Function at 0x1002c8e9
Capabilities:
Compare security identifiers
Delete file
Extract resource via kernel32 functions
Get common file path
Get disk information
Get keyboard layout
Identify system language via api
Modify service
Parse pe header
Query or enumerate registry key
Query service status
Read .ini file
Start service

Disassembly:
mov eax, 0x1006b068
call fcn.100699bc
mov eax, 0x1434
call fcn.1005a490
push ebx
push esi
push edi
mov esi, 0x102d149f
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x18], esi
mov edi, 0xd46758e3
mov dword [ebp - 0x38], edi
xor ebx, ebx
mov dword [ebp - 0x1c], 0x4392
inc ebx
push 2
pop ecx
mov dword [ebp - 0x30], ecx
xor eax, eax
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x89], dl
cmp dword [ebp - 0x14], ebx
jge 0x1002c955
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x724], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002c93d
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002c967
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9f0], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002c95a
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x724], eax
je 0x1002c9c3
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002c9ae
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe84], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002c996
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002c9be
push eax
call dword [sym.imp.COMDLG32.dll_FindTextW]
dec dword [ebp - 0x4c]
jmp 0x1002c9da
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002c9da
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffe5
push 0xfffffffffffffff8
pop ecx
jne 0x1002ca31
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], eax
jmp 0x1002ca10
mov dword [ebp - 0x4c], eax
jmp 0x1002ca07
cmp dword [ebp - 0x2c], eax
jne 0x1002ca0d
mov dword [ebp - 0x9f0], 0xfffffffd
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0x34
jl 0x1002c9f5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x15
jl 0x1002c9f0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x9f0], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe5
push 0
pop eax
je 0x1002c9e8
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x1c], 0x4392
push 2
pop esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002ca6e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x774], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002ca56
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002ca80
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9e0], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002ca73
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x774], eax
je 0x1002cadc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002cac7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe94], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002caaf
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002cad7
push eax
call dword [sym.imp.COMDLG32.dll_FindTextW]
dec dword [ebp - 0x4c]
jmp 0x1002caf3
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002caf3
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002cb41
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x1c], eax
jmp 0x1002cb26
mov dword [ebp - 0x4c], eax
jmp 0x1002cb1d
cmp dword [ebp - 0x2c], eax
jne 0x1002cb23
mov dword [ebp - 0x9e0], 0xfffffffd
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0x34
jl 0x1002cb0b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x15
jl 0x1002cb06
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x9e0], eax
dec dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], 0xffffffe5
je 0x1002cafa
mov dword [ebp - 0x24], 0xfffffff9
lea ecx, [ebp - 0x7c4]
push esi
call fcn.1001565b
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x3c], 0xfffe
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x30], 0x275cf8b8
mov dword [ebp - 0x2c], 0xaf9eb11d
mov dword [ebp - 0x1c], eax
jmp 0x1002cb9d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x7c4]
call fcn.100156f9
mov dword [eax], 0x13034d00
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002cb86
inc dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x24]
cmp eax, ecx
jg 0x1002cbbd
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002cbbf
mov edi, eax
jmp 0x1002cbc1
xor eax, eax
mov edi, ebx
push eax
lea ecx, [ebp - 0x7c4]
call fcn.100156f9
push ebx
lea ecx, [ebp - 0x7c4]
mov esi, eax
call fcn.100156f9
push ebx
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x28]
imul ecx, dword [esi]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x7c4]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
call fcn.100156f9
mov ecx, dword [ebp - 0x54]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
add ecx, edi
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x7c4]
mov eax, dword [ebp - 0x30]
neg eax
mov dword [ebp - 0x2c], eax
or dword [ebp - 4], 0xffffffff
call fcn.100156dd
mov dword [ebp - 0x4c], ebx
xor eax, eax
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x50], 0xcd50997
mov dword [ebp - 0x30], 0xea2a
mov dword [ebp - 0x20], 0x65653d42
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], 0xea1b1489
mov dword [ebp - 0x60], 0xfe54
push 4
mov dword [ebp - 0x54], 0xc33490c
mov dword [ebp - 0x1c], eax
pop esi
jmp 0x1002cc82
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x588], 0xb055cc25
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002cc71
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x24]
test eax, eax
je 0x1002cd25
mov eax, dword [ebp - 0x584]
xor ecx, ecx
cmp eax, 0xfeae
setg cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x588]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x588]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002ccdf
mov edx, ebx
cmp dword [ebp - 0x24], eax
jne 0x1002cce1
mov edx, eax
mov eax, dword [ebp - 0x588]
xor ecx, ecx
cmp eax, edx
setge cl
cmp ebx, ecx
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x588]
jg 0x1002cd07
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002cd09
mov edx, ebx
jmp 0x1002cd0b
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x50]
xor ecx, ecx
cmp edx, eax
sete cl
add ecx, dword [ebp - 0x4c]
je 0x1002cd25
mov dword [ebp - 0x588], ebx
mov eax, dword [ebp - 0x30]
jmp 0x1002cd2d
xor eax, eax
mov dword [ebp - 0x588], eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x4c]
je 0x1002cd5d
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002ce25
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x1002cdf9
xor ecx, ecx
mov dword [ebp - 0x2c], 0xeae26468
mov eax, dword [ebp - 0x14]
cmp eax, 0x32215f8f
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x2c]
setl cl
xor ebx, ebx
cmp ecx, 0x98ef
setl bl
xor ecx, ecx
sub edx, 0x4f3ac16b
cmp edx, eax
setg cl
lea eax, [ecx + 1]
xor ecx, ecx
add eax, ebx
cmp eax, 0x9a81
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x54]
je 0x1002cdfd
xor ebx, ebx
mov dword [ebp - 0x1c], eax
inc ebx
cmp dword [ebp - 0x1c], ebx
jge 0x1002cdc8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6d0], 0xfff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002cdb0
xor eax, eax
mov dword [ebp - 0x4c], eax
jmp 0x1002cdf3
mov dword [ebp - 0x2c], 0x3e09e13a
mov dword [ebp - 0x50], 0xb817bb5c
cmp dword [ebp - 0x6d0], eax
je 0x1002cdea
cmp dword [ebp - 0x2c], eax
je 0x1002cdea
mov eax, ebx
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x4c]
push 0
pop eax
cmp dword [ebp - 0x4c], 0xfffffff0
jne 0x1002cdcd
xor eax, eax
jmp 0x1002ce25
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002ce20
push eax
push 0x47a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
xor ebx, ebx
xor eax, eax
inc ebx
push 0xfffffffffffffff8
mov dword [ebp - 0x14], 0xfffffffc
pop ecx
jmp 0x1002ce54
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], eax
jl 0x1002ce51
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x588], 0
jne 0x1002ce4f
dec dword [ebp - 0x20]
jns 0x1002ce3d
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002ce31
mov dword [ebp - 0x18], 0x102d149f
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xa
jmp 0x1002ceba
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], 0x14
cmp dword [ebp - 0x1c], 0xfffffff2
jl 0x1002ceb7
mov dword [ebp - 0x2c], 0x4320
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xd6b65720
cmp dword [ebp - 0x2c], eax
je 0x1002ce99
mov ecx, ebx
cmp dword [ebp - 0x50], eax
jne 0x1002ce9b
mov ecx, eax
mov eax, dword [ebp - 0x20]
sub eax, ecx
cmp eax, 0xe6f7fbf2
push 0
sbb eax, eax
inc eax
mov dword [ebp - 0x60], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff2
pop eax
jge 0x1002ce7c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x16
jle 0x1002ce6c
mov dword [ebp - 0x38], 0xd46758e3
lea ecx, [ebp - 0xe30]
push ebx
call fcn.1001565b
xor eax, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002cefe
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe30]
call fcn.100156f9
mov dword [eax], 0xec2e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002cee0
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop edi
cmp dword [ebp - 0x14], edi
jge 0x1002cf21
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4a8], 0xe83c7730
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002cf09
xor eax, eax
mov dword [ebp - 0x4a4], eax
push 8
pop ecx
cmp dword [ebp - 0x4a4], eax
jl 0x1002cf5b
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x30]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002cf53
push eax
push eax
push 0x7b5
call dword [sym.imp.ADVAPI32.dll_CopySid]
push 8
xor eax, eax
pop ecx
dec dword [ebp - 0x4a4]
jns 0x1002cf32
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002cf74
push 0x7e9
push 0x1bd
call dword [sym.imp.USER32.dll_SetCaretPos]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe30]
call fcn.100156dd
mov dword [ebp - 0x1c], 0x4392
lea ecx, [ebp - 0x85c]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x3c], 0xb4e
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
push ebx
call fcn.1001565b
mov dword [ebp - 4], edi
xor eax, eax
push 9
mov dword [ebp - 0x2c], ebx
pop esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002cfe1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x85c]
call fcn.100156f9
mov dword [eax], 0x7b831966
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002cfc3
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002cff7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], eax
jg 0x1002d017
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3c], eax
jle 0x1002d017
mov ecx, ebx
jmp 0x1002d01b
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x24]
add eax, ecx
imul eax, dword [ebp - 0x20]
test eax, eax
je 0x1002d033
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002d035
mov eax, ebx
jmp 0x1002d035
xor eax, eax
cmp esi, eax
mov eax, dword [ebp - 0x24]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor eax, eax
inc edx
sub edx, dword [ebp - 0x24]
je 0x1002d05b
mov esi, ebx
cmp dword [ebp - 0x1c], eax
jne 0x1002d05d
mov esi, eax
push eax
lea ecx, [ebp - 0x85c]
call fcn.100156f9
mov dword [eax], esi
mov eax, dword [ebp - 0x20]
sub esi, eax
add esi, 6
mov eax, 0xaf953423
cmp eax, esi
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
lea ecx, [ebp - 0x85c]
setne dl
sub edx, 0x28eaf608
neg edx
sbb edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x2c], edx
push eax
call fcn.100156f9
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax]
je 0x1002d0ad
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], 0x27720104
lea ecx, [ebp - 0x85c]
or dword [ebp - 4], 0xffffffff
call fcn.100156dd
push edi
lea ecx, [ebp - 0x384]
call fcn.1001565b
push 3
pop esi
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffffa
mov dword [ebp - 0x20], 0x7d711e7b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002d10b
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x384]
call fcn.100156f9
mov dword [eax], 0xdf75dcec
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002d0ed
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], ebx
jg 0x1002d1b4
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x384]
call fcn.100156f9
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x384]
call fcn.100156f9
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x384]
xor eax, eax
push eax
call fcn.100156f9
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x384]
call fcn.100156f9
mov esi, eax
lea ecx, [ebp - 0x384]
xor eax, eax
push eax
call fcn.100156f9
mov ecx, dword [eax]
mov dword [esi], ecx
test ecx, ecx
je 0x1002d17f
push ebx
lea ecx, [ebp - 0x384]
call fcn.100156f9
cmp dword [eax], 0
je 0x1002d17f
mov eax, ebx
jmp 0x1002d181
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002d19f
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002d19c
call dword [sym.imp.USER32.dll_WaitMessage]
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffe
je 0x1002d18b
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ebx
jle 0x1002d117
push 3
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x384]
call fcn.100156dd
mov dword [ebp - 0x4c], esi
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002d1eb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7dc], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002d1d3
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002d1fd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9c8], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002d1f0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x7dc], eax
je 0x1002d259
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002d244
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xea4], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002d22c
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002d254
push eax
call dword [sym.imp.COMDLG32.dll_FindTextW]
dec dword [ebp - 0x4c]
jmp 0x1002d270
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002d270
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002d2be
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x1c], eax
jmp 0x1002d2a3
mov dword [ebp - 0x4c], eax
jmp 0x1002d29a
cmp dword [ebp - 0x2c], eax
jne 0x1002d2a0
mov dword [ebp - 0x9c8], 0xfffffffd
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0x34
jl 0x1002d288
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x15
jl 0x1002d283
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x9c8], eax
dec dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], 0xffffffe5
je 0x1002d277
mov dword [ebp - 0x38], 0x53d42374
lea ecx, [ebp - 0xc08]
mov dword [ebp - 0x38], ebx
push ebx
call fcn.1001565b
xor eax, eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002d303
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x350], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002d2eb
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002d329
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc08]
call fcn.100156f9
mov dword [eax], 0x87642760
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002d30b
xor eax, eax
mov dword [ebp - 0x350], 0xffffffed
cmp dword [ebp - 0x350], 0xfffffffc
push 0xfffffffffffffff6
pop ecx
jl 0x1002d3e4
jmp 0x1002d347
xor eax, eax
mov dword [ebp - 0x30], 0x39ed
mov dword [ebp - 0x3c], 0xfda7ef5d
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002d371
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa28], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002d35d
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002d383
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6e0], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002d376
mov eax, dword [ebp - 0xa28]
lea ecx, [ebp - 0xc08]
xor eax, eax
push eax
call fcn.100156f9
mov eax, dword [ebp - 0xa28]
dec dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
dec ecx
neg ecx
push 0xfffffffffffffff6
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setl dl
xor ecx, ecx
mov dword [ebp - 0xa24], edx
mov eax, dword [ebp - 0x30]
cmp eax, edx
setne cl
mov dword [ebp - 0x6e0], ecx
inc dword [ebp - 0x350]
cmp dword [ebp - 0x350], 0xfffffffc
pop ecx
jge 0x1002d345
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc08]
call fcn.100156dd
mov dword [ebp - 0x24], 0xfffffff9
lea ecx, [ebp - 0x708]
push edi
call fcn.1001565b
mov dword [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x3c], 0xfffe
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x30], 0x275cf8b8
mov dword [ebp - 0x2c], 0xaf9eb11d
mov dword [ebp - 0x1c], eax
jmp 0x1002d44d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x708]
call fcn.100156f9
mov dword [eax], 0x13034d00
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002d436
inc dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x24]
cmp eax, ecx
jg 0x1002d46d
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002d46f
mov edi, eax
jmp 0x1002d471
xor eax, eax
mov edi, ebx
push eax
lea ecx, [ebp - 0x708]
call fcn.100156f9
push ebx
lea ecx, [ebp - 0x708]
mov esi, eax
call fcn.100156f9
push ebx
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x28]
imul ecx, dword [esi]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x708]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
call fcn.100156f9
mov ecx, dword [ebp - 0x54]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
or esi, 0xffffffff
add ecx, edi
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x708]
mov eax, dword [ebp - 0x30]
neg eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], esi
call fcn.100156dd
mov dword [ebp - 0x58], 0xdd03
xor eax, eax
mov dword [ebp - 0x3c], 0x66d210ec
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], 0x8531d14c
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x24], 0x39ee491
mov dword [ebp - 0x30], 0x54ab1007
push 2
mov dword [ebp - 0x54], 0x86565ea9
mov dword [ebp - 0x1c], eax
pop edi
jmp 0x1002d534
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x498], 0xad5befa1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002d523
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x24]
add eax, dword [ebp - 0x14]
jne 0x1002d577
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x498]
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x28], ecx
imul eax, dword [ebp - 0x28], 0xfffd
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x58]
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002d671
mov dword [ebp - 0x24], 0xc8ff05c8
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x2c], 0xd7787123
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002d5c6
push eax
push 0xaa6
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 8
pop eax
mov dword [ebp - 0x14], eax
jmp 0x1002d665
mov dword [ebp - 0x3c], 0xa061
mov dword [ebp - 0x58], 0x3a798be
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x498], eax
xor eax, eax
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x24], eax
jne 0x1002d635
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x498]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
dec eax
neg eax
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x24]
jg 0x1002d635
xor eax, eax
mov edx, eax
jmp 0x1002d637
mov edx, ebx
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp edx, eax
push 7
setle cl
add ecx, dword [ebp - 0x24]
neg ecx
pop eax
sbb ecx, ecx
inc ecx
cmp eax, ecx
mov ecx, 0xffff
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x4c]
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x58], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1c
jg 0x1002d5d1
jmp 0x1002d6df
mov dword [ebp - 0x38], 0x7363
lea ecx, [ebp - 0x102c]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0x6e2414c3
push 4
call fcn.1001565b
push 8
mov dword [ebp - 4], 6
pop eax
mov dword [ebp - 0x38], eax
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x38], 0x8e342ba5
mov dword [ebp - 0x30], 0x5796d0a3
mov dword [ebp - 0x1c], eax
jmp 0x1002d6c8
push dword [ebp - 0x1c]
call fcn.100156f9
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
lea ecx, [ebp - 0x102c]
jl 0x1002d6b7
dec dword [ebp - 0x30]
mov dword [ebp - 4], esi
call fcn.100156dd
mov dword [ebp - 0x4c], ebx
xor eax, eax
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x50], 0xcd50997
mov dword [ebp - 0x30], 0xea2a
mov dword [ebp - 0x20], 0x65653d42
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], 0xea1b1489
mov dword [ebp - 0x60], 0xfe54
mov dword [ebp - 0x54], 0xc33490c
mov dword [ebp - 0x1c], eax
jmp 0x1002d72e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x628], 0xb055cc25
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002d71d
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x24]
test eax, eax
je 0x1002d7d2
mov eax, dword [ebp - 0x624]
xor ecx, ecx
cmp eax, 0xfeae
setg cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x628]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x628]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002d78c
mov edx, ebx
cmp dword [ebp - 0x24], eax
jne 0x1002d78e
mov edx, eax
mov eax, dword [ebp - 0x628]
xor ecx, ecx
cmp eax, edx
setge cl
cmp ebx, ecx
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x628]
jg 0x1002d7b4
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002d7b6
mov edx, ebx
jmp 0x1002d7b8
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x50]
xor ecx, ecx
cmp edx, eax
sete cl
add ecx, dword [ebp - 0x4c]
je 0x1002d7d2
mov dword [ebp - 0x628], ebx
mov eax, dword [ebp - 0x30]
jmp 0x1002d7da
xor eax, eax
mov dword [ebp - 0x628], eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x4c]
je 0x1002d80a
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002d8d2
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x1002d8a6
xor ecx, ecx
mov dword [ebp - 0x2c], 0xeae26468
mov eax, dword [ebp - 0x14]
cmp eax, 0x32215f8f
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x2c]
setl cl
xor ebx, ebx
cmp ecx, 0x98ef
setl bl
xor ecx, ecx
sub edx, 0x4f3ac16b
cmp edx, eax
setg cl
lea eax, [ecx + 1]
xor ecx, ecx
add eax, ebx
cmp eax, 0x9a81
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x54]
je 0x1002d8aa
xor ebx, ebx
mov dword [ebp - 0x1c], eax
inc ebx
cmp dword [ebp - 0x1c], ebx
jge 0x1002d875
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x77c], 0xfff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002d85d
xor eax, eax
mov dword [ebp - 0x4c], eax
jmp 0x1002d8a0
mov dword [ebp - 0x2c], 0x3e09e13a
mov dword [ebp - 0x50], 0xb817bb5c
cmp dword [ebp - 0x77c], eax
je 0x1002d897
cmp dword [ebp - 0x2c], eax
je 0x1002d897
mov eax, ebx
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x4c]
push 0
pop eax
cmp dword [ebp - 0x4c], 0xfffffff0
jne 0x1002d87a
xor eax, eax
jmp 0x1002d8d2
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002d8cd
push eax
push 0x47a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
xor ebx, ebx
xor eax, eax
inc ebx
push 0xfffffffffffffff8
mov dword [ebp - 0x14], 0xfffffffc
pop ecx
jmp 0x1002d901
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], eax
jl 0x1002d8fe
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x628], 0
jne 0x1002d8fc
dec dword [ebp - 0x20]
jns 0x1002d8ea
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002d8de
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xa
jmp 0x1002d964
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x1c], 0x14
cmp dword [ebp - 0x1c], 0xfffffff2
jl 0x1002d961
mov dword [ebp - 0x2c], 0x4320
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xd6b65720
cmp dword [ebp - 0x2c], eax
je 0x1002d943
mov ecx, ebx
cmp dword [ebp - 0x50], eax
jne 0x1002d945
mov ecx, eax
mov eax, dword [ebp - 0x20]
sub eax, ecx
cmp eax, 0xe6f7fbf2
push 0
sbb eax, eax
inc eax
mov dword [ebp - 0x60], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff2
pop eax
jge 0x1002d926
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x16
jle 0x1002d912
mov dword [ebp - 0x14], 0x102d149f
lea ecx, [ebp - 0xe44]
push ebx
call fcn.1001565b
push 7
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002d9ab
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe44]
call fcn.100156f9
mov dword [eax], 0xec2e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002d98d
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002d9cb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x490], 0xe83c7730
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002d9b3
xor eax, eax
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], eax
jl 0x1002da03
mov dword [ebp - 0x30], 8
dec dword [ebp - 0x30]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002d9fb
push eax
push eax
push 0x7b5
call dword [sym.imp.ADVAPI32.dll_CopySid]
xor eax, eax
dec dword [ebp - 0x48c]
jns 0x1002d9d9
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002da1c
push 0x7e9
push 0x1bd
call dword [sym.imp.USER32.dll_SetCaretPos]
lea ecx, [ebp - 0xe44]
mov dword [ebp - 4], esi
call fcn.100156dd
mov dword [ebp - 0x3c], 0xb4e
lea ecx, [ebp - 0x910]
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
push ebx
call fcn.1001565b
push 8
pop eax
mov dword [ebp - 4], eax
xor eax, eax
push 9
mov dword [ebp - 0x2c], ebx
pop esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002da81
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x910]
call fcn.100156f9
mov dword [eax], 0x7b831966
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002da63
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002da97
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], eax
jg 0x1002dab7
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3c], eax
jle 0x1002dab7
mov ecx, ebx
jmp 0x1002dabb
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x24]
add eax, ecx
imul eax, dword [ebp - 0x20]
test eax, eax
je 0x1002dad3
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002dad5
mov eax, ebx
jmp 0x1002dad5
xor eax, eax
cmp esi, eax
mov eax, dword [ebp - 0x24]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor eax, eax
inc edx
sub edx, dword [ebp - 0x24]
je 0x1002dafb
mov esi, ebx
cmp dword [ebp - 0x1c], eax
jne 0x1002dafd
mov esi, eax
push eax
lea ecx, [ebp - 0x910]
call fcn.100156f9
mov dword [eax], esi
mov eax, dword [ebp - 0x20]
sub esi, eax
add esi, 6
mov eax, 0xaf953423
cmp eax, esi
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
lea ecx, [ebp - 0x910]
setne dl
sub edx, 0x28eaf608
neg edx
sbb edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x2c], edx
push eax
call fcn.100156f9
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax]
je 0x1002db4d
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], 0x27720104
lea ecx, [ebp - 0x910]
or dword [ebp - 4], 0xffffffff
call fcn.100156dd
mov dword [ebp - 0x38], 0xd46758e3
lea ecx, [ebp - 0x360]
push edi
call fcn.1001565b
push 9
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffffa
mov dword [ebp - 0x20], 0x7d711e7b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002dbb2
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x360]
call fcn.100156f9
mov dword [eax], 0xdf75dcec
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002db94
xor eax, eax
mov dword [ebp - 0x4c], eax
jmp 0x1002dc45
push dword [ebp - 0x4c]
call fcn.100156f9
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x360]
call fcn.100156f9
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x360]
xor eax, eax
push eax
call fcn.100156f9
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x360]
call fcn.100156f9
mov esi, eax
lea ecx, [ebp - 0x360]
xor eax, eax
push eax
call fcn.100156f9
mov ecx, dword [eax]
mov dword [esi], ecx
test ecx, ecx
je 0x1002dc1c
push ebx
lea ecx, [ebp - 0x360]
call fcn.100156f9
cmp dword [eax], 0
je 0x1002dc1c
mov eax, ebx
jmp 0x1002dc1e
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002dc3c
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002dc39
call dword [sym.imp.USER32.dll_WaitMessage]
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffe
je 0x1002dc28
inc dword [ebp - 0x4c]
lea ecx, [ebp - 0x360]
cmp dword [ebp - 0x4c], ebx
jle 0x1002dbba
or dword [ebp - 4], 0xffffffff
call fcn.100156dd
mov dword [ebp - 0x20], 0x4392
xor eax, eax
mov dword [ebp - 0x34], 0xc4d8e5c
mov dword [ebp - 0x1c], 0xb09f5954
mov dword [ebp - 0x28], 0x75507304
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x58], 0x685b90c3
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002dca9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x84], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002dc91
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002dccb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x131c], 0x6e9b1cc8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002dcb2
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x1002dce5
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, ebx
setg cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jl 0x1002dd18
mov dword [ebp - 0x24], 0x5d7c1543
jmp 0x1002ddd8
mov eax, 0xffff
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jg 0x1002ddd8
jmp 0x1002dd32
xor eax, eax
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002dd50
push 0xde
push 0x18aa
push 0x40
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov eax, dword [ebp - 0x34]
mov ecx, 0xdfe1602a
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x3c]
sub ecx, eax
mov eax, dword [ebp - 0x34]
sub ecx, dword [ebp + eax*4 - 0x84]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp + eax*4 - 0x84]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, esi
setne al
add eax, dword [ebp - 0x3c]
cmp eax, 0xfffb
mov eax, dword [ebp - 0x3c]
sbb edx, edx
add edx, 0xfffffffd
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor eax, eax
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jle 0x1002dd30
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x84]
neg ecx
inc dword [ebp - 0x58]
cmp eax, ecx
jne 0x1002ddee
mov ecx, ebx
jmp 0x1002ddf2
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x84]
xor edx, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x84]
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x131c]
push 3
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x84]
pop esi
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x1c]
push esi
setge cl
sub eax, ecx
lea ecx, [ebp - 0xfb8]
neg eax
sbb eax, eax
add eax, 2
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], edi
call fcn.1001565b
xor eax, eax
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002de80
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xfb8]
call fcn.100156f9
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002de66
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002de9a
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002de97
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x1002de85
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfb8]
call fcn.100156dd
mov dword [ebp - 0x48], esi
xor eax, eax
mov dword [ebp - 0x20], 0xee76f502
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002deda