Function at 0x1002c2c5
Capabilities:
Check os version
Compare security identifiers
Create process on windows
Delete file
Get common file path
Get disk information
Get file attributes
Identify system language via api
Log keystrokes via polling
Modify service
Parse pe header
Read .ini file
Resume thread

Disassembly:
mov eax, 0x100758d0
call fcn.10074300
mov eax, 0x143c
call fcn.10070ab0
push ebx
xor ebx, ebx
mov byte [ebp - 0x69], dl
inc ebx
mov dword [ebp - 0x4c], ecx
xor eax, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], eax
push esi
push edi
cmp dword [ebp - 0x10], ebx
jge 0x1002c30a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd3c], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002c2f2
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov dword [ebp - 0x10], eax
jmp 0x1002c32d
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002c32a
push eax
push 0x2688
push eax
push eax
call edi
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x1002c315
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002c355
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd4c], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002c33d
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002c372
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002c36f
push eax
push 0x2688
push eax
push eax
call edi
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x1002c35a
mov dword [ebp - 0x10], 9
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1002c39c
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x131c], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1002c387
xor eax, eax
push 3
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x1002c3bf
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x5b0], 8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002c3a7
xor eax, eax
mov dword [ebp - 0x5b0], ecx
cmp dword [ebp - 0x5b0], eax
jl 0x1002c40b
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002c3f0
push eax
push 0x66
push eax
push 0xe69
push 0x1ee6
push eax
push 0xb3d
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp - 0x5b0]
push 0
mov eax, dword [ebp + eax*4 - 0x131c]
dec dword [ebp - 0x5b0]
pop eax
jns 0x1002c3cd
push 3
pop ecx
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x10], eax
jmp 0x1002c460
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002c434
push eax
push eax
push 0x2055
call esi
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 3
xor eax, eax
pop ecx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002c45d
push eax
push 0x26e
push 0x1bab
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
push 3
xor eax, eax
pop ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x1002c416
push 0xfffffffffffffffc
mov dword [ebp - 0x30], ebx
pop edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x50], 0xfffffff7
jmp 0x1002c51e
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002c4a0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5b4], 0x13244d51
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002c488
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002c4c2
mov dword [ebp - 0x18], 0x568d
mov dword [ebp - 0x3c], 0x8588d0d3
mov dword [ebp - 0x2c], 0xfffffff7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
jmp 0x1002c511
mov dword [ebp - 0x2c], 9
jmp 0x1002c4ed
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002c4ea
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5b4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002c4d6
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xe
jl 0x1002c4cb
mov dword [ebp - 0x2c], 0xffffffe4
jmp 0x1002c50b
mov dword [ebp - 0x18], 0x1c17c774
cmp dword [ebp - 0x18], eax
jne 0x1002c511
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 8
je 0x1002c4fc
push 0
mov dword [ebp - 0x2c], 0x61b583dc
dec dword [ebp - 0x30]
pop eax
cmp dword [ebp - 0x30], 0xffffffe5
jne 0x1002c47d
push ecx
mov dword [ebp - 0x18], 4
lea ecx, [ebp - 0x8bc]
mov dword [ebp - 0x38], edx
call fcn.10014568
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x3c], 0xa5efa20b
mov dword [ebp - 0x3c], 0x35e4b783
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], eax
jmp 0x1002c567
push dword [ebp - 0x10]
call fcn.100145f4
or dword [eax], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0x8bc]
jl 0x1002c559
push ebx
call fcn.100145f4
mov ecx, dword [ebp - 0x18]
xor edx, edx
inc dword [eax]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x8bc]
setge dl
mov dword [ebp - 0x38], edx
inc dword [ebp - 0x3c]
or dword [ebp - 4], 0xffffffff
call fcn.100145ef
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002c5bc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd5c], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002c5a4
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x1002ca37
push ebx
lea ecx, [ebp - 0x388]
call fcn.10014568
lea eax, [ebp - 0xfa4]
mov dword [ebp - 4], ebx
movdqa xmm0, xmmword [0x10007b80]
lea ecx, [ebp - 0x12d4]
push eax
lea eax, [ebp - 0xfb4]
mov dword [ebp - 0x1c], 0x4f204795
push eax
movdqu xmmword [ebp - 0xfb4], xmm0
call fcn.10014606
lea ecx, [ebp - 0x134]
mov esi, eax
call fcn.10014603
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xca4]
push dword [esi]
call fcn.100145c9
mov byte [ebp - 4], 2
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002c65a
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x388]
call fcn.100145f4
mov dword [eax], 2
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002c63c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002c677
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x78], 0x184c506d
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002c662
xor eax, eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], eax
jg 0x1002c7c6
push 0xfffffffffffffffc
pop esi
mov dword [ebp - 0x3c], 0x12af0488
lea ecx, [ebp - 0xa6c]
push 3
mov dword [ebp - 0x18], ebx
pop ebx
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x28], esi
push ebx
call fcn.10014568
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x10], eax
jmp 0x1002c6ca
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa6c]
call fcn.100145f4
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002c6b3
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x24]
test eax, eax
jne 0x1002c734
mov ecx, dword [ebp - 0x28]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
cmp ecx, esi
setg al
xor edx, edx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setg dl
xor ebx, ebx
cmp edx, 7
setle bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jne 0x1002c71c
cmp dword [ebp - 0x78], eax
jne 0x1002c71c
mov eax, dword [ebp - 0x24]
push 3
lea ecx, [ebp - 0xca4]
call fcn.100145f4
xor ebx, ebx
cmp dword [eax], ebx
je 0x1002c736
mov eax, dword [ebp - 0x78]
jmp 0x1002c736
xor ebx, ebx
push 2
lea ecx, [ebp - 0xa6c]
call fcn.100145f4
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x388]
mov eax, dword [ebp - 0x78]
push dword [ebp - 0x78]
call fcn.100145f4
lea ecx, [ebp - 0x388]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x78]
call fcn.100145f4
push ebx
lea ecx, [ebp - 0x388]
call fcn.100145f4
push ebx
lea ecx, [ebp - 0x388]
call fcn.100145f4
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002c7a3
push eax
lea ecx, [ebp - 0x388]
call fcn.100145f4
cmp dword [eax], 0
je 0x1002c7a1
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x1002c7a6
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0xa6c]
mov byte [ebp - 4], 2
call fcn.100145ef
inc dword [ebp - 0x78]
xor eax, eax
cmp dword [ebp - 0x78], eax
jle 0x1002c686
push 3
pop esi
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x1002c814
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002c7ee
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x78], 0x46bac60
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002c7d9
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002c80a
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002c807
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1002c7f3
dec dword [ebp - 0x1c]
jns 0x1002c7d1
lea ecx, [ebp - 0xca4]
call fcn.100145ef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x388]
call fcn.100145ef
xor eax, eax
mov byte [ebp - 0x3d], al
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], 0x480
mov dword [ebp - 0x1c], 0x2d1a4e66
mov dword [ebp - 0x3c], 0xaba4a2c6
mov dword [ebp - 0x3c], 0x7f9f41ad
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x1002c879
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x8d4], 7
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002c861
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002c88f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x3ac], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1002c87e
inc dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x8d0]
mov eax, dword [ebp - 0x1c]
add ecx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setg dl
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3ac]
mov eax, dword [ebp - 0x3ac]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x8d4]
mov eax, dword [ebp - 0x3a8]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x8d0], eax
mov ecx, dword [ebp - 0x3a8]
add ecx, eax
xor eax, eax
cmp ecx, 0x8c38ec32
setne al
mov dword [ebp - 0x3c], eax
cmp byte [ebp - 0x3d], 0
je 0x1002ca23
push ebx
lea ecx, [ebp - 0x7bc]
call fcn.10014568
mov dword [ebp - 4], 4
lea ecx, [ebp - 0xafc]
mov dword [ebp - 0x10], 5
push 2
call fcn.10014568
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002c949
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1d4], 0xfffc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002c930
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002c96f
push dword [ebp - 0x24]
lea ecx, [ebp - 0x7bc]
call fcn.100145f4
mov dword [eax], 0x9cdf9c77
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002c951
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002c997
push dword [ebp - 0x24]
lea ecx, [ebp - 0xafc]
call fcn.100145f4
mov dword [eax], 0x1eb64d0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002c978
xor eax, eax
dec dword [ebp - 0x1d4]
cmp dword [ebp - 0x1d0], 0x95ae649f
jae 0x1002c9c9
push eax
lea ecx, [ebp - 0x7bc]
call fcn.100145f4
mov dword [eax], ebx
mov eax, dword [ebp - 0x1d4]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1d4]
lea ecx, [ebp - 0x7bc]
xor eax, eax
push eax
call fcn.100145f4
push ebx
lea ecx, [ebp - 0xafc]
call fcn.100145f4
mov edx, dword [ebp - 0x1d4]
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0xafc]
setge al
mov dword [esi], eax
call fcn.100145ef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7bc]
call fcn.100145ef
xor eax, eax
push eax
push 0x2688
push eax
push eax
call edi
inc dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
jle 0x1002c5c8
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0xf68]
mov dword [ebp - 0x18], 0xdada439b
mov dword [ebp - 0x18], 0xdc4b4e12
mov dword [ebp - 0x18], 0x90a624cd
mov dword [ebp - 0x18], 0xeb9ae77a
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], 0x707dfe4
mov dword [ebp - 0x18], ebx
push 2
call fcn.10014568
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002caa8
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf68]
call fcn.100145f4
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002ca8c
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_CreatePopupMenu]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002cab9
call ebx
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0xf68]
or dword [ebp - 4], 0xffffffff
call fcn.100145ef
xor eax, eax
mov dword [ebp - 0x10], 9
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1002caf6
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1334], 1
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1002cadd
xor eax, eax
push 3
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x1002cb19
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x6f0], 8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002cb01
xor eax, eax
mov dword [ebp - 0x6f0], ecx
cmp dword [ebp - 0x6f0], eax
jl 0x1002cb65
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002cb4a
push eax
push 0x66
push eax
push 0xe69
push 0x1ee6
push eax
push 0xb3d
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp - 0x6f0]
push 0
mov eax, dword [ebp + eax*4 - 0x1334]
dec dword [ebp - 0x6f0]
pop eax
jns 0x1002cb27
push 3
pop ecx
mov dword [ebp - 0x10], eax
jmp 0x1002cbb4
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002cb88
push eax
push eax
push 0x2055
call esi
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 3
xor eax, eax
pop ecx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002cbb1
push eax
push 0x26e
push 0x1bab
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
push 3
xor eax, eax
pop ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x1002cb6a
push 0xfffffffffffffffc
pop edx
xor esi, esi
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x30], eax
inc esi
cmp dword [ebp - 0x30], 0xffffffe5
je 0x1002cc75
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002cbf2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5f4], 0x13244d51
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002cbda
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002cc14
mov dword [ebp - 0x18], 0x568d
mov dword [ebp - 0x3c], 0x8588d0d3
mov dword [ebp - 0x2c], 0xfffffff7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
jmp 0x1002cc63
mov dword [ebp - 0x2c], 9
jmp 0x1002cc3f
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002cc3c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5f4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002cc28
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xe
jl 0x1002cc1d
mov dword [ebp - 0x2c], 0xffffffe4
jmp 0x1002cc5d
mov dword [ebp - 0x18], 0x1c17c774
cmp dword [ebp - 0x18], eax
jne 0x1002cc63
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 8
je 0x1002cc4e
push 0
mov dword [ebp - 0x2c], 0x61b583dc
dec dword [ebp - 0x30]
pop eax
jmp 0x1002cbc5
mov dword [ebp - 0x30], esi
push ecx
mov dword [ebp - 0x18], 4
lea ecx, [ebp - 0x8ec]
mov dword [ebp - 0x38], edx
call fcn.10014568
mov dword [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x3c], 0xa5efa20b
mov dword [ebp - 0x3c], 0x35e4b783
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], eax
jmp 0x1002ccbb
push dword [ebp - 0x10]
call fcn.100145f4
or dword [eax], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0x8ec]
jl 0x1002ccad
push esi
call fcn.100145f4
mov ecx, dword [ebp - 0x18]
xor edx, edx
inc dword [eax]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x8ec]
setge dl
mov dword [ebp - 0x38], edx
inc dword [ebp - 0x3c]
or dword [ebp - 4], 0xffffffff
call fcn.100145ef
push esi
lea ecx, [ebp - 0x394]
call fcn.10014568
lea eax, [ebp - 0x10c4]
mov dword [ebp - 4], 8
movdqa xmm0, xmmword [0x10007b80]
lea ecx, [ebp - 0x12f4]
push eax
lea eax, [ebp - 0x10d4]
mov dword [ebp - 0x1c], 0x4f204795
push eax
movdqu xmmword [ebp - 0x10d4], xmm0
call fcn.10014606
lea ecx, [ebp - 0x14f]
mov esi, eax
call fcn.10014603
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xcb8]
push dword [esi]
call fcn.100145c9
mov byte [ebp - 4], 9
xor esi, esi
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x24], eax
inc esi
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x1002cd87
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x394]
call fcn.100145f4
mov dword [eax], 2
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002cd69
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x1002cda4
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x74], 0x184c506d
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002cd8f
xor eax, eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], eax
jg 0x1002cefc
push 0xfffffffffffffffc
pop ebx
push 3
mov dword [ebp - 0x3c], 0x12af0488
lea ecx, [ebp - 0xa84]
pop edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x30], ebx
push edi
call fcn.10014568
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x10], eax
jmp 0x1002cdf8
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa84]
call fcn.100145f4
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002cde1
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x24]
test eax, eax
jne 0x1002ce61
mov ecx, dword [ebp - 0x30]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
cmp ecx, ebx
setg al
xor edx, edx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setg dl
xor ebx, ebx
cmp edx, 7
setle bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jne 0x1002ce4a
cmp dword [ebp - 0x74], eax
jne 0x1002ce4a
mov eax, dword [ebp - 0x24]
push edi
lea ecx, [ebp - 0xcb8]
call fcn.100145f4
xor ebx, ebx
cmp dword [eax], ebx
je 0x1002ce63
mov eax, dword [ebp - 0x74]
jmp 0x1002ce63
xor ebx, ebx
push 2
lea ecx, [ebp - 0xa84]
call fcn.100145f4
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x394]
mov eax, dword [ebp - 0x74]
push dword [ebp - 0x74]
call fcn.100145f4
lea ecx, [ebp - 0x394]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x74]
call fcn.100145f4
push ebx
lea ecx, [ebp - 0x394]
call fcn.100145f4
push ebx
lea ecx, [ebp - 0x394]
call fcn.100145f4
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002cece
push eax
lea ecx, [ebp - 0x394]
call fcn.100145f4
xor edi, edi
cmp dword [eax], edi
je 0x1002cecc
mov eax, esi
jmp 0x1002ced0
xor eax, eax
xor edi, edi
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0xa84]
mov byte [ebp - 4], 9
call fcn.100145ef
inc dword [ebp - 0x74]
cmp dword [ebp - 0x74], edi
jle 0x1002cdb0
mov edi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x1002cf4b
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002cf25
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x74], 0x46bac60
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002cf10
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002cf41
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002cf3e
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1002cf2a
dec dword [ebp - 0x1c]
jns 0x1002cf08
lea ecx, [ebp - 0xcb8]
call fcn.100145ef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x394]
call fcn.100145ef
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002cf87
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcbc], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002cf6f
xor eax, eax
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], 0x480
mov dword [ebp - 0x1c], 0x2d1a4e66
mov dword [ebp - 0x3c], 0xaba4a2c6
mov dword [ebp - 0x3c], 0x7f9f41ad
push 3
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x1002cfd0
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x904], 7
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002cfb8
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002cfe6
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x3bc], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1002cfd5
inc dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x900]
mov eax, dword [ebp - 0x1c]
add ecx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setg dl
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3bc]
mov eax, dword [ebp - 0x3bc]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x904]
mov eax, dword [ebp - 0x3b8]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x900], eax
mov ecx, dword [ebp - 0x3b8]
add ecx, eax
xor eax, eax
cmp ecx, 0x8c38ec32
setne al
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002d370
push esi
lea ecx, [ebp - 0x7d4]
call fcn.10014568
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0xb14]
mov dword [ebp - 0x10], 5
push 2
call fcn.10014568
xor eax, eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002d0a0
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1f4], 0xfffc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002d087
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002d0c6
push dword [ebp - 0x24]
lea ecx, [ebp - 0x7d4]
call fcn.100145f4
mov dword [eax], 0x9cdf9c77
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002d0a8
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002d0ee
push dword [ebp - 0x24]
lea ecx, [ebp - 0xb14]
call fcn.100145f4
mov dword [eax], 0x1eb64d0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002d0cf
xor eax, eax
dec dword [ebp - 0x1f4]
cmp dword [ebp - 0x1f0], 0x95ae649f
jae 0x1002d120
push eax
lea ecx, [ebp - 0x7d4]
call fcn.100145f4
mov dword [eax], esi
mov eax, dword [ebp - 0x1f4]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1f4]
lea ecx, [ebp - 0x7d4]
xor eax, eax
push eax
call fcn.100145f4
push esi
lea ecx, [ebp - 0xb14]
call fcn.100145f4
mov edx, dword [ebp - 0x1f4]
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0xb14]
setge al
mov dword [esi], eax
call fcn.100145ef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7d4]
call fcn.100145ef
push 2
lea ecx, [ebp - 0x430]
call fcn.10014568
push 3
pop esi
push esi
lea ecx, [ebp - 0x46c]
mov dword [ebp - 4], 0xd
call fcn.10014568
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1002d1bf
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x430]
call fcn.100145f4
mov dword [eax], 0x571177e8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1002d1a0
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002d1db
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x46c]
call fcn.100145f4
mov dword [eax], 0xcdcb363f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002d1c4
xor esi, esi
lea ecx, [ebp - 0x430]
inc esi
push esi
call fcn.100145f4
mov dword [eax], 0x1d
jmp 0x1002d24c
mov dword [ebp - 0x18], 0xe1e2c0d3
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002d25d
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002d23e
push eax
push 0x17c3
push 0x2396
push 0xa1
push 0x20eb
push 0x1ecf
push 0x180a
push 0x116f
push 0xb0d
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push esi
lea ecx, [ebp - 0x430]
call fcn.100145f4
dec dword [eax]
push esi
lea ecx, [ebp - 0x430]
call fcn.100145f4
cmp dword [eax], 8
jg 0x1002d1f7
push esi
lea ecx, [ebp - 0x46c]
call fcn.100145f4
and dword [eax], 0
jmp 0x1002d29a
mov dword [ebp - 0x18], 0x89d221e9
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x46c]
mov dword [ebp - 0x3c], 0x62a9
dec dword [ebp - 0x3c]
push esi
call fcn.100145f4
inc dword [eax]
push esi
lea ecx, [ebp - 0x46c]
call fcn.100145f4
xor ecx, ecx
cmp dword [eax], ecx
je 0x1002d26e
lea ecx, [ebp - 0x46c]
call fcn.100145ef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x430]
call fcn.100145ef
xor eax, eax
lea ecx, [ebp - 0xec4]
mov byte [ebp - 0x11], al
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], 0xdada439b
mov dword [ebp - 0x18], 0xdc4b4e12
mov dword [ebp - 0x18], 0x90a624cd
mov dword [ebp - 0x18], 0xeb9ae77a
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], 0x707dfe4
mov dword [ebp - 0x18], esi
push 2
call fcn.10014568
mov dword [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002d33c
push dword [ebp - 0x10]
lea ecx, [ebp - 0xec4]
call fcn.100145f4
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002d320
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002d347
call ebx
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0xec4]
or dword [ebp - 4], 0xffffffff
call fcn.100145ef
cmp byte [ebp - 0x11], 0
je 0x1002d36b
xor eax, eax
push eax
push 0x2688
push eax
push eax
call edi
inc dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
jle 0x1002d051
xor edi, edi
lea ecx, [ebp - 0xcc8]
inc edi
mov esi, 0xdada439b
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], 0xdc4b4e12
mov dword [ebp - 0x18], 0x90a624cd
mov dword [ebp - 0x18], 0xeb9ae77a
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], 0x707dfe4
mov dword [ebp - 0x18], edi
push 2
call fcn.10014568
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002d3ee
push dword [ebp - 0x10]
lea ecx, [ebp - 0xcc8]
call fcn.100145f4
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002d3d2
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002d3f9
call ebx
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0xcc8]
or dword [ebp - 4], 0xffffffff
call fcn.100145ef
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0xf38]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], 0xdc4b4e12
mov dword [ebp - 0x18], 0x90a624cd
mov dword [ebp - 0x18], 0xeb9ae77a
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], 0x707dfe4
mov dword [ebp - 0x18], edi
push 2
call fcn.10014568
mov dword [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002d478
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf38]
call fcn.100145f4
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002d45c
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002d483
call ebx
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0xf38]
or dword [ebp - 4], 0xffffffff
call fcn.100145ef
push 0xfffffffffffffffc
pop esi
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x18], eax
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002d4c6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcd8], 0x5e17
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d4ae
xor eax, eax
push 2
pop ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], eax
jl 0x1002d59f
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002d596
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x18], 0x3cf68729
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x1002d58d
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jg 0x1002d577
mov dword [ebp - 0x3c], 0xfffffffb
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002d520
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x1c], 0xfff9
mov edx, dword [ebp - 0x34]
sbb eax, eax
neg eax
sub edx, eax
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xcd8]
inc edx
cmp eax, edx
setg cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xcd0]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x28], eax
jne 0x1002d567
cmp dword [ebp - 0x1c], eax
je 0x1002d569
mov eax, edi
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1002d50c
push 3
pop ecx
imul eax, dword [ebp - 0x2c], 0x3e32
push 0
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x28]
pop eax
jns 0x1002d501
dec dword [ebp - 0x1c]
jns 0x1002d4e7
dec dword [ebp - 0x34]
jns 0x1002d4d8
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002d5c9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xedc], 0x5e17
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d5b1
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], eax
jl 0x1002d69f
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002d696
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x18], 0x3cf68729
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x1002d68d
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jg 0x1002d677
mov dword [ebp - 0x3c], 0xfffffffb
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002d620
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x1c], 0xfff9
mov edx, dword [ebp - 0x34]
sbb eax, eax
neg eax
sub edx, eax
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xedc]
inc edx
cmp eax, edx
setg cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xed4]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x28], eax
jne 0x1002d667
cmp dword [ebp - 0x1c], eax
je 0x1002d669
mov eax, edi
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1002d60c
push 3
pop ecx
imul eax, dword [ebp - 0x2c], 0x3e32
push 0
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x28]
pop eax
jns 0x1002d601
dec dword [ebp - 0x1c]
jns 0x1002d5e7
dec dword [ebp - 0x34]
jns 0x1002d5d8
mov dword [ebp - 0x1c], 0xd8b9dbea
lea ecx, [ebp - 0x5c0]
push ebx
call fcn.10014568
mov dword [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x18], 0xd329
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x10], 0x8700d35d
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002d6f9
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5c0]
call fcn.100145f4
mov dword [eax], 0xe3b372ba
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d6db
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002d71c
imul eax, dword [ebp - 0x1c], 7
test eax, eax
je 0x1002d71c
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x5c0]
xor eax, eax
push eax
call fcn.100145f4
mov dword [eax], esi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x5c0]
mov dword [ebp - 0x3c], edi
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.100145f4
xor ecx, ecx
xor edx, edx
push edx
cmp dword [eax], edx
mov eax, dword [ebp - 0x1c]
setle cl
sub ecx, eax
sub ecx, 0xb7a1
imul eax, ecx, 0x8722
xor ecx, ecx
cmp eax, 0xc895
setg cl
xor eax, eax
cmp ecx, 5
lea ecx, [ebp - 0x5c0]
setg al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
call fcn.100145f4
mov edx, dword [ebp - 0x10]
mov esi, eax
mov ecx, dword [ebp - 0x1c]
xor eax, eax
cmp edx, ecx
lea ecx, [ebp - 0x5c0]
setge al
or dword [ebp - 4], 0xffffffff
mov dword [esi], eax
call fcn.100145ef
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe5
je 0x1002d857
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002d7cf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x538], 0x13244d51
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002d7b7
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002d7f1
mov dword [ebp - 0x18], 0x568d
mov dword [ebp - 0x3c], 0x8588d0d3
mov dword [ebp - 0x2c], 0xfffffff7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
jmp 0x1002d840
mov dword [ebp - 0x2c], 9
jmp 0x1002d81c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002d819
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x538], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002d805
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xe
jl 0x1002d7fa
mov dword [ebp - 0x2c], 0xffffffe4
jmp 0x1002d83a
mov dword [ebp - 0x18], 0x1c17c774
cmp dword [ebp - 0x18], eax
jne 0x1002d840
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 8
je 0x1002d82b
mov dword [ebp - 0x2c], 0x61b583dc
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe5
push 0
pop eax
jne 0x1002d7ac
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], 0xa8ea
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002d879
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002d889
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 0x18], 0xdada439b
lea ecx, [ebp - 0x91c]
mov dword [ebp - 0x18], 0xdc4b4e12
mov dword [ebp - 0x30], 0x5d81
mov dword [ebp - 0x10], 0x4ad37400
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x18], 0x7921e124
mov dword [ebp - 0x1c], 0xfc657863
push ebx
call fcn.10014568
mov dword [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x10], eax
jmp 0x1002d8ea
push dword [ebp - 0x10]
lea ecx, [ebp - 0x91c]
call fcn.100145f4
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d8d7
mov eax, dword [ebp - 0x30]
xor edx, edx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x91c]
mov esi, dword [ebp - 0x10]
neg esi
sbb esi, esi
xor ebx, ebx
push ebx
neg esi
call fcn.100145f4
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x10]
imul eax, esi
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp eax, 0x422d5fba
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x91c]
or dword [ebp - 4], 0xffffffff
call fcn.100145ef
push 4
pop esi
mov dword [ebp - 0x18], 0x90a624cd
lea ecx, [ebp - 0xce8]
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x28], ebx
push esi
call fcn.10014568
xor eax, eax
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
jmp 0x1002d9af
push dword [ebp - 0x10]
lea ecx, [ebp - 0xce8]
call fcn.100145f4
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002d99b
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x1c]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
push 3
setge dl
xor ecx, ecx
cmp eax, edx
pop ebx
setle cl
xor eax, eax
cmp ecx, 0x220985a9
setl al
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002da0e
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
jmp 0x1002da06
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002da03
push eax
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1002d9f0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x1002d9e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xce8]
call fcn.100145ef
mov dword [ebp - 0x18], 0xeb9ae77a
lea ecx, [ebp - 0xf4]
push edi
call fcn.10014568
push edi
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0x15
call fcn.10014568
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x44], 0x9ad1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002da84
push dword [ebp - 0x24]
lea ecx, [ebp - 0xf4]
call fcn.100145f4
mov dword [eax], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002da6a
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002daa9
push dword [ebp - 0x24]
lea ecx, [ebp - 0xa8]
call fcn.100145f4
push 0xfffffffffffffffe
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002da8c
xor eax, eax
push eax
lea ecx, [ebp - 0xa8]
call fcn.100145f4
xor ebx, ebx
lea ecx, [ebp - 0xa8]
push ebx
mov dword [eax], ebx
call fcn.100145f4
cmp dword [eax], ebx
jl 0x1002dd0c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002daf1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8c], 0xbb11accb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002dad8
xor eax, eax
push eax
lea ecx, [ebp - 0xa8]
call fcn.100145f4
lea ecx, [ebp - 0xf4]
push dword [eax]
call fcn.100145f4
xor ebx, ebx
cmp dword [eax], ebx
jne 0x1002dd09
xor eax, eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], eax
jg 0x1002dce5
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x28], 0x80e3580d
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x18], 0x705be734
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x1002dcd3
push eax
lea ecx, [ebp - 0xa8]
call fcn.100145f4
lea ecx, [ebp - 0xf4]
push dword [eax]
call fcn.100145f4
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf4]
mov esi, eax
call fcn.100145f4
mov ecx, dword [esi]
push dword [ebp - 0x8c]
mov dword [eax], ecx
lea ecx, [ebp - 0xf4]
call fcn.100145f4
xor ebx, ebx
cmp dword [eax], ebx
jne 0x1002dc8c
mov eax, dword [ebp - 0x8c]
lea ecx, [ebp - 0xa8]
mov eax, dword [ebp - 0x8c]
push ebx
call fcn.100145f4
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf4]
call fcn.100145f4
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xa8]
push ebx
call fcn.100145f4
lea ecx, [ebp - 0xf4]
push dword [eax]
call fcn.100145f4
push ebx
lea ecx, [ebp - 0xa8]
call fcn.100145f4
lea ecx, [ebp - 0xf4]
push dword [eax]
call fcn.100145f4
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0xf4]
dec eax
neg eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x8c]
add eax, 0xfcc9
mov dword [ebp - 0x18], eax
push dword [ebp - 0x8c]
call fcn.100145f4
mov ecx, dword [ebp - 0x2c]
push 0xfffffffffffffffe
pop edx
cmp edx, ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [eax]
cmp ecx, 0x4f9af392
je 0x1002dc42
push ebx
lea ecx, [ebp - 0xa8]
call fcn.100145f4
cmp dword [eax], ebx
mov eax, ebx
je 0x1002dc44
mov eax, edi
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0xa8]
mov eax, dword [ebp - 0x2c]
push ebx
call fcn.100145f4
lea ecx, [ebp - 0xf4]
push dword [eax]
call fcn.100145f4
push ebx
lea ecx, [ebp - 0xa8]
mov esi, eax
call fcn.100145f4
mov ecx, dword [ebp - 0x8c]
xor edx, edx
sub ecx, dword [eax]
cmp ecx, 0x507b3925
setge dl
sub edx, dword [esi]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xf4]
call fcn.100145f4
push ebx
lea ecx, [ebp - 0xf4]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
call fcn.100145f4
mov ecx, dword [ebp - 0x3c]
xor edx, edx
add ecx, 0xd3d3
push 0
cmp ecx, dword [eax]
pop eax
setle dl
mov dword [ebp - 0x34], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x1002db4f
push 0xfffffffffffffffc
pop ecx
inc dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], eax
jle 0x1002db2b
push eax
lea ecx, [ebp - 0xa8]
call fcn.100145f4
xor ebx, ebx
lea ecx, [ebp - 0xa8]
push ebx
dec dword [eax]
call fcn.100145f4
cmp dword [eax], ebx
jge 0x1002dacd
push 4
pop esi
mov dword [ebp - 0x34], 7
jmp 0x1002dda0
mov dword [ebp - 0x38], 0x2f747eab
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x18], 0xfffffffa
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
push ebx
call fcn.100145f4
push ebx
lea ecx, [ebp - 0xa8]
call fcn.100145f4
mov ecx, dword [ebp - 0x34]
inc ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002dd78
mov dword [ebp - 0x18], 0xd142575e
mov dword [ebp - 0x18], 0x8f381c4e
cmp dword [ebp - 0x38], eax
jne 0x1002ddaa
inc dword [ebp - 0x44]
jmp 0x1002dd9a
mov dword [ebp - 0x18], 0xb104b5bc
mov dword [ebp - 0x3c], 0xbb416c01
mov dword [ebp - 0x2c], eax
jmp 0x1002dd94
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xc
je 0x1002dd8b
inc dword [ebp - 0x34]
push 0
pop ebx
cmp dword [ebp - 0x34], 0x18
jle 0x1002dd18
lea ecx, [ebp - 0xa8]
call fcn.100145ef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf4]
call fcn.100145ef
mov dword [ebp - 0x18], edi
xor eax, eax
mov dword [ebp - 0x34], 0x46c2
mov dword [ebp - 0x10], 0x703acb6d
mov dword [ebp - 0x18], 0xe6a0
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 0x69a75015
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x1002de0c
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x134c], 0x99da9727
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002ddf4
xor eax, eax
push 2
mov dword [ebp - 0x2c], eax
pop ebx
cmp dword [ebp - 0x2c], ebx
jge 0x1002de2f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xd80], 0xfffffff7
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002de17
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x1002de37
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp eax, edi
mov eax, dword [ebp - 0x10]
setg cl
sub ecx, eax
mov dword [ebp - 0x1348], ecx
mov dword [ebp - 0xd80], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
push 0xfffffffffffffffc
pop ecx
cmp ecx, eax
push 3
sbb eax, eax
neg eax
pop esi
sub eax, esi
jne 0x1002de80
mov eax, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002deaa
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
xor eax, eax
mov dword [ebp - 0x18], 0x707dfe4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], 0xb13309e6
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], 0xebdc590c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002deeb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdc], 0xec2e0cf5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002ded3
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1002dfda
jmp 0x1002defb
xor eax, eax
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x3c], 0xc7153413
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x10], eax
jmp 0x1002df29
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1364], 0x5524
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002df18
mov eax, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xdc]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
add ecx, dword [ebp - 0x24]
je 0x1002df5b
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xdc]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0xdc]
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
add ecx, dword [ebp + eax*4 - 0xdc]
mov eax, dword [ebp - 0x1358]
cmp ecx, eax
mov eax, dword [ebp - 0xd8]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
neg eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x24]
cmp eax, 0x8475
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
cmp ecx, 0x728ad64d
setl dl
cmp dword [ebp + eax*4 - 0xdc], edx
jle 0x1002dfcc
xor eax, eax
cmp dword [ebp - 0xd8], eax
je 0x1002dfce
mov eax, edi
jmp 0x1002dfce
xor eax, eax
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x24]
jns 0x1002def9
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x30]
jle 0x1002e017
xor eax, eax
cmp dword [ebp - 0xdc], eax
je 0x1002e019
mov ecx, edi
jmp 0x1002e01b
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], ecx
mov ecx, edi
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd8]
sub ecx, eax
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0xcf8]
mov dword [ebp - 0x18], edi
push ebx
call fcn.10014568
mov dword [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x4f8], edi
mov dword [ebp - 0x4f4], edi
mov dword [ebp - 0x4f0], edi
mov dword [ebp - 0x4ec], edi
mov dword [ebp - 0x18], 0x1c0f8067
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0xe6e2bfbd
mov dword [ebp - 0x18], 0x8cf5a8
mov dword [ebp - 0x18], 0xf38d927f
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x3c], 0x3c1de6fc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002e0c2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13f4], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002e0ae
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_KillTimer]
mov dword [ebp - 0x4f8], ebx
cmp dword [ebp - 0x4f8], eax
jl 0x1002e140
xor ebx, ebx
inc ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002e0fc
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xccc], 0x9869
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002e0e4
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1002e11e
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1304], 0xfffffffd
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1002e105
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e133
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
dec dword [ebp - 0x3c]
dec dword [ebp - 0x4f8]
jns 0x1002e0d9
jmp 0x1002e143
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x4f8]
lea ecx, [ebp - 0x139c]
movdqa xmm0, xmmword [0x10007bd0]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xfe4]
push eax
lea eax, [ebp - 0xff4]
mov dword [ebp - 0x18], 0xfffffff8
push eax
movdqu xmmword [ebp - 0xff4], xmm0
call fcn.10014606
lea ecx, [ebp - 0x183]
mov esi, eax
call fcn.10014603
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x2c8]
push dword [esi]
call fcn.100145c9
mov byte [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffa
push 3
mov dword [ebp - 0x30], 0xfffffffb
pop esi
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1002e337
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x2c8]
mov dword [ebp - 0x34], ebx
push dword [ebp - 0x20]
call fcn.100145f4
push dword [ebp - 0x20]
lea ecx, [ebp - 0x2c8]
mov esi, eax
call fcn.100145f4
mov ecx, dword [esi]
push 3
pop esi
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x1002e328
jmp 0x1002e1fa
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x1002e2eb
xor edi, edi
inc edi
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1002e2cb
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x2c8]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
xor eax, eax
push eax
call fcn.100145f4
mov ecx, dword [ebp - 0x28]
xor ebx, ebx
push dword [ebp - 0x10]
cmp dword [eax], ecx
lea ecx, [ebp - 0x2c8]
setl bl
call fcn.100145f4
push 1
mov dword [eax], ebx
dec dword [ebp - 0x10]
pop ebx
jns 0x1002e1f8
dec dword [ebp - 0x20]
jns 0x1002e1bd
mov edi, dword [sym.imp.USER32.dll_KillTimer]
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0x17
call fcn.100145ef
xor eax, eax
lea ecx, [ebp - 0xa9c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 0x29bf390
mov dword [ebp - 0x18], 0xffff
push 2
call fcn.10014568
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002e394
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa9c]
call fcn.100145f4
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002e375
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002e39c
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0xa9c]
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.100145f4
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x30]
mov esi, dword [sym.imp.USER32.dll_DefWindowProcA]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002e3d8
push eax
push eax
push 0x26ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
lea ecx, [ebp - 0xa9c]
mov byte [ebp - 4], 0x17
call fcn.100145ef
mov dword [ebp - 0x28], 0x5d6c05ba
xor eax, eax
mov dword [ebp - 0x24], 0x6e6f7fbf
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffe2
je 0x1002e508