Function at 0x10020b29
Capabilities:
Get disk size
Modify service
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10022a31
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2fc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x310], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x31c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x3a4], 6
mov dword [ebp - 0x344], 0xe6bae055
mov dword [ebp - 0xd8], 0
jmp 0x10020b96
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 4
jge 0x10020bb2
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x2c0], 0xffffffff
jmp 0x10020b89
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c0], 0x8932
jge 0x10020bd1
mov dword [ebp - 0x234], 1
jmp 0x10020bd8
and dword [ebp - 0x234], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c0]
cmp eax, dword [ebp - 0x234]
jl 0x10020bf9
mov dword [ebp - 0x240], 1
jmp 0x10020c00
and dword [ebp - 0x240], 0
cmp dword [ebp - 0x240], 1
jge 0x10020c15
mov dword [ebp - 0x114], 1
jmp 0x10020c1c
and dword [ebp - 0x114], 0
cmp dword [ebp - 0x114], 0xffffffff
je 0x10020c37
cmp dword [ebp - 0x20], 0
je 0x10020c37
mov dword [ebp - 0x248], 1
jmp 0x10020c3e
and dword [ebp - 0x248], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c0]
cmp dword [ebp - 0x248], eax
jne 0x10020c6c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c0], 0
jne 0x10020c6c
and dword [ebp - 0x11c], 0
jmp 0x10020c76
mov dword [ebp - 0x11c], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x11c], eax
jl 0x10020c8d
mov dword [ebp - 0x2d4], 1
jmp 0x10020c94
and dword [ebp - 0x2d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c0]
mov dword [ebp - 0x390], eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x20], 0
jmp 0x10020cbe
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x10020d85
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x314], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x2c0], 1
jne 0x10020d67
xor eax, eax
inc eax
je 0x10020d07
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x2c0], 0
je 0x10020d07
mov dword [ebp - 0x250], 1
jmp 0x10020d0e
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x124], eax
imul eax, dword [ebp - 0x124], 9
mov ecx, dword [ebp - 0x20]
cmp eax, dword [ebp + ecx*4 - 0x2c0]
jl 0x10020d3f
cmp dword [ebp - 0x314], 0
jne 0x10020d3f
and dword [ebp - 0x258], 0
jmp 0x10020d49
mov dword [ebp - 0x258], 1
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x258]
sub ecx, dword [ebp + eax - 0x2c0]
jne 0x10020d67
and dword [ebp - 0x12c], 0
jmp 0x10020d71
mov dword [ebp - 0x12c], 1
mov eax, dword [ebp - 0x12c]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x344], eax
jmp 0x10020cb7
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x14], 0x9dada439
mov dword [ebp - 0x5c], 0x7440271d
mov dword [ebp - 0xcc], 0
jmp 0x10020db5
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jge 0x10020dd1
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x394], 0xd6d2
jmp 0x10020da8
mov dword [ebp - 0x14], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x10021079
mov dword [ebp - 0xc], 0xfffffff9
mov dword [ebp - 0x80], 0
jmp 0x10020df9
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x10020e0f
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xc4], 0x65fbc01d
jmp 0x10020df2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0xc], 0xffffaed5
je 0x10020e2d
mov dword [ebp - 0x260], 1
jmp 0x10020e34
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xffff
jbe 0x10020e52
mov dword [ebp - 0x134], 1
jmp 0x10020e59
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x134], eax
jne 0x10020e70
mov dword [ebp - 0x340], 1
jmp 0x10020e77
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x3e0], eax
push 3
pop eax
test eax, eax
jne 0x10020e96
cmp dword [ebp - 0x5c], 0
jne 0x10020e96
and dword [ebp - 0x268], 0
jmp 0x10020ea0
mov dword [ebp - 0x268], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x268], eax
jne 0x10020eb7
mov dword [ebp - 0x13c], 1
jmp 0x10020ebe
and dword [ebp - 0x13c], 0
cmp dword [ebp - 0x13c], 0x58ed
je 0x10020ed6
mov dword [ebp - 0x270], 1
jmp 0x10020edd
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x270]
cmp eax, 0xfffffff9
jge 0x10020ef8
mov dword [ebp - 0x144], 1
jmp 0x10020eff
and dword [ebp - 0x144], 0
cmp dword [ebp - 0x144], 0xf4a1
jle 0x10020f17
mov dword [ebp - 0x278], 1
jmp 0x10020f1e
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x278], eax
jl 0x10020f35
mov dword [ebp - 0x14c], 1
jmp 0x10020f3c
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x14c]
sub eax, dword [ebp - 0x14]
sub eax, 0xffff
je 0x10020f61
mov eax, 0x36c93846
test eax, eax
je 0x10020f61
mov dword [ebp - 0x280], 1
jmp 0x10020f68
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0x280]
test eax, eax
jne 0x10020f85
cmp dword [ebp - 0xc], 0
jne 0x10020f85
and dword [ebp - 0x154], 0
jmp 0x10020f8f
mov dword [ebp - 0x154], 1
imul eax, dword [ebp - 0x154], 0x39bf
cmp eax, dword [ebp - 0xc]
je 0x10020faa
mov dword [ebp - 0x320], 1
jmp 0x10020fb1
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0xc]
cmp eax, 0xffffffff
je 0x10020fd5
cmp dword [ebp - 0x5c], 0
jne 0x10020fd5
and dword [ebp - 0x288], 0
jmp 0x10020fdf
mov dword [ebp - 0x288], 1
imul eax, dword [ebp - 0x288], 0xf4d0
test eax, eax
je 0x10021009
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc4], 0
je 0x10021009
mov dword [ebp - 0x15c], 1
jmp 0x10021010
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x15c]
jle 0x10021027
mov dword [ebp - 0x30c], 1
jmp 0x1002102e
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x424], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0xc4]
mov dword [ebp + ecx - 0xc4], eax
mov dword [ebp - 0xc], 0
jmp 0x10021061
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x10021077
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc4], 0xf51885a1
jmp 0x1002105a
jmp 0x1002108d
mov byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x1002108d
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x14], 0
jmp 0x1002109d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1a
jle 0x100211ec
mov dword [ebp - 0x100], 5
mov dword [ebp - 0x298], 0x39c1d5
mov dword [ebp - 0xdc], 0x435d7d23
mov dword [ebp - 0x2e0], 0x4bfce934
mov dword [ebp - 0x88], 0
jmp 0x100210e8
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x10021104
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x3a0], 4
jmp 0x100210db
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x290], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x290]
mov dword [ebp + eax - 0x3a0], ecx
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0x100], 0xd5dd215
jne 0x10021165
mov dword [ebp - 0x164], 1
jmp 0x1002116c
and dword [ebp - 0x164], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x164], eax
jge 0x10021183
mov dword [ebp - 0x174], 1
jmp 0x1002118a
and dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x298]
cmp eax, dword [ebp - 0x174]
jne 0x100211ad
mov dword [ebp - 0x16c], 1
jmp 0x100211b4
and dword [ebp - 0x16c], 0
mov eax, dword [ebp - 0x100]
imul eax, dword [ebp - 0x16c]
cmp eax, 0x686a
jl 0x100211d4
mov dword [ebp - 0x178], 1
jmp 0x100211db
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x2e0], eax
jmp 0x10021096
mov dword [ebp - 0xb4], 0x31713b91
mov dword [ebp - 0xb4], 0
jmp 0x1002120f
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xfffffff0
jle 0x100212dc
mov dword [ebp - 0x90], 0
jmp 0x10021235
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 4
jge 0x10021251
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x388], 0xffffffff
jmp 0x10021228
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x388], 0
jmp 0x1002127c
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x388]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x388], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x388], 0xfffffffc
jne 0x100212bc
mov byte [ebp - 0x41], 0
movzx eax, byte [ebp - 0x41]
test eax, eax
je 0x100212a6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov byte [ebp - 0x4b], 0
movzx eax, byte [ebp - 0x4b]
test eax, eax
je 0x100212ba
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x10021263
mov byte [ebp - 0x43], 0
movzx eax, byte [ebp - 0x43]
test eax, eax
je 0x100212d7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x10021202
mov dword [ebp - 0x38], 0xa122
mov dword [ebp - 0x360], 3
mov dword [ebp - 0x35c], 3
mov dword [ebp - 0x358], 3
mov dword [ebp - 0x354], 3
mov dword [ebp - 0x20c], 1
mov dword [ebp - 0x254], 0xfffffffb
mov dword [ebp - 0xb8], 0
jmp 0x10021338
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x10021354
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x45c], 0x1d018875
jmp 0x1002132b
cmp dword [ebp - 0x38], 0
jne 0x10021396
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x448], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x360], 1
cmp dword [ebp - 0x38], 0x6173
jle 0x1002138d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x360], 0
jne 0x10021396
and dword [ebp - 0x274], 0
jmp 0x100213a0
mov dword [ebp - 0x274], 1
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x274], eax
jge 0x100213b7
mov dword [ebp - 0x17c], 1
jmp 0x100213be
and dword [ebp - 0x17c], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0x2e97
jne 0x100213e2
mov dword [ebp - 0x184], 1
jmp 0x100213e9
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x184]
add eax, 0x8e46
mov dword [ebp - 0x254], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x254]
mov dword [ebp + eax - 0x45c], ecx
mov dword [ebp - 0x38], 0
jmp 0x1002141d
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jg 0x10021439
mov byte [ebp - 0x49], 0
movzx eax, byte [ebp - 0x49]
test eax, eax
je 0x10021437
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x10021416
mov dword [ebp - 4], 0xfffffffa
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 4], 0
jmp 0x10021457
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xfffffff1
jg 0x100217fd
mov dword [ebp - 0x194], 0x2ee6d058
mov dword [ebp - 0x24], 0x8b15e3
mov dword [ebp - 0x224], 0xe712c519
mov dword [ebp - 0xf8], 1
mov dword [ebp - 0x98], 0
jmp 0x1002149f
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x100214bb
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x2b0], 1
jmp 0x10021492
mov eax, dword [ebp - 4]
mov dword [ebp - 0x450], eax
cmp dword [ebp - 4], 0
jne 0x100214d9
cmp dword [ebp - 4], 0
jne 0x100214d9
and dword [ebp - 0x18c], 0
jmp 0x100214e3
mov dword [ebp - 0x18c], 1
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x18c], eax
jl 0x100214fa
mov dword [ebp - 0xe8], 1
jmp 0x10021501
and dword [ebp - 0xe8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xe8]
mov dword [ebp + eax - 0x2b0], ecx
cmp dword [ebp - 0xe8], 0
jne 0x10021529
mov dword [ebp - 0x214], 1
jmp 0x10021530
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x214]
cmp eax, dword [ebp - 0x194]
jg 0x1002154d
mov dword [ebp - 0x294], 1
jmp 0x10021554
and dword [ebp - 0x294], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x194]
cmp eax, dword [ebp - 0x294]
jne 0x10021571
mov dword [ebp - 0x19c], 1
jmp 0x10021578
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x19c]
jle 0x1002158f
mov dword [ebp - 0x21c], 1
jmp 0x10021596
and dword [ebp - 0x21c], 0
cmp dword [ebp - 0x21c], 0xb8b78acc
jbe 0x100215ae
mov dword [ebp - 0x1a4], 1
jmp 0x100215b5
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x24], 0
jne 0x1002163e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2b0]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x2b0]
jne 0x100215fb
mov eax, 0xee1d
test eax, eax
jne 0x100215fb
and dword [ebp - 0x25c], 0
jmp 0x10021605
mov dword [ebp - 0x25c], 1
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x25c]
jg 0x1002161c
mov dword [ebp - 0x1ac], 1
jmp 0x10021623
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x10021647
cmp dword [ebp - 4], 0
je 0x10021647
cmp dword [ebp - 0xf8], 0
jne 0x10021656
cmp dword [ebp - 0x24], 0
jne 0x10021656
and dword [ebp - 0x1b4], 0
jmp 0x10021660
mov dword [ebp - 0x1b4], 1
cmp dword [ebp - 0x1b4], 1
jae 0x10021675
mov dword [ebp - 0x27c], 1
jmp 0x1002167c
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x27c]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x100216c7
mov dword [ebp - 0x24], 0x14
jmp 0x1002169f
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe6
jne 0x100216c2
mov byte [ebp - 0x3a], 0
movzx eax, byte [ebp - 0x3a]
test eax, eax
je 0x100216c0
push 0x1fa5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x10021698
jmp 0x100217f8
mov dword [ebp - 0xf0], 0x8a3d3555
mov byte [ebp - 0x3c], 0
movzx eax, byte [ebp - 0x3c]
test eax, eax
je 0x100216e3
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x398], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2b0]
cmp dword [ebp - 4], eax
je 0x10021713
cmp dword [ebp - 0x24], 0
je 0x10021713
mov dword [ebp - 0x1bc], 1
jmp 0x1002171a
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x1bc]
jg 0x10021731
mov dword [ebp - 0x22c], 1
jmp 0x10021738
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x22c]
je 0x10021754
xor eax, eax
inc eax
je 0x10021754
mov dword [ebp - 0x1c4], 1
jmp 0x1002175b
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x1c4], eax
jle 0x10021772
mov dword [ebp - 0x318], 1
jmp 0x10021779
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0xf0], eax
jge 0x10021799
mov dword [ebp - 0x264], 1
jmp 0x100217a0
and dword [ebp - 0x264], 0
cmp dword [ebp - 0x264], 0x615a0349
jl 0x100217b8
mov dword [ebp - 0x1cc], 1
jmp 0x100217bf
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x1cc], eax
jg 0x100217d9
mov dword [ebp - 0x108], 1
jmp 0x100217e0
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
sub eax, dword [ebp - 0x68]
mov dword [ebp - 0x24], eax
jmp 0x10021450
mov dword [ebp - 0x58], 0xfffffffc
mov dword [ebp - 0x38c], 0xfffffff7
mov dword [ebp - 0xc0], 0xd1e1e87d
mov dword [ebp - 0x40c], 7
mov dword [ebp - 0x54], 0xfffffff9
mov dword [ebp - 0x28], 0
jmp 0x10021839
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002184f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x468], 1
jmp 0x10021832
mov dword [ebp - 0x28], 0
jmp 0x1002185f
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10021875
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x3ac], 0xfffffffd
jmp 0x10021858
mov byte [ebp - 0x3e], 0
movzx eax, byte [ebp - 0x3e]
test eax, eax
je 0x10021890
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [ebp - 0xc0], 2
jmp 0x100218a9
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jl 0x10021a5f
mov dword [ebp - 0x2d0], 0xfffffffa
mov dword [ebp - 0x2cc], 0xfffffffa
mov dword [ebp - 0x2c8], 0xfffffffa
mov dword [ebp - 0x2c4], 0xfffffffa
mov dword [ebp - 0x1d4], 0xfffffffe
mov dword [ebp - 0xa0], 0
jmp 0x10021901
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 4
jge 0x1002191d
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x478], 0xfffffff9
jmp 0x100218f4
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x2d0], 0
jmp 0x1002194b
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2d0]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x2d0], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2d0], 2
jg 0x10021a12
mov dword [ebp - 0x2e8], 8
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2d0]
cmp dword [ebp + eax*4 - 0x468], 0x924b5411
jb 0x1002198f
mov dword [ebp - 0x28c], 1
jmp 0x10021996
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1d4]
imul eax, dword [ebp - 0x28c]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x3ac]
je 0x100219d7
cmp dword [ebp - 0x2e8], 0
je 0x100219d7
mov dword [ebp - 0x1dc], 1
jmp 0x100219de
and dword [ebp - 0x1dc], 0
cmp dword [ebp - 0x1dc], 6
jne 0x100219f3
mov dword [ebp - 0x23c], 1
jmp 0x100219fa
and dword [ebp - 0x23c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x23c]
mov dword [ebp + eax - 0x478], ecx
jmp 0x10021930
mov dword [ebp - 0x54], 0
jmp 0x10021a22
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jg 0x10021a5a
mov dword [ebp - 0x324], 0
cmp dword [ebp - 0x324], 0
je 0x10021a3d
jmp 0x10021a5a
mov byte [ebp - 0x40], 0
movzx eax, byte [ebp - 0x40]
test eax, eax
je 0x10021a58
push 0
push 0x90f
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
jmp 0x10021a1b
jmp 0x1002189c
mov dword [ebp - 0xc8], 0
jmp 0x10021a78
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x10021a94
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x408], 1
jmp 0x10021a6b
mov byte [ebp - 0x44], 0
mov dword [ebp - 0x64], 0xfffffffc
mov dword [ebp - 0x3b0], 0xfffffff7
mov dword [ebp - 0xa8], 0
jmp 0x10021ac2
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x10021ade
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x3f8], 1
jmp 0x10021ab5
mov byte [ebp - 0x42], 0
movzx eax, byte [ebp - 0x42]
test eax, eax
je 0x10021af8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov dword [ebp - 0x64], 0
jmp 0x10021b08
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jg 0x10021b24
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x3f8]
mov dword [ebp + ecx*4 - 0x3f8], eax
jmp 0x10021b01
movzx eax, byte [ebp - 0x44]
test eax, eax
je 0x10022121
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0xe4], 0x7d2703d9
mov dword [ebp - 0x70], 0x9ecf4a41
mov dword [ebp - 0x24c], 0xd6b3bfa3
mov dword [ebp - 0xec], 0xfffffffd
mov dword [ebp - 0x34], 0xf145ba13
mov dword [ebp - 0x18], 0
jmp 0x10021b73
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10021b89
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x330], 0x86fd5d70
jmp 0x10021b6c
mov dword [ebp - 0x18], 0
jmp 0x10021b99
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10021baf
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb0], 0
jmp 0x10021b92
mov dword [ebp - 0x18], 0
jmp 0x10021bbf
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10021bd5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe0], 1
jmp 0x10021bb8
mov byte [ebp - 0x46], 0
movzx eax, byte [ebp - 0x46]
test eax, eax
je 0x10021c06
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1c07
push 0x9ae
push 0x26f4
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x330]
mov dword [ebp - 0x414], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0]
neg eax
neg eax
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x24c]
sub eax, dword [ebp - 0xec]
mov dword [ebp - 0x338], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xe0], eax
mov eax, dword [ebp - 0x2f0]
cmp eax, dword [ebp - 0x338]
je 0x10021c77
mov dword [ebp - 0x1e4], 1
jmp 0x10021c7e
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x1e4]
jl 0x10021c95
mov dword [ebp - 0x26c], 1
jmp 0x10021c9c
and dword [ebp - 0x26c], 0
cmp dword [ebp - 0x26c], 0xe6da
jge 0x10021cb4
mov dword [ebp - 0x1ec], 1
jmp 0x10021cbb
and dword [ebp - 0x1ec], 0
mov dword [ebp - 0xe4], 0xe58b
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x1ec]
jle 0x10021cdf
mov dword [ebp - 0x244], 1
jmp 0x10021ce6
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x244]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0xb0]
cmp eax, 0x4ed25e42
je 0x10021d0f
mov dword [ebp - 0x1f4], 1
jmp 0x10021d16
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x1f4]
jge 0x10021d2d
mov dword [ebp - 0x284], 1
jmp 0x10021d34
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x284], eax
jne 0x10021d4b
mov dword [ebp - 0x2f8], 1
jmp 0x10021d52
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x3bc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x70]
cmp dword [ebp + eax - 0xb0], ecx
jge 0x10021e57
mov dword [ebp - 0x328], 0x2c752785
mov dword [ebp - 0xd0], 0
jmp 0x10021d94
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 3
jge 0x10021db0
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x350], 0x12535b5b
jmp 0x10021d87
mov eax, 0x7342
test eax, eax
je 0x10021ddd
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x350]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x6c], 1
jne 0x10021ddd
mov dword [ebp - 0x1fc], 1
jmp 0x10021de4
and dword [ebp - 0x1fc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1fc]
sub ecx, dword [ebp + eax - 0x350]
je 0x10021e10
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x350], 0
je 0x10021e10
cmp dword [ebp - 0xe4], 0
jne 0x10021e22
cmp dword [ebp - 0x328], 0
jne 0x10021e22
and dword [ebp - 0x300], 0
jmp 0x10021e2c
mov dword [ebp - 0x300], 1
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x3c8], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x350]
mov dword [ebp + ecx - 0x330], eax
jmp 0x10021fd6
mov dword [ebp - 0x1a8], 0x5a6edb5b
mov dword [ebp - 0x34], 0
jmp 0x10021e71
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x10021fd6
mov dword [ebp - 0x204], 0xfffffff9
mov dword [ebp - 0xec], 6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x330]
cmp dword [ebp - 0xec], eax
jge 0x10021eb0
mov dword [ebp - 0x180], 1
jmp 0x10021eb7
and dword [ebp - 0x180], 0
mov dword [ebp - 0x204], 0xc3d3
cmp dword [ebp - 0x204], 0x9e48
je 0x10021ed9
mov dword [ebp - 0x170], 1
jmp 0x10021ee0
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x170], eax
jne 0x10021efa
mov dword [ebp - 0x168], 1
jmp 0x10021f01
and dword [ebp - 0x168], 0
cmp dword [ebp - 0x168], 0x2197
jl 0x10021f19
mov dword [ebp - 0x188], 1
jmp 0x10021f20
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x188]
jle 0x10021f3a
mov dword [ebp - 0x190], 1
jmp 0x10021f41
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x190]
cmp eax, 0x453d
jle 0x10021f5e
mov dword [ebp - 0x198], 1
jmp 0x10021f65
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0xb0]
cmp eax, dword [ebp - 0x198]
jle 0x10021f83
mov dword [ebp - 0x1a0], 1
jmp 0x10021f8a
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0xb0], ecx
mov dword [ebp - 0x70], 0
jmp 0x10021faa
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x10021fd1
cmp dword [ebp - 0x1a8], 0
je 0x10021fbb
jmp 0x10021fd1
mov byte [ebp - 0x48], 0
movzx eax, byte [ebp - 0x48]
test eax, eax
je 0x10021fcf
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10021fa3
jmp 0x10021e6a
push 0x1195
push 0x7aef
push 0
call fcn.10028b9f
add esp, 0xc
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x444], 0xffffffff
mov dword [ebp - 0x440], 0xffffffff
mov dword [ebp - 0x43c], 0xffffffff
mov dword [ebp - 0x438], 0xffffffff
mov dword [ebp - 0x74], 0
jmp 0x10022029
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xf
jne 0x100220fa
mov dword [ebp - 0xd4], 0xfffffffd
mov dword [ebp - 0xd4], 0xe
jmp 0x10022056
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x14
je 0x100220f5
mov dword [ebp - 0xbc], 0x3e63e315
mov dword [ebp - 0xbc], 0
jmp 0x10022086
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jg 0x100220c4
mov dword [ebp - 0x78], 0x79e672ca
mov dword [ebp - 0x78], 3
jmp 0x100220a6
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x100220c2
mov byte [ebp - 0x4a], 0
movzx eax, byte [ebp - 0x4a]
test eax, eax
je 0x100220c0
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002209f
jmp 0x10022079
mov byte [ebp - 0x4c], 0
movzx eax, byte [ebp - 0x4c]
test eax, eax
je 0x100220f0
push 0
push 0xfc3
push 0x21af
push 0
push 0x1cb7
push 0x20b4
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x10022049
jmp 0x10022022
mov byte [ebp - 0x3b], 0
movzx eax, byte [ebp - 0x3b]
test eax, eax
je 0x10022121
push 0xb2b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
mov dword [ebp - 0x58], 0
jmp 0x10022131
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jg 0x1002214d
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x408]
mov dword [ebp + ecx*4 - 0x408], eax
jmp 0x1002212a
mov dword [ebp - 0x7c], 3
mov dword [ebp - 0x2c], 0
jmp 0x10022164
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002217a
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x378], 0x960f57a7
jmp 0x1002215d
mov dword [ebp - 0x2c], 0
jmp 0x1002218a
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x100221a0
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x3b8], 0x6a3367f5
jmp 0x10022183
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x378]
push 4
pop edx
shl edx, 0
imul ecx, dword [ebp + edx - 0x378]
cmp dword [ebp + eax - 0x378], ecx
jle 0x100221d6
mov dword [ebp - 0x1b0], 1
jmp 0x100221dd
and dword [ebp - 0x1b0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1b0]
mov dword [ebp + eax - 0x3b8], ecx
mov dword [ebp - 0x7c], 0
jmp 0x10022200
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 7
je 0x10022244
mov byte [ebp - 0x45], 0
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x10022226
push 0
push 0x13bc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov byte [ebp - 0x39], 0
movzx eax, byte [ebp - 0x39]
test eax, eax
je 0x10022242
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x100221f9
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x418], 6
mov dword [ebp - 0x334], 0xe6bae055
mov dword [ebp - 0x84], 0
jmp 0x10022278
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x10022294
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x2a8], 0xffffffff
jmp 0x1002226b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2a8], 0x8932
jge 0x100222b3
mov dword [ebp - 0x1b8], 1
jmp 0x100222ba
and dword [ebp - 0x1b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a8]
cmp eax, dword [ebp - 0x1b8]
jl 0x100222db
mov dword [ebp - 0x1c0], 1
jmp 0x100222e2
and dword [ebp - 0x1c0], 0
cmp dword [ebp - 0x1c0], 1
jge 0x100222f7
mov dword [ebp - 0x1c8], 1
jmp 0x100222fe
and dword [ebp - 0x1c8], 0
cmp dword [ebp - 0x1c8], 0xffffffff
je 0x10022319
cmp dword [ebp - 0x1c], 0
je 0x10022319
mov dword [ebp - 0x1d0], 1
jmp 0x10022320
and dword [ebp - 0x1d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a8]
cmp dword [ebp - 0x1d0], eax
jne 0x1002234e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2a8], 0
jne 0x1002234e
and dword [ebp - 0x1d8], 0
jmp 0x10022358
mov dword [ebp - 0x1d8], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1d8], eax
jl 0x1002236f
mov dword [ebp - 0x33c], 1
jmp 0x10022376
and dword [ebp - 0x33c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a8]
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x1c], 0
jmp 0x100223a0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x10022467
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x308], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x2a8], 1
jne 0x10022449
xor eax, eax
inc eax
je 0x100223e9
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x2a8], 0
je 0x100223e9
mov dword [ebp - 0x1e0], 1
jmp 0x100223f0
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x1e8], eax
imul eax, dword [ebp - 0x1e8], 9
mov ecx, dword [ebp - 0x1c]
cmp eax, dword [ebp + ecx*4 - 0x2a8]
jl 0x10022421
cmp dword [ebp - 0x308], 0
jne 0x10022421
and dword [ebp - 0x1f0], 0
jmp 0x1002242b
mov dword [ebp - 0x1f0], 1
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x1f0]
sub ecx, dword [ebp + eax - 0x2a8]
jne 0x10022449
and dword [ebp - 0x1f8], 0
jmp 0x10022453
mov dword [ebp - 0x1f8], 1
mov eax, dword [ebp - 0x1f8]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x334], eax
jmp 0x10022399
mov eax, dword [ebp - 0x310]
mov eax, dword [eax]
shl eax, 4
mov ecx, dword [ebp - 0x31c]
mov ecx, dword [ecx]
lea eax, [eax + ecx*8 + 0x10080848]
mov ecx, dword [ebp - 0x2d8]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x104]
mov eax, dword [eax + ecx*4]
mov dword [edx], eax
mov dword [ebp - 0x10], 0x9dada439
mov dword [ebp - 0x60], 0x7440271d
mov dword [ebp - 0x8c], 0
jmp 0x100224bb
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x100224d7
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x430], 0xd6d2
jmp 0x100224ae
mov dword [ebp - 0x10], 0xffffffff
cmp dword [ebp - 0x10], 0
je 0x1002278e
mov dword [ebp - 8], 0xfffffff9
mov dword [ebp - 0x94], 0
jmp 0x10022508
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x10022524
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x9c], 0x65fbc01d
jmp 0x100224fb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 8], 0xffffaed5
je 0x10022542
mov dword [ebp - 0x200], 1
jmp 0x10022549
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xffff
jbe 0x10022567
mov dword [ebp - 0x208], 1
jmp 0x1002256e
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x208], eax
jne 0x10022585
mov dword [ebp - 0x2dc], 1
jmp 0x1002258c
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x420], eax
push 3
pop eax
test eax, eax
jne 0x100225ab
cmp dword [ebp - 0x60], 0
jne 0x100225ab
and dword [ebp - 0x210], 0
jmp 0x100225b5
mov dword [ebp - 0x210], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x210], eax
jne 0x100225cc
mov dword [ebp - 0x218], 1
jmp 0x100225d3
and dword [ebp - 0x218], 0
cmp dword [ebp - 0x218], 0x58ed
je 0x100225eb
mov dword [ebp - 0x220], 1
jmp 0x100225f2
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x220]
cmp eax, 0xfffffff9
jge 0x1002260d
mov dword [ebp - 0x228], 1
jmp 0x10022614
and dword [ebp - 0x228], 0
cmp dword [ebp - 0x228], 0xf4a1
jle 0x1002262c
mov dword [ebp - 0x230], 1
jmp 0x10022633
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x230], eax
jl 0x1002264a
mov dword [ebp - 0x238], 1
jmp 0x10022651
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x238]
sub eax, dword [ebp - 0x10]
sub eax, 0xffff
je 0x10022676
mov eax, 0x36c93846
test eax, eax
je 0x10022676
mov dword [ebp - 0x10c], 1
jmp 0x1002267d
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x10c]
test eax, eax
jne 0x1002269a
cmp dword [ebp - 8], 0
jne 0x1002269a
and dword [ebp - 0x110], 0
jmp 0x100226a4
mov dword [ebp - 0x110], 1
imul eax, dword [ebp - 0x110], 0x39bf
cmp eax, dword [ebp - 8]
je 0x100226bf
mov dword [ebp - 0x2e4], 1
jmp 0x100226c6
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 8]
cmp eax, 0xffffffff
je 0x100226ea
cmp dword [ebp - 0x60], 0
jne 0x100226ea
and dword [ebp - 0x118], 0
jmp 0x100226f4
mov dword [ebp - 0x118], 1
imul eax, dword [ebp - 0x118], 0xf4d0
test eax, eax
je 0x1002271e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9c], 0
je 0x1002271e
mov dword [ebp - 0x120], 1
jmp 0x10022725
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x120]
jle 0x1002273c
mov dword [ebp - 0x2ec], 1
jmp 0x10022743
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x44c], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x9c]
mov dword [ebp + ecx - 0x9c], eax
mov dword [ebp - 8], 0
jmp 0x10022776
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x1002278c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x9c], 0xf51885a1
jmp 0x1002276f
jmp 0x100227aa
mov byte [ebp - 0x4d], 0
push 0
lea eax, [ebp - 0x4d]
push eax
push 0x4c0b
push 0x5e13
call fcn.10027e22
add esp, 0x10
mov dword [ebp - 0x10], 0
jmp 0x100227ba
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1a
jle 0x10022909
mov dword [ebp - 0xfc], 5
mov dword [ebp - 0x138], 0x39c1d5
mov dword [ebp - 0xf4], 0x435d7d23
mov dword [ebp - 0x2f4], 0x4bfce934
mov dword [ebp - 0xa4], 0
jmp 0x10022805
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x10022821
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x3c4], 4
jmp 0x100227f8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x128], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x128]
mov dword [ebp + eax - 0x3c4], ecx
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xfc], 0xd5dd215
jne 0x10022882
mov dword [ebp - 0x130], 1
jmp 0x10022889
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x130], eax
jge 0x100228a0
mov dword [ebp - 0x140], 1
jmp 0x100228a7
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x140]
jne 0x100228ca
mov dword [ebp - 0x148], 1
jmp 0x100228d1
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0xfc]
imul eax, dword [ebp - 0x148]
cmp eax, 0x686a
jl 0x100228f1
mov dword [ebp - 0x150], 1
jmp 0x100228f8
and dword [ebp - 0x150], 0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x2f4], eax
jmp 0x100227b3
mov eax, dword [ebp - 0x2fc]
mov eax, dword [eax + 0x24]
and eax, 0x4000000
je 0x10022a2f
mov dword [ebp - 0xac], 3
mov dword [ebp - 0x30], 0
jmp 0x10022937
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1002294d
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x36c], 0x960f57a7
jmp 0x10022930
mov dword [ebp - 0x30], 0
jmp 0x1002295d
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x10022973
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x3d0], 0x6a3367f5
jmp 0x10022956
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x36c]
push 4
pop edx
shl edx, 0
imul ecx, dword [ebp + edx - 0x36c]
cmp dword [ebp + eax - 0x36c], ecx
jle 0x100229a9
mov dword [ebp - 0x158], 1
jmp 0x100229b0
and dword [ebp - 0x158], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x158]
mov dword [ebp + eax - 0x3d0], ecx
mov dword [ebp - 0xac], 0
jmp 0x100229dc
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 7
je 0x10022a1a
mov byte [ebp - 0x3f], 0
push 0x2dd4
lea eax, [ebp - 0x3f]
push eax
push 1
call fcn.100205c1
add esp, 0xc
mov byte [ebp - 0x47], 0
movzx eax, byte [ebp - 0x47]
test eax, eax
je 0x10022a18
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x100229cf
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
or eax, 0x200
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
jmp 0x10022a57
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x160]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret