Function at 0x100282f6
Capabilities:
Allocate thread local storage
Check for time delay via queryperformancecounter
Check os version
Connect pipe
Create pipe
Create process on windows
Delete directory
Delete file
Extract resource via kernel32 functions
Get common file path
Get disk information
Get disk size
Get file system object information
Get geographical location
Get memory capacity
Identify system language via api
Log keystrokes
Modify service
Parse pe header
Set environment variable
Set thread local storage value
Suspend thread
Terminate process

Disassembly:
mov eax, 0x1006c42e
call fcn.1006af60
mov eax, 0x1294
call fcn.10067710
push ebx
push esi
push edi
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x458]
push 3
mov byte [ebp - 0x65], dl
call fcn.10014761
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], 0x126ff23b
mov dword [ebp - 0x4c], 0x8cccddd
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10028375
push dword [ebp - 0x14]
lea ecx, [ebp - 0x458]
call fcn.100147ff
mov dword [eax], 0xc69aed23
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10028356
xor eax, eax
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x458]
push eax
call fcn.100147ff
xor edx, edx
inc edx
cmp dword [eax], 0
jne 0x100283cb
cmp dword [ebp - 0x1c], 0xcda7209c
mov eax, dword [ebp - 0x44]
sbb ecx, ecx
add eax, 0xd02268f6
neg ecx
add eax, ecx
xor ecx, ecx
cmp eax, 0x5f27
setge cl
cmp ecx, 0x44f4
je 0x100283c2
push edx
lea ecx, [ebp - 0x458]
call fcn.100147ff
xor edx, edx
inc edx
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x100283cb
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
imul ecx, dword [ebp - 0x44]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
lea ecx, [ebp - 0x458]
setl dl
xor ebx, ebx
mov dword [ebp - 0x40], edx
push ebx
call fcn.100147ff
mov esi, dword [ebp - 0x40]
lea ecx, [ebp - 0x458]
push ebx
sub esi, dword [eax]
call fcn.100147ff
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [eax]
imul eax, esi
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x10028465
mov dword [ebp - 0x38], 0x7d3709e8
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10028440
call edi
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor eax, eax
push eax
lea ecx, [ebp - 0x458]
call fcn.100147ff
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x38], ecx
jmp 0x10028475
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10028475
push 0x1418
push eax
call ebx
or eax, 0xffffffff
lea ecx, [ebp - 0x458]
mov dword [ebp - 4], eax
call fcn.100147e3
push 3
lea ecx, [ebp - 0x434]
call fcn.10014761
xor esi, esi
xor eax, eax
inc esi
or ecx, 0xffffffff
mov dword [ebp - 4], esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], 0x126ff23b
mov dword [ebp - 0x4c], 0x8cccddd
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x30], 0xfffffff7
push 0xfffffffffffffffb
mov dword [ebp - 0x1c], eax
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100284ea
push dword [ebp - 0x14]
lea ecx, [ebp - 0x434]
call fcn.100147ff
mov dword [eax], 0xc69aed23
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100284cb
xor eax, eax
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x434]
push eax
call fcn.100147ff
cmp dword [eax], 0
jne 0x1002853a
cmp dword [ebp - 0x1c], 0xcda7209c
mov eax, dword [ebp - 0x44]
sbb ecx, ecx
add eax, 0xd02268f6
neg ecx
add eax, ecx
xor ecx, ecx
cmp eax, 0x5f27
setge cl
cmp ecx, 0x44f4
je 0x10028531
push esi
lea ecx, [ebp - 0x434]
call fcn.100147ff
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x38], eax
je 0x1002853c
mov edx, esi
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
imul ecx, dword [ebp - 0x44]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
lea ecx, [ebp - 0x434]
setl dl
xor eax, eax
mov dword [ebp - 0x40], edx
push eax
call fcn.100147ff
mov esi, dword [ebp - 0x40]
lea ecx, [ebp - 0x434]
sub esi, dword [eax]
xor eax, eax
push eax
call fcn.100147ff
mov eax, dword [eax]
imul eax, esi
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x100285cc
mov dword [ebp - 0x38], 0x7d3709e8
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x100285a7
call edi
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor eax, eax
push eax
lea ecx, [ebp - 0x434]
call fcn.100147ff
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x38], ecx
jmp 0x100285dc
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x100285dc
push 0x1418
push eax
call ebx
or ebx, 0xffffffff
lea ecx, [ebp - 0x434]
mov dword [ebp - 4], ebx
call fcn.100147e3
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x44], 0x9534
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10028625
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x320], 0xd1d8f8f5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002860c
xor eax, eax
cmp dword [ebp - 0x318], eax
jne 0x1002863f
mov eax, dword [ebp - 0x320]
mov eax, dword [ebp - 0x320]
mov eax, dword [ebp - 0x320]
mov eax, dword [ebp - 0x40]
xor ebx, ebx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x320]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x320]
setne bl
xor ecx, ecx
xor esi, esi
inc esi
cmp eax, esi
mov eax, dword [ebp - 0x31c]
push 0xfffffffffffffffe
setg cl
xor edx, edx
cmp ebx, ecx
setle dl
xor ebx, ebx
cmp edx, eax
setge bl
xor ecx, ecx
mov dword [ebp - 0x320], ebx
mov eax, dword [ebp - 0x1c]
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, eax
lea ecx, [ebp - 0x464]
pop eax
setge dl
sub eax, edx
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x44]
push 3
call fcn.10014761
mov dword [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x38], eax
or ecx, 0xffffffff
mov dword [ebp - 0x40], 0x126ff23b
mov dword [ebp - 0x4c], 0x8cccddd
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x30], 0xfffffff7
push 0xfffffffffffffffb
mov dword [ebp - 0x1c], eax
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10028703
push dword [ebp - 0x14]
lea ecx, [ebp - 0x464]
call fcn.100147ff
mov dword [eax], 0xc69aed23
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100286e4
xor eax, eax
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x464]
push eax
call fcn.100147ff
cmp dword [eax], 0
jne 0x10028753
cmp dword [ebp - 0x1c], 0xcda7209c
mov eax, dword [ebp - 0x44]
sbb ecx, ecx
add eax, 0xd02268f6
neg ecx
add eax, ecx
xor ecx, ecx
cmp eax, 0x5f27
setge cl
cmp ecx, 0x44f4
je 0x1002874a
push esi
lea ecx, [ebp - 0x464]
call fcn.100147ff
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x38], eax
je 0x10028755
mov edx, esi
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
imul ecx, dword [ebp - 0x44]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
lea ecx, [ebp - 0x464]
setl dl
xor ebx, ebx
mov dword [ebp - 0x40], edx
push ebx
call fcn.100147ff
mov esi, dword [ebp - 0x40]
lea ecx, [ebp - 0x464]
push ebx
sub esi, dword [eax]
call fcn.100147ff
mov eax, dword [eax]
imul eax, esi
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x100287e3
mov dword [ebp - 0x38], 0x7d3709e8
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x100287be
call edi
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor eax, eax
push eax
lea ecx, [ebp - 0x464]
call fcn.100147ff
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x38], ecx
jmp 0x100287f7
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x100287f7
push 0x1418
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
or esi, 0xffffffff
lea ecx, [ebp - 0x464]
mov dword [ebp - 4], esi
call fcn.100147e3
push 3
pop ebx
mov dword [ebp - 0x3c], 0xfffffffd
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x28], 0xd8da8e97
mov dword [ebp - 0x2c], 0xffff
push ebx
call fcn.10014761
xor eax, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10028857
push dword [ebp - 0x10]
lea ecx, [ebp - 0x150]
call fcn.100147ff
mov dword [eax], 0xbefa1e1c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10028839
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10028869
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd08], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002885c
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
neg edx
push 6
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setg cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setne dl
sub eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x28]
setle cl
xor edx, edx
cmp eax, ecx
setge dl
sub edx, 0xd14c
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x28]
pop edx
je 0x10028ac9
mov dword [ebp - 0x1c], 0x97eedf66
xor eax, eax
mov dword [ebp - 0x40], 0x5c8a2db
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x10028b28
push ebx
lea ecx, [ebp - 0x5a8]
call fcn.10014761
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x14], eax
jmp 0x1002891d
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5a8]
call fcn.100147ff
mov dword [eax], 0xb4b1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10028906
xor ebx, ebx
lea ecx, [ebp - 0x150]
inc ebx
push ebx
call fcn.100147ff
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x150]
call fcn.100147ff
push ebx
lea ecx, [ebp - 0x5a8]
mov esi, dword [eax]
add esi, 0x70a80ab6
neg esi
sbb esi, esi
neg esi
call fcn.100147ff
sub esi, dword [eax]
mov eax, dword [ebp - 0x28]
imul eax, esi
test eax, eax
jne 0x1002896c
mov esi, eax
cmp dword [ebp - 0x2c], eax
je 0x1002896e
mov esi, ebx
push ebx
lea ecx, [ebp - 0x150]
call fcn.100147ff
xor ebx, ebx
lea ecx, [ebp - 0x150]
push 2
cmp esi, dword [eax]
setge bl
call fcn.100147ff
push 2
lea ecx, [ebp - 0x150]
mov esi, dword [eax]
imul esi, ebx
call fcn.100147ff
push dword [ebp - 0x3c]
xor ebx, ebx
lea ecx, [ebp - 0x150]
cmp esi, dword [eax]
setl bl
call fcn.100147ff
xor ecx, ecx
sub ebx, dword [eax]
mov eax, dword [ebp - 0x2c]
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setle cl
xor edx, edx
cmp ecx, eax
lea ecx, [ebp - 0x5a8]
setl dl
sub edx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor esi, esi
inc edx
inc esi
mov dword [ebp - 0x44], edx
push esi
call fcn.100147ff
mov ecx, dword [ebp - 0x44]
xor ebx, ebx
push dword [ebp - 0x3c]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x150]
setl bl
call fcn.100147ff
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x28]
setge cl
sub ecx, eax
je 0x10028a3c
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10028a3e
jmp 0x10028a40
xor eax, eax
mov esi, eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x150]
call fcn.100147ff
xor ebx, ebx
lea ecx, [ebp - 0x150]
cmp dword [eax], esi
setge bl
xor eax, eax
inc eax
push eax
call fcn.100147ff
xor ecx, ecx
push 2
cmp ebx, dword [eax]
setg cl
xor ebx, ebx
cmp ecx, 0x718ce682
lea ecx, [ebp - 0x150]
setg bl
call fcn.100147ff
mov edx, dword [ebp - 0x40]
mov esi, eax
mov ecx, dword [ebp - 0xd08]
xor eax, eax
imul edx, ebx
push 3
pop ebx
mov byte [ebp - 4], bl
cmp edx, ecx
setl al
xor ecx, ecx
cmp eax, 0x17f4
setge cl
xor eax, eax
cmp dword [ebp - 0x1c], eax
mov dword [esi], ecx
lea ecx, [ebp - 0x5a8]
call fcn.100147e3
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jle 0x100288e8
jmp 0x10028b25
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edx
jle 0x10028b28
mov dword [ebp - 0x28], 0x18
cmp dword [ebp - 0x28], 0xf
jge 0x10028b1d
push ecx
lea ecx, [ebp - 0x150]
call fcn.100147ff
mov ecx, dword [ebp - 0x44]
mov esi, eax
xor eax, eax
cmp ecx, 0x27fa52e9
mov ecx, dword [ebp - 0x44]
setne al
xor edx, edx
cmp ecx, eax
push 1
setle dl
mov dword [esi], edx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xf
pop ecx
jl 0x10028ae6
push 6
pop edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jg 0x10028ad9
or esi, 0xffffffff
lea ecx, [ebp - 0x150]
mov dword [ebp - 4], esi
call fcn.100147e3
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x44], 0x9534
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10028b6c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x330], 0xd1d8f8f5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10028b54
xor eax, eax
cmp dword [ebp - 0x328], eax
jne 0x10028b86
mov eax, dword [ebp - 0x330]
mov eax, dword [ebp - 0x330]
mov eax, dword [ebp - 0x330]
mov eax, dword [ebp - 0x40]
xor ebx, ebx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x330]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x330]
setne bl
xor ecx, ecx
xor esi, esi
inc esi
cmp eax, esi
mov eax, dword [ebp - 0x32c]
push 0xfffffffffffffffe
setg cl
xor edx, edx
cmp ebx, ecx
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x330], ecx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
pop eax
setge cl
or ebx, 0xffffffff
sub eax, ecx
mov dword [ebp - 0x1c], eax
xor eax, eax
inc dword [ebp - 0x44]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], 0x6874be76
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x3c], 0x6d5d64f6
mov dword [ebp - 0x40], 0xd63ccf75
mov dword [ebp - 0x48], 0xfffffffa
mov dword [ebp - 0x4c], 0xfffffff9
cmp dword [ebp - 0x14], eax
je 0x10028c1e
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
neg eax
cmp eax, 0x92e6c0b3
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp eax, esi
setge cl
xor eax, eax
cmp ecx, 4
setg al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10028d6d
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x44], 0xe6047311
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], eax
jmp 0x10028cfc
mov dword [ebp - 0x1c], 0xa2c6eb81
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x22
jle 0x10028cf9
mov dword [ebp - 0x38], 0x49ce
mov dword [ebp - 0x34], 0x1cdffa87
cmp dword [ebp - 0x1c], eax
je 0x10028cad
cmp dword [ebp - 0x24], eax
jne 0x10028caf
mov esi, eax
mov edx, dword [ebp - 0x1c]
dec edx
neg edx
push 0
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
cmp eax, edx
setg cl
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x10]
cmp esi, eax
setne cl
xor eax, eax
cmp ecx, 0x6121589a
setl al
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x22
pop eax
push 1
pop esi
jg 0x10028c95
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe8
jge 0x10028c85
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
add edx, 0xa8b0
sub edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
cmp ecx, ebx
jge 0x10028d2d
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x14], eax
je 0x10028d2f
mov ecx, esi
mov eax, dword [ebp - 0x28]
sub ecx, eax
add ecx, dword [ebp - 0x40]
jne 0x10028d42
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x44], eax
je 0x10028d44
mov edx, esi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
sub eax, dword [ebp - 0x28]
imul eax, eax, 0xfffd
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], eax
jne 0x10028d66
cmp dword [ebp - 0x48], eax
je 0x10028d68
mov eax, esi
mov dword [ebp - 0x10], eax
jmp 0x10028d92
mov dword [ebp - 0x10], 0xc
jmp 0x10028d8c
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10028d89
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffef
jle 0x10028d76
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10028dcb
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setge dl
xor ecx, ecx
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
cmp eax, edx
setg cl
sub ecx, 0x3dd60280
je 0x10028dc9
mov eax, esi
jmp 0x10028dcb
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10028df0
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10028e0a
push 0x188c
push 0x909
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 3
lea ecx, [ebp - 0x4ac]
call fcn.10014761
mov dword [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x38], 0xb34e6d4f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10028e47
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x88], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10028e2f
xor eax, eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x1c
jge 0x10028e81
mov dword [ebp - 0x38], esi
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10028e69
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x88]
cmp dword [ebp - 0x88], 0x1c
push 0
pop eax
jl 0x10028e56
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10028e98
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
xor eax, eax
push 3
pop ebx
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0xdc4]
push ebx
call fcn.10014761
push 6
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10028ee2
push dword [ebp - 0x14]
lea ecx, [ebp - 0xdc4]
call fcn.100147ff
mov dword [eax], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10028ec4
xor eax, eax
mov dword [ebp - 0x4c], 2
cmp dword [ebp - 0x4c], eax
jl 0x10028f28
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x10028f23
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10028f17
push eax
push 0xd1d
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
mov dword [ebp - 0x38], 0x126ff23b
dec dword [ebp - 0x1c]
jns 0x10028efd
dec dword [ebp - 0x4c]
jns 0x10028eee
lea ecx, [ebp - 0xdc4]
mov byte [ebp - 4], 5
call fcn.100147e3
mov dword [ebp - 0x4c], 0x126ff23b
xor eax, eax
mov dword [ebp - 0x1c], 0x5121ac48
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x38], 0xe24b2e80
mov dword [ebp - 0x30], esi
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10028f7a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd8], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10028f62
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10028f90
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbf8], 0x5799333c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10028f7f
mov eax, dword [ebp - 0xd4]
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], esi
mov eax, dword [ebp - 0xd4]
test eax, eax
mov eax, dword [ebp - 0x44]
setg cl
xor edx, edx
cmp eax, ecx
push 3
setle dl
xor ecx, ecx
mov dword [ebp - 0xbf4], edx
mov eax, dword [ebp - 0xd4]
cmp edx, eax
setle cl
imul eax, ecx, 0xfffc
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd4]
sub edx, eax
mov eax, dword [ebp - 0xd4]
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xd8]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0xd4]
setge bl
xor ecx, ecx
cmp ebx, eax
pop ebx
setg cl
or eax, 0xffffffff
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x1f4]
mov dword [ebp - 0x48], 0x8cccddd
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xffff
mov dword [ebp - 0x10], 0xca2c
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x44], 0xa3531f1
mov dword [ebp - 0x24], eax
push ebx
call fcn.10014761
xor eax, eax
mov byte [ebp - 4], 7
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002908c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1f4]
call fcn.100147ff
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10029072
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10029094
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
cmp eax, 0x4204
mov eax, dword [ebp - 0x10]
setne cl
sub eax, ecx
xor ecx, ecx
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp eax, esi
setle cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x100291df
mov dword [ebp - 0x38], 0xffff
lea ecx, [ebp - 0x1f4]
push dword [ebp - 0x3c]
call fcn.100147ff
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1f4]
call fcn.100147ff
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1f4]
call fcn.100147ff
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1f4]
call fcn.100147ff
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1f4]
call fcn.100147ff
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1f4]
call fcn.100147ff
xor ebx, ebx
cmp dword [eax], ebx
je 0x10029156
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1f4]
call fcn.100147ff
cmp dword [eax], ebx
jne 0x1002915c
xor eax, eax
xor ebx, ebx
mov esi, eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1f4]
call fcn.100147ff
mov eax, dword [eax]
add eax, esi
je 0x10029187
push ebx
lea ecx, [ebp - 0x1f4]
call fcn.100147ff
cmp dword [eax], ebx
je 0x10029187
xor esi, esi
inc esi
mov eax, esi
jmp 0x1002918c
xor esi, esi
mov eax, ebx
inc esi
push 2
mov dword [ebp - 0x38], eax
xor eax, eax
pop ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x100291d0
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jl 0x100291cb
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x100291c6
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100291be
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
dec dword [ebp - 0x24]
jns 0x100291ac
push 2
pop ecx
dec dword [ebp - 0x14]
jns 0x100291a4
dec dword [ebp - 0x10]
jns 0x1002919c
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ecx
jle 0x100290e3
push 3
pop ebx
lea ecx, [ebp - 0x1f4]
mov byte [ebp - 4], 5
call fcn.100147e3
or eax, 0xffffffff
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff5
jle 0x1002933d
push 2
lea ecx, [ebp - 0x9ac]
call fcn.10014761
mov byte [ebp - 4], 8
push 6
pop eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x40], 0x41637c1d
mov dword [ebp - 0x44], 0xbd0d42ad
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10029259
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9ac]
call fcn.100147ff
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002923a
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10029316
mov dword [ebp - 0x38], 0x5ff57440
mov dword [ebp - 0x24], eax
jmp 0x1002927e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa0], 0xf9d4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002926d
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x9ac]
xor eax, eax
push eax
call fcn.100147ff
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
inc ecx
imul ecx, dword [ebp - 0xa0]
cmp ecx, 2
setl al
xor ecx, ecx
cmp eax, 2
setne cl
sub ecx, 0xa4ccfd66
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp dword [ebp - 0x14], ecx
jne 0x100292d9
mov ecx, esi
cmp dword [ebp - 0x14], eax
jne 0x100292db
mov ecx, eax
dec dword [ebp - 0x40]
mov eax, dword [ebp - 0xa0]
sub ecx, eax
cmp dword [ebp - 0x40], ecx
je 0x100292f1
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
push 0
setne dl
mov dword [ebp - 0x38], edx
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], esi
jle 0x10029261
lea ecx, [ebp - 0x9ac]
mov byte [ebp - 4], 5
call fcn.100147e3
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff5
jg 0x1002920a
xor eax, eax
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0xcd0]
push ebx
call fcn.10014761
push 9
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10029384
push dword [ebp - 0x14]
lea ecx, [ebp - 0xcd0]
call fcn.100147ff
mov dword [eax], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10029366
xor eax, eax
mov dword [ebp - 0x4c], 2
cmp dword [ebp - 0x4c], eax
jl 0x100293ca
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x100293c5
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100293b9
push eax
push 0xd1d
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
mov dword [ebp - 0x38], 0x126ff23b
dec dword [ebp - 0x1c]
jns 0x1002939f
dec dword [ebp - 0x4c]
jns 0x10029390
lea ecx, [ebp - 0xcd0]
mov byte [ebp - 4], 5
call fcn.100147e3
movdqa xmm0, xmmword [0x10007aa0]
lea ecx, [ebp - 0x11ec]
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x34], eax
or eax, 0xffffffff
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0xf90]
push eax
lea eax, [ebp - 0xfa0]
mov dword [ebp - 0x14], 0xad386cce
push eax
movdqu xmmword [ebp - 0xfa0], xmm0
call fcn.1001480e
lea ecx, [ebp - 0x1c9]
mov esi, eax
call fcn.10008a08
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x340]
push dword [esi]
call fcn.100147bd
push 6
mov byte [ebp - 4], 0xa
pop eax
mov dword [ebp - 0x40], 0x60277ed4
mov dword [ebp - 0x3c], eax
jmp 0x100294ae
xor eax, eax
mov dword [ebp - 0x38], 0xadacd7d3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10029471
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x62c], 0xa516
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10029458
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x100294b4
mov eax, dword [ebp - 0x62c]
xor edx, edx
mov eax, dword [ebp - 0x62c]
mov ecx, dword [ebp - 0x628]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
push 0
setle cl
add ecx, 0x51ebf0d
pop eax
setns al
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff6
jg 0x10029446
mov dword [ebp - 0x3c], ebx
xor eax, eax
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x3c], eax
jl 0x100295bd
mov dword [ebp - 0x44], 0xfffffff7
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x1c], 0x534ce5fe
mov dword [ebp - 0x44], ebx
push ebx
call fcn.100147ff
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp ecx, 0xffffffff
setle dl
cmp edx, dword [eax]
jge 0x100294f4
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x340]
call fcn.100147ff
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x340]
push dword [ebp - 0x3c]
call fcn.100147ff
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x340]
push dword [ebp - 0x3c]
call fcn.100147ff
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x340]
call fcn.100147ff
push 2
lea ecx, [ebp - 0x340]
mov esi, eax
call fcn.100147ff
mov ecx, dword [eax]
xor eax, eax
cmp ecx, dword [esi]
setle al
sub eax, 0xd89d6848
neg eax
sbb eax, eax
add eax, 0xbeb927f5
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, ebx
setle cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x340]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x1c]
push dword [ebp - 0x3c]
add esi, 0x36a74b4f
neg esi
sbb esi, esi
neg esi
call fcn.100147ff
xor edx, edx
cmp esi, 0xf9c85207
setne dl
xor ecx, ecx
cmp edx, dword [eax]
setne cl
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x3c]
jns 0x100294c5
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 5
call fcn.100147e3
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100295ee
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd94], 0xffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100295d6
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002960e
push 0x1ba4
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002962a
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10029652
push dword [ebp - 0x14]
lea ecx, [ebp - 0x4ac]
call fcn.100147ff
mov dword [eax], 0xc69aed23
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10029633
xor eax, eax
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x1c], 0x1f2e
push 0xfffffffffffffffb
mov dword [ebp - 0x38], 0x93c1
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x14], eax
jmp 0x10029683
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x388], 0x5ca9869e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10029672
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x1c], eax
jl 0x100296a2
mov eax, dword [ebp - 0x388]
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp eax, 0xcd9796a0
mov dword [ebp - 0x388], eax
push 0
setne cl
xor eax, eax
cmp ecx, 0x9785
setle al
sub eax, 0x4cb4
pop eax
setns al
inc eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x100296ee
push 0xdf9
push eax
push eax
push 0x60e
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
xor eax, eax
inc dword [ebp - 0x28]
lea ecx, [ebp - 0x4ac]
push eax
call fcn.100147ff
cmp dword [eax], 0
jne 0x1002973e
cmp dword [ebp - 0x28], 0xcda7209c
mov eax, dword [ebp - 0x34]
sbb ecx, ecx
add eax, 0xd02268f6
neg ecx
add eax, ecx
xor ecx, ecx
cmp eax, 0x5f27
setge cl
cmp ecx, 0x44f4
je 0x10029735
push ebx
lea ecx, [ebp - 0x4ac]
call fcn.100147ff
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x50], eax
je 0x10029740
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
imul ecx, dword [ebp - 0x34]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
lea ecx, [ebp - 0x4ac]
setl dl
xor ebx, ebx
mov dword [ebp - 0x4c], edx
push ebx
call fcn.100147ff
mov esi, dword [ebp - 0x4c]
lea ecx, [ebp - 0x4ac]
push ebx
sub esi, dword [eax]
call fcn.100147ff
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [eax]
imul eax, esi
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10029bf7
mov dword [ebp - 0x10], 0x69fdf99f
inc ebx
mov dword [ebp - 0x48], 0xdab9737e
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x10], 0xffffffe4
cmp dword [ebp - 0x10], 0x16
jge 0x1002986a
mov dword [ebp - 0x1c], 0xf1a0
xor ecx, ecx
mov dword [ebp - 0x14], 0xf97812a3
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, ebx
setg cl
xor eax, eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x14], eax
jmp 0x1002985c
mov dword [ebp - 0x44], 0xc1f7b400
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002981f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x774], 0x3c017f21
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10029806
xor eax, eax
cmp dword [ebp - 0x76c], eax
je 0x1002982e
mov ecx, ebx
cmp dword [ebp - 0x14], eax
jne 0x10029830
mov ecx, eax
cmp dword [ebp - 0x76c], eax
jne 0x10029848
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x76c], eax
je 0x1002984a
mov eax, ebx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
imul eax, ecx
push 0
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], 0xfffffffd
jle 0x100297f6
inc dword [ebp - 0x10]
jmp 0x100297b2
mov dword [ebp - 0x50], 0x7d3709e8
lea ecx, [ebp - 0x8e0]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x48], 7
push 4
call fcn.10014761
mov byte [ebp - 4], 0xb
or eax, 0xffffffff
mov dword [ebp - 0x40], 0xd44c039e
push 4
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x50], 0xfffffffe
mov dword [ebp - 0x38], 0x1434a938
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x100298d4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x8e0]
call fcn.100147ff
mov dword [eax], 0x315362da
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100298b7
dec dword [ebp - 0x44]
lea ecx, [ebp - 0x8e0]
mov eax, dword [ebp - 0x48]
dec eax
neg eax
push 3
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
call fcn.100147ff
mov edx, dword [ebp - 0x34]
mov esi, eax
mov ecx, dword [ebp - 0x48]
xor eax, eax
cmp ecx, edx
setl al
xor edx, edx
mov dword [esi], eax
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x40]
add ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x38]
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, edx
setg cl
cmp dword [ebp - 0x10], ecx
jne 0x10029938
push 3
lea ecx, [ebp - 0x8e0]
call fcn.100147ff
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x8e0]
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 5
call fcn.100147e3
xor eax, eax
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10029972
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3d8], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002995e
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x100299d4
mov dword [ebp - 0x10], eax
jmp 0x10029990
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x77c], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002997f
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x3d8]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3d8], ecx
test ecx, ecx
jne 0x100299c2
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x100299cc
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
jmp 0x100299cc
mov dword [ebp - 0x77c], 0xc8d3c891
dec dword [ebp - 0x14]
push 0
pop eax
jns 0x1002997a
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100299e7
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10029a51
mov dword [ebp - 0x10], 0x91a049fe
mov dword [ebp - 0x50], 0x70cd5099
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10029a16
push eax
push 0x2d3
push eax
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
xor eax, eax
push 9
mov dword [ebp - 0x10], 0xfffffff6
pop ecx
jmp 0x10029a3f
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0x1c
jmp 0x10029a36
cmp dword [ebp - 0x50], eax
jne 0x10029a3c
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffe
jle 0x10029a2e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jge 0x10029a22
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 3
lea ecx, [ebp - 0x7a8]
call fcn.10014761
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x11fc]
movdqa xmm0, xmmword [0x10007ae0]
or eax, 0xffffffff
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xed0]
push eax
mov dword [ebp - 0x40], 0xfffffff6
lea eax, [ebp - 0xee0]
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], 0xb1466ac3
push eax
movdqu xmmword [ebp - 0xee0], xmm0
call fcn.1001480e
lea ecx, [ebp - 0x215]
mov esi, eax
call fcn.10008a08
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xe74]
push dword [esi]
call fcn.100147bd
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10029af8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x7a8]
call fcn.100147ff
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10029ad9
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x10029b24
mov dword [ebp - 0x1c], 0xade2167f
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x10029b21
or edx, 0xffffffff
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x50], 0xfffffff9
dec dword [ebp - 0x1c]
jns 0x10029b12
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x10029b00
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
neg eax
mov dword [ebp - 0x14], eax
jne 0x10029b61
dec dword [ebp - 0x48]
jne 0x10029b47
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0xe74]
xor eax, eax
push eax
call fcn.100147ff
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x24], eax
je 0x10029b63
mov esi, ebx
push ebx
lea ecx, [ebp - 0x7a8]
call fcn.100147ff
or edx, 0xffffffff
xor ecx, ecx
cmp esi, edx
push ebx
setg cl
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x7a8]
setne dl
xor eax, eax
cmp edx, 0x5bb5
setg al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
call fcn.100147ff
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, ebx
setg cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0xe74]
call fcn.100147e3
lea ecx, [ebp - 0x7a8]
mov byte [ebp - 4], 5
call fcn.100147e3
xor eax, eax
lea ecx, [ebp - 0x4ac]
push eax
call fcn.100147ff
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x4c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x50], ecx
jmp 0x10029f44
push 3
pop ecx
mov dword [ebp - 0x14], 0x60477862
mov dword [ebp - 0x14], ecx
jmp 0x10029c41
mov dword [ebp - 0x50], 0x7f5ed9a9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10029c2d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x107c], 0x2e08974b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10029c15
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10029c47
mov eax, dword [ebp - 0x107c]
mov dword [ebp - 0x50], eax
inc dword [ebp - 0x14]
push 0
pop eax
cmp dword [ebp - 0x14], 0x1a
jge 0x10029c06
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], bl
je 0x10029c5f
push 0x3fa
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor ebx, ebx
mov dword [ebp - 0x24], 0x5132
inc ebx
mov dword [ebp - 0x44], 0xc299e885
push ebx
lea ecx, [ebp - 0x688]
call fcn.10014761
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x530]
mov dword [ebp - 0x50], 0x2d6273d5
mov dword [ebp - 0x44], 0xe6337258
push 2
call fcn.10014761
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x44], 0xfffffffc
push 0xfffffffffffffffd
pop esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10029cd9
push dword [ebp - 0x10]
lea ecx, [ebp - 0x688]
call fcn.100147ff
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10029cbf
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10029d01
push dword [ebp - 0x10]
lea ecx, [ebp - 0x530]
call fcn.100147ff
mov dword [eax], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10029ce2
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10029dce
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x688]
mov dword [ebp - 0x44], eax
xor ebx, ebx
mov eax, dword [ebp - 0x44]
push ebx
imul esi, eax, 0xfffa
call fcn.100147ff
xor ecx, ecx
inc ecx
push ecx
mov dword [eax], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x530]
mov esi, dword [ebp - 0x44]
add esi, 0xffffc026
call fcn.100147ff
mov dword [eax], esi
test esi, esi
je 0x10029d50
mov eax, dword [ebp - 0x24]
xor eax, eax
lea ecx, [ebp - 0x530]
inc eax
push eax
call fcn.100147ff
cmp dword [eax], ebx
jne 0x10029d8a
push ebx
lea ecx, [ebp - 0x530]
call fcn.100147ff
cmp dword [eax], ebx
jne 0x10029d8a
push ebx
lea ecx, [ebp - 0x688]
call fcn.100147ff
cmp dword [eax], ebx
jne 0x10029d8a
mov eax, ebx
xor ebx, ebx
inc ebx
jmp 0x10029d8f
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x10029dab
push eax
lea ecx, [ebp - 0x688]
call fcn.100147ff
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x530]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
push ebx
call fcn.100147ff
cmp dword [eax], 0
jne 0x10029dce
xor eax, eax
mov ecx, eax
jmp 0x10029dd0
mov ecx, ebx
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
setg al
xor edx, edx
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setge cl
xor eax, eax
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x50], ecx
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10029e10
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
lea ecx, [ebp - 0x530]
call fcn.100147e3
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 5
call fcn.100147e3
xor eax, eax
lea ecx, [ebp - 0xab4]
mov byte [ebp - 0x15], al
mov dword [ebp - 0x24], 0xf9c28ade
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x1160
mov dword [ebp - 0x48], 0xfffffff7
push 3
call fcn.10014761
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x14], eax
jmp 0x10029e7c
push dword [ebp - 0x14]
lea ecx, [ebp - 0xab4]
call fcn.100147ff
mov dword [eax], 0x41dbc46d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10029e65
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10029ead
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
je 0x10029ea4
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x14], eax
je 0x10029ece
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10029ed0
mov eax, ebx
mov edx, dword [ebp - 0x10]
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x10]
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0xab4]
mov esi, dword [ebp - 0x48]
push eax
call fcn.100147ff
mov dword [eax], esi
xor eax, eax
cmp esi, 0x5e40c883
sete al
mov dword [ebp - 0x44], eax
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x10029f12
mov edx, eax
cmp dword [ebp - 0x48], eax
je 0x10029f14
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
sete cl
imul ecx, dword [ebp - 0x10]
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0xab4]
call fcn.100147e3
cmp byte [ebp - 0x15], 0
je 0x10029f44
push 0x1418
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
or esi, 0xffffffff
lea ecx, [ebp - 0x4ac]
mov dword [ebp - 4], esi
call fcn.100147e3
mov dword [ebp - 0x14], esi
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], esi
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10029f87
push 0x74e
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10029fa4
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x48], eax
je 0x10029fa6
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], eax
jne 0x10029fbf
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10029fe5
mov dword [ebp - 0x44], 0x50f82bae
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10029fe0
push 0x1418
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
dec dword [ebp - 0x44]
jmp 0x10029ffa
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10029ffa
push eax
push 0x15ee
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x3c], 0xfffffffd
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x28], 0xd8da8e97
mov dword [ebp - 0x2c], 0xffff
push 3
call fcn.10014761
xor eax, eax
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002a04d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x168]
call fcn.100147ff
mov dword [eax], 0xbefa1e1c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002a02e
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002a05f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe34], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002a052
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setg cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setne dl
sub eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x28]
setle cl
xor edx, edx
cmp eax, ecx
setge dl
sub edx, 0xd14c
neg edx
sbb edx, edx
xor eax, eax
inc edx
add edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x28]
je 0x1002a2c3
mov dword [ebp - 0x40], 0x97eedf66
mov dword [ebp - 0x48], 0x5c8a2db
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x1002a31d
jmp 0x1002a0e0
xor ebx, ebx
inc ebx
push 3
lea ecx, [ebp - 0x71c]
call fcn.10014761
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x14], eax
jmp 0x1002a116
push dword [ebp - 0x14]
lea ecx, [ebp - 0x71c]
call fcn.100147ff
mov dword [eax], 0xb4b1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002a0ff
push ebx
lea ecx, [ebp - 0x168]
call fcn.100147ff
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x168]
call fcn.100147ff
push ebx
lea ecx, [ebp - 0x71c]
mov esi, dword [eax]
add esi, 0x70a80ab6
neg esi
sbb esi, esi
neg esi
call fcn.100147ff
sub esi, dword [eax]
mov eax, dword [ebp - 0x28]
imul eax, esi
test eax, eax
jne 0x1002a163
mov esi, eax
cmp dword [ebp - 0x2c], eax
je 0x1002a165
mov esi, ebx
push ebx
lea ecx, [ebp - 0x168]
call fcn.100147ff
xor ebx, ebx
lea ecx, [ebp - 0x168]
push 2
cmp esi, dword [eax]
setge bl
call fcn.100147ff
push 2
lea ecx, [ebp - 0x168]
mov esi, dword [eax]
imul esi, ebx
call fcn.100147ff
push dword [ebp - 0x3c]
xor ebx, ebx
lea ecx, [ebp - 0x168]
cmp esi, dword [eax]
setl bl
call fcn.100147ff
xor ecx, ecx
sub ebx, dword [eax]
mov eax, dword [ebp - 0x2c]
cmp ebx, eax
mov eax, dword [ebp - 0x40]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setle cl
xor edx, edx
cmp ecx, eax
lea ecx, [ebp - 0x71c]
setl dl
sub edx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor edi, edi
inc edx
inc edi
mov dword [ebp - 0x44], edx
push edi
call fcn.100147ff
mov ecx, dword [ebp - 0x44]
xor ebx, ebx
push dword [ebp - 0x3c]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x168]
setl bl
call fcn.100147ff
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x28]
setge cl
sub ecx, eax
je 0x1002a235
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002a237
mov esi, edi
jmp 0x1002a239
xor eax, eax
mov esi, eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x168]
call fcn.100147ff
xor ebx, ebx
lea ecx, [ebp - 0x168]
push edi
cmp dword [eax], esi
setge bl
call fcn.100147ff
xor ecx, ecx
push 2
cmp ebx, dword [eax]
setg cl
xor ebx, ebx
cmp ecx, 0x718ce682
lea ecx, [ebp - 0x168]
setg bl
call fcn.100147ff
mov edx, dword [ebp - 0x48]
mov esi, eax
mov ecx, dword [ebp - 0xe34]
xor eax, eax
imul edx, ebx
mov byte [ebp - 4], 0x11
cmp edx, ecx
setl al
xor ecx, ecx
cmp eax, 0x17f4
setge cl
xor eax, eax
cmp dword [ebp - 0x40], eax
mov dword [esi], ecx
lea ecx, [ebp - 0x71c]
call fcn.100147e3
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jle 0x1002a0dd
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1002a31a
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x2c], eax
push 6
pop eax
cmp dword [ebp - 0x2c], eax
jle 0x1002a31d
mov dword [ebp - 0x28], 0x18
cmp dword [ebp - 0x28], 0xf
jge 0x1002a312
push ebx
lea ecx, [ebp - 0x168]
call fcn.100147ff
mov ecx, dword [ebp - 0x44]
mov esi, eax
xor eax, eax
cmp ecx, 0x27fa52e9
mov ecx, dword [ebp - 0x44]
setne al
xor edx, edx
cmp ecx, eax
setle dl
mov dword [esi], edx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xf
jl 0x1002a2de
push 6
pop eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jg 0x1002a2d1
or esi, 0xffffffff
lea ecx, [ebp - 0x168]
mov dword [ebp - 4], esi
call fcn.100147e3
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffe
xor edx, edx
mov dword [ebp - 0x14], eax
inc edx
cmp dword [ebp - 0x14], edx
jge 0x1002a357
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x670], 0x13b9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002a33f
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x1002a378
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x670], 0
jne 0x1002a376
inc dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jle 0x1002a35f
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x44], 0x9534
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002a3ae
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x354], 0xd1d8f8f5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002a395
xor eax, eax
cmp dword [ebp - 0x34c], eax
jne 0x1002a3c8
mov eax, dword [ebp - 0x354]
mov eax, dword [ebp - 0x354]
mov eax, dword [ebp - 0x354]
mov eax, dword [ebp - 0x48]
xor ebx, ebx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x354]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
mov eax, dword [ebp - 0x354]
setne bl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x350]
push 0xfffffffffffffffe
setg cl
xor edx, edx
cmp ebx, ecx
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x354], ecx
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
cmp edx, eax
pop eax
setge cl
sub eax, ecx
mov dword [ebp - 0x40], eax
xor eax, eax
inc dword [ebp - 0x44]
mov dword [ebp - 0x10], 0x91a049fe
mov dword [ebp - 0x50], 0x70cd5099
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1002a44b
push eax
push 0x2d3
push eax
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
xor eax, eax
push 9
mov dword [ebp - 0x10], 0xfffffff6
pop ecx
jmp 0x1002a474
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0x1c
jmp 0x1002a46b
cmp dword [ebp - 0x50], eax
jne 0x1002a471
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffe
jle 0x1002a463
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jge 0x1002a457
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], esi
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002a4aa
push 0x74e
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002a4cc
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002a4cc
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x1002a4d1
xor ebx, ebx
inc ebx
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], eax
jne 0x1002a4ea
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002a510
mov dword [ebp - 0x44], 0x50f82bae
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002a50b
push 0x1418
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
dec dword [ebp - 0x44]
jmp 0x1002a525
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002a525
push eax
push 0x15ee
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x10], 0x5043c4ab
push 9
pop eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x38], 0xddac0faa
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002a55b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1d8], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002a543
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002a588
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1d8], eax
test eax, eax
jne 0x1002a588
mov eax, dword [ebp - 0x1d8]
mov edx, dword [ebp - 0x1d8]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xfff8
setne al
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1002a5be
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov dword [ebp - 0x3c], 0xfffffffd
lea ecx, [ebp - 0x15c]
mov dword [ebp - 0x28], 0xd8da8e97
mov dword [ebp - 0x2c], 0xffff
push 3
call fcn.10014761
xor eax, eax
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002a611
push dword [ebp - 0x10]
lea ecx, [ebp - 0x15c]
call fcn.100147ff
mov dword [eax], 0xbefa1e1c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002a5f2
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002a623
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe4c], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002a616
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setg cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setne dl
sub eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x28]
setle cl
xor edx, edx
cmp eax, ecx
setge dl
sub edx, 0xd14c
neg edx
sbb edx, edx
xor eax, eax
inc edx
add edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x28]
je 0x1002a885
mov dword [ebp - 0x40], 0x97eedf66
mov dword [ebp - 0x48], 0x5c8a2db
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x1002a8df
push 3
lea ecx, [ebp - 0x6a0]
call fcn.10014761
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x14], eax
jmp 0x1002a6d5
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6a0]
call fcn.100147ff
mov dword [eax], 0xb4b1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002a6be
push ebx
lea ecx, [ebp - 0x15c]
call fcn.100147ff
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x15c]
call fcn.100147ff
push ebx
lea ecx, [ebp - 0x6a0]
mov esi, dword [eax]
add esi, 0x70a80ab6
neg esi
sbb esi, esi
neg esi
call fcn.100147ff
sub esi, dword [eax]
mov eax, dword [ebp - 0x28]
imul eax, esi
test eax, eax
jne 0x1002a722
mov esi, eax
cmp dword [ebp - 0x2c], eax
je 0x1002a724
mov esi, ebx
push ebx
lea ecx, [ebp - 0x15c]
call fcn.100147ff
xor ebx, ebx
lea ecx, [ebp - 0x15c]
push 2
cmp esi, dword [eax]
setge bl
call fcn.100147ff
push 2
lea ecx, [ebp - 0x15c]
mov esi, dword [eax]
imul esi, ebx
call fcn.100147ff
push dword [ebp - 0x3c]
xor ebx, ebx
lea ecx, [ebp - 0x15c]
cmp esi, dword [eax]
setl bl
call fcn.100147ff
xor ecx, ecx
sub ebx, dword [eax]
mov eax, dword [ebp - 0x2c]
cmp ebx, eax
mov eax, dword [ebp - 0x40]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setle cl
xor edx, edx
cmp ecx, eax
lea ecx, [ebp - 0x6a0]
setl dl
sub edx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor edi, edi
inc edx
inc edi
mov dword [ebp - 0x44], edx
push edi
call fcn.100147ff
mov ecx, dword [ebp - 0x44]
xor ebx, ebx
push dword [ebp - 0x3c]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x15c]
setl bl
call fcn.100147ff
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x28]
setge cl
sub ecx, eax
je 0x1002a7f4
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002a7f6
mov esi, edi
jmp 0x1002a7f8
xor eax, eax
mov esi, eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x15c]
call fcn.100147ff
xor ebx, ebx
lea ecx, [ebp - 0x15c]
push edi
cmp dword [eax], esi
setge bl
call fcn.100147ff
xor ecx, ecx
push 2
cmp ebx, dword [eax]
setg cl
xor ebx, ebx
cmp ecx, 0x718ce682
lea ecx, [ebp - 0x15c]
setg bl
call fcn.100147ff
mov edx, dword [ebp - 0x48]
mov esi, eax
mov ecx, dword [ebp - 0xe4c]
xor eax, eax
imul edx, ebx
mov byte [ebp - 4], 0x13
cmp edx, ecx
setl al
xor ecx, ecx
cmp eax, 0x17f4
setge cl
xor eax, eax
cmp dword [ebp - 0x40], eax
mov dword [esi], ecx
lea ecx, [ebp - 0x6a0]
call fcn.100147e3
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
push 1
pop ebx
jle 0x1002a69f
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1002a8dc
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x2c], eax
push 6
pop eax
cmp dword [ebp - 0x2c], eax
jle 0x1002a8df
mov dword [ebp - 0x28], 0x18
cmp dword [ebp - 0x28], 0xf
jge 0x1002a8d4
push ebx
lea ecx, [ebp - 0x15c]
call fcn.100147ff
mov ecx, dword [ebp - 0x44]
mov esi, eax
xor eax, eax
cmp ecx, 0x27fa52e9
mov ecx, dword [ebp - 0x44]
setne al
xor edx, edx
cmp ecx, eax
setle dl
mov dword [esi], edx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xf
jl 0x1002a8a0
push 6
pop eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jg 0x1002a893
or esi, 0xffffffff
lea ecx, [ebp - 0x15c]
mov dword [ebp - 4], esi
call fcn.100147e3
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002a916
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5e8], 0x13b9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002a8fe
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002a92d
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x5e8], 0
jne 0x1002a932
inc dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jle 0x1002a91b
push ebx
lea ecx, [ebp - 0x760]
call fcn.10014761
mov dword [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x14], 0xb96ca2c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002a974
push dword [ebp - 0x14]
lea ecx, [ebp - 0x760]
call fcn.100147ff
mov dword [eax], 0x47dfa860
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002a956
xor eax, eax
push eax
lea ecx, [ebp - 0x760]
call fcn.100147ff
mov esi, eax
lea ecx, [ebp - 0x760]
xor eax, eax
push eax
call fcn.100147ff
mov ecx, dword [esi]
push 3
pop esi
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002a9b0
push eax
call fcn.100147ff
push 0
mov dword [eax], 0x6da5043c
inc dword [ebp - 0x14]
pop eax
lea ecx, [ebp - 0x760]
cmp dword [ebp - 0x14], esi
jle 0x1002a99e
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.100147e3
xor eax, eax
mov dword [ebp - 0x50], 0x89fff12f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002a9ec
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x78], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002a9d7
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002aa0c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x380], 0x2e7c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002a9f4
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002aa2d
push 0x57
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
xor eax, eax
cmp dword [ebp - 0x78], eax
je 0x1002aa4e
mov eax, dword [ebp - 0x78]
mov edx, ebx
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x380]
mov eax, dword [ebp - 0x380]
mov eax, dword [ebp - 0x78]
jmp 0x1002aa50
mov edx, eax
mov eax, dword [ebp - 0x78]
xor ecx, ecx
imul eax, dword [ebp - 0x78]
cmp eax, edx
setl cl
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x14], 0xcb457102
mov dword [ebp - 0x14], 0x841b3c69
mov dword [ebp - 0x14], 0xfffffffd
cmp dword [ebp - 0x14], 0x1b
jg 0x1002aaa0
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002aa97
push 0x1ba9
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1b
jle 0x1002aa7e
xor eax, eax
lea ecx, [ebp - 0xce8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
push 4
call fcn.10014761
xor eax, eax
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002aade
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10b8], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002aac6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002ab06