Function at 0x1002e698
Capabilities:
Accept command line arguments
Allocate thread local storage
Check os version
Connect pipe
Create directory
Create pipe
Create process on windows
Create thread
Delete file
Delete registry key
Delete registry value
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file size
Get file system object information
Log keystrokes via polling
Parse pe header
Query environment variable
Query service status
Read .ini file
Set registry value
Set thread local storage value

Disassembly:
mov eax, 0x10081a92
call fcn.100804d8
mov eax, 0x142c
call fcn.1007cc90
push ebx
push esi
push edi
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0xe30]
push 2
mov byte [ebp - 0x5d], dl
call fcn.10016765
xor eax, eax
or edi, 0xffffffff
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x44], 0x95364446
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x1002e6fc
push dword [ebp - 0x34]
lea ecx, [ebp - 0xe30]
call fcn.100167d2
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jl 0x1002e6dd
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x34], eax
inc ebx
jmp 0x1002e711
mov dword [ebp - 0x30], 0xfffffffd
inc dword [ebp - 0x30]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x1002e704
lea ecx, [ebp - 0xe30]
mov dword [ebp - 4], edi
call fcn.100167cd
mov dword [ebp - 0x40], 7
lea ecx, [ebp - 0xa04]
push 2
call fcn.10016765
xor eax, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002e75f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xbf8], 0x8100c430
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002e746
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002e77e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x74], 0xa32f3f60
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1002e768
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002e79a
push dword [ebp - 0x28]
lea ecx, [ebp - 0xa04]
call fcn.100167d2
mov dword [eax], 0x633933b8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1002e783
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x70]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, 0x1355fff8
jg 0x1002e7ca
mov eax, dword [ebp - 0x70]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0xbf4], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x74]
cmp eax, ebx
setge cl
xor eax, eax
cmp ecx, 0x71dbcabe
setne al
xor edx, edx
cmp eax, 8
mov eax, dword [ebp - 0x70]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x74]
jge 0x1002e819
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x70], eax
je 0x1002e81b
mov edx, ebx
mov eax, dword [ebp - 0x70]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x40]
jg 0x1002e84b
cmp dword [ebp - 0xbf4], eax
je 0x1002e84b
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x1002e846
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor eax, eax
mov dword [ebp - 0x70], eax
jmp 0x1002e868
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1002e868
push eax
push 0x216f
push eax
push eax
push 0x1176
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
lea ecx, [ebp - 0xa04]
call fcn.100167d2
lea ecx, [ebp - 0xa04]
mov dword [ebp - 4], edi
mov dword [eax], 0xfffffffa
call fcn.100167cd
lea eax, [ebp - 0xef8]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0xf08]
push eax
lea ecx, [ebp - 0x1268]
movdqu xmmword [ebp - 0xf08], xmm0
call fcn.100167e1
lea ecx, [ebp - 0x1d3]
mov esi, eax
call fcn.100091c3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x5b4]
push dword [esi]
call fcn.100167a7
push ebx
lea ecx, [ebp - 0xf8]
mov dword [ebp - 4], 2
call fcn.10016765
mov byte [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x3c], 0x3009ce45
push 0xfffffffffffffffb
pop esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x30], 0xbf8c3261
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x1002e923
push dword [ebp - 0x34]
lea ecx, [ebp - 0xf8]
call fcn.100167d2
mov dword [eax], 0x5568
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x1002e905
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1002e989
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], eax
jmp 0x1002e978
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1002e94f
push 0x1d99
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002e975
push dword [ebp - 0x24]
lea ecx, [ebp - 0xf8]
call fcn.100167d2
mov dword [eax], 0xe858
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002e957
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jle 0x1002e933
mov dword [ebp - 0x3c], 0x7bf48c44
dec dword [ebp - 0x14]
jns 0x1002e92b
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setne dl
cmp edx, 0xcedda565
sbb eax, eax
add eax, 0xf1359289
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0x260e
test eax, eax
je 0x1002e9cf
xor eax, eax
lea ecx, [ebp - 0xf8]
push eax
call fcn.100167d2
cmp dword [eax], 0
je 0x1002e9cf
mov eax, ebx
jmp 0x1002e9d1
xor eax, eax
cmp eax, dword [ebp - 0x3c]
jg 0x1002e9e4
xor eax, eax
lea ecx, [ebp - 0xf8]
push eax
call fcn.100167d2
xor eax, eax
lea ecx, [ebp - 0xf8]
push eax
call fcn.100167d2
xor eax, eax
lea ecx, [ebp - 0xf8]
push eax
call fcn.100167d2
xor eax, eax
lea ecx, [ebp - 0xf8]
push eax
call fcn.100167d2
xor eax, eax
lea ecx, [ebp - 0xf8]
push eax
call fcn.100167d2
xor eax, eax
lea ecx, [ebp - 0xf8]
push eax
call fcn.100167d2
xor eax, eax
lea ecx, [ebp - 0xf8]
push eax
call fcn.100167d2
xor eax, eax
lea ecx, [ebp - 0xf8]
push eax
call fcn.100167d2
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002ea56
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0xf8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.100167d2
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0x40], 0x3aa4807c
mov byte [ebp - 4], 2
call fcn.100167cd
mov dword [ebp - 0x1c], 0xfffffffd
lea ecx, [ebp - 0x49c]
mov dword [ebp - 0x28], 0xf38c0887
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x18], 0x3ae5d5ec
mov dword [ebp - 0x44], 0x55e97312
push 3
call fcn.10016765
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x3c], 0xa3396d56
mov dword [ebp - 0x2c], 0x2038
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002eaed
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd80], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002ead4
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002eb06
push dword [ebp - 0x20]
lea ecx, [ebp - 0x49c]
call fcn.100167d2
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002eaf2
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002eb26
cmp dword [ebp - 0x28], 0xfffffffe
jle 0x1002eb26
cmp dword [ebp - 0x1c], eax
jne 0x1002eb26
cmp dword [ebp - 0x28], eax
je 0x1002eb28
mov eax, ebx
mov edi, dword [sym.imp.GDI32.dll_SetViewportExtEx]
neg eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x1c], eax
je 0x1002eb7f
xor eax, eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x1002eb54
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002eb77
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1002eb74
push eax
push 0x10b2
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x1002eb59
jmp 0x1002ebbb
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002eb97
mov dword [ebp - 0x48], 0xaa53f0d3
mov dword [ebp - 0x48], 0x2ba75a59
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002eb86
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x1002ebbb
push eax
push 0xdb2
push 0x14c3
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x49c]
dec dword [ebp - 0x3c]
xor esi, esi
mov eax, dword [ebp - 0x3c]
inc esi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
push esi
call fcn.100167d2
push esi
lea ecx, [ebp - 0x49c]
call fcn.100167d2
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xd78]
mov eax, dword [ebp - 0xd78]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x18]
jne 0x1002ec09
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x49c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
push esi
call fcn.100167d2
push esi
lea ecx, [ebp - 0x49c]
call fcn.100167d2
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
je 0x1002ec51
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002ec49
cmp dword [ebp - 0x28], eax
jne 0x1002ec6b
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xe
jne 0x1002ec41
jmp 0x1002ec6b
mov dword [ebp - 0x18], 0xb447fd32
xor edx, edx
dec dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg dl
mov dword [ebp - 0x48], edx
lea ecx, [ebp - 0x49c]
mov byte [ebp - 4], 2
call fcn.100167cd
xor eax, eax
lea ecx, [ebp - 0x5b4]
push eax
call fcn.100167d2
mov dword [eax], 0x1b
jmp 0x1002ecba
xor eax, eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x1002ecac
push eax
push eax
push 0x3da
call ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
push eax
lea ecx, [ebp - 0x5b4]
call fcn.100167d2
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x5b4]
push eax
call fcn.100167d2
cmp dword [eax], 0x1d
jle 0x1002ec90
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5b4]
call fcn.100167cd
lea eax, [ebp - 0x1058]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x1068]
push eax
lea ecx, [ebp - 0x1278]
movdqu xmmword [ebp - 0x1068], xmm0
call fcn.100167e1
lea ecx, [ebp - 0x1a1]
mov esi, eax
call fcn.100091c3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x50c]
push dword [esi]
call fcn.100167a7
push 5
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x50c]
xor eax, eax
push eax
call fcn.100167d2
mov dword [eax], 0x1b
jmp 0x1002ed64
xor eax, eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x1002ed56
push eax
push eax
push 0x3da
call ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
push eax
lea ecx, [ebp - 0x50c]
call fcn.100167d2
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x50c]
push eax
call fcn.100167d2
cmp dword [eax], 0x1d
jle 0x1002ed3a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50c]
call fcn.100167cd
lea eax, [ebp - 0xf18]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0xf28]
push eax
lea ecx, [ebp - 0x1288]
movdqu xmmword [ebp - 0xf28], xmm0
call fcn.100167e1
lea ecx, [ebp - 0x1d5]
mov esi, eax
call fcn.100091c3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x638]
push dword [esi]
call fcn.100167a7
push 6
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x638]
xor eax, eax
push eax
call fcn.100167d2
lea ecx, [ebp - 0x638]
mov dword [eax], 0x1b
xor eax, eax
push eax
call fcn.100167d2
push 0x1d
pop esi
jmp 0x1002ee2d
xor eax, eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x1002ee11
push eax
push eax
push 0x3da
call ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
push eax
lea ecx, [ebp - 0x638]
call fcn.100167d2
lea ecx, [ebp - 0x638]
inc dword [eax]
xor eax, eax
push eax
call fcn.100167d2
cmp dword [eax], esi
jle 0x1002edf5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x638]
call fcn.100167cd
xor eax, eax
inc eax
mov dword [ebp - 0x34], eax
push 5
pop eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x30], 0xfe57f6cc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1002ee77
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1204], 0xa8eac8b1
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x1002ee5e
xor eax, eax
mov dword [ebp - 0x34], 2
cmp dword [ebp - 0x34], eax
jl 0x1002ee95
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x1204], 0
jne 0x1002ee95
dec dword [ebp - 0x34]
jns 0x1002ee83
dec dword [ebp - 0x30]
mov dword [ebp - 0x14], 0x61928c17
mov dword [ebp - 0x40], 0xe229edca
mov dword [ebp - 0x24], 0xd816f93b
mov dword [ebp - 0x50], 0x18bd8502
push 4
pop eax
mov dword [ebp - 0x68c], eax
mov dword [ebp - 0x688], eax
mov dword [ebp - 0x684], eax
mov dword [ebp - 0x680], eax
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x14], esi
jmp 0x1002f05c
mov dword [ebp - 0x3c], 0x3b6f
xor edx, edx
mov dword [ebp - 0x18], 0xffffffff
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
add edx, dword [ebp - 0x3c]
imul edx, dword [ebp - 0x3c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x3c]
sub eax, 9
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
imul ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x1002f039
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x12a0]
lea eax, [ebp - 0xff8]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x1008]
push eax
movdqu xmmword [ebp - 0x1008], xmm0
call fcn.100167e1
lea ecx, [ebp - 0x1b7]
mov esi, eax
call fcn.100091c3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xc10]
push dword [esi]
call fcn.100167a7
xor eax, eax
mov dword [ebp - 4], 7
xor ecx, ecx
mov dword [ebp - 0x34], eax
inc ecx
jmp 0x1002efaf
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1b4], 0xffffffff
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x1002ef9e
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1b4]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x68c]
dec dword [ebp - 0x68c]
test eax, eax
jne 0x1002efdc
cmp dword [ebp - 0x18], eax
je 0x1002efde
mov eax, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1b4]
push ecx
lea ecx, [ebp - 0xc10]
call fcn.100167d2
mov edx, dword [ebp - 0x18]
mov esi, eax
mov ecx, dword [ebp - 0x3c]
xor eax, eax
cmp edx, ecx
setle al
mov dword [esi], eax
mov eax, dword [ebp - 0x1b4]
imul eax, dword [ebp - 0x3c]
sub eax, 7
mov dword [ebp - 0x50], eax
xor eax, eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x1002f028
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc10]
call fcn.100167cd
jmp 0x1002f059
mov dword [ebp - 0x24], eax
jmp 0x1002f053
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1002f050
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffd
jne 0x1002f03e
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x12
jne 0x1002eede
lea eax, [ebp - 0xf38]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0xf48]
push eax
lea ecx, [ebp - 0x12a8]
movdqu xmmword [ebp - 0xf48], xmm0
call fcn.100167e1
lea ecx, [ebp - 0x1b9]
mov esi, eax
call fcn.100091c3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x51c]
push dword [esi]
call fcn.100167a7
push 2
lea ecx, [ebp - 0xec8]
mov dword [ebp - 4], 8
call fcn.10016765
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x44], 0x95364446
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x1002f0f8
push dword [ebp - 0x34]
lea ecx, [ebp - 0xec8]
call fcn.100167d2
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jl 0x1002f0d9
xor eax, eax
xor esi, esi
mov dword [ebp - 0x34], eax
inc esi
jmp 0x1002f10d
mov dword [ebp - 0x30], 0xfffffffd
inc dword [ebp - 0x30]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x1002f100
lea ecx, [ebp - 0xec8]
mov byte [ebp - 4], 8
call fcn.100167cd
mov dword [ebp - 0x40], 7
lea ecx, [ebp - 0x86c]
push 2
call fcn.10016765
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002f15d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc28], 0x8100c430
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002f144
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002f17c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x7c], 0xa32f3f60
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1002f166
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002f198
push dword [ebp - 0x28]
lea ecx, [ebp - 0x86c]
call fcn.100167d2
mov dword [eax], 0x633933b8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1002f181
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x78]
sub ecx, eax
mov eax, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x78]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, 0x1355fff8
jg 0x1002f1ca
mov eax, dword [ebp - 0x78]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0xc24], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
cmp eax, esi
setge cl
xor eax, eax
cmp ecx, 0x71dbcabe
setne al
xor edx, edx
cmp eax, 8
mov eax, dword [ebp - 0x78]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x7c]
jge 0x1002f219
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x78], eax
je 0x1002f21b
mov edx, esi
mov eax, dword [ebp - 0x78]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x40]
jg 0x1002f24b
cmp dword [ebp - 0xc24], eax
je 0x1002f24b
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x1002f246
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor eax, eax
mov dword [ebp - 0x78], eax
jmp 0x1002f268
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1002f268
push eax
push 0x216f
push eax
push eax
push 0x1176
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
lea ecx, [ebp - 0x86c]
call fcn.100167d2
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], 8
mov dword [eax], 0xfffffffa
call fcn.100167cd
xor eax, eax
lea ecx, [ebp - 0x51c]
push eax
call fcn.100167d2
mov dword [eax], 0x1b
jmp 0x1002f6be
push esi
lea ecx, [ebp - 0x11c]
call fcn.10016765
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x3c], 0x3009ce45
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x30], 0xbf8c3261
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x1002f2f8
push dword [ebp - 0x34]
lea ecx, [ebp - 0x11c]
call fcn.100167d2
mov dword [eax], 0x5568
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x1002f2da
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1002f35e
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], eax
jmp 0x1002f34d
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1002f324
push 0x1d99
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002f34a
push dword [ebp - 0x24]
lea ecx, [ebp - 0x11c]
call fcn.100167d2
mov dword [eax], 0xe858
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002f32c
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jle 0x1002f308
mov dword [ebp - 0x3c], 0x7bf48c44
dec dword [ebp - 0x14]
jns 0x1002f300
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setne dl
cmp edx, 0xcedda565
sbb eax, eax
add eax, 0xf1359289
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0x260e
test eax, eax
je 0x1002f3a4
xor eax, eax
lea ecx, [ebp - 0x11c]
push eax
call fcn.100167d2
cmp dword [eax], 0
je 0x1002f3a4
mov eax, esi
jmp 0x1002f3a6
xor eax, eax
cmp eax, dword [ebp - 0x3c]
jg 0x1002f3b9
xor eax, eax
lea ecx, [ebp - 0x11c]
push eax
call fcn.100167d2
xor eax, eax
lea ecx, [ebp - 0x11c]
push eax
call fcn.100167d2
xor eax, eax
lea ecx, [ebp - 0x11c]
push eax
call fcn.100167d2
xor eax, eax
lea ecx, [ebp - 0x11c]
push eax
call fcn.100167d2
xor eax, eax
lea ecx, [ebp - 0x11c]
push eax
call fcn.100167d2
xor eax, eax
lea ecx, [ebp - 0x11c]
push eax
call fcn.100167d2
xor eax, eax
lea ecx, [ebp - 0x11c]
push eax
call fcn.100167d2
xor eax, eax
lea ecx, [ebp - 0x11c]
push eax
call fcn.100167d2
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002f42b
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x11c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.100167d2
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x40], 0x3aa4807c
mov byte [ebp - 4], 8
call fcn.100167cd
mov dword [ebp - 0x1c], 0xfffffffd
lea ecx, [ebp - 0x418]
mov dword [ebp - 0x28], 0xf38c0887
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x18], 0x3ae5d5ec
mov dword [ebp - 0x44], 0x55e97312
push 3
call fcn.10016765
mov byte [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x3c], 0xa3396d56
mov dword [ebp - 0x2c], 0x2038
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002f4c2
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd98], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002f4a9
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002f4db
push dword [ebp - 0x20]
lea ecx, [ebp - 0x418]
call fcn.100167d2
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002f4c7
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002f4fb
cmp dword [ebp - 0x28], 0xfffffffe
jle 0x1002f4fb
cmp dword [ebp - 0x1c], eax
jne 0x1002f4fb
cmp dword [ebp - 0x28], eax
je 0x1002f4fd
mov eax, esi
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x1c], eax
je 0x1002f548
xor eax, eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x1002f51d
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002f540
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1002f53d
push eax
push 0x10b2
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x1002f522
jmp 0x1002f587
xor eax, eax
push 0xfffffffffffffffb
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x1002f563
mov dword [ebp - 0x48], 0xaa53f0d3
mov dword [ebp - 0x48], 0x2ba75a59
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f552
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x1002f587
push eax
push 0xdb2
push 0x14c3
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x418]
dec dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
push esi
call fcn.100167d2
push esi
lea ecx, [ebp - 0x418]
call fcn.100167d2
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xd90]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xd90]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x18]
jne 0x1002f5d0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x418]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
push esi
call fcn.100167d2
push esi
lea ecx, [ebp - 0x418]
call fcn.100167d2
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
je 0x1002f618
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002f610
cmp dword [ebp - 0x28], eax
jne 0x1002f632
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xe
jne 0x1002f608
jmp 0x1002f632
mov dword [ebp - 0x18], 0xb447fd32
xor edx, edx
dec dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg dl
mov dword [ebp - 0x48], edx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 8
call fcn.100167cd
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x38], eax
jmp 0x1002f67c
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x1002f671
push 6
pop ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x558], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x1002f65d
xor eax, eax
cmp dword [ebp - 0x558], eax
jne 0x1002f682
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xb
je 0x1002f652
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1002f698
push 0x1495
call dword [sym.imp.USER32.dll_GetSysColorBrush]
xor eax, eax
cmp byte [ebp - 0xd], 0
je 0x1002f6ae
push eax
push eax
push 0x3da
call ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea ecx, [ebp - 0x51c]
push eax
call fcn.100167d2
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x51c]
push eax
call fcn.100167d2
cmp dword [eax], 0x1d
jle 0x1002f2a2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x51c]
call fcn.100167cd
push 6
pop eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x714]
mov dword [ebp - 0x3c], 0x45ee28fd
push esi
call fcn.10016765
xor eax, eax
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x1002f729
push dword [ebp - 0x34]
lea ecx, [ebp - 0x714]
call fcn.100167d2
and dword [eax], 0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x1002f70e
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1002f730
mov esi, eax
push eax
lea ecx, [ebp - 0x714]
call fcn.100167d2
xor ecx, ecx
mov ebx, dword [sym.imp.KERNEL32.dll_MulDiv]
cmp esi, 0xd9ba
mov edi, eax
setle cl
imul ecx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub esi, 0x585b7f
neg esi
sbb esi, esi
inc esi
neg esi
sub esi, ecx
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp eax, esi
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0x9f4ffcf3
sbb eax, eax
inc eax
mov dword [edi], eax
mov dword [ebp - 0x14], 0xffffffe5
cmp dword [ebp - 0x14], 0xf
jg 0x1002f7fd
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jg 0x1002f7f4
xor esi, esi
inc esi
mov dword [ebp - 0x24], 0xf4a8fe24
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002f7d0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x714]
call fcn.100167d2
mov dword [eax], 0x7a329ef4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002f7b2
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f7ec
push 0x1f76
push 0x24c1
push 0x33e
call ebx
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jle 0x1002f7a3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xf
jle 0x1002f798
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x714]
call fcn.100167cd
push 6
pop eax
xor esi, esi
mov dword [ebp - 0x14], eax
inc esi
mov dword [ebp - 0x3c], 0x45ee28fd
push esi
lea ecx, [ebp - 0x7d4]
call fcn.10016765
xor eax, eax
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x1002f854
push dword [ebp - 0x34]
lea ecx, [ebp - 0x7d4]
call fcn.100167d2
and dword [eax], 0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x1002f839
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1002f85b
mov esi, eax
push eax
lea ecx, [ebp - 0x7d4]
call fcn.100167d2
xor ecx, ecx
mov edi, eax
cmp esi, 0xd9ba
push 0xf
setle cl
imul ecx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub esi, 0x585b7f
neg esi
sbb esi, esi
inc esi
neg esi
sub esi, ecx
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp eax, esi
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0x9f4ffcf3
sbb eax, eax
inc eax
mov dword [edi], eax
mov dword [ebp - 0x14], 0xffffffe5
pop edi
cmp dword [ebp - 0x14], edi
jg 0x1002f923
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jg 0x1002f91b
xor esi, esi
inc esi
mov dword [ebp - 0x24], 0xf4a8fe24
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002f8f7
push dword [ebp - 0x24]
lea ecx, [ebp - 0x7d4]
call fcn.100167d2
mov dword [eax], 0x7a329ef4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002f8d9
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f913
push 0x1f76
push 0x24c1
push 0x33e
call ebx
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jle 0x1002f8ca
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1002f8bf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7d4]
call fcn.100167cd
push 6
pop eax
xor esi, esi
mov dword [ebp - 0x14], eax
inc esi
mov dword [ebp - 0x3c], 0x45ee28fd
push esi
lea ecx, [ebp - 0x72c]
call fcn.10016765
xor eax, eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x1002f976
push dword [ebp - 0x34]
lea ecx, [ebp - 0x72c]
call fcn.100167d2
and dword [eax], 0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x1002f95b
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1002f97d
mov esi, eax
push eax
lea ecx, [ebp - 0x72c]
call fcn.100167d2
xor ecx, ecx
mov edi, eax
cmp esi, 0xd9ba
setle cl
imul ecx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub esi, 0x585b7f
neg esi
sbb esi, esi
inc esi
neg esi
sub esi, ecx
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp eax, esi
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0x9f4ffcf3
sbb eax, eax
inc eax
mov dword [edi], eax
mov dword [ebp - 0x14], 0xffffffe5
cmp dword [ebp - 0x14], 0xf
jg 0x1002fa44
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jg 0x1002fa3b
xor esi, esi
inc esi
mov dword [ebp - 0x24], 0xf4a8fe24
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002fa17
push dword [ebp - 0x24]
lea ecx, [ebp - 0x72c]
call fcn.100167d2
mov dword [eax], 0x7a329ef4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002f9f9
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002fa33
push 0x1f76
push 0x24c1
push 0x33e
call ebx
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jle 0x1002f9ea
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xf
jle 0x1002f9df
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x72c]
call fcn.100167cd
mov dword [ebp - 0x1c], 0x8a61928c
push 8
mov dword [ebp - 0x1c], 0xfffffff5
pop ecx
cmp dword [ebp - 0x1c], ecx
jl 0x1002fa89
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], eax
jmp 0x1002fa7b
cmp dword [ebp - 0x1c], eax
jne 0x1002fa81
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffff4
jg 0x1002fa73
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jge 0x1002fa6b
mov eax, dword [ebp - 0x1c]
xor edi, edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c], 0xd8dec141
push 0xfffffffffffffff8
mov dword [ebp - 0x1c], eax
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 0xf27d2703
mov dword [ebp - 0x44], 0x3bfa32a1
push 3
mov dword [ebp - 0x44], 0x3531f145
pop ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xfffffff2
jne 0x1002fb33
xor eax, eax
inc edi
mov dword [ebp - 0x34], 0xb96ca2cb
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], 0x315362da
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
jge 0x1002faff
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xe78], 2
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x1002fae7
xor eax, eax
mov dword [ebp - 0x34], 0xffffffe3
jmp 0x1002fb22
mov dword [ebp - 0x44], 0x74bf90ed
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], 0x1a35ca42
mov dword [ebp - 0x44], edi
dec dword [ebp - 0x30]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x1b
jle 0x1002fb08
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff2
je 0x1002facb
jmp 0x1002fb34
inc edi
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x1002fb68
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002fb65
push eax
push 0xdb2
push 0x14c3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
xor eax, eax
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffffd
jl 0x1002fb3b
mov dword [ebp - 0x28], 0xffffffff
lea ecx, [ebp - 0xa64]
mov dword [ebp - 0x48], edi
push edi
call fcn.10016765
xor eax, eax
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002fbaf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbe0], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002fb96
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002fbcb
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa64]
call fcn.100167d2
mov dword [eax], 0xa10dd664
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002fbb4
mov eax, dword [ebp - 0x28]
neg eax
push 0
sbb eax, eax
neg eax
pop eax
setne al
cmp eax, dword [ebp - 0x28]
jle 0x1002fbe7
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x28], 0x889a
jle 0x1002fbfc
mov edx, edi
cmp dword [ebp - 0x28], eax
jne 0x1002fbfe
mov edx, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setne cl
xor edx, edx
imul ecx, ecx, 0xdac7
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor eax, eax
inc edx
sub edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x28]
jne 0x1002fc31
mov esi, edi
cmp dword [ebp - 0x48], eax
jne 0x1002fc33
mov esi, eax
mov dword [ebp - 0xbdc], esi
lea ecx, [ebp - 0xa64]
push eax
call fcn.100167d2
lea ecx, [ebp - 0xa64]
mov dword [eax], esi
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.100167cd
mov dword [ebp - 0x38], 0xcb457102
xor eax, eax
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x44], 0x79253a34
mov dword [ebp - 0x44], 0x9d585ed0
mov dword [ebp - 0x354], eax
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x34c], eax
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002fcae
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1114], 0x692b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002fc96
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002fcce
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc40], 0xf039d3cd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002fcb6
xor eax, eax
mov dword [ebp - 0x38], 2
cmp dword [ebp - 0x38], eax
jl 0x1002fd52
jmp 0x1002fcde
xor eax, eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], 0x3046b6eb
mov dword [ebp - 0x44], 0x2eaa29c1
mov dword [ebp - 0x48], 0x7182abbf
mov dword [ebp - 0x44], 0x40f2fdad
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0xcc47d1af
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], 0xa0c8d467
mov dword [ebp - 0x44], 0x920a6ff
mov dword [ebp - 0x44], 0x290ce96f
mov dword [ebp - 0x34], eax
jmp 0x1002fd35
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1370], 0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x1002fd24
dec dword [ebp - 0xc40]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1114]
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x38]
jns 0x1002fcdc
push 6
pop eax
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0xe4]
push 4
call fcn.10016765
mov dword [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x48], 0xfcb8f1fe
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002fda3
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xe4]
call fcn.100167d2
mov dword [eax], 0xf75dcec3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002fd84
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002fdc5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe4c], 0x314e7649
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002fdac
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x1002ff1f
jmp 0x1002fdd5
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x1002fde7
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x5b8], edi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x1002fdda
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xe4]
call fcn.100167d2
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xe4]
call fcn.100167d2
xor ebx, ebx
lea ecx, [ebp - 0xe4]
push edi
cmp dword [eax], ebx
sete bl
call fcn.100167d2
xor ecx, ecx
push 3
cmp ebx, dword [eax]
setge cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0xe4]
call fcn.100167d2
mov ecx, dword [ebp - 0x48]
xor ebx, ebx
push dword [ebp - 0x1c]
cmp ecx, dword [eax]
lea ecx, [ebp - 0xe4]
sete bl
call fcn.100167d2
push dword [ebp - 0x1c]
xor ecx, ecx
cmp ebx, dword [eax]
setl cl
xor ebx, ebx
cmp ecx, 0x97bc
lea ecx, [ebp - 0xe4]
setle bl
call fcn.100167d2
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xe4]
mov esi, eax
call fcn.100167d2
mov ecx, dword [esi]
xor edx, edx
push edi
cmp ecx, dword [eax]
lea ecx, [ebp - 0xe4]
setle dl
add edx, ebx
mov dword [ebp - 0x48], edx
call fcn.100167d2
push dword [ebp - 0x1c]
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0xe4]
sub esi, dword [eax]
call fcn.100167d2
xor ecx, ecx
push edi
cmp esi, dword [eax]
setle cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0xe4]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x5b8]
call fcn.100167d2
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0xe4]
push dword [ebp - 0x1c]
imul esi, dword [eax]
call fcn.100167d2
xor ebx, ebx
lea ecx, [ebp - 0xe4]
push edi
cmp dword [eax], esi
sete bl
call fcn.100167d2
mov ecx, dword [ebp - 0xe48]
xor edx, edx
cmp ebx, ecx
setge dl
xor ecx, ecx
cmp edx, dword [eax]
setg cl
xor eax, eax
cmp ecx, 0xdc64
setne al
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1002fdd3
or esi, 0xffffffff
lea ecx, [ebp - 0xe4]
mov dword [ebp - 4], esi
call fcn.100167cd
mov dword [ebp - 0x14], 0x45ee28fd
xor eax, eax
mov dword [ebp - 0x48], 0x1f6f49c2
mov dword [ebp - 0x34], eax
jmp 0x1002ff50
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x68], 0xfffffff7
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x1002ff42
push 5
mov dword [ebp - 0x68], 0xfffffffc
pop ebx
jmp 0x1002ffca
mov dword [ebp - 0x34], edi
xor ecx, ecx
mov dword [ebp - 0x48], 9
mov eax, dword [ebp - 0x68]
cmp eax, 0xfffffff9
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x68]
je 0x1002ff89
cmp dword [ebp - 0x68], esi
jg 0x1002ff89
mov ecx, edi
cmp dword [ebp - 0x34], eax
jne 0x1002ff8b
mov ecx, eax
mov eax, dword [ebp - 0x34]
imul eax, ecx
mov ecx, dword [ebp - 0x34]
sub ecx, eax
mov eax, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x2f3d
setg al
imul eax, eax, 9
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0x66c1932e
inc dword [ebp - 0x68]
cmp dword [ebp - 0x68], ebx
jg 0x1002ff61
push edi
lea ecx, [ebp - 0x7a4]
call fcn.10016765
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x18], 0xd53b
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], 0x8f6c74aa
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], 0xe4a6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x30]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edi
setle cl
xor eax, eax
add edx, ecx
imul edx, dword [ebp - 0x18]
mov dword [ebp - 0x48], edx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1003003d
push eax
push 0x186b
push eax
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov dword [ebp - 0x3c], 0xf6af1124
mov dword [ebp - 0x30], 0x5b6478c3
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x24], 0x8d8ef068
mov dword [ebp - 0x3c], 2
cmp dword [ebp - 0x3c], esi
jge 0x10030109
push 6
pop ebx
mov dword [ebp - 0x50], ebx
xor ecx, ecx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x48]
cmp eax, 0x38330377
setge cl
xor eax, eax
cmp ecx, 0x226c
setne al
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x100300a7
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
jge 0x1003012e