Function at 0x1002b7c4
Capabilities:
Allocate thread local storage
Check os version
Connect pipe
Create pipe
Delete directory
Delete file
Enumerate gui resources
Get common file path
Get disk information
Get file system object information
Get geographical location
Get memory capacity
Get system information on windows
Get thread local storage value
Start service
Terminate process

Disassembly:
mov eax, 0x1007c27d
call fcn.1007bc10
mov eax, 0x10d8
call fcn.100783c0
push ebx
push esi
push edi
push 6
pop edi
mov dword [ebp - 0x34], edi
xor ebx, ebx
inc ebx
mov byte [ebp - 0x81], dl
mov dword [ebp - 0x18], ebx
xor eax, eax
mov dword [ebp - 0x20], 0x1ec2
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x3c], 0x578cca69
push 3
mov dword [ebp - 0x28], eax
pop esi
mov dword [ebp - 0x64], ecx
cmp dword [ebp - 0x28], esi
jge 0x1002b82a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc98], 0x5ebec5ec
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002b812
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002b840
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc08], 0xcd1d2a6f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002b82f
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc00], ebx
mov dword [ebp - 0x14], 0x2cb51dba
mov dword [ebp - 0x20], 0xfd3df75d
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], 0xec415051
push 0xfffffffffffffffa
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x20], 0xfffffff8
pop edx
jmp 0x1002b913
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x1002b8bc
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x1044], 0x9314e764
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 4
jl 0x1002b8a3
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002b8f5
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xf7e7308f
jae 0x1002b8e5
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1002b8e7
mov ecx, ebx
mov eax, dword [ebp - 0x18]
add eax, ecx
je 0x1002b955
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002b8f7
mov eax, ebx
xor ecx, ecx
cmp eax, 0xfffffffc
setl cl
xor eax, eax
cmp ecx, 0x4f402e31
setl al
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x4c]
inc dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], edx
jne 0x1002b886
mov dword [ebp - 0x20], 0xa5d6c05b
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002b94c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd10], 0xd1d25bb0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002b934
xor eax, eax
mov dword [ebp - 0x20], 0x15
jmp 0x1002b992
xor eax, eax
jmp 0x1002b8f7
mov dword [ebp - 0x2c], 0x31d1
mov dword [ebp - 0x18], eax
jmp 0x1002b976
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe3c], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002b965
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp eax, ebx
push 0
setge cl
mov dword [ebp - 0xd10], ecx
dec dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], edi
jne 0x1002b959
mov ecx, 0x9e22
mov eax, 0xffff
mov dword [ebp - 0x24], ecx
mov edx, 0x7e91c178
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x20], 0x2cb51dba
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x28], eax
push 0xfffffffffffffffb
pop edi
cmp dword [ebp - 0x28], ebx
jge 0x1002b9e0
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5d8], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002b9cc
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b9f5
push 0x1559
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp - 0x20]
mov ecx, 0xffff993c
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x20]
test ecx, ecx
jle 0x1002ba12
mov ecx, ebx
cmp dword [ebp - 0x20], eax
jne 0x1002ba14
mov ecx, eax
xor eax, eax
cmp ecx, 0x112d
setge al
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
neg eax
jne 0x1002ba47
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1002ba49
mov ecx, ebx
mov eax, dword [ebp - 0x18]
add eax, 0xe2f49430
add eax, ecx
cmp dword [ebp - 0x20], eax
je 0x1002ba99
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1002ba99
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x18], eax
jmp 0x1002ba91
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002ba85
push 0x141b
push ebx
push 0x842
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], 0x33
je 0x1002ba6b
jmp 0x1002baa3
mov dword [ebp - 0x4c], 0x440e708b
dec dword [ebp - 0x4c]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002bac1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x54c], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002baad
xor eax, eax
mov dword [ebp - 0x2c], 0x585b7f37
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002bae8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x100], 0xb26bdde0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002bad0
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002bb08
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x9bc], 0x3e8e1b88
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002baf0
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x100], eax
jmp 0x1002bb8b
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002bb3f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe84], 0x23ed15de
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1002bb26
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002bb5f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x350], 0x7278fa8f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002bb47
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002bb7f
push 0xb8a
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
xor eax, eax
inc dword [ebp - 0x350]
inc dword [ebp - 0x100]
cmp dword [ebp - 0x100], 0x16
jge 0x1002bb16
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002bba9
push 0x1559
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp - 0x14]
mov ecx, 0xffff993c
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x14]
test ecx, ecx
jle 0x1002bbc6
mov ecx, ebx
cmp dword [ebp - 0x14], eax
jne 0x1002bbc8
mov ecx, eax
xor eax, eax
cmp ecx, 0x112d
setge al
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
neg eax
jne 0x1002bbfb
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x44], eax
je 0x1002bbfd
mov ecx, ebx
mov eax, dword [ebp - 0x44]
add eax, 0xe2f49430
add eax, ecx
cmp dword [ebp - 0x14], eax
je 0x1002bc4d
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002bc4d
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x44], eax
jmp 0x1002bc45
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002bc39
push 0x141b
push ebx
push 0x842
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x44]
push 0
pop eax
cmp dword [ebp - 0x44], 0x33
je 0x1002bc1f
jmp 0x1002bc57
mov dword [ebp - 0x4c], 0x440e708b
dec dword [ebp - 0x4c]
mov dword [ebp - 0x30], 0x4fd3df75
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x34], 0x4d9faba
mov dword [ebp - 0x38], 0xa8edf97e
mov dword [ebp - 0x30], 0xffffffee
cmp dword [ebp - 0x30], 0x10
push 8
pop edx
jge 0x1002be60
jmp 0x1002bc8c
push 8
pop edx
xor eax, eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0xcad7d711
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
add eax, 0xc660
cmp eax, 0x7308
setge cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 0x94a2
je 0x1002bd8c
mov dword [ebp - 0x48], 0xfffffff7
xor eax, eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x28], eax
jmp 0x1002bd80
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002bd06
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5f0], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002bced
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1002bd71
mov dword [ebp - 0x3c], edx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x5f0]
mov edx, dword [ebp - 0x5f0]
mov eax, dword [ebp - 0x30]
neg edx
cmp edx, eax
setge cl
cmp dword [ebp - 0x30], ecx
jl 0x1002bd35
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 0x5512
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov eax, ebx
neg ecx
push 8
sbb ecx, ecx
inc ecx
sub eax, ecx
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x24]
pop edx
jns 0x1002bd0e
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x28]
push 0
pop eax
cmp dword [ebp - 0x28], 0xffffffed
je 0x1002bce4
jmp 0x1002bdf0
mov dword [ebp - 0x3c], 0x689b
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x864], eax
mov dword [ebp - 0x860], eax
mov dword [ebp - 0x85c], eax
mov dword [ebp - 0x858], eax
mov ecx, dword [ebp - 0x34]
imul ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xffffffff
setl al
xor edx, edx
test eax, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x85c], ecx
push 8
pop eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffffc
jge 0x1002be08
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002be19
cmp dword [ebp - 0x20], eax
je 0x1002be19
mov eax, ebx
mov dword [ebp - 0x24], eax
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
push 1
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setg bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x28]
pop ebx
setge cl
sub eax, ecx
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x10
jl 0x1002bc89
mov dword [ebp - 0x30], 0xffffffff
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x48], 0xffd52699
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002be97
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7c], 0x13b9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002be82
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x1002c092
mov dword [ebp - 0x44], 0x6db3533b
mov dword [ebp - 0x18], eax
jmp 0x1002bec0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x210], 0x4215e1ab
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002beaf
mov eax, dword [ebp - 0x7c]
xor ecx, ecx
mov eax, dword [ebp - 0x7c]
cmp eax, 0x75da2ca3
setg cl
xor eax, eax
cmp ecx, 0x4cbed562
setne al
xor ecx, ecx
cmp eax, 7
mov eax, dword [ebp - 0x30]
setne cl
xor edx, edx
cmp ecx, 0x2a7e
setne dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x7c]
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xfffffff6
setl al
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x30]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x30]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x210]
setg dl
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
cmp ecx, 0x1300d3b5
setg al
cmp dword [ebp - 0x7c], eax
jg 0x1002bfd9
mov dword [ebp - 0x4c], 0xd863
xor eax, eax
mov dword [ebp - 0x3c], 0x52276c1f
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1002bf73
push 0x6d6
push 0xda7
call edi
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1002c080
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x7c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x7c]
mov dword [ebp - 0x4c], eax
mov esi, dword [ebp - 0x4c]
mov dword [ebp - 0x210], esi
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x7c]
cmp eax, ebx
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x7c]
cmp eax, esi
sete cl
xor eax, eax
imul edx, ecx
cmp edx, 0xdbdf
setne al
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x20]
jns 0x1002bf7f
jmp 0x1002c07e
mov dword [ebp - 0x14], 0x1ba827cf
mov eax, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x7c], eax
jne 0x1002bfef
cmp dword [ebp - 0x14], eax
je 0x1002bff1
mov eax, ebx
mov dword [ebp - 0x210], eax
xor edx, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x44]
setne dl
xor ecx, ecx
cmp edx, 0xe541
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x7c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
imul ecx, ecx, 0xebaa
cmp eax, ecx
setne dl
xor eax, eax
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x48], eax
jne 0x1002c05b
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x3c], ecx
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
push 0
pop eax
jle 0x1002bea3
push 3
pop esi
mov dword [ebp - 0x14], 0x2cb51dba
mov dword [ebp - 0x24], 0xcf2e5664
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x4c], 0xa75015e0
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x40], 0x7b364fe
mov dword [ebp - 0x4c], 0xd757520c
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x38], 0x160ec253
mov dword [ebp - 0x4c], 0x83eb999c
mov dword [ebp - 0x18], eax
jmp 0x1002c0e6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2e4], 0xb4709ba8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002c0d5
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov esi, dword [ebp - 0x24]
setge dl
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
add esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg esi
cmp esi, eax
setl cl
mov dword [ebp - 0x2dc], ecx
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x1002c14b
mov eax, dword [ebp - 0x2dc]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov ecx, ebx
sbb eax, eax
neg eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
sub ecx, eax
xor eax, eax
cmp ecx, 0x8e1c
setne al
xor edx, edx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x2dc]
setg dl
add eax, edx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2dc]
cmp eax, dword [ebp - 0x2dc]
jg 0x1002c1a9
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002c1ab
mov eax, ebx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x2e0]
mov eax, dword [ebp - 0x4c]
imul ecx, eax
mov eax, dword [ebp - 0x2e4]
push 3
pop esi
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x2dc], ecx
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], 0x1ec2
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x3c], 0x578cca69
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002c20c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc20], 0x5ebec5ec
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002c1f4
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002c222
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xcc8], 0xcd1d2a6f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002c211
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xcc0], ebx
mov dword [ebp - 0x24], 0x9e22
mov dword [ebp - 0x20], 0xfd3df75d
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], 0xec415051
push 0xfffffffffffffffa
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x20], 0xfffffff8
pop edx
jmp 0x1002c2f7
mov dword [ebp - 0x18], ebx
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x1002c2a0
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x10d4], 0x9314e764
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 4
jl 0x1002c287
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002c2d9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xf7e7308f
jae 0x1002c2c9
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1002c2cb
mov ecx, ebx
mov eax, dword [ebp - 0x18]
add eax, ecx
je 0x1002c340
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002c2db
mov eax, ebx
xor ecx, ecx
cmp eax, 0xfffffffc
setl cl
xor eax, eax
cmp ecx, 0x4f402e31
setl al
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x4c]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jne 0x1002c268
mov edx, 0xffff
mov dword [ebp - 0x44], edx
push 0xfffffffffffffffd
mov dword [ebp - 0x20], 0xa5d6c05b
pop eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002c337
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc38], 0xd1d25bb0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002c31f
xor eax, eax
mov dword [ebp - 0x20], 0x15
jmp 0x1002c37d
xor eax, eax
jmp 0x1002c2db
mov dword [ebp - 0x2c], 0x31d1
mov dword [ebp - 0x18], eax
jmp 0x1002c361
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xddc], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002c350
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp eax, ebx
push 0
setge cl
mov dword [ebp - 0xc38], ecx
dec dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], 6
jne 0x1002c344
mov eax, 0x7e91c178
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], 0x2cb51dba
mov dword [ebp - 0x30], 0x9e22
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002c3c1
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x560], 0xfffffffb
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002c3a9
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002c3d6
push 0x1559
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp - 0x20]
mov ecx, 0xffff993c
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x20]
test ecx, ecx
jle 0x1002c3f3
mov ecx, ebx
cmp dword [ebp - 0x20], eax
jne 0x1002c3f5
mov ecx, eax
xor eax, eax
cmp ecx, 0x112d
setge al
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
neg eax
jne 0x1002c428
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1002c42a
mov ecx, ebx
mov eax, dword [ebp - 0x18]
add eax, 0xe2f49430
add eax, ecx
cmp dword [ebp - 0x20], eax
je 0x1002c47a
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1002c47a
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x18], eax
jmp 0x1002c472
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002c466
push 0x141b
push ebx
push 0x842
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], 0x33
je 0x1002c44c
jmp 0x1002c484
mov dword [ebp - 0x4c], 0x440e708b
dec dword [ebp - 0x4c]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002c4a6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x568], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002c48e
xor eax, eax
mov dword [ebp - 0x2c], 0x585b7f37
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002c4cd
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x120], 0xb26bdde0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002c4b5
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002c4ed
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x9c8], 0x3e8e1b88
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002c4d5
xor eax, eax
mov dword [ebp - 0x120], eax
jmp 0x1002c56a
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002c51e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xeec], 0x23ed15de
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1002c505
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002c53e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x344], 0x7278fa8f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002c526
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002c55e
push 0xb8a
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
xor eax, eax
inc dword [ebp - 0x344]
inc dword [ebp - 0x120]
cmp dword [ebp - 0x120], 0x16
jge 0x1002c4f5
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002c59a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd40], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002c582
xor eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002c5b0
push eax
push eax
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002c5d0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd40], 0xfffffff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002c5b8
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0x34], 0x9e57ad95
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002c5fc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdf4], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002c5e3
xor eax, eax
xor edx, edx
inc edx
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], eax
jl 0x1002c61d
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002c618
call dword [sym.imp.USER32.dll_EndMenu]
xor eax, eax
dec dword [ebp - 0x34]
jns 0x1002c607
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002c62f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp byte [ebp - 0xd], 0
je 0x1002c691
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x2c], 0xebb6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002c663
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc50], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002c64b
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c676
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0xc50]
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [ebp - 0x3c], eax
xor eax, eax
push 0x1559
push eax
call esi
jmp 0x1002c697
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002c6c2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xce0], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002c6a9
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c6d2
push eax
push eax
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002c6e8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xce0], 0xfffffff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002c6d7
mov eax, dword [ebp - 0x14]
mov ecx, 0xffff993c
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x14]
test ecx, ecx
jle 0x1002c710
cmp dword [ebp - 0x14], eax
je 0x1002c710
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x1002c715
xor ebx, ebx
mov ecx, eax
inc ebx
xor eax, eax
cmp ecx, 0x112d
setge al
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
neg eax
jne 0x1002c748
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x44], eax
je 0x1002c74a
mov ecx, ebx
mov eax, dword [ebp - 0x44]
add eax, 0xe2f49430
add eax, ecx
cmp dword [ebp - 0x14], eax
je 0x1002ccd1
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002ccd3
mov dword [ebp - 0x14], 0x16df251d
mov dword [ebp - 0x3c], 0x7110e6b6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002c796
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x39c], 0x4a8c6a53
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002c77e
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002c83f
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002c7c7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x824], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002c7ae
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c7dd
push 0x1c86
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x824], eax
jl 0x1002c83c
mov dword [ebp - 0x18], 0xb283066c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1002c834
mov dword [ebp - 0x20], 0x17be9fb1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x39c]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x39c], ecx
mov dword [ebp - 0x20], 0xffffffe6
jmp 0x1002c827
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe5
jg 0x1002c81e
dec dword [ebp - 0x18]
jns 0x1002c7fa
xor eax, eax
dec dword [ebp - 0x824]
jns 0x1002c7eb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1002c79e
mov dword [ebp - 0x14], eax
jmp 0x1002c87e
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x17
jg 0x1002c87b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002c870
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x17
jle 0x1002c859
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffc
jg 0x1002c84d
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffe2
jge 0x1002c8ce
mov dword [ebp - 0x3c], 0x29bf39
mov dword [ebp - 0x38], 0x290b
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002c8c3
push ebx
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe2
jl 0x1002c89b
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c8e4
push 0xfd
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x33
jne 0x1002ce18
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002c916
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x13c], 0x2c03342e
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1002c8fd
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002c928
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xb74], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002c91b
mov dword [ebp - 0x13c], 0xf
jmp 0x1002c983
mov dword [ebp - 0x4c], 0x23b1a956
xor ecx, ecx
mov dword [ebp - 0x4c], 0xba7b7e80
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], 0xffff
mov eax, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp eax, 0xf985589b
setne cl
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x13c]
cmp dword [ebp - 0x13c], 0x1b
je 0x1002c93a
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov eax, dword [ebp - 0xb74]
cmp eax, ecx
mov eax, dword [ebp - 0xb74]
setl bl
xor edx, edx
sub ebx, eax
mov eax, dword [ebp - 0x13c]
test eax, eax
mov eax, dword [ebp - 0x13c]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, ebx
setle al
xor ebx, ebx
mov dword [ebp - 0x18], eax
inc ebx
xor eax, eax
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002c9e5
push 0x2667
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002ca15
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c9fc
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ca12
push 0x2620
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff7
jne 0x1002c9ea
mov byte [ebp - 0x4d], al
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002ca3e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe8], 2
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002ca26
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002ca5c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xfd4], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002ca47
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ca78
push 0x269e
push 0x1823
push eax
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
xor eax, eax
mov dword [ebp - 0xe8], eax
jmp 0x1002caa3
mov dword [ebp - 0x18], 0x3250e6da
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], eax
jl 0x1002ca9d
cmp dword [ebp - 0x18], eax
jne 0x1002ca9d
dec dword [ebp - 0x18]
jns 0x1002ca93
dec dword [ebp - 0xe8]
cmp dword [ebp - 0xe8], 0xffffffee
jne 0x1002ca80
cmp byte [ebp - 0x4d], 0
je 0x1002cb04
mov dword [ebp - 0x20], 0x8ec0ae97
mov dword [ebp - 0x20], eax
jmp 0x1002caeb
mov dword [ebp - 0x18], 0x86cce57b
cmp dword [ebp - 0x18], eax
jne 0x1002caf1
mov dword [ebp - 0x18], 0xffffffeb
jmp 0x1002cae2
mov dword [ebp - 0x3c], 8
cmp dword [ebp - 0x3c], eax
jne 0x1002cae8
cmp dword [ebp - 0x18], 0x10
jle 0x1002cad3
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 6
je 0x1002cabe
push 0x141b
push ebx
push 0x842
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002cb26
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc0], 0xfffffffc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002cb0d
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002cb43
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x70], 0xfffffffe
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002cb2e
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002cb65
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe9c], 0xfffb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002cb4c
xor eax, eax
mov dword [ebp - 0xc0], eax
jmp 0x1002cb90
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cb8a
cmp dword [ebp - 0xc0], 0xb
jge 0x1002cb6d
mov dword [ebp - 0x70], eax
jmp 0x1002ccad
xor eax, eax
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002ccfa
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x570], 0x55683450
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002cce2
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002cd1c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x418], 4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002cd03
xor eax, eax
mov dword [ebp - 0x414], eax
jmp 0x1002cd42
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cd3c
push eax
push 0x338
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor eax, eax
inc dword [ebp - 0x414]
cmp dword [ebp - 0x414], eax
jle 0x1002cd24
cmp dword [ebp - 0x570], eax
je 0x1002cd7b
mov dword [ebp - 0x48], eax
xor ecx, ecx
dec dword [ebp - 0x48]
mov edx, dword [ebp - 0x414]
mov dword [ebp - 0x414], edx
mov eax, dword [ebp - 0x48]
cmp eax, 6
setl cl
xor eax, eax
cmp edx, ecx
setle al
mov dword [ebp - 0x3c], eax
jmp 0x1002cd92
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cd94
push 0x19fa
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
xor eax, eax
mov dword [ebp - 0x4c], 0x440e708b
mov dword [ebp - 0x20], 0xa5d6c05b
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002cdcb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc68], 0xd1d25bb0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002cdb2
xor eax, eax
mov dword [ebp - 0x20], 0x15
jmp 0x1002ce0d
mov dword [ebp - 0x2c], 0x31d1
mov dword [ebp - 0x18], eax
jmp 0x1002cdf1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe0c], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002cde0
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp eax, ebx
push 0
setge cl
mov dword [ebp - 0xc68], ecx
dec dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], 6
jne 0x1002cdd4
dec dword [ebp - 0x4c]
xor eax, eax
mov dword [ebp - 0x20], 0x2cb51dba
mov edi, 0xffff
mov dword [ebp - 0x44], 0x9e22
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x38], 0x7e91c178
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002ce55
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x578], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002ce3d
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ce66
push 0x1559
push eax
call esi
mov eax, dword [ebp - 0x20]
mov ecx, 0xffff993c
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x20]
test ecx, ecx
jle 0x1002ce83
mov ecx, ebx
cmp dword [ebp - 0x20], eax
jne 0x1002ce85
mov ecx, eax
xor eax, eax
cmp ecx, 0x112d
setge al
mov dword [ebp - 0x578], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
neg eax
jne 0x1002ceb8
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1002ceba
mov ecx, ebx
mov eax, dword [ebp - 0x18]
add eax, 0xe2f49430
add eax, ecx
cmp dword [ebp - 0x20], eax
je 0x1002cf0a
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x1002cf0a
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x18], eax
jmp 0x1002cf02
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cef6
push 0x141b
push ebx
push 0x842
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], 0x33
je 0x1002cedc
jmp 0x1002cf14
mov dword [ebp - 0x4c], 0x440e708b
dec dword [ebp - 0x4c]
mov dword [ebp - 0x20], 0x2cb51dba
xor eax, eax
mov dword [ebp - 0x44], 0x9e22
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x38], 0x7e91c178
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002cf4e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x580], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002cf36
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cf5f
push 0x1559
push eax
call esi
mov eax, dword [ebp - 0x20]
mov ecx, 0xffff993c
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x20]
test ecx, ecx
jle 0x1002cf7c
mov ecx, ebx
cmp dword [ebp - 0x20], eax
jne 0x1002cf7e
mov ecx, eax
xor eax, eax
cmp ecx, 0x112d
setge al
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
neg eax
jne 0x1002cfb1
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1002cfb3
mov ecx, ebx
mov eax, dword [ebp - 0x18]
add eax, 0xe2f49430
add eax, ecx
cmp dword [ebp - 0x20], eax
je 0x1002d003
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x1002d003
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x18], eax
jmp 0x1002cffb
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cfef
push 0x141b
push ebx
push 0x842
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], 0x33
je 0x1002cfd5
jmp 0x1002d00d
mov dword [ebp - 0x4c], 0x440e708b
dec dword [ebp - 0x4c]
mov dword [ebp - 0x14], 0xfffffff7
mov edi, 0x647dc4b
push 4
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x14]
pop ecx
mov dword [ebp - 0x34], eax
push 8
mov dword [ebp - 0x14], ecx
pop eax
cmp dword [ebp - 0x14], eax
jg 0x1002d0a1
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x1002d055
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd7c], 0xc67ee39f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002d044
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x1002d076
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x1002d078
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp edx, eax
push 8
setge cl
xor eax, eax
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0xd70], ecx
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x14]
pop eax
push 4
pop ecx
cmp dword [ebp - 0x14], eax
jle 0x1002d030
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
push 8
mov dword [ebp - 0x14], ecx
pop eax
cmp dword [ebp - 0x14], eax
jg 0x1002d12d
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x1002d0e1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd8c], 0xc67ee39f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002d0d0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x1002d102
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x1002d104
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp edx, eax
push 8
setge cl
xor eax, eax
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0xd80], ecx
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x14]
pop eax
push 4
pop ecx
cmp dword [ebp - 0x14], eax
jle 0x1002d0bc
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
push 8
mov dword [ebp - 0x14], ecx
pop edi
cmp dword [ebp - 0x14], edi
jg 0x1002d1b8
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x1002d16d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xda4], 0xc67ee39f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002d15c
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x1002d18e
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x1002d190
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp edx, eax
push 4
setge cl
xor eax, eax
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0xd98], ecx
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x14]
pop ecx
cmp dword [ebp - 0x14], edi
jle 0x1002d148
jmp 0x1002d1ba
xor eax, eax
mov edi, 0xfd41e559
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x4c], 0xdcc80fc3
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x34], 0x7ddbf4df
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002d200
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xb14], 0xfffffffa
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002d1e8
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002d220
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xdbc], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002d208
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002d279
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], eax
jmp 0x1002d23e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x45c], 0x6a3367f5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002d22d
mov ecx, dword [ebp - 0x458]
xor edx, edx
mov eax, dword [ebp - 0x458]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
add eax, edx
je 0x1002d272
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x45c], eax
test eax, eax
je 0x1002d272
mov eax, ebx
jmp 0x1002d274
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002d28a
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d28a
push eax
push eax
call dword [sym.imp.USER32.dll_LoadMenuW]
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002d2f3
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0xb08]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
sete cl
xor edx, edx
cmp ecx, 5
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setl bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor ebx, ebx
mov dword [ebp - 0xdb8], ecx
inc ebx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xb14]
cmp eax, 0x1ac3dc99
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
push 8
setg cl
pop eax
cmp ecx, eax
push 4
sbb edx, edx
xor ecx, ecx
neg edx
add edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x4c], 0xdcc80fc3
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x34], 0x7ddbf4df
pop ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002d375
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xb54], 0xfffffffa
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002d35d
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002d395
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xdd4], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002d37d
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002d3ee
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], eax
jmp 0x1002d3b3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x46c], 0x6a3367f5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002d3a2
mov ecx, dword [ebp - 0x468]
xor edx, edx
mov eax, dword [ebp - 0x468]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
add eax, edx
je 0x1002d3e7
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x46c], eax
test eax, eax
je 0x1002d3e7
mov eax, ebx
jmp 0x1002d3e9
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002d3ff
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d3ff
push eax
push eax
call dword [sym.imp.USER32.dll_LoadMenuW]
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002d465
mov ecx, dword [ebp - 0xb48]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
sete cl
xor edx, edx
cmp ecx, 5
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setl bl
xor ecx, ecx
cmp ebx, eax
setg cl
mov dword [ebp - 0xdd0], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xb54]
cmp eax, 0x1ac3dc99
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
push 8
setg cl
pop eax
cmp ecx, eax
sbb edx, edx
xor ecx, ecx
neg edx
add edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
mov eax, 0xb3cf8132
setle cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x48], 0xcee6
mov dword [ebp - 0x924], eax
mov dword [ebp - 0x920], eax
mov dword [ebp - 0x91c], eax
mov dword [ebp - 0x918], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002d4e9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa98], 0xfffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002d4d0
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d4fe
push 0x165f
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0xa94]
mov ecx, 0xe57bf5cd
cmp ecx, eax
mov eax, dword [ebp - 0x48]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setge bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x91c], ecx
xor ebx, ebx
mov dword [ebp - 0x20], 0xfffffff7
inc ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x18], eax
jmp 0x1002d55b
cmp dword [ebp - 0x18], ebx
jl 0x1002d54e