Function at 0x1002f3e9
Capabilities:
Create pipe
Create thread
Delete file
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file size
Get file system object information
Identify system language via api
Query or enumerate registry key

Disassembly:
mov eax, 0x10067bde
call fcn.10066a48
sub esp, 0x81c
push ebx
push esi
push edi
push 1
pop eax
mov dword [ebp - 0x24], 0x17c2
cmp dword [ebp - 0x24], 0xbd2
push 0
mov byte [ebp - 0x45], dl
mov dword [ebp - 0x6c], ecx
pop ebx
mov dword [ebp - 0x50], 0xa
jge 0x1002f4da
push eax
push eax
mov edx, eax
xor ecx, ecx
call fcn.1002f390
mov edi, dword [0x1099da58]
lea eax, [ebp - 0xb8]
sub edi, dword [0x1099da54]
push eax
push 0x10008ae4
sar edi, 2
call fcn.1004eb10
mov eax, dword [ebp - 0xb8]
add esp, 0x10
test eax, eax
je 0x1002f4d3
dec eax
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0x240]
push eax
push 0x10008ae4
call fcn.1004eb10
pop ecx
xor esi, esi
mov bl, 1
pop ecx
test edi, edi
jle 0x1002f4bd
mov eax, dword [0x1099da54]
mov eax, dword [eax + esi*4]
cmp eax, dword [ebp - 0x240]
jg 0x1002f4b8
test bl, bl
jne 0x1002f499
push 0x2c
call fcn.1004fee8
pop ecx
mov eax, dword [0x1099da54]
xor bl, bl
push dword [eax + esi*4]
mov eax, dword [0x1099d9c4]
push dword [eax + esi*4]
push 0x10008dec
call fcn.1004f14f
add esp, 0xc
inc esi
cmp esi, edi
jl 0x1002f47d
push 0xa
pop eax
push eax
call fcn.1004fee8
mov eax, dword [ebp - 0xb8]
pop ecx
test eax, eax
jne 0x1002f45b
xor ebx, ebx
dec eax
mov dword [ebp - 0xb8], eax
push 6
pop esi
mov dword [ebp - 0x18], esi
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002f506
push 0xfd3
push ebx
push ebx
push 0x161d
push 0x11ec
push ebx
push 0x183e
call dword [sym.imp.GDI32.dll_GetDIBits]
mov ebx, dword [sym.imp.KERNEL32.dll_IsValidLocale]
push 3
mov dword [ebp - 0x18], 0xffffffe6
pop edi
jmp 0x1002f5a4
push edi
lea ecx, [ebp - 0x3ec]
call fcn.10028b5c
xor edx, edx
mov dword [ebp - 0x10], edx
jmp 0x1002f541
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3ec]
mov dword [eax + ecx*4], 0x386c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002f52e
xor ecx, ecx
mov dword [ebp - 0x10], edx
inc ecx
jmp 0x1002f55f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa8], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002f54e
cmp dword [ebp - 0x18], edx
jne 0x1002f5b0
mov dword [ebp - 0xa8], 2
cmp dword [ebp - 0xa8], edx
jl 0x1002f596
mov byte [ebp - 0x11], dl
cmp byte [ebp - 0x11], 0
je 0x1002f58e
push 0xb18
push edx
call ebx
xor edx, edx
dec dword [ebp - 0xa8]
jns 0x1002f57b
lea ecx, [ebp - 0x3ec]
call fcn.10028c61
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffee
jg 0x1002f51b
jmp 0x1002f5bb
lea ecx, [ebp - 0x3ec]
call fcn.10028c61
xor eax, eax
mov dword [ebp - 0x18], esi
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002f5e5
push 0xfd3
push eax
push eax
push 0x161d
push 0x11ec
push eax
push 0x183e
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0xffffffffffffffff
mov dword [ebp - 0x18], 0xffffffe6
pop esi
jmp 0x1002f7c9
push edi
lea ecx, [ebp - 0x500]
call fcn.10028b5c
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x24], 0x1ec0
cmp dword [ebp - 0x24], 0x100c
jge 0x1002f74b
lea eax, [ebp - 0x98]
push eax
push 0x10008ae8
call fcn.1004eb10
mov eax, dword [ebp - 0x98]
pop ecx
pop ecx
test eax, eax
je 0x1002f742
dec eax
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x88]
push eax
push 0x10008af4
call fcn.1004eb10
mov ecx, dword [ebp - 0x88]
add esp, 0xc
lea eax, [ecx - 1]
cdq
sub eax, edx
sar eax, 1
cmp dword [ebp - 0xc0], eax
jle 0x1002f682
push 0x10008bf8
call fcn.1004f621
pop ecx
jmp 0x1002f731
lea eax, [ebp - 0x250]
mov dword [ebp - 0x250], esi
push eax
lea eax, [ecx + 1]
push eax
lea ecx, [ebp - 0x578]
call fcn.10028e52
mov eax, dword [ebp - 0x88]
mov ecx, eax
mov edi, dword [ebp - 0x578]
push 2
pop esi
cmp eax, esi
jl 0x1002f6db
mov edx, dword [ebp - 0xc0]
test edx, edx
jle 0x1002f6db
mov dword [edi + esi*4], ecx
dec ecx
mov edx, dword [ebp - 0xc0]
add esi, 2
mov eax, dword [ebp - 0x88]
dec edx
mov dword [ebp - 0xc0], edx
cmp esi, eax
jle 0x1002f6b9
xor edx, edx
inc edx
cmp eax, edx
jl 0x1002f6f7
cmp dword [edi + edx*4], 0
jge 0x1002f6f2
mov dword [edi + edx*4], ecx
dec ecx
mov eax, dword [ebp - 0x88]
inc edx
cmp edx, eax
jle 0x1002f6e2
xor ecx, ecx
inc ecx
mov esi, ecx
cmp eax, ecx
jl 0x1002f718
push dword [edi + esi*4]
push 0x10008b30
call fcn.1004f14f
inc esi
pop ecx
pop ecx
cmp esi, dword [ebp - 0x88]
jle 0x1002f700
push 0x10008a51
call fcn.1004f621
pop ecx
lea ecx, [ebp - 0x578]
call fcn.10028c61
or esi, 0xffffffff
mov eax, dword [ebp - 0x98]
test eax, eax
jne 0x1002f63a
push 3
pop edi
dec eax
xor edx, edx
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x10], edx
jmp 0x1002f763
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x500]
mov dword [eax + ecx*4], 0x386c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002f750
xor ecx, ecx
mov dword [ebp - 0x10], edx
inc ecx
jmp 0x1002f781
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9c], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002f770
cmp dword [ebp - 0x18], edx
jne 0x1002f7d5
mov dword [ebp - 0x9c], 2
cmp dword [ebp - 0x9c], edx
jl 0x1002f7b8
mov byte [ebp - 0x11], dl
cmp byte [ebp - 0x11], 0
je 0x1002f7b0
push 0xb18
push edx
call ebx
xor edx, edx
dec dword [ebp - 0x9c]
jns 0x1002f79d
lea ecx, [ebp - 0x500]
mov dword [ebp - 4], esi
call fcn.10028c61
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffee
jg 0x1002f5f4
jmp 0x1002f7e3
lea ecx, [ebp - 0x500]
mov dword [ebp - 4], esi
call fcn.10028c61
push 1
lea ecx, [ebp - 0x2bc]
call fcn.10028b5c
xor ebx, ebx
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x24], ebx
xor edx, edx
mov dword [ebp - 0x44], 0xcd7d393e
inc edx
mov dword [ebp - 0x18], ebx
jmp 0x1002f81e
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2bc]
mov dword [eax + ecx*4], 0x6cce57bf
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002f80b
mov eax, dword [ebp - 0x2bc]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jne 0x1002f85a
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
mov edx, esi
mov esi, ebx
setg cl
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setle cl
xor edx, edx
inc edx
cmp ecx, edx
jl 0x1002f85c
mov esi, edx
mov eax, dword [ebp - 0x2bc]
neg esi
xor ecx, ecx
mov edx, dword [eax]
cmp esi, edx
setge cl
xor eax, eax
cmp ecx, edx
setne al
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1002f892
push 0x1ee5
push ebx
push ebx
push 0x213
push ebx
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
lea ecx, [ebp - 0x2bc]
call fcn.10028c61
mov dword [ebp - 0x2c], 6
lea ecx, [ebp - 0x3ac]
mov dword [ebp - 0x10], 8
or eax, 0xffffffff
mov dword [ebp - 0x18], 0x412df3d3
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], 0x3b4709ba
push edi
call fcn.10028b5c
xor eax, eax
lea ecx, [ebp - 0x404]
push 4
inc eax
mov dword [ebp - 4], eax
pop esi
mov dword [ebp - 0x1c], 0x37ae9f90
mov dword [ebp - 0x40], eax
push esi
call fcn.10028b5c
xor edx, edx
mov byte [ebp - 4], 2
mov dword [ebp - 0x2c], ebx
inc edx
jmp 0x1002f904
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x60], 0x648261f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1002f8f6
mov dword [ebp - 0x2c], ebx
jmp 0x1002f921
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3ac]
mov dword [eax + ecx*4], 0xafb5d1cb
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1002f90e
mov dword [ebp - 0x2c], ebx
jmp 0x1002f93e
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x404]
mov dword [eax + ecx*4], 0x7dfb
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002f92b
mov dword [ebp - 0x10], ebx
jmp 0x1002f9b2
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x10]
cmp ecx, dword [ebp + eax*4 - 0x60]
je 0x1002f966
mov ecx, edx
cmp dword [ebp - 0x18], ebx
jne 0x1002f968
mov ecx, ebx
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x60]
cmp ecx, eax
mov eax, dword [ebp - 0x60]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], ebx
je 0x1002f9a0
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002f9ac
push ebx
push ebx
push 0x2322
call dword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x1002f9ac
mov dword [ebp - 0x24], 0xfe662db8
cmp dword [ebp - 0x24], ebx
jne 0x1002f9b7
inc dword [ebp - 0x10]
push 1
pop edx
cmp dword [ebp - 0x10], ebx
jle 0x1002f948
inc dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
setl dl
mov dword [ebp - 0x24], edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3ac]
setg dl
xor ebx, ebx
cmp edx, dword [ebp - 0x24]
setge bl
xor ecx, ecx
cmp ebx, dword [eax + 8]
setge cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
add ecx, 0xd7276cc
cmp eax, ecx
setl dl
cmp edx, 0x390f
jne 0x1002faa6
mov dword [ebp - 0x38], 0xe4f2007
lea ecx, [ebp - 0x394]
push esi
call fcn.10028b5c
xor ebx, ebx
mov dword [ebp - 0x18], ebx
jmp 0x1002fa3c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x394]
mov dword [eax + ecx*4], 0xb364fef5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002fa29
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1002fa51
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp dword [ebp - 0x38], ebx
je 0x1002fa63
mov eax, dword [ebp - 0x40]
dec dword [ebp - 0x40]
test eax, eax
jne 0x1002fa63
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ebx
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3ac]
add edx, dword [eax]
mov eax, dword [ebp - 0x38]
cmp eax, edx
mov eax, dword [ebp - 0x394]
setl cl
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x394]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x394]
mov eax, dword [eax + 8]
mov dword [ebp - 0x38], eax
call fcn.10028c61
jmp 0x1002fb05
xor ecx, ecx
mov dword [ebp - 0x18], 0x8f781be2
inc ecx
xor ebx, ebx
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1002fad7
push 0x391
push 0xfa2
push ebx
push 0x36d
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
mov edx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x30], ebx
jne 0x1002faf5
mov edx, ebx
mov eax, dword [ebp - 0x404]
xor ecx, ecx
cmp edx, dword [eax]
setg cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x404]
call fcn.10028c61
or eax, 0xffffffff
lea ecx, [ebp - 0x3ac]
mov dword [ebp - 4], eax
call fcn.10028c61
push esi
lea ecx, [ebp - 0x370]
call fcn.10028b5c
lea ecx, [ebp - 0x6ac]
mov dword [ebp - 4], edi
movdqa xmm0, xmmword [0x100090a0]
lea eax, [ebp - 0x69c]
push ecx
push eax
push ecx
mov dword [ebp - 0x10], 0x66fe7d8a
lea ecx, [ebp - 0x650]
movdqu xmmword [ebp - 0x6ac], xmm0
call fcn.10028c3b
push 4
pop edx
mov byte [ebp - 4], dl
or esi, 0xffffffff
mov dword [ebp - 0x40], 0x73e70d28
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], edx
jge 0x1002fb94
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x370]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
jmp 0x1002fb7e
mov dword [ebp - 0x10], ebx
jmp 0x1002fbaa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5d4], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002fb99
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], ebx
jl 0x1002fccb
mov dword [ebp - 0x34], 6
lea ecx, [ebp - 0x23c]
push 2
call fcn.10028b5c
mov dword [ebp - 0x30], 0x8e4c12f6
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x18], ebx
jmp 0x1002fbf1
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x23c]
mov dword [eax + ecx*4], 0x5ec62bb2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002fbde
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x23c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x34]
imul eax, ecx
neg eax
je 0x1002fc1e
mov eax, dword [ebp - 0x23c]
cmp dword [eax], ebx
je 0x1002fc1e
xor ecx, ecx
inc ecx
jmp 0x1002fc20
mov ecx, ebx
mov eax, dword [ebp - 0x650]
mov dword [eax], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x370]
mov dword [eax + ecx*4], 0x35e1
mov dword [ebp - 0x40], 0xd860
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x370]
cmp dword [eax], ebx
je 0x1002fc5e
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x5d4], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
setg cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x23c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x23c]
mov dword [eax + 4], 0xc987
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5d4]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x5cc], eax
call fcn.10028c61
dec dword [ebp - 0x10]
jns 0x1002fbbb
lea ecx, [ebp - 0x650]
call fcn.10028c61
lea ecx, [ebp - 0x370]
mov dword [ebp - 4], esi
call fcn.10028c61
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002fec8
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x18], ebx
jmp 0x1002fd0e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc8], 0xe8cff0ea
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002fcfd
mov dword [ebp - 0xc8], 7
jmp 0x1002fe8a
mov dword [ebp - 0x28], 0x999d94b4
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setne bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x28]
setge cl
xor edx, edx
cmp ecx, 0x5537
setg dl
xor ecx, ecx
test eax, eax
sets cl
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, edx
jg 0x1002fdf8
xor ebx, ebx
mov dword [ebp - 0x18], ebx
jmp 0x1002fd9c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x590], 0xee24
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002fd8b
mov dword [ebp - 0x28], ebx
jmp 0x1002fded
mov dword [ebp - 0x24], 0x149c
mov dword [ebp - 0x34], ebx
jmp 0x1002fde4
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], ebx
jmp 0x1002fddb
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x590]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x590]
cmp edx, eax
setg cl
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1002fdba
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jle 0x1002fdb2
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x1002fda6
jmp 0x1002fe84
mov dword [ebp - 0x18], 0xa52b3395
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc4]
imul ecx, eax, 0x9e52
mov eax, dword [ebp - 0xc8]
cmp eax, ecx
mov eax, dword [ebp - 0xc8]
setle dl
xor ebx, ebx
add edx, 0xffff72a8
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge bl
xor ecx, ecx
cmp ebx, eax
sete cl
xor ebx, ebx
imul ecx, dword [ebp - 0x18]
imul eax, ecx, 0x8c0c
test eax, eax
je 0x1002fe55
cmp dword [ebp - 0xc4], ebx
je 0x1002fe55
xor edx, edx
inc edx
jmp 0x1002fe57
mov edx, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
sub ecx, edi
cmp ecx, dword [ebp - 0x18]
je 0x1002fe6d
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002fe84
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
dec dword [ebp - 0xc8]
cmp dword [ebp - 0xc8], 0xffffffe7
je 0x1002fd23
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002feab
push 0x226b
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0xfd3
push ebx
push ebx
push 0x161d
push 0x11ec
push ebx
push 0x183e
call dword [sym.imp.GDI32.dll_GetDIBits]
mov dword [ebp - 0x34], 0x53b26bdd
mov dword [ebp - 0x28], 0x34172034
mov dword [ebp - 0x34], ebx
jmp 0x1002fff7
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], 0x3260389a
mov dword [ebp - 0x10], ebx
jmp 0x1002fefe
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x144], 0x6318
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002feed
mov dword [ebp - 0x10], ebx
jmp 0x1002ff1a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x640], 0xcce35a12
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002ff09
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], ebx
jl 0x10030001
push edi
lea ecx, [ebp - 0x2a0]
call fcn.10028b5c
mov dword [ebp - 0x18], ebx
jmp 0x1002ff53
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2a0]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002ff40
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x144]
mov edx, dword [ebp - 0x2a0]
mov eax, dword [edx + 4]
add eax, 7
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
imul ecx, dword [edx + 4]
xor edx, edx
mov eax, dword [ebp - 0x2a0]
cmp ecx, dword [eax + 8]
mov eax, dword [ebp - 0x34]
setge dl
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x144]
jne 0x1002ffa7
cmp dword [ebp - 0x144], ebx
jne 0x1002ffa7
xor edx, edx
mov ecx, ebx
inc edx
jmp 0x1002ffac
xor edx, edx
inc edx
mov ecx, edx
mov eax, dword [ebp - 0x34]
add eax, 0x8e1b8814
add eax, ecx
je 0x1003006d
mov dword [ebp - 0x30], esi
mov ecx, 0xc39d5b61
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x34]
cmp ecx, eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x30]
jg 0x10030051
cmp dword [ebp - 0x34], ebx
je 0x100300aa
lea ecx, [ebp - 0x2a0]
call fcn.10028c61
cmp dword [ebp - 0x10], ebx
jne 0x10030001
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffffa
jge 0x1002fede
mov dword [ebp - 0x2c], 0xffffffe6
cmp dword [ebp - 0x2c], 0xffffffee
jle 0x1003078f
mov edi, 0xa9a97186
mov dword [ebp - 0x18], 0xfffffffa
xor edx, edx
mov dword [ebp - 0x30], 0xf36f6dd8
inc edx
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x1c], 0x23d1bca9
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x34], ebx
jmp 0x100300e1
mov eax, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x144]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setl dl
mov dword [ebp - 0x638], edx
jmp 0x100300aa
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], ebx
jl 0x100300aa
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], ebx
jl 0x1003008e
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x144], ebx
jne 0x1003008e
dec dword [ebp - 0x20]
jns 0x1003007d
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100300a5
push 0x24d2
call dword [sym.imp.GDI32.dll_SaveDC]
xor edx, edx
inc edx
dec dword [ebp - 0x28]
jns 0x10030075
mov eax, dword [ebp - 0x640]
lea ecx, [ebp - 0x2a0]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
call fcn.10028c61
dec dword [ebp - 0x10]
jns 0x1002ff2f
jmp 0x1002ffef
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x3b4], 5
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jl 0x100300d0
mov ecx, dword [ebp - 0x40]
mov esi, edx
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmovg esi, ebx
mov dword [ebp - 0x3b4], 0xaacda2a4
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 0xaacda2a4
setne cl
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jne 0x1003013d
mov ecx, ebx
cmp dword [ebp - 0x38], ebx
je 0x1003013f
mov ecx, edx
mov eax, dword [ebp - 0x20]
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0xf323
jle 0x10030178
cmp dword [ebp - 0x3b0], ebx
je 0x10030178
xor ecx, ecx
inc ecx
jmp 0x1003017a
mov ecx, ebx
mov eax, 0xffffe33c
xor edx, edx
sub eax, ecx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl dl
neg edx
jne 0x1003019e
cmp dword [ebp - 0x20], ebx
jne 0x1003019e
mov eax, ebx
jmp 0x100301a1
xor eax, eax
inc eax
mov dword [ebp - 0x30], eax
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
push 3
setne dl
xor ecx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x10]
sub esi, eax
add esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
cmp esi, eax
pop esi
setg cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x4a0]
push esi
call fcn.10028b5c
mov dword [ebp - 4], 5
xor ecx, ecx
mov dword [ebp - 0x18], 0xb110c93b
inc ecx
mov dword [ebp - 0x294], ecx
mov dword [ebp - 0x290], ecx
mov dword [ebp - 0x28c], ecx
mov dword [ebp - 0x288], ecx
mov dword [ebp - 0x24], 0x9cd4
mov dword [ebp - 0x24], 0x815f8425
mov dword [ebp - 0x18], 0x1c
jmp 0x1003025e
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0xd3c15d0d
mov dword [ebp - 0x10], ebx
jmp 0x10030238
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x814], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10030227
mov dword [ebp - 0x10], ebx
jmp 0x10030250
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x124], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10030243
inc dword [ebp - 0x124]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x13
jg 0x10030218
mov dword [ebp - 0x10], 0x462d5e48
mov dword [ebp - 0x30], 0xedb39523
mov dword [ebp - 0x10], ebx
jmp 0x100302a2
mov dword [ebp - 0x18], 0x665683c8
mov dword [ebp - 0x18], ebx
jmp 0x10030299
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10030296
push ebx
push 0x6a
push ebx
call dword [sym.imp.GDI32.dll_GetBitmapBits]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xe
jge 0x10030283
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xd
jg 0x10030277
mov dword [ebp - 0x10], ebx
jmp 0x100303ac
mov dword [ebp - 0x2b0], edi
mov dword [ebp - 0x2ac], edi
mov dword [ebp - 0x2a8], edi
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], esi
jg 0x100303a9
push 2
lea ecx, [ebp - 0x388]
call fcn.10028b5c
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
cmp dword [ebp - 0x18], 2
jge 0x10030305
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x388]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
jmp 0x100302ee
mov ebx, dword [ebp - 0x388]
mov dword [ebx], esi
mov dword [ebp - 0x1c], 0xfffffffc
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x2b0]
or eax, 0xffffffff
cmp dword [ebp - 0x1c], eax
je 0x1003032c
cmp dword [ebp - 0x34], 0
jne 0x1003032e
xor edx, edx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, 0x941c
push 1
setge cl
mov edi, dword [ebp + eax*4 - 0x2b0]
mov eax, dword [ebp - 0x34]
mov esi, dword [ebx + 4]
mov dword [ebp + eax*4 - 0x2b0], edi
xor eax, eax
add ecx, dword [ebp - 0x1c]
cmp ecx, esi
setle al
xor edx, edx
cmp eax, esi
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
pop edx
setl cl
imul ecx, edi
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x388]
dec dword [eax]
jns 0x1003030d
lea ecx, [ebp - 0x388]
call fcn.10028c61
inc dword [ebp - 0x34]
push 3
pop esi
push 0
pop ebx
cmp dword [ebp - 0x34], esi
jle 0x100302db
mov edi, 0xa9a97186
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffeb
jge 0x100302b0
mov dword [ebp - 0x10], ebx
jmp 0x100303ce
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4a0]
mov dword [eax + ecx*4], 0x386c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100303bb
xor ecx, ecx
mov dword [ebp - 0x10], ebx
inc ecx
jmp 0x100303ec
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa4], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100303db
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], 0x57a67d92
mov dword [ebp - 0x40], 0xfffffff8
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], 0xc2541761
mov dword [ebp - 0x24], 0xccce1cc0
mov dword [ebp - 0x18], ebx
jmp 0x10030425
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6bc], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10030418
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x1c]
jge 0x10030459
cmp dword [ebp - 0x10], ebx
jne 0x10030459
mov eax, ebx
jmp 0x1003045c
xor eax, eax
inc eax
xor edx, edx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
sub edx, 4
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x10]
jl 0x1003048e
cmp dword [ebp - 0x10], ebx
je 0x1003048e
xor esi, esi
inc esi
jmp 0x10030490
mov esi, ebx
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x6b0]
setne dl
xor ebx, ebx
cmp edx, esi
setg bl
xor ecx, ecx
cmp ebx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x6b8]
setne bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor ebx, ebx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x2c], ebx
jne 0x100307a1
mov dword [ebp - 0xa4], 2
or esi, 0xffffffff
cmp dword [ebp - 0xa4], ebx
jl 0x10030774
mov dword [ebp - 0x28], esi
xor edx, edx
mov dword [ebp - 0x20], esi
inc edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x20], 0x99cf48b0
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x18], ebx
jmp 0x10030528
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x64], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003051e
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jg 0x100306ec
mov dword [ebp - 0x10], 0x5799
mov dword [ebp - 0x18], ebx
jmp 0x10030552
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x214], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10030545
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x64]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x10]
jle 0x10030571
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x64]
imul eax, dword [ebp - 0x28], 5
test eax, eax
jne 0x10030589
mov ecx, ebx
cmp dword [ebp - 0x10], ebx
je 0x1003058b
mov ecx, edx
mov eax, dword [ebp - 0x10]
imul eax, ecx
cmp dword [ebp - 0x28], eax
jl 0x1003059d
mov eax, edx
cmp dword [ebp - 0x10], ebx
jne 0x1003059f
mov eax, ebx
neg eax
mov dword [ebp - 0x20], eax
jne 0x100305a9
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setle dl
cmp edx, 0xea6801fc
ja 0x1003067d
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x24], 0xd4938140
mov dword [ebp - 0x40], 0x4c62b419
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x210]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jge 0x10030619
cmp dword [ebp - 0x64], ebx
je 0x10030619
xor edx, edx
inc edx
jmp 0x1003061b
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x40]
setle cl
xor edx, edx
cmp ecx, 3
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x64]
setle dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x44]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x210]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
imul eax, edx
sub eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
inc eax
xor ebx, ebx
mov dword [ebp - 0x24], eax
jmp 0x100306be
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1003068c
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov dword [ebp - 0x20], ebx
jmp 0x100306b9
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100306a2
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100306b6
push 0x1eee
call dword [sym.imp.USER32.dll_IsIconic]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10030691
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100306dd
push 0x243f
push ebx
push 0x2137
push 0xb92
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
inc dword [ebp - 0x28]
push 1
pop edx
cmp dword [ebp - 0x28], ebx
jle 0x10030539
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x20], 0xd313dd33
mov dword [ebp - 0x18], ebx
jmp 0x10030710
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x258], 0xe01bd97a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100306ff
mov dword [ebp - 0x20], ebx
jmp 0x1003074d
mov dword [ebp - 0x18], 0xfffffff7
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10030731
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x18], ebx
jmp 0x10030745
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x258], ebx
jne 0x1003074a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10030736
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1a
jg 0x1003071a
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10030768
push 0xb18
push ebx
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
dec dword [ebp - 0xa4]
jns 0x100304ff
lea ecx, [ebp - 0x4a0]
mov dword [ebp - 4], esi
call fcn.10028c61
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffee
jg 0x10030017
or edi, 0xffffffff
push 0xffffffffffffffe2
mov dword [ebp - 0x18], 0x7e2799ac
mov dword [ebp - 0x18], ebx
pop esi
jmp 0x100307d7
or edi, 0xffffffff
lea ecx, [ebp - 0x4a0]
mov dword [ebp - 4], edi
call fcn.10028c61
jmp 0x10030792
mov dword [ebp - 0x24], 7
cmp dword [ebp - 0x24], ebx
jne 0x100307dc
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100307d4
push 0x9ef
call dword [sym.imp.USER32.dll_DestroyWindow]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x100307b4
mov dword [ebp - 0x18], 0x7e2799ac
mov dword [ebp - 0x18], ebx
jmp 0x1003080b
mov dword [ebp - 0x24], 7
cmp dword [ebp - 0x24], ebx
jne 0x10030810
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10030808
push 0x9ef
call dword [sym.imp.USER32.dll_DestroyWindow]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x100307e8
mov dword [ebp - 0x2c], 0x5a9c4c8d
mov dword [ebp - 0x10], 0xf415
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x40], 0xa46b4c01
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0xdc66
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
je 0x10030863
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp eax, 1
mov eax, dword [ebp - 0x2c]
setle cl
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x10]
test edx, edx
je 0x10030863
xor edx, edx
inc edx
jmp 0x10030865
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setl cl
cmp edi, ecx
sbb eax, eax
neg eax
add eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x10]
je 0x1003089e
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10030893
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
jmp 0x10030b77
push 1
lea ecx, [ebp - 0x24c]
call fcn.10028b5c
mov dword [ebp - 4], 6
xor edx, edx
mov dword [ebp - 0x34], edi
inc edx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x24], 0x4d37718c
mov dword [ebp - 0x18], ebx
jmp 0x100308dd
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24c]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100308ce
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24c]
cmp dword [eax], ecx
jne 0x100308f2
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x24c]
cmp dword [eax], edi
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setg cl
cmp ecx, 0xfffffff9
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
inc ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x10]
jne 0x10030940
mov edx, ebx
cmp dword [ebp - 0x30], ebx
je 0x10030942
mov edx, ecx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setg cl
imul ecx, dword [ebp - 0x30]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x40], 0xe63d4d86
mov eax, dword [ebp - 0x2c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], ebx
jg 0x10030b69
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ebx
jl 0x10030b3d
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x24], 0x1c54
cmp dword [ebp - 0x24], 0x110c
jge 0x10030b18
mov edx, 0x106569e8
mov ecx, 0x106572f0
call fcn.1002de89
mov edx, 0x10656a30
mov ecx, eax
call fcn.1002de89
mov edx, 0x10656a18
mov ecx, eax
call fcn.1002de89
mov edi, dword [0x10656a44]
mov eax, 0x10656a30
mov ebx, dword [0x10656a30]
cmp edi, 0x10
mov edx, dword [0x106569fc]
mov ecx, 0x106569e8
mov esi, dword [0x106569e8]
cmovae eax, ebx
cmp edx, 0x10
cmovae ecx, esi
mov al, byte [eax + 1]
cmp al, byte [ecx]
jne 0x10030a44
cmp dword [0x10656a2c], 0x10
mov eax, 0x10656a18
mov ecx, 0x106569e8
cmovae eax, dword [0x10656a18]
cmp edx, 0x10
cmovae ecx, esi
mov al, byte [eax + 1]
cmp al, byte [ecx]
je 0x10030a44
push 0x10008b18
call fcn.1004f621
xor ebx, ebx
jmp 0x10030b17
cmp edi, 0x10
mov eax, 0x10656a30
mov ecx, 0x106569e8
cmovae eax, ebx
cmp edx, 0x10
cmovae ecx, esi
mov al, byte [eax + 1]
cmp al, byte [ecx]
je 0x10030a8e
cmp dword [0x10656a2c], 0x10
mov eax, 0x10656a18
mov ecx, 0x106569e8
cmovae eax, dword [0x10656a18]
cmp edx, 0x10
cmovae ecx, esi
mov al, byte [eax + 1]
cmp al, byte [ecx]
jne 0x10030a8e
mov eax, 0x10008b04
push eax
jmp 0x10030a38
cmp edi, 0x10
mov eax, 0x10656a30
mov ecx, 0x10656a18
cmovae eax, ebx
cmp dword [0x10656a2c], 0x10
cmovae ecx, dword [0x10656a18]
mov al, byte [eax + 1]
cmp al, byte [ecx + 1]
jne 0x10030a86
cmp edi, 0x10
mov eax, 0x10656a30
push 1
cmovae eax, ebx
mov edi, 0x10656a00
xor ebx, ebx
mov ecx, edi
push ebx
mov al, byte [eax]
mov byte [ebp - 0x80], al
lea eax, [ebp - 0x80]
push eax
call fcn.10029575
cmp dword [0x10656a2c], 0x10
mov ecx, 0x10656a18
push 1
cmovae ecx, dword [0x10656a18]
mov esi, eax
push ebx
lea eax, [ebp - 0x74]
push eax
mov cl, byte [ecx]
mov byte [ebp - 0x74], cl
mov ecx, edi
call fcn.10029575
cmp esi, eax
jle 0x10030b0c
push 0x10008b18
jmp 0x10030b12
mov eax, 0x10008b04
push eax
call fcn.1004f621
pop ecx
cmp byte [ebp - 0x11], 0
je 0x10030b2a
push ebx
push 0x1f60
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, dword [ebp - 0x24c]
cmp dword [eax], ebx
jne 0x10030b3d
dec dword [ebp - 0x2c]
jns 0x1003099b
mov dword [ebp - 0x20], ebx
jmp 0x10030b55
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10030b52
push ebx
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10030b42
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x1003098f
or edi, 0xffffffff
lea ecx, [ebp - 0x24c]
mov dword [ebp - 4], edi
call fcn.10028c61
mov dword [ebp - 0x1c], 0x33efc07e
lea ecx, [ebp - 0x274]
push 2
call fcn.10028b5c
mov dword [ebp - 0x24], 0xfffffffc
mov esi, 0xffff
push 2
mov dword [ebp - 0x24], 0x90ae
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x10030bb5
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x274]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10030ba6
mov dword [ebp - 0x10], ebx
jmp 0x10030bd0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5e8], 0x628405ce
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10030bbf
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x274]
mov eax, dword [ebp - 0x1c]
cmp dword [ecx + 4], eax
jl 0x10030bf4
mov eax, dword [ebp - 0x274]
cmp dword [eax], ebx
jne 0x10030bf4
mov eax, ebx
jmp 0x10030bf7
xor eax, eax
inc eax
mov dword [ebp - 0x5e4], eax
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x274]
mov ecx, dword [eax]
lea eax, [ecx + 1]
cmp eax, ecx
lea eax, [ecx + ecx]
lea ecx, [ebp - 0x274]
setle dl
sub edx, eax
mov eax, dword [ebp - 0x1c]
sub eax, edx
neg eax
sbb eax, eax
add eax, 0x488b
imul eax, eax, 0xf59e
mov dword [ebp - 0x24], eax
call fcn.10028c61
mov dword [ebp - 0x2c], 0x5a9c4c8d
mov dword [ebp - 0x10], 0xf415
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x40], 0xa46b4c01
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0xdc66
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
je 0x10030c8c
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp eax, 1
mov eax, dword [ebp - 0x2c]
setle cl
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x10]
test edx, edx
je 0x10030c8c
xor edx, edx
inc edx
jmp 0x10030c8e
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setl cl
cmp edi, ecx
sbb eax, eax
neg eax
add eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x10]
je 0x10030cc7
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10030cbc
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
jmp 0x10030e06
push 1
lea ecx, [ebp - 0x1e8]
call fcn.10028b5c
mov dword [ebp - 0x34], edi
xor edx, edx
mov dword [ebp - 0x30], edi
inc edx
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x24], 0x4d37718c
mov dword [ebp - 0x18], ebx
jmp 0x10030cff
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1e8]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10030cf0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1e8]
cmp dword [eax], ecx
jne 0x10030d14
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x1e8]
cmp dword [eax], edi
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setg cl
cmp ecx, 0xfffffff9
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
inc ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x10]
jne 0x10030d62
mov edx, ebx
cmp dword [ebp - 0x30], ebx
je 0x10030d64
mov edx, ecx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setg cl
imul ecx, dword [ebp - 0x30]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x40], 0xe63d4d86
mov eax, dword [ebp - 0x2c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x34], ebx
jmp 0x10030df6
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ebx
jl 0x10030dd6
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10030dc7
push ebx
push 0x1f60
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, dword [ebp - 0x1e8]
cmp dword [eax], ebx
jne 0x10030dd6
dec dword [ebp - 0x2c]
jns 0x10030db2
mov dword [ebp - 0x20], ebx
jmp 0x10030dee
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10030deb
push ebx
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10030ddb
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x10030daa
lea ecx, [ebp - 0x1e8]
call fcn.10028c61
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x1c], 0x36544d18
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
je 0x10030e22
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], ebx
je 0x10030e48
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10030ee8
call dword [sym.imp.USER32.dll_GetMessageTime]
jmp 0x10030ee8
xor ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jge 0x10030e6f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5a4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10030e5c
mov eax, dword [ebp - 0x1c]
mov edx, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x20], ebx
je 0x10030e8d
mov edx, ecx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
cmp ecx, edi
setne dl
sub edx, esi
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x6fdd
setle al
cmp dword [ebp - 0x5a4], eax
jl 0x10030ed5
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10030ee8
push 0x6ee
push ebx
push 0xcf7
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x10030ee8
dec dword [ebp - 0x3c]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10030ee8
push ebx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 0x18], 0x20624039
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10030eff
push ebx
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov dword [ebp - 0x18], ebx
jmp 0x10030f18
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10030f15
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffe
je 0x10030f04
mov dword [ebp - 0x20], 0x7e2799ac
mov dword [ebp - 0x18], 0xbac64a68
mov dword [ebp - 0x24], 0x240a
cmp dword [ebp - 0x24], 0x633
jge 0x1003102a
lea eax, [ebp - 0xb4]
push eax
push 0x10008ae8
call fcn.1004eb10
pop ecx
pop ecx
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x668]
call fcn.10028e16
mov dword [ebp - 4], 7
mov edi, ebx
cmp dword [ebp - 0xb4], 0
mov ebx, dword [ebp - 0x668]
jle 0x10030f97
mov esi, ebx
push esi
push 0x10008ae8
call fcn.1004eb10
inc edi
add esi, 4
pop ecx
pop ecx
cmp edi, dword [ebp - 0xb4]
jl 0x10030f7e
xor eax, eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
call fcn.1002cc10
mov dword [ebp - 0x13c], eax
mov byte [ebp - 4], 8
xor ecx, ecx
mov edi, dword [ebp - 0xb4]
dec edi
mov dword [ebp - 0x30], ecx
js 0x10030fff
lea esi, [ebx + edi*4]
push esi
lea ecx, [ebp - 0x13c]
call fcn.10029085
test eax, eax
jne 0x10030ff6
mov eax, dword [esi]
mov dword [ebp - 0x30], eax
movzx eax, byte [0x1099da77]
push eax
push esi
push ecx
lea eax, [ebp - 0x748]
push eax
lea ecx, [ebp - 0x13c]
call fcn.1002d737
sub esi, 4
dec edi
jns 0x10030fc5
mov ecx, dword [ebp - 0x30]
push ecx
push 0x10008afc
call fcn.1004f14f
pop ecx
pop ecx
lea ecx, [ebp - 0x13c]
call fcn.10028fbb
or eax, 0xffffffff
lea ecx, [ebp - 0x668]
mov dword [ebp - 4], eax
call fcn.10028c61
xor ebx, ebx
mov dword [ebp - 0x24], 6
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x24], 8
push 3
call fcn.10028b5c
mov dword [ebp - 4], 9
mov dword [ebp - 0x24], 0x14e1
cmp dword [ebp - 0x24], 0xbf5
jge 0x100311ef
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x68]
push eax
push 0x10008af4
call fcn.1004eb10
add esp, 0xc
mov dword [ebp - 0x1dc], ebx
lea eax, [ebp - 0x1dc]
lea ecx, [ebp - 0x2e0]
push eax
mov eax, dword [ebp - 0x68]
inc eax
push eax
call fcn.10028e52
push 0xa
xor ecx, ecx
pop eax
inc ecx
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x68]
mov edi, ecx
cmp eax, ecx
mov ecx, dword [ebp - 0x2e0]
jl 0x100310d6
lea esi, [ecx + 4]
push esi
push 0x10008ae8
call fcn.1004eb10
mov eax, dword [ebp - 0x68]
inc edi
pop ecx
add esi, 4
pop ecx
cmp edi, eax
jle 0x100310be
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x260], ebx
push ecx
inc eax
lea ecx, [ebp - 0x4e8]
push eax
call fcn.10028e52
xor ecx, ecx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x68]
inc ecx
mov edi, ecx
cmp eax, ecx
mov ecx, dword [ebp - 0x4e8]
jl 0x10031121
lea esi, [ecx + 4]
push esi
push 0x10008ae8
call fcn.1004eb10
mov eax, dword [ebp - 0x68]
inc edi
pop ecx
add esi, 4
pop ecx
cmp edi, eax
jle 0x10031109
lea ecx, [ebp - 0x268]
mov dword [ebp - 0x268], ebx
push ecx
inc eax
lea ecx, [ebp - 0x41c]
push eax
call fcn.10028e52
xor eax, eax
mov esi, ebx
inc eax
mov edx, eax
cmp dword [ebp - 0x68], eax
jl 0x100311bb
mov edi, dword [ebp - 0x4e8]
sub edi, dword [ebp - 0x2e0]
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x44], edi
mov edi, dword [ebp - 0x2e0]
sub edi, eax
lea ecx, [eax + 4]
mov dword [ebp - 0x24], edi
mov edi, dword [ecx - 4]
mov eax, dword [ebp - 0x24]
mov dword [ecx], edi
add eax, ecx
mov edi, dword [ebp - 0x44]
cmp dword [eax + edi], 0
mov edi, dword [ecx - 4]
je 0x10031184
add esi, dword [eax]
jmp 0x1003118a
mov eax, dword [eax]
add eax, edi
mov dword [ecx], eax
cmp edx, dword [ebp - 0x130]
jl 0x100311a5
mov edi, dword [ebp - 0x41c]
mov eax, edx
sub eax, dword [ebp - 0x130]
mov edi, dword [edi + eax*4]
jmp 0x100311a7
xor edi, edi
mov eax, dword [ecx]
sub eax, edi
cmp ebx, eax
cmovg eax, ebx
inc edx
add ecx, 4
mov ebx, eax
cmp edx, dword [ebp - 0x68]
jle 0x1003116a
add esi, ebx
push esi
push 0x10008afc
call fcn.1004f14f
pop ecx
pop ecx
lea ecx, [ebp - 0x41c]
call fcn.10028c61
lea ecx, [ebp - 0x4e8]
call fcn.10028c61
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 9
call fcn.10028c61
xor ebx, ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1003120c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5b4]
mov dword [eax + ecx*4], 0xa26f3f17
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100311f9
mov dword [ebp - 0x18], 5
or edi, 0xffffffff
jmp 0x1003127b
mov dword [ebp - 0x24], 0xb274bf90
lea ecx, [ebp - 0x434]
push 1
call fcn.10028b5c
xor edx, edx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10031250
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x434]
mov dword [eax + ecx*4], 0xfc4f27d2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1003123d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
dec dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x434]
mov ecx, edx
cmovge ecx, ebx
add dword [eax], ecx
lea ecx, [ebp - 0x434]
call fcn.10028c61
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jge 0x1003121e
mov dword [ebp - 0x24], 0x1f59
cmp dword [ebp - 0x24], 0xc96
jge 0x1003133b
push 0x1096c9f8
push 0x10008ae4
call fcn.1004eb10
mov eax, dword [0x1096c9f8]
pop ecx
pop ecx
test eax, eax
jne 0x100312c2
push 0x10008df4
call fcn.1004f621
mov eax, dword [0x1096c9f8]
pop ecx
test eax, eax
je 0x1003133b
push 0xa
cdq
pop ecx
idiv ecx
mov esi, edx
mov dword [0x1096c9f8], eax
cmp esi, 5
jl 0x100312e3
push 0x10008ccc
call fcn.1004f14f
sub esi, 5
jmp 0x100312ed
push 0x10008cc8
call fcn.1004f14f
pop ecx
test esi, esi
jle 0x10031302
mov edi, esi
push 0x10008cd0
call fcn.1004f14f
pop ecx
dec edi
jne 0x100312f4
push 0x10008c2c
call fcn.1004f14f
pop ecx
push 4
pop edi
sub edi, esi
test edi, edi
jle 0x10031324
push 0x10008cd0
call fcn.1004f14f
pop ecx
dec edi
jne 0x10031316
push 0x10008a51
call fcn.1004f621
mov eax, dword [0x1096c9f8]
pop ecx
test eax, eax
jne 0x100312c2
or edi, 0xffffffff
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1003134f
push 0x170c
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 4], edi
call fcn.10028c61
mov dword [ebp - 0x20], ebx
jmp 0x100314ff
mov dword [ebp - 0x18], 0xd5e48d32
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1003137c
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
mov dword [ebp - 0x18], ebx
jmp 0x10031398
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10031395
push 0xf4a
push ebx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffe
jle 0x10031381
mov dword [ebp - 0x24], 7
cmp dword [ebp - 0x24], ebx
jne 0x10031509
push 2
lea ecx, [ebp - 0x1f4]
call fcn.10028b5c
mov dword [ebp - 0x10], ebx
jmp 0x100313cf
cmp dword [ebp - 0x20], 0xffffffe2
jle 0x10031365
mov dword [ebp - 0x1c], 0x33efc07e
lea ecx, [ebp - 0x1a0]
push 2
call fcn.10028b5c
push 0xfffffffffffffffc
pop esi
mov dword [ebp - 0x24], esi
push 2
mov dword [ebp - 0x24], 0x90ae
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x10031545