dword [ebp - 0x40], 0xff24264a
mov dword [ebp - 0x30], 0xdfef28ed
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
sub eax, 0xb
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, esi
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x20]
jl 0x100315a3
mov ecx, ebx
cmp dword [ebp - 0x20], eax
jne 0x100315a5
mov ecx, eax
mov eax, dword [ebp - 0x18]
neg ecx
xor edx, edx
cmp eax, ecx
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
sub edx, 0x456014ef
cmp edx, 0xc53a
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x18]
jne 0x100315e5
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x100315e8
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov ecx, ebx
sub ecx, eax
xor eax, eax
cmp ecx, dword [ebp - 0x3c]
jge 0x10031600
mov ecx, ebx
cmp dword [ebp - 0xcc4], eax
jne 0x10031602
mov ecx, eax
xor eax, eax
cmp ecx, 0x206cbc8c
setge al
xor edx, edx
cmp eax, 0x29ef
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setle dl
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x10]
test eax, eax
je 0x1003164d
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
jmp 0x100316bc
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop edx
jmp 0x10031698
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jg 0x1003167d
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0xcd0]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcd0], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1003165f
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10031695
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 3
xor eax, eax
pop edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x10031657
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x100316bc
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x100316b7
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x100316a5
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x100316cf
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff5
jl 0x1003155a
mov dword [ebp - 0x38], 0xae974ca7
or eax, 0xffffffff
mov dword [ebp - 0x38], 0x4ff5452f
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jl 0x1003173a
mov dword [ebp - 0x10], eax
jmp 0x10031710
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x758], 2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100316ff
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x758], eax
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1003172f
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
dec dword [ebp - 0x1c]
push 0
pop eax
cmp dword [ebp - 0x1c], esi
jge 0x100316fa
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0xdc0]
mov dword [ebp - 0x10], 0xbf58aae0
mov dword [ebp - 0x38], 0x5706b379
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x38], 0x4cff15cc
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 2
push 3
call fcn.1001737c
mov byte [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x44], 0xfffffffc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1003179d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x2f4], 0xb3921ded
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10031785
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x100317c5
push dword [ebp - 0x28]
lea ecx, [ebp - 0xa54]
call fcn.1001740a
mov dword [eax], 9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x100317a6
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x100317e1
push dword [ebp - 0x28]
lea ecx, [ebp - 0xdc0]
call fcn.1001740a
mov dword [eax], 8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x100317ca
push 3
lea ecx, [ebp - 0xa90]
call fcn.1001740a
push 2
lea ecx, [ebp - 0xa54]
mov esi, eax
call fcn.1001740a
inc dword [esi]
lea ecx, [ebp - 0xa90]
push 3
call fcn.1001740a
mov ecx, dword [ebp - 0x44]
mov eax, dword [eax]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2f4]
inc dword [ebp - 0x44]
cmp eax, ecx
jle 0x1003182e
mov edx, ebx
jmp 0x10031832
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x34]
sub edx, eax
mov eax, dword [ebp - 0x30]
cmp edx, eax
setne cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0xdc0]
call fcn.10017405
lea ecx, [ebp - 0xa90]
call fcn.10017405
or eax, 0xffffffff
lea ecx, [ebp - 0xa54]
mov dword [ebp - 4], eax
call fcn.10017405
push 2
lea ecx, [ebp - 0x8dc]
call fcn.1001737c
push 2
lea ecx, [ebp - 0x104]
mov dword [ebp - 4], 8
call fcn.1001737c
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x30], 0x2aa61fc2
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100318d3
push dword [ebp - 0x18]
lea ecx, [ebp - 0x8dc]
call fcn.1001740a
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100318b7
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100318e9
push dword [ebp - 0x18]
call fcn.1001740a
mov dword [eax], 0x25d16df2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
lea ecx, [ebp - 0x104]
jl 0x100318d8
push ebx
call fcn.1001740a
xor ebx, ebx
xor esi, esi
inc esi
mov dword [eax], ebx
jmp 0x1003192f
push esi
lea ecx, [ebp - 0x104]
call fcn.1001740a
lea ecx, [ebp - 0x8dc]
push dword [eax]
call fcn.1001740a
cmp dword [eax], ebx
jne 0x1003193f
push esi
lea ecx, [ebp - 0x104]
call fcn.1001740a
inc dword [eax]
push esi
lea ecx, [ebp - 0x104]
call fcn.1001740a
cmp dword [eax], esi
jle 0x10031904
push esi
lea ecx, [ebp - 0x104]
call fcn.1001740a
push esi
lea ecx, [ebp - 0x104]
call fcn.1001740a
or eax, 0xffffffff
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.1001740a
push esi
lea ecx, [ebp - 0x104]
call fcn.1001740a
xor eax, eax
lea ecx, [ebp - 0x104]
push eax
call fcn.1001740a
push esi
lea ecx, [ebp - 0x104]
call fcn.1001740a
mov ecx, dword [ebp - 0x44]
xor ebx, ebx
push esi
cmp dword [eax], ecx
lea ecx, [ebp - 0x8dc]
setg bl
call fcn.1001740a
xor ecx, ecx
cmp ebx, dword [eax]
setne cl
xor ebx, ebx
mov dword [ebp - 0x34], ecx
inc ebx
push ebx
lea ecx, [ebp - 0x104]
call fcn.1001740a
mov ecx, dword [ebp - 0x44]
mov esi, eax
xor eax, eax
cmp dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x44]
setle al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x104]
setl dl
mov dword [esi], edx
call fcn.10017405
or esi, 0xffffffff
lea ecx, [ebp - 0x8dc]
mov dword [ebp - 4], esi
call fcn.10017405
xor eax, eax
mov dword [ebp - 0x38], 0xe0cf5720
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x10031a18
push eax
push 0x19db
push eax
call dword [sym.imp.GDI32.dll_GetRegionData]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10031a33
push 0x1d75
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov dword [ebp - 0x38], 0xcdb8faaa
mov dword [ebp - 0x3c], 0x2e08
mov dword [ebp - 0x10], 0xb0befcdf
mov dword [ebp - 0x18], 0xc1dfe936
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x44], 0xc0de450b
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10031a7e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd10], 0x80095520
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10031a65
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10031a86
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
cmp eax, 0xfc9b
setle cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xd10], ebx
mov dword [ebp - 0x3c], 0x17
cmp dword [ebp - 0x3c], 0xfffffff5
jge 0x10031c62
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x30], 0x4499c77e
mov dword [ebp - 0x1c], 0x5493a50e
mov dword [ebp - 0x40], 0xff24264a
mov dword [ebp - 0x30], 0xdfef28ed
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
sub eax, 0xb
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0xfffffff7
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x20]
jl 0x10031b29
mov ecx, ebx
cmp dword [ebp - 0x20], eax
jne 0x10031b2b
mov ecx, eax
mov eax, dword [ebp - 0x18]
neg ecx
xor edx, edx
cmp eax, ecx
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
sub edx, 0x456014ef
cmp edx, 0xc53a
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x18]
jne 0x10031b6b
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10031b6e
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov ecx, ebx
sub ecx, eax
xor eax, eax
cmp ecx, dword [ebp - 0x3c]
jge 0x10031b86
mov ecx, ebx
cmp dword [ebp - 0xd04], eax
jne 0x10031b88
mov ecx, eax
xor eax, eax
cmp ecx, 0x206cbc8c
setge al
xor edx, edx
cmp eax, 0x29ef
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setle dl
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x10]
test eax, eax
je 0x10031bd3
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
jmp 0x10031c42
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop edx
jmp 0x10031c1e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jg 0x10031c03
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0xd10]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd10], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x10031be5
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10031c1b
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 3
xor eax, eax
pop edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x10031bdd
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x10031c42
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10031c3d
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10031c2b
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x10031c55
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff5
jl 0x10031adf
xor eax, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff7
jl 0x10031cb2
jmp 0x10031c74
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10031c8a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x61c], 2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10031c79
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x61c], eax
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x10031ca9
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff7
jge 0x10031c72
push 3
lea ecx, [ebp - 0xc1c]
call fcn.1001737c
xor eax, eax
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10031ce6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1478], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10031cd1
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10031d08
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5e0], 0xa76aabec
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10031cef
xor eax, eax
mov dword [ebp - 0x5e0], eax
jmp 0x10031d44
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10031d2c
push 0x5cb
push 0xb7a
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10031d3e
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
inc dword [ebp - 0x5e0]
cmp dword [ebp - 0x5e0], 3
jle 0x10031d10
mov dword [ebp - 0x38], 0x3c67ee39
lea ecx, [ebp - 0x524]
mov dword [ebp - 0x20], 0x39ed
push 2
call fcn.1001737c
mov byte [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x10], 0xf90350d8
mov dword [ebp - 0x34], 0xf86f25db
mov dword [ebp - 0x24], 0xf4caa5d7
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], eax
jmp 0x10031d9e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x524]
call fcn.1001740a
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10031d8b
mov eax, dword [ebp - 0x20]
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x20], eax
je 0x10031db2
mov edi, ebx
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x524]
mov eax, dword [ebp - 0x20]
xor eax, eax
push eax
call fcn.1001740a
mov edx, dword [ebp - 0x20]
mov esi, eax
mov ecx, dword [ebp - 0x20]
xor eax, eax
add edx, edi
cmp edx, ecx
lea ecx, [ebp - 0x524]
setge al
sub eax, dword [ebp - 0x20]
imul eax, dword [esi]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor eax, eax
push eax
call fcn.1001740a
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x524]
mov eax, dword [ebp - 0x34]
xor eax, eax
push eax
call fcn.1001740a
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, 9
lea ecx, [ebp - 0x524]
push ebx
setg dl
add edx, dword [eax]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
call fcn.1001740a
mov edx, dword [ebp - 0x10]
mov esi, eax
mov ecx, dword [ebp - 0x20]
xor eax, eax
cmp ecx, edx
setge al
cmp eax, dword [esi]
jge 0x10031e48
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10031e4a
mov eax, ebx
jmp 0x10031e4a
xor eax, eax
mov ecx, 0xffff
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, ebx
mov eax, 0xb8b0d58e
setge cl
sub eax, ecx
xor ecx, ecx
cmp eax, 0x8f50
mov eax, dword [ebp - 0x24]
setle cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
mov ecx, 0xec0
setl bl
sub ecx, eax
xor eax, eax
cmp ecx, 0xfffffff6
setle al
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x524]
mov byte [ebp - 4], 0xa
call fcn.10017405
movdqa xmm0, xmmword [0x10007a40]
lea eax, [ebp - 0xff0]
push eax
lea eax, [ebp - 0x1000]
push eax
lea ecx, [ebp - 0x1394]
movdqu xmmword [ebp - 0x1000], xmm0
call fcn.10017419
lea ecx, [ebp - 0x194]
mov esi, eax
call fcn.100088c3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xa84]
push dword [esi]
call fcn.100173db
mov byte [ebp - 4], 0xc
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x10], eax
inc ebx
or edi, 0xffffffff
cmp dword [ebp - 0x10], ebx
jge 0x10031f1f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x80], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10031f0e
xor eax, eax
mov dword [ebp - 0x80], 0xfffffffc
jmp 0x10031fb6
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10031f40
push eax
call dword [sym.imp.USER32.dll_CharNextW]
xor eax, eax
cmp dword [ebp - 0x80], eax
je 0x10031f7b
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10031f63
push eax
push 0x254e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10031fb3
push eax
push ebx
push 0x20d
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
jmp 0x10031fb1
mov dword [ebp - 0x30], 0x5b7d8cf4
mov dword [ebp - 0x48], 0xfffffffe
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x80], 0xfffffffd
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x34], eax
xor eax, eax
inc dword [ebp - 0x80]
cmp dword [ebp - 0x80], 8
jne 0x10031f2b
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10031fd0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [ebp - 0x38], 0x9a13
lea ecx, [ebp - 0xed4]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0xe1e87df2
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], 9
push ebx
call fcn.1001737c
mov byte [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0x83674579
mov dword [ebp - 0x38], 0x761be360
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10032030
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x142c], 0x6801fc3e
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10032017
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10032052
push dword [ebp - 0x28]
lea ecx, [ebp - 0xed4]
call fcn.1001740a
mov dword [eax], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10032038
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10032074
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1160], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1003205b
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1003208a
push eax
push 0x1d35
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
inc dword [ebp - 0x1158]
lea ecx, [ebp - 0xed4]
mov byte [ebp - 4], 0xc
call fcn.10017405
mov dword [ebp - 0x38], 0xae974ca7
xor eax, eax
mov dword [ebp - 0x30], 0x6e32
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], 0x8e00f680
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0x3895196e
mov dword [ebp - 0x38], 0x208373b2
mov dword [ebp - 0x38], 0xf09a2b44
mov dword [ebp - 0x38], 0x6950a4ba
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x10], eax
jmp 0x100320f4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1b8], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100320e3
mov eax, dword [ebp - 0x30]
inc dword [ebp - 0x44]
je 0x10032118
mov eax, dword [ebp - 0x1b8]
imul ecx, eax, 0x77e0
mov eax, dword [ebp - 0x44]
sub ecx, eax
je 0x10032118
mov eax, ebx
jmp 0x1003211a
xor eax, eax
mov ecx, 0xfff8
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, 0x9e923e64
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 8
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
neg edx
cmp eax, edx
setne cl
xor eax, eax
sub ecx, dword [ebp - 0x1b8]
mov dword [ebp - 0x1b8], ecx
mov dword [ebp - 0x38], 0x4ff5452f
mov dword [ebp - 0x4c], 0xfffffff7
mov dword [ebp - 0x18], 0xca4f833f
mov dword [ebp - 0x34], 0x191b4956
mov dword [ebp - 0x30], 0x7d266845
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10032195
mov esi, 0xffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x414], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10032180
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
push 0xfffffffffffffff8
pop esi
jg 0x1003228c
mov dword [ebp - 0x40], 3
lea ecx, [ebp - 0xc7c]
mov dword [ebp - 0x30], ebx
push 3
call fcn.1001737c
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x10], eax
jmp 0x100321de
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc7c]
call fcn.1001740a
mov dword [eax], 0x2d683a7e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100321c7
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x414]
mov eax, dword [ebp - 0x34]
sub eax, 0x4e80031a
neg eax
sbb eax, eax
inc eax
sub eax, esi
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setl cl
cmp ecx, dword [ebp + eax*4 - 0x414]
jge 0x10032225
mov eax, dword [ebp - 0x414]
mov eax, dword [ebp - 0x40c]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x414]
test eax, eax
sete cl
cmp ecx, dword [ebp - 0x30]
jl 0x10032251
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x414]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xc7c]
mov eax, dword [ebp + eax*4 - 0x414]
xor eax, eax
push eax
call fcn.1001740a
mov ecx, dword [ebp - 0x40]
mov byte [ebp - 4], 0xc
mov dword [eax], ecx
lea ecx, [ebp - 0xc7c]
call fcn.10017405
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x100321a5
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x100322a5
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
xor eax, eax
mov dword [ebp - 0x48], 0xbf58aae0
mov dword [ebp - 0x38], 0x5706b379
mov dword [ebp - 0x24], 0x5d6c05ba
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x100322d6
push ebx
push 0x257d
push 0x19e6
call dword [sym.imp.USER32.dll_AttachThreadInput]
xor eax, eax
mov dword [ebp - 0x24], 0xfffffff2
jmp 0x1003230b
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x10], eax
jmp 0x10032302
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x100322ff
push 0x163e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe4
je 0x100322e7
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe5
jle 0x100322df
mov dword [ebp - 0x4c], 0xfffffff9
lea ecx, [ebp - 0xa6c]
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], 0x3b8c105a
mov dword [ebp - 0x30], 0x6bc22736
mov dword [ebp - 0x44], 0x245c
mov dword [ebp - 0x30], 0x1031c36b
push ebx
call fcn.1001737c
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x24], 0x53b
mov dword [ebp - 0x10], eax
jmp 0x10032372
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa6c]
call fcn.1001740a
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003235f
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], 0x67d9
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jne 0x100323b6
cmp dword [ebp - 0x44], eax
je 0x100323b8
mov eax, ebx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
imul ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
sub eax, ecx
je 0x100323d4
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x100323d6
mov ecx, ebx
jmp 0x100323d8
xor eax, eax
mov ecx, eax
mov esi, dword [ebp - 0x1c]
xor eax, eax
add esi, ecx
lea ecx, [ebp - 0xa6c]
push eax
call fcn.1001740a
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
cmp esi, eax
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp ecx, 3
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
sub ecx, 0x3331e340
je 0x10032442
cmp dword [ebp - 0x24], eax
je 0x10032442
cmp dword [ebp - 0x10], eax
je 0x10032442
mov dword [ebp - 0x34], 0x5ce4ec6f
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x10032492
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor eax, eax
jmp 0x10032492
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x38], 0x85aa1ede
mov dword [ebp - 0x38], 0x81b1d0b8
mov dword [ebp - 0x10], 0xf61160dd
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], 0xc0f86f4c
push 6
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], 0xfffffffc
dec dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
jmp 0x1003248c
cmp dword [ebp - 0x34], eax
jne 0x10032492
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 5
jle 0x10032484
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x100324b1
push 0x2277
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0xa6c]
mov byte [ebp - 4], 0xc
call fcn.10017405
mov dword [ebp - 0x38], 0x4cff15cc
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x30], 0x815cbcef
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0xeb8e136d
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1003251e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13fc], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10032505
xor eax, eax
mov dword [ebp - 0x1c], eax
mov esi, 0xb1510afb
cmp dword [ebp - 0x1c], 0xffffffe7
jg 0x10032629
mov dword [ebp - 0x10], 0x85c6f1bf
lea ecx, [ebp - 0xdd0]
push 4
call fcn.1001737c
xor eax, eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10032572
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdd0]
call fcn.1001740a
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10032553
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10032592
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x408], 0x11de2a90
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003257a
xor eax, eax
mov dword [ebp - 0x10], 0xfffffff2
jmp 0x10032605
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0x3648bd92
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0x5378470e
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x38], 0x5f5a2f61
mov dword [ebp - 0x38], 0xe458c458
cmp dword [ebp - 0x1c], eax
je 0x100325de
mov edx, ebx
cmp dword [ebp - 0x30], eax
jne 0x100325e0
mov edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x34]
push 0
setg cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
pop eax
setne cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x408]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffec
jl 0x1003259b
lea ecx, [ebp - 0xdd0]
mov byte [ebp - 4], 0xc
call fcn.10017405
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe7
jle 0x10032530
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0xeec]
mov dword [ebp - 0x30], 0xb0ceafd
mov dword [ebp - 0x18], 0xca968364
mov dword [ebp - 0x24], 0xb0ae28de
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x34], eax
push ebx
call fcn.1001737c
mov byte [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x10], eax
jmp 0x10032675
push dword [ebp - 0x10]
call fcn.1001740a
mov dword [eax], 4
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xeec]
cmp dword [ebp - 0x10], ebx
jl 0x10032664
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0xcac24577
mov byte [ebp - 4], 0xc
call fcn.10017405
mov dword [ebp - 0x30], 2
lea ecx, [ebp - 0xde0]
push 3
call fcn.1001737c
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x10], 0x6aabecba
mov dword [ebp - 0x38], 0x9f3690f1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1003270a
push dword [ebp - 0x10]
lea ecx, [ebp - 0xde0]
call fcn.1001740a
mov dword [eax], 0x313dd33a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100326eb
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10032718
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x30]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x1003270f
lea ecx, [ebp - 0xde0]
mov byte [ebp - 4], 0xc
call fcn.10017405
push 3
lea ecx, [ebp - 0xf04]
call fcn.1001737c
xor eax, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0xb8c]
push 2
call fcn.1001737c
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003277e