Function at 0x10029849
Capabilities:
Accept command line arguments
Allocate thread local storage
Check os version
Clear file content
Connect pipe
Create directory
Delete file
Get common file path
Get disk information
Get file attributes
Parse pe header
Query environment variable
Query or enumerate registry key
Set thread local storage value
Terminate process

Disassembly:
mov eax, 0x1005dc82
call fcn.1005c15c
mov eax, 0x1754
call fcn.10059420
push ebx
xor ebx, ebx
mov byte [ebp - 0x75], dl
inc ebx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x38], ebx
xor eax, eax
mov dword [ebp - 0x40], 0xa53d06ce
mov byte [ebp - 0x31], al
push esi
push edi
cmp byte [ebp - 0x31], al
je 0x10029888
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002989f
push 0x4d7
push eax
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
xor eax, eax
mov dword [ebp - 0x4c], 0x7e4a9061
mov dword [ebp - 0x4c], 0x2e3f9150
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], 0x7392715e
mov dword [ebp - 0x40], 0xe2e4e
mov dword [ebp - 0x28], 0x7b47e0fa
mov dword [ebp - 0x10], eax
jmp 0x100298db
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x88], 0x251d69f4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100298ca
mov ecx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
neg ecx
push ebx
sbb ecx, ecx
inc ecx
add eax, ecx
mov ecx, dword [ebp - 0x88]
add ecx, 0x107
sub ecx, eax
mov eax, dword [ebp - 0x88]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
setg dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
setl dl
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x88]
setl dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x88]
cmp eax, edx
setl cl
add dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x978]
inc dword [ebp - 0x28]
call fcn.100134ea
xor eax, eax
lea ecx, [ebp - 0x6f4]
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0xf425f5f9
mov dword [ebp - 0x44], 0x6959
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x58], 0xfffffffa
mov dword [ebp - 0x40], ebx
push ebx
call fcn.100134ea
mov byte [ebp - 4], bl
xor eax, eax
mov dword [ebp - 0x50], 6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100299c6
push dword [ebp - 0x10]
lea ecx, [ebp - 0x6f4]
call fcn.10013557
mov dword [eax], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100299a8
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x100299e3
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x20], eax
je 0x100299e5
mov esi, ebx
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp eax, edx
setne cl
sub ecx, esi
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x20]
jl 0x10029a83
mov dword [ebp - 0x28], 0xfffffff9
xor eax, eax
mov dword [ebp - 0x870], eax
mov dword [ebp - 0x86c], eax
mov dword [ebp - 0x868], eax
mov dword [ebp - 0x864], eax
mov dword [ebp - 0x3c], 0xd7ba
mov dword [ebp - 0x48], 0xad2214c2
cmp dword [ebp - 0x44], eax
je 0x10029a5e
mov eax, dword [ebp - 0x28]
neg eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x86c], eax
cmp dword [ebp - 0x28], ebx
jne 0x10029a58
mov eax, dword [ebp - 0x86c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x48], ecx
jmp 0x10029b05
mov dword [ebp - 0x40], 0x380d33b9
lea ecx, [ebp - 0x960]
mov dword [ebp - 0x30], 0x4322e7c6
push 3
call fcn.100134ea
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x4c], 0xd602ff7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10029ad3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x960]
call fcn.10013557
mov dword [eax], 0x63446b7d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10029ab4
xor eax, eax
dec dword [ebp - 0x4c]
mov dword [ebp - 0x30], eax
jmp 0x10029af1
push dword [ebp - 0x30]
lea ecx, [ebp - 0x960]
call fcn.10013557
cmp dword [eax], 0
jne 0x10029af7
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jle 0x10029adb
lea ecx, [ebp - 0x960]
mov byte [ebp - 4], bl
call fcn.10013552
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x6f4]
mov eax, dword [ebp - 0x50]
xor ebx, ebx
mov eax, dword [ebp - 0x20]
push ebx
call fcn.10013557
cmp dword [ebp - 0x20], 0xe6139440
jbe 0x10029b31
push ebx
lea ecx, [ebp - 0x6f4]
call fcn.10013557
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x6f4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], bl
call fcn.10013552
xor ebx, ebx
lea ecx, [ebp - 0xbe8]
inc ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x4c], 0xfffe
push ebx
call fcn.100134ea
xor eax, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10029b99
push dword [ebp - 0x18]
lea ecx, [ebp - 0x978]
call fcn.10013557
mov dword [eax], 0x13d0bb94
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10029b7b
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10029bb5
push dword [ebp - 0x18]
lea ecx, [ebp - 0xbe8]
call fcn.10013557
mov dword [eax], 0xb11f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10029b9e
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x4c]
sub edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0xa330
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x38]
neg ecx
je 0x10029bf2
xor eax, eax
lea ecx, [ebp - 0x978]
push eax
call fcn.10013557
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0xbe8]
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x4c], ebx
push eax
call fcn.10013557
mov ecx, dword [ebp - 0x4c]
add ecx, 0xff54
mov dword [eax], ecx
lea ecx, [ebp - 0xbe8]
call fcn.10013552
or edi, 0xffffffff
lea ecx, [ebp - 0x978]
mov dword [ebp - 4], edi
call fcn.10013552
mov dword [ebp - 0x54], 0x4e064826
lea ecx, [ebp - 0xd80]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x4c], 0xfffffffd
push 3
call fcn.100134ea
xor eax, eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x10], eax
jmp 0x10029c76
push dword [ebp - 0x10]
call fcn.10013557
mov dword [eax], 0x75d5f8d9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0xd80]
jl 0x10029c65
mov eax, dword [ebp - 0x30]
push ebx
call fcn.10013557
mov ecx, dword [ebp - 0x30]
mov esi, eax
xor eax, eax
cmp ecx, 0x2ae7
mov ecx, dword [ebp - 0x30]
setle al
xor edx, edx
cmp eax, ecx
setne dl
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4c]
imul ecx, edx, 0xffff
xor edx, edx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0xba29f583
setne al
xor edx, edx
imul eax, dword [ebp - 0x4c]
imul ecx, eax, 0xd329
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, edi
setne al
mov dword [esi], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10029cf1
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
lea ecx, [ebp - 0xd80]
mov dword [ebp - 4], edi
call fcn.10013552
xor eax, eax
lea ecx, [ebp - 0x990]
mov dword [ebp - 0x3c], eax
push 2
call fcn.100134ea
push 5
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x40], 0xffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10029d48
push dword [ebp - 0x10]
lea ecx, [ebp - 0x990]
call fcn.10013557
mov dword [eax], 0x453606de
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10029d29
xor eax, eax
push eax
lea ecx, [ebp - 0x990]
call fcn.10013557
mov ecx, dword [ebp - 0x3c]
mov edi, dword [sym.imp.USER32.dll_InflateRect]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10029d76
push 0x152d
push 0x180b
push eax
call edi
or eax, 0xffffffff
lea ecx, [ebp - 0x990]
mov dword [ebp - 4], eax
call fcn.10013552
push 2
lea ecx, [ebp - 0x550]
call fcn.100134ea
lea eax, [ebp - 0x10bc]
mov dword [ebp - 4], 6
movdqa xmm0, xmmword [0x10006600]
lea ecx, [ebp - 0x1594]
push eax
lea eax, [ebp - 0x10cc]
push eax
movdqu xmmword [ebp - 0x10cc], xmm0
call fcn.10013569
lea ecx, [ebp - 0x181]
mov esi, eax
call fcn.10013566
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x7fc]
push dword [esi]
call fcn.1001352c
push 7
pop eax
mov byte [ebp - 4], al
mov eax, 0xffff
mov dword [ebp - 0x40], 0xe93d
mov dword [ebp - 0x28], 0x26a7609f
mov dword [ebp - 0x24], 0x86a67606
mov dword [ebp - 0x4c], 0xfaa0
mov dword [ebp - 0x888], eax
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x880], eax
mov dword [ebp - 0x87c], eax
xor eax, eax
mov dword [ebp - 0x3c], 0xae9140de
mov dword [ebp - 0x10], eax
jmp 0x10029e46
push dword [ebp - 0x10]
lea ecx, [ebp - 0x550]
call fcn.10013557
mov dword [eax], 0xcdbe8e56
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10029e2f
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x7fc]
mov dword [ebp - 0x28], eax
push 2
call fcn.10013557
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x550]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x888]
push ebx
call fcn.10013557
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x7fc]
dec dword [ebp - 0x24]
push 2
call fcn.10013557
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x550]
neg esi
sbb esi, esi
xor eax, eax
push eax
neg esi
call fcn.10013557
mov ecx, dword [ebp - 0x888]
xor ebx, ebx
add ecx, esi
cmp dword [eax], ecx
lea ecx, [ebp - 0x550]
setle bl
xor esi, esi
push esi
call fcn.10013557
xor ecx, ecx
push esi
cmp dword [eax], ebx
setge cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x550]
call fcn.10013557
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x7fc]
push 3
setge dl
xor ebx, ebx
cmp dword [eax], edx
setge bl
call fcn.10013557
lea ecx, [ebp - 0x7fc]
mov dword [eax], ebx
call fcn.10013552
or ebx, 0xffffffff
lea ecx, [ebp - 0x550]
mov dword [ebp - 4], ebx
call fcn.10013552
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0xedc]
push 4
mov dword [ebp - 0x10], 0xfffffff8
call fcn.100134ea
lea eax, [ebp - 0x11fc]
mov dword [ebp - 4], 8
movdqa xmm0, xmmword [0x10006680]
lea ecx, [ebp - 0x14b4]
push eax
lea eax, [ebp - 0x120c]
push eax
movdqu xmmword [ebp - 0x120c], xmm0
call fcn.10013569
lea ecx, [ebp - 0x17b]
mov esi, eax
call fcn.10013566
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1334]
push dword [esi]
call fcn.1001352c
push 3
pop ebx
push ebx
lea ecx, [ebp - 0xc00]
mov byte [ebp - 4], 9
call fcn.100134ea
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x24], 0xf3faa32f
xor esi, esi
mov dword [ebp - 0x18], eax
inc esi
cmp dword [ebp - 0x18], 4
jge 0x10029fbd
push dword [ebp - 0x18]
lea ecx, [ebp - 0xedc]
call fcn.10013557
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10029fa2
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10029fe3
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc00]
call fcn.10013557
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10029fc5
xor eax, eax
mov dword [ebp - 0x18], 0x15
cmp dword [ebp - 0x18], esi
jne 0x1002a050
or ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x1c], 0x135
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002a01c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1640], 0x47dc4b4e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002a004
xor eax, eax
dec dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002a048
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xc00]
call fcn.10013557
mov dword [eax], 0x5132d7af
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002a027
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
je 0x10029ff2
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1002a0c7
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1002a0a8
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002a072
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002a09e
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002a09b
push eax
push eax
push 0x20d
push 0x523
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1002a077
dec dword [ebp - 0x18]
jns 0x1002a060
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002a0c2
push eax
push eax
push 0x2458
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
dec dword [ebp - 0x24]
jns 0x1002a058
lea ecx, [ebp - 0xc00]
call fcn.10013552
lea ecx, [ebp - 0x1334]
call fcn.10013552
or eax, 0xffffffff
lea ecx, [ebp - 0xedc]
mov dword [ebp - 4], eax
call fcn.10013552
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002a106
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xef0], 0x64dc9ed9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002a0f5
mov dword [ebp - 0x1c], 0xa624
lea ecx, [ebp - 0x2fc]
push esi
call fcn.100134ea
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x28], 0xea0627e8
mov dword [ebp - 0x4c], 0xed23c5ad
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x3c], 0x53dd
mov dword [ebp - 0x4c], 0x9515ed76
mov dword [ebp - 0x4c], 0x187e526
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002a173
push dword [ebp - 0x20]
lea ecx, [ebp - 0x2fc]
call fcn.10013557
mov dword [eax], 0xc7c44d99
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002a155
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002a195
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x4c0], 0x7649
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002a17c
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002a1b5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x690], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002a19d
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002a20f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
neg eax
je 0x1002a1e5
xor ebx, ebx
lea ecx, [ebp - 0x2fc]
push ebx
call fcn.10013557
cmp dword [eax], ebx
je 0x1002a1e5
xor eax, eax
jmp 0x1002a1e9
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x2fc]
call fcn.10013557
xor ecx, ecx
cmp esi, 0xffffffff
setge cl
imul ecx, dword [eax]
sub ecx, 8
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2fc]
xor ebx, ebx
push ebx
call fcn.10013557
push ebx
lea ecx, [ebp - 0x2fc]
call fcn.10013557
push ebx
lea ecx, [ebp - 0x2fc]
call fcn.10013557
mov ecx, dword [ebp - 0x1c]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
add ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x2fc]
setle bl
xor eax, eax
push eax
call fcn.10013557
cmp ebx, dword [eax]
jle 0x1002a26a
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002a26a
xor ebx, ebx
mov ecx, eax
inc ebx
jmp 0x1002a26f
xor ebx, ebx
inc ebx
mov ecx, ebx
mov eax, dword [ebp - 0x4c0]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x4c0]
sub ecx, eax
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x3c]
imul ecx, dword [ebp - 0x4c]
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c0]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
add eax, edx
xor edx, edx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x4c0]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
cmp eax, 0x56a759f3
setge cl
or esi, 0xffffffff
mov dword [ebp - 0x690], ecx
lea ecx, [ebp - 0x2fc]
mov dword [ebp - 4], esi
call fcn.10013552
push 2
lea ecx, [ebp - 0x9a8]
call fcn.100134ea
mov dword [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002a31e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9a8]
call fcn.10013557
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002a303
xor eax, eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], eax
jl 0x1002a387
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x10], eax
jmp 0x1002a343
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x920], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002a332
cmp dword [ebp - 0x920], 2
jbe 0x1002a367
push ebx
lea ecx, [ebp - 0x9a8]
call fcn.10013557
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x920]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
neg eax
push 0
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x30]
pop eax
jns 0x1002a326
lea ecx, [ebp - 0x9a8]
mov dword [ebp - 4], esi
call fcn.10013552
xor eax, eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfffffff9
jl 0x1002a6d6
push 4
lea ecx, [ebp - 0x10c]
call fcn.100134ea
mov dword [ebp - 4], 0xd
push 0xfffffffffffffffb
mov dword [ebp - 0x38], 0x98070ade
pop eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
jmp 0x1002a3e0
push dword [ebp - 0x10]
call fcn.10013557
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
lea ecx, [ebp - 0x10c]
jl 0x1002a3cf
push 2
call fcn.10013557
mov dword [eax], 9
jmp 0x1002a421
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002a412
push 0x152d
push 0x180b
push eax
call edi
push 2
lea ecx, [ebp - 0x10c]
call fcn.10013557
dec dword [eax]
push 2
lea ecx, [ebp - 0x10c]
call fcn.10013557
cmp dword [eax], 7
jg 0x1002a3fb
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x1002a692
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x24], 0x3dc99cdf
push ebx
call fcn.100134ea
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002a484
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4b0]
call fcn.10013557
mov dword [eax], 0xb4f5ac3d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002a466
xor eax, eax
mov dword [ebp - 0x30], 3
cmp dword [ebp - 0x30], eax
jl 0x1002a66a
push ebx
lea ecx, [ebp - 0x70c]
call fcn.100134ea
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x44], 0x1d4416da
mov dword [ebp - 0x10], eax
jmp 0x1002a4c9
push dword [ebp - 0x10]
lea ecx, [ebp - 0x70c]
call fcn.10013557
mov dword [eax], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002a4b2
push dword [ebp - 0x38]
lea ecx, [ebp - 0x10c]
call fcn.10013557
push dword [ebp - 0x30]
xor esi, esi
lea ecx, [ebp - 0x10c]
xor ebx, ebx
inc esi
cmp dword [eax], esi
setl bl
neg ebx
call fcn.10013557
mov dword [eax], ebx
test ebx, ebx
je 0x1002a5b2
push 3
pop eax
mov dword [ebp - 0x28], 4
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0xe58], eax
mov dword [ebp - 0xe54], eax
mov dword [ebp - 0xe50], eax
mov dword [ebp - 0xe4c], eax
or eax, 0xffffffff
mov dword [ebp - 0x4c], eax
push 2
call fcn.10013557
mov ecx, dword [ebp - 0x28]
xor ebx, ebx
push ebx
mov dword [eax], ecx
lea ecx, [ebp - 0x4b0]
dec dword [ebp - 0x4c]
call fcn.10013557
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x10c]
push 2
call fcn.10013557
push esi
lea ecx, [ebp - 0x10c]
call fcn.10013557
push ebx
lea ecx, [ebp - 0x4b0]
call fcn.10013557
mov ecx, dword [ebp - 0x24]
push ebx
mov esi, dword [eax]
sub esi, ecx
lea ecx, [ebp - 0x10c]
call fcn.10013557
mov edi, dword [ebp - 0x44]
lea ecx, [ebp - 0x70c]
add edi, esi
push ebx
imul edi, dword [eax]
mov dword [ebp - 0xe54], edi
call fcn.10013557
xor ecx, ecx
cmp edi, 0x4126315b
setg cl
mov dword [eax], ecx
jmp 0x1002a64f
mov dword [ebp - 0x10], 0x4efc7101
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002a606
push eax
lea ecx, [ebp - 0x4b0]
call fcn.10013557
lea ecx, [ebp - 0x70c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
xor eax, eax
push eax
call fcn.10013557
mov edx, dword [ebp - 0x10]
mov esi, eax
mov ecx, dword [ebp - 0x24]
xor eax, eax
push dword [ebp - 0x30]
cmp ecx, edx
lea ecx, [ebp - 0x10c]
setne al
mov dword [esi], eax
call fcn.10013557
xor eax, eax
push eax
lea ecx, [ebp - 0x4b0]
call fcn.10013557
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
lea ecx, [ebp - 0x4b0]
setge dl
xor ebx, ebx
cmp edx, 0x486
setge bl
xor eax, eax
push eax
call fcn.10013557
push 2
lea ecx, [ebp - 0x10c]
mov dword [eax], ebx
call fcn.10013557
mov dword [eax], ebx
lea ecx, [ebp - 0x70c]
mov byte [ebp - 4], 0xe
call fcn.10013552
dec dword [ebp - 0x30]
push 1
pop ebx
jns 0x1002a494
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 4], 0xd
call fcn.10013552
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
push 0
pop eax
jle 0x1002a442
mov edi, dword [sym.imp.USER32.dll_InflateRect]
or esi, 0xffffffff
lea ecx, [ebp - 0x10c]
mov dword [ebp - 4], esi
call fcn.10013552
mov edx, 0xffff
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x48], 0x9ee1c974
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0xee8], ecx
mov eax, dword [ebp - 0x54]
xor eax, eax
test ecx, ecx
setns al
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x54]
cmp dword [ebp - 0x54], 0xfffffff9
jge 0x1002a3a4
xor eax, eax
jmp 0x1002a6db
mov edx, 0xffff
mov dword [ebp - 0x30], 0x4e064826
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002a704
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x105c], 0x64dc9ed9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002a6eb
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff9
jl 0x1002a738
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x48], 0x9ee1c974
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x1054], ecx
mov eax, dword [ebp - 0x30]
xor eax, eax
test ecx, ecx
setns al
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff9
jge 0x1002a70d
xor eax, eax
mov ecx, 0x37a5b7d8
mov dword [ebp - 0x105c], ecx
mov dword [ebp - 0xef0], ecx
mov dword [ebp - 0x4c], 0x2e3f9150
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], 0x7392715e
mov dword [ebp - 0x40], 0xe2e4e
mov dword [ebp - 0x28], 0x7b47e0fa
mov dword [ebp - 0x10], eax
jmp 0x1002a77e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x84], 0x251d69f4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002a76d
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
neg ecx
push ebx
sbb ecx, ecx
inc ecx
add eax, ecx
mov ecx, dword [ebp - 0x84]
add ecx, 0x107
sub ecx, eax
mov eax, dword [ebp - 0x84]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
setg dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
setl dl
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x84]
setl dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x84]
cmp eax, edx
setl cl
xor eax, eax
add dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x7b4]
inc dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0xf425f5f9
mov dword [ebp - 0x44], 0x6959
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x58], 0xfffffffa
mov dword [ebp - 0x40], ebx
call fcn.100134ea
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x50], 6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002a85e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x7b4]
call fcn.10013557
mov dword [eax], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002a840
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002a87b
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x20], eax
je 0x1002a87d
mov esi, ebx
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp eax, edx
setne cl
sub ecx, esi
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x20]
jl 0x1002a91b
mov dword [ebp - 0x28], 0xfffffff9
xor eax, eax
mov dword [ebp - 0x8a0], eax
mov dword [ebp - 0x89c], eax
mov dword [ebp - 0x898], eax
mov dword [ebp - 0x894], eax
mov dword [ebp - 0x3c], 0xd7ba
mov dword [ebp - 0x48], 0xad2214c2
cmp dword [ebp - 0x44], eax
je 0x1002a8f6
mov eax, dword [ebp - 0x28]
neg eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x89c], eax
cmp dword [ebp - 0x28], ebx
jne 0x1002a8f0
mov eax, dword [ebp - 0x89c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x48], ecx
jmp 0x1002a99e
mov dword [ebp - 0x40], 0x380d33b9
lea ecx, [ebp - 0xdec]
mov dword [ebp - 0x30], 0x4322e7c6
push 3
call fcn.100134ea
mov byte [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x4c], 0xd602ff7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002a96b
push dword [ebp - 0x10]
lea ecx, [ebp - 0xdec]
call fcn.10013557
mov dword [eax], 0x63446b7d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002a94c
xor eax, eax
dec dword [ebp - 0x4c]
mov dword [ebp - 0x30], eax
jmp 0x1002a989
push dword [ebp - 0x30]
lea ecx, [ebp - 0xdec]
call fcn.10013557
cmp dword [eax], 0
jne 0x1002a98f
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jle 0x1002a973
lea ecx, [ebp - 0xdec]
mov byte [ebp - 4], 0x10
call fcn.10013552
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x7b4]
mov eax, dword [ebp - 0x50]
xor ebx, ebx
mov eax, dword [ebp - 0x20]
push ebx
call fcn.10013557
cmp dword [ebp - 0x20], 0xe6139440
jbe 0x1002a9ca
push ebx
lea ecx, [ebp - 0x7b4]
call fcn.10013557
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x7b4]
mov eax, dword [ebp - 0x20]
xor esi, esi
mov eax, dword [ebp - 0x20]
inc esi
mov eax, dword [ebp - 0x20]
or eax, 0xffffffff
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], eax
call fcn.10013552
push 2
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0x9c0]
pop ebx
push ebx
call fcn.100134ea
mov dword [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x40], 0xffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002aa35
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9c0]
call fcn.10013557
mov dword [eax], 0x453606de
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002aa17
xor eax, eax
push eax
lea ecx, [ebp - 0x9c0]
call fcn.10013557
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002aa5d
push 0x152d
push 0x180b
push eax
call edi
or eax, 0xffffffff
lea ecx, [ebp - 0x9c0]
mov dword [ebp - 4], eax
call fcn.10013552
or eax, 0xffffffff
lea ecx, [ebp - 0xc18]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x4c], 0xfffffffd
push 3
call fcn.100134ea
xor eax, eax
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x10], eax
jmp 0x1002aaa7
push dword [ebp - 0x10]
call fcn.10013557
mov dword [eax], 0x75d5f8d9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0xc18]
jl 0x1002aa96
mov eax, dword [ebp - 0x30]
push esi
call fcn.10013557
mov ecx, dword [ebp - 0x30]
mov esi, eax
xor eax, eax
cmp ecx, 0x2ae7
mov ecx, dword [ebp - 0x30]
setle al
xor edx, edx
cmp eax, ecx
setne dl
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4c]
imul ecx, edx, 0xffff
xor edx, edx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0xba29f583
setne al
xor edx, edx
imul eax, dword [ebp - 0x4c]
imul ecx, eax, 0xd329
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setne dl
xor eax, eax
or ecx, 0xffffffff
cmp edx, ecx
setne al
mov dword [esi], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002ab25
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
or eax, 0xffffffff
lea ecx, [ebp - 0xc18]
mov dword [ebp - 4], eax
call fcn.10013552
xor esi, esi
mov dword [ebp - 0x1c], 0xa624
inc esi
lea ecx, [ebp - 0x31c]
push esi
call fcn.100134ea
mov dword [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x28], 0xea0627e8
mov dword [ebp - 0x4c], 0xed23c5ad
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x3c], 0x53dd
mov dword [ebp - 0x4c], 0x9515ed76
mov dword [ebp - 0x4c], 0x187e526
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002aba1
push dword [ebp - 0x20]
lea ecx, [ebp - 0x31c]
call fcn.10013557
mov dword [eax], 0xc7c44d99
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002ab83
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002abc1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x4c8], 0x7649
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002aba9
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002abe1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x588], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002abc9
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002ac3e
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
neg eax
je 0x1002ac11
xor ebx, ebx
lea ecx, [ebp - 0x31c]
push ebx
call fcn.10013557
cmp dword [eax], ebx
je 0x1002ac11
xor eax, eax
jmp 0x1002ac15
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x31c]
call fcn.10013557
xor ecx, ecx
cmp esi, 0xffffffff
setge cl
xor esi, esi
imul ecx, dword [eax]
sub ecx, 8
inc esi
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x31c]
xor ebx, ebx
push ebx
call fcn.10013557
push ebx
lea ecx, [ebp - 0x31c]
call fcn.10013557
push ebx
lea ecx, [ebp - 0x31c]
call fcn.10013557
mov ecx, dword [ebp - 0x1c]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
add ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x31c]
setle bl
xor eax, eax
push eax
call fcn.10013557
cmp ebx, dword [eax]
jle 0x1002ac94
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x1002ac96
mov ecx, esi
mov eax, dword [ebp - 0x4c8]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x4c8]
sub ecx, eax
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x3c]
imul ecx, dword [ebp - 0x4c]
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c8]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
add eax, edx
xor edx, edx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x4c8]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
cmp eax, 0x56a759f3
setge cl
or eax, 0xffffffff
mov dword [ebp - 0x588], ecx
lea ecx, [ebp - 0x31c]
mov dword [ebp - 4], eax
call fcn.10013552
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x508]
call fcn.100134ea
lea eax, [ebp - 0x10fc]
mov dword [ebp - 4], 0x15
movdqa xmm0, xmmword [0x10006600]
lea ecx, [ebp - 0x13d4]
push eax
lea eax, [ebp - 0x110c]
push eax
movdqu xmmword [ebp - 0x110c], xmm0
call fcn.10013569
lea ecx, [ebp - 0x157]
mov esi, eax
call fcn.10013566
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x724]
push dword [esi]
call fcn.1001352c
mov byte [ebp - 4], 0x16
mov eax, 0xffff
mov dword [ebp - 0x40], 0xe93d
mov dword [ebp - 0x28], 0x26a7609f
mov dword [ebp - 0x24], 0x86a67606
mov dword [ebp - 0x4c], 0xfaa0
mov dword [ebp - 0x8b8], eax
mov dword [ebp - 0x8b4], eax
mov dword [ebp - 0x8b0], eax
mov dword [ebp - 0x8ac], eax
xor eax, eax
mov dword [ebp - 0x3c], 0xae9140de
mov dword [ebp - 0x10], eax
jmp 0x1002adc1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x508]
call fcn.10013557
mov dword [eax], 0xcdbe8e56
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002adaa
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x724]
mov dword [ebp - 0x28], eax
push ebx
call fcn.10013557
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x508]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x8b8]
xor eax, eax
inc eax
push eax
call fcn.10013557
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x724]
dec dword [ebp - 0x24]
push ebx
call fcn.10013557
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x508]
neg esi
sbb esi, esi
xor eax, eax
push eax
neg esi
call fcn.10013557
mov ecx, dword [ebp - 0x8b8]
xor ebx, ebx
add ecx, esi
cmp dword [eax], ecx
lea ecx, [ebp - 0x508]
setle bl
xor esi, esi
push esi
call fcn.10013557
xor ecx, ecx
push esi
cmp dword [eax], ebx
setge cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x508]
call fcn.10013557
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x724]
push 3
setge dl
xor ebx, ebx
cmp dword [eax], edx
setge bl
call fcn.10013557
lea ecx, [ebp - 0x724]
mov dword [eax], ebx
call fcn.10013552
or ebx, 0xffffffff
lea ecx, [ebp - 0x508]
mov dword [ebp - 4], ebx
call fcn.10013552
mov dword [ebp - 0x38], 0x4e064826
lea ecx, [ebp - 0x1074]
mov dword [ebp - 0x18], ebx
push 4
mov dword [ebp - 0x10], 0xfffffff8
call fcn.100134ea
lea eax, [ebp - 0x12fc]
mov dword [ebp - 4], 0x17
movdqa xmm0, xmmword [0x10006680]
lea ecx, [ebp - 0x1454]
push eax
lea eax, [ebp - 0x130c]
push eax
movdqu xmmword [ebp - 0x130c], xmm0
call fcn.10013569
lea ecx, [ebp - 0x159]
mov esi, eax
call fcn.10013566
push eax
push dword [esi + 4]
push dword [esi]
lea ecx, [ebp - 0x1358]
call fcn.1001352c
push 3
lea ecx, [ebp - 0x9d8]
mov byte [ebp - 4], 0x18
call fcn.100134ea
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x24], 0xf3faa32f
xor ebx, ebx
mov dword [ebp - 0x18], eax
inc ebx
cmp dword [ebp - 0x18], 4
jge 0x1002af3d
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1074]
call fcn.10013557
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002af22
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002af65
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9d8]
call fcn.10013557
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002af46
xor eax, eax
mov dword [ebp - 0x18], 0x15
or esi, 0xffffffff
cmp dword [ebp - 0x18], ebx
jne 0x1002afd0
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x1c], 0x135
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002afa0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x16c4], 0x47dc4b4e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002af87
xor eax, eax
dec dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002afcb
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9d8]
call fcn.10013557
mov dword [eax], 0x5132d7af
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002afac
xor eax, eax
dec dword [ebp - 0x18]
jmp 0x1002af6f
mov dword [ebp - 0x24], 3
cmp dword [ebp - 0x24], eax
jl 0x1002b050
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x18], eax
jl 0x1002b031
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002affa
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002b026
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002b023
push eax
push eax
push 0x20d
push 0x523
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x1002afff
dec dword [ebp - 0x18]
jns 0x1002afe8
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002b04b
push eax
push eax
push 0x2458
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
dec dword [ebp - 0x24]
jns 0x1002afdc
lea ecx, [ebp - 0x9d8]
call fcn.10013552
lea ecx, [ebp - 0x1358]
call fcn.10013552
lea ecx, [ebp - 0x1074]
mov dword [ebp - 4], esi
call fcn.10013552
xor eax, eax
mov dword [ebp - 0x30], 0x4e064826
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002b09f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf04], 0x64dc9ed9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002b086
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002b0cb
mov dword [ebp - 0x3c], 0xffff
mov dword [ebp - 0x48], 0x9ee1c974
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0xefc], ecx
mov eax, dword [ebp - 0x30]
xor eax, eax
test ecx, ecx
setns al
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff9
jge 0x1002b0a4
mov dword [ebp - 0xf04], 0x37a5b7d8
lea ecx, [ebp - 0xd44]
push 2
call fcn.100134ea
mov dword [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002b11e
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd44]
call fcn.10013557
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002b103
xor eax, eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], eax
jl 0x1002b187
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x10], eax
jmp 0x1002b143
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8f0], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002b132
cmp dword [ebp - 0x8f0], 2
jbe 0x1002b167
push ebx
lea ecx, [ebp - 0xd44]
call fcn.10013557
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x8f0]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
neg eax
push 0
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x30]
pop eax
jns 0x1002b126
lea ecx, [ebp - 0xd44]
mov dword [ebp - 4], esi
call fcn.10013552
push 4
lea ecx, [ebp - 0xe4]
call fcn.100134ea
mov dword [ebp - 4], 0x1b
push 0xfffffffffffffffb
mov dword [ebp - 0x38], 0x98070ade
pop eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
jmp 0x1002b1d1
push dword [ebp - 0x10]
call fcn.10013557
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
lea ecx, [ebp - 0xe4]
jl 0x1002b1c0
push 2
call fcn.10013557
push 2
lea ecx, [ebp - 0xe4]
mov dword [eax], 9
call fcn.10013557
push 7
pop esi
jmp 0x1002b22f
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002b213
push 0x152d
push 0x180b
push eax
call edi
push 2
lea ecx, [ebp - 0xe4]
call fcn.10013557
push 2
lea ecx, [ebp - 0xe4]
dec dword [eax]
call fcn.10013557
cmp dword [eax], esi
jg 0x1002b1fc
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x1002b48a
jmp 0x1002b246
xor eax, eax
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x24], 0x3dc99cdf
push ebx
call fcn.100134ea
xor eax, eax
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002b288
push dword [ebp - 0x10]
lea ecx, [ebp - 0x450]
call fcn.10013557
mov dword [eax], 0xb4f5ac3d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002b26a
xor eax, eax
mov dword [ebp - 0x30], 3
cmp dword [ebp - 0x30], eax
jl 0x1002b46e
push ebx
lea ecx, [ebp - 0x82c]
call fcn.100134ea
mov byte [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x44], 0x1d4416da
mov dword [ebp - 0x10], eax
jmp 0x1002b2cd
push dword [ebp - 0x10]
lea ecx, [ebp - 0x82c]
call fcn.10013557
mov dword [eax], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002b2b6
push dword [ebp - 0x38]
lea ecx, [ebp - 0xe4]
call fcn.10013557
push dword [ebp - 0x30]
xor esi, esi
lea ecx, [ebp - 0xe4]
xor ebx, ebx
inc esi
cmp dword [eax], esi
setl bl
neg ebx
call fcn.10013557
mov dword [eax], ebx
test ebx, ebx
je 0x1002b3b6
push 3
pop eax
mov dword [ebp - 0x28], 4
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe38], eax
mov dword [ebp - 0xe34], eax
mov dword [ebp - 0xe30], eax
mov dword [ebp - 0xe2c], eax
or eax, 0xffffffff
mov dword [ebp - 0x4c], eax
push 2
call fcn.10013557
mov ecx, dword [ebp - 0x28]
xor ebx, ebx
push ebx
mov dword [eax], ecx
lea ecx, [ebp - 0x450]
dec dword [ebp - 0x4c]
call fcn.10013557
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xe4]
push 2
call fcn.10013557
push esi
lea ecx, [ebp - 0xe4]
call fcn.10013557
push ebx
lea ecx, [ebp - 0x450]
call fcn.10013557
mov ecx, dword [ebp - 0x24]
push ebx
mov esi, dword [eax]
sub esi, ecx
lea ecx, [ebp - 0xe4]
call fcn.10013557
mov edi, dword [ebp - 0x44]
lea ecx, [ebp - 0x82c]
add edi, esi
push ebx
imul edi, dword [eax]
mov dword [ebp - 0xe34], edi
call fcn.10013557
xor ecx, ecx
cmp edi, 0x4126315b
setg cl
mov dword [eax], ecx
jmp 0x1002b453
mov dword [ebp - 0x10], 0x4efc7101
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002b40a
push eax
lea ecx, [ebp - 0x450]
call fcn.10013557
lea ecx, [ebp - 0x82c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
xor eax, eax
push eax
call fcn.10013557
mov edx, dword [ebp - 0x10]
mov esi, eax
mov ecx, dword [ebp - 0x24]
xor eax, eax
push dword [ebp - 0x30]
cmp ecx, edx
lea ecx, [ebp - 0xe4]
setne al
mov dword [esi], eax
call fcn.10013557
xor eax, eax
push eax
lea ecx, [ebp - 0x450]
call fcn.10013557
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
lea ecx, [ebp - 0x450]
setge dl
xor ebx, ebx
cmp edx, 0x486
setge bl
xor eax, eax
push eax
call fcn.10013557
push 2
lea ecx, [ebp - 0xe4]
mov dword [eax], ebx
call fcn.10013557
mov dword [eax], ebx
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], 0x1c
call fcn.10013552
dec dword [ebp - 0x30]
push 1
pop ebx
jns 0x1002b298
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x1b
call fcn.10013552
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jle 0x1002b244
or edi, 0xffffffff
lea ecx, [ebp - 0xe4]
mov dword [ebp - 4], edi
call fcn.10013552
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002b4b3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf18], 0x64dc9ed9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002b4a2
mov dword [ebp - 0x30], edi
lea ecx, [ebp - 0x9f0]
mov dword [ebp - 0x4c], 0xfffffffd
push 3
call fcn.100134ea
xor eax, eax
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x10], eax
jmp 0x1002b4ef
push dword [ebp - 0x10]
call fcn.10013557
mov dword [eax], 0x75d5f8d9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0x9f0]
jl 0x1002b4de
mov eax, dword [ebp - 0x30]
push ebx
call fcn.10013557
mov ecx, dword [ebp - 0x30]
mov esi, eax
xor eax, eax
cmp ecx, 0x2ae7
mov ecx, dword [ebp - 0x30]
setle al
xor edx, edx
cmp eax, ecx
setne dl
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4c]
imul ecx, edx, 0xffff
xor edx, edx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0xba29f583
setne al
xor edx, edx
imul eax, dword [ebp - 0x4c]
imul ecx, eax, 0xd329
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, edi
setne al
mov dword [esi], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002b56a
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
lea ecx, [ebp - 0x9f0]
mov dword [ebp - 4], edi
call fcn.10013552
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xfffffff9
jl 0x1002b9d8
push 2
lea ecx, [ebp - 0x4e4]
call fcn.100134ea
lea eax, [ebp - 0x111c]
mov dword [ebp - 4], 0x1f
movdqa xmm0, xmmword [0x10006600]
lea ecx, [ebp - 0x14a4]
push eax
lea eax, [ebp - 0x112c]
push eax
movdqu xmmword [ebp - 0x112c], xmm0
call fcn.10013569
lea ecx, [ebp - 0x17e]
mov esi, eax
call fcn.10013566
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x73c]
push dword [esi]
call fcn.1001352c
mov byte [ebp - 4], 0x20
mov eax, 0xffff
mov dword [ebp - 0x40], 0xe93d
mov dword [ebp - 0x28], 0x26a7609f
mov dword [ebp - 0x24], 0x86a67606
mov dword [ebp - 0x4c], 0xfaa0
mov dword [ebp - 0x8d0], eax
mov dword [ebp - 0x8cc], eax
mov dword [ebp - 0x8c8], eax
mov dword [ebp - 0x8c4], eax
xor eax, eax
mov dword [ebp - 0x3c], 0xae9140de
mov dword [ebp - 0x10], eax
jmp 0x1002b644
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4e4]
call fcn.10013557
mov dword [eax], 0xcdbe8e56
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002b62d
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x73c]
mov dword [ebp - 0x28], eax
push 2
call fcn.10013557
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x4e4]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x8d0]
push ebx
call fcn.10013557
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x73c]
dec dword [ebp - 0x24]
push 2
call fcn.10013557
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x4e4]
neg esi
sbb esi, esi
xor edi, edi
push edi
neg esi
call fcn.10013557
mov ecx, dword [ebp - 0x8d0]
xor ebx, ebx
add ecx, esi
push edi
cmp dword [eax], ecx
lea ecx, [ebp - 0x4e4]
setle bl
call fcn.10013557
xor ecx, ecx
push edi
cmp dword [eax], ebx
setge cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x4e4]
call fcn.10013557
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x73c]
push 3
setge dl
xor ebx, ebx
cmp dword [eax], edx
setge bl
call fcn.10013557
lea ecx, [ebp - 0x73c]
mov dword [eax], ebx
call fcn.10013552
or edi, 0xffffffff
lea ecx, [ebp - 0x4e4]
mov dword [ebp - 4], edi
call fcn.10013552
mov dword [ebp - 0x48], 0xffff
lea ecx, [ebp - 0x108c]
mov dword [ebp - 0x18], edi
push 4
mov dword [ebp - 0x10], 0xfffffff8
call fcn.100134ea
lea eax, [ebp - 0x121c]
mov dword [ebp - 4], 0x21
movdqa xmm0, xmmword [0x10006680]
lea ecx, [ebp - 0x14c4]
push eax
lea eax, [ebp - 0x122c]
push eax
movdqu xmmword [ebp - 0x122c], xmm0
call fcn.10013569
lea ecx, [ebp - 0x180]
mov esi, eax
call fcn.10013566
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x13b8]
push dword [esi]
call fcn.1001352c
push 3
lea ecx, [ebp - 0xc30]
mov byte [ebp - 4], 0x22
call fcn.100134ea
mov byte [ebp - 4], 0x23
xor eax, eax
mov dword [ebp - 0x24], 0xf3faa32f
xor ebx, ebx
mov dword [ebp - 0x18], eax
inc ebx
cmp dword [ebp - 0x18], 4
jge 0x1002b7be
push dword [ebp - 0x18]
lea ecx, [ebp - 0x108c]
call fcn.10013557
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002b7a3
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002b7e6
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc30]
call fcn.10013557
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002b7c7
xor eax, eax
mov dword [ebp - 0x18], 0x15
jmp 0x1002b849
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x1c], 0x135
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002b81b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1604], 0x47dc4b4e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002b802
xor eax, eax
dec dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002b846
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xc30]
call fcn.10013557
mov dword [eax], 0x5132d7af
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002b827
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
je 0x1002b7ef
mov dword [ebp - 0x24], 3
cmp dword [ebp - 0x24], eax
jl 0x1002b8ce
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x18], eax
jl 0x1002b8af
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002b878
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002b8a4
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002b8a1
push eax
push eax
push 0x20d
push 0x523
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x1002b87d
dec dword [ebp - 0x18]
jns 0x1002b866
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002b8c9
push eax
push eax
push 0x2458
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
dec dword [ebp - 0x24]
jns 0x1002b85a
lea ecx, [ebp - 0xc30]
call fcn.10013552
lea ecx, [ebp - 0x13b8]
call fcn.10013552
lea ecx, [ebp - 0x108c]
mov dword [ebp - 4], edi
call fcn.10013552
mov dword [ebp - 0x3c], 0x9ee1c974
lea ecx, [ebp - 0xa08]
push 2
call fcn.100134ea
mov dword [ebp - 4], 0x24
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002b93c
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa08]
call fcn.10013557
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002b921
xor eax, eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], eax
jl 0x1002b9a5
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x10], eax
jmp 0x1002b961
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8c0], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002b950
cmp dword [ebp - 0x8c0], 2
jbe 0x1002b985
push ebx
lea ecx, [ebp - 0xa08]
call fcn.10013557
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x8c0]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
neg eax
push 0
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x30]
pop eax
jns 0x1002b944
lea ecx, [ebp - 0xa08]
mov dword [ebp - 4], edi
call fcn.10013552
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0xf10], ecx
mov eax, dword [ebp - 0x38]
xor eax, eax
test ecx, ecx
setns al
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff9
jge 0x1002b587
xor eax, eax
mov dword [ebp - 0x40], 0xa53d06ce
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002b9f3
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002ba0a
push 0x4d7
push eax
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
xor eax, eax
mov dword [ebp - 0xf18], 0x37a5b7d8
mov dword [ebp - 0x30], 0x4e064826
push 3
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x1002ba3e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10a4], 0x64dc9ed9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002ba26
xor eax, eax
mov dword [ebp - 0x30], eax
mov esi, 0xffff
cmp dword [ebp - 0x30], 0xfffffff9
jl 0x1002ba77
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x48], 0x9ee1c974
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x109c], ecx
mov eax, dword [ebp - 0x30]
xor eax, eax
test ecx, ecx
setns al
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff9
jge 0x1002ba4c
xor eax, eax
mov dword [ebp - 0x10a4], 0x37a5b7d8
mov dword [ebp - 0x30], 0x4e064826
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002baa8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe94], 0x64dc9ed9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002ba90
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002bad0
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x48], 0x9ee1c974
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0xe8c], ecx
mov eax, dword [ebp - 0x30]
xor eax, eax
test ecx, ecx
setns al
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff9
jge 0x1002baad
movdqa xmm0, xmmword [0x10006620]
lea eax, [ebp - 0x113c]
push eax
lea eax, [ebp - 0x114c]
mov dword [ebp - 0xe94], 0x37a5b7d8
push eax
lea ecx, [ebp - 0x15c4]
movdqu xmmword [ebp - 0x114c], xmm0
call fcn.10013569
lea ecx, [ebp - 0x152]
mov esi, eax
call fcn.10013566
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x268]
push dword [esi]
call fcn.1001352c
mov dword [ebp - 4], 0x25
lea ecx, [ebp - 0xda4]
mov dword [ebp - 0x38], 0x8047d203
xor eax, eax
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x4c], eax
push 4
call fcn.100134ea
xor eax, eax
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x10], eax
jmp 0x1002bb6c
push dword [ebp - 0x10]
lea ecx, [ebp - 0xda4]
call fcn.10013557
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002bb59
push 3
lea ecx, [ebp - 0x268]
call fcn.10013557
cmp dword [eax], 0xd5e16b79
jle 0x1002bbe0
push 3
lea ecx, [ebp - 0x268]
call fcn.10013557
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x268]
push 3
call fcn.10013557
push 3
lea ecx, [ebp - 0x268]
call fcn.10013557
push ebx
lea ecx, [ebp - 0x268]
mov esi, eax
call fcn.10013557
mov ecx, dword [esi]
imul ecx, dword [eax]
xor eax, eax
cmp ecx, 0x9cf3
setg al
imul eax, eax, 0x9ca3
cmp eax, 0xfffe
je 0x1002bbe0
xor eax, eax
jmp 0x1002bbe2
mov eax, ebx
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x268]
mov eax, dword [ebp - 0x38]
push 3
call fcn.10013557
push 3
lea ecx, [ebp - 0x268]
call fcn.10013557
push 2
lea ecx, [ebp - 0x268]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
call fcn.10013557
mov ecx, dword [ebp - 0x4c]
sub ecx, dword [eax]
xor eax, eax
cmp ecx, 8
setg al
xor ebx, ebx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
lea ecx, [ebp - 0xda4]
setge bl
xor edi, edi
inc edi
push edi
call fcn.10013557
xor edx, edx
mov dword [eax], ebx
mov eax, dword [ebp - 0x38]
cmp eax, ebx
mov eax, dword [ebp - 0x38]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xda4]
call fcn.10013552
or ebx, 0xffffffff
lea ecx, [ebp - 0x268]
mov dword [ebp - 4], ebx
call fcn.10013552
movdqa xmm0, xmmword [0x10006620]
lea eax, [ebp - 0x129c]
push eax
lea eax, [ebp - 0x12ac]
push eax
lea ecx, [ebp - 0x140c]
movdqu xmmword [ebp - 0x12ac], xmm0
call fcn.10013569
lea ecx, [ebp - 0x15f]
mov esi, eax
call fcn.10013566
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x28c]
push dword [esi]
call fcn.1001352c
mov dword [ebp - 4], 0x27
lea ecx, [ebp - 0xa20]
mov dword [ebp - 0x38], 0x8047d203
xor eax, eax
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x4c], eax
push 4
call fcn.100134ea
xor eax, eax
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x10], eax
jmp 0x1002bd01
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa20]
call fcn.10013557
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002bcee
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x28c]
call fcn.10013557
cmp dword [eax], 0xd5e16b79
jle 0x1002bd74
push ebx
lea ecx, [ebp - 0x28c]
call fcn.10013557
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x28c]
push ebx
call fcn.10013557
push ebx
lea ecx, [ebp - 0x28c]
call fcn.10013557
push edi
lea ecx, [ebp - 0x28c]
mov esi, eax
call fcn.10013557
mov ecx, dword [esi]
imul ecx, dword [eax]
xor eax, eax
cmp ecx, 0x9cf3
setg al
imul eax, eax, 0x9ca3
cmp eax, 0xfffe
je 0x1002bd74
xor eax, eax
jmp 0x1002bd76
mov eax, edi
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x28c]
mov eax, dword [ebp - 0x38]
push ebx
call fcn.10013557
push ebx
lea ecx, [ebp - 0x28c]
call fcn.10013557
push 2
lea ecx, [ebp - 0x28c]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
call fcn.10013557
mov ecx, dword [ebp - 0x4c]
push edi
sub ecx, dword [eax]
xor eax, eax
cmp ecx, 8
setg al
xor ebx, ebx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
lea ecx, [ebp - 0xa20]
setge bl
call fcn.10013557
xor edx, edx
mov dword [eax], ebx
mov eax, dword [ebp - 0x38]
cmp eax, ebx
mov eax, dword [ebp - 0x38]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xa20]
call fcn.10013552
or esi, 0xffffffff
lea ecx, [ebp - 0x28c]
mov dword [ebp - 4], esi
call fcn.10013552
mov edi, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
xor eax, eax
mov dword [ebp - 0x18], 0x5912491e
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], 0xb9a31c0a
mov dword [ebp - 0x3c], esi
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002be30
push eax
push eax
push eax
call edi
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x18]
test eax, eax
je 0x1002be3d
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ebx, ebx
mov eax, dword [ebp - 0x4c]
inc ebx
mov eax, dword [ebp - 0x24]
mov ecx, ebx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
sub ecx, eax
sub ecx, dword [ebp - 0x24]
neg ecx
movdqa xmm0, xmmword [0x10006620]
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x151c]
mov eax, dword [ebp - 0x28]
cmp esi, eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
neg eax
movdqu xmmword [ebp - 0x116c], xmm0
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x115c]
push eax
lea eax, [ebp - 0x116c]
push eax
call fcn.10013569
lea ecx, [ebp - 0x165]
mov esi, eax
call fcn.10013566
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x250]
push dword [esi]
call fcn.1001352c
mov dword [ebp - 4], 0x29
lea ecx, [ebp - 0xc48]
mov dword [ebp - 0x38], 0x8047d203
xor eax, eax
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x4c], eax
push 4
call fcn.100134ea
xor eax, eax
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002bf19
or edi, 0xffffffff
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc48]
call fcn.10013557
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002befa
mov edi, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push 3
lea ecx, [ebp - 0x250]
call fcn.10013557
cmp dword [eax], 0xd5e16b79
jle 0x1002bf8a
push 3
lea ecx, [ebp - 0x250]
call fcn.10013557
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x250]
push 3
call fcn.10013557
push 3
lea ecx, [ebp - 0x250]
call fcn.10013557
push ebx
lea ecx, [ebp - 0x250]
mov esi, eax
call fcn.10013557
mov ecx, dword [eax]
xor eax, eax
imul ecx, dword [esi]
cmp ecx, 0x9cf3
setg al
imul eax, eax, 0x9ca3
cmp eax, 0xfffe
je 0x1002bf8a
xor esi, esi
xor eax, eax
inc esi
jmp 0x1002bf8f
xor esi, esi
inc esi
mov eax, esi
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x250]
mov eax, dword [ebp - 0x38]
push 3
call fcn.10013557
push 3
lea ecx, [ebp - 0x250]
call fcn.10013557
push 2
lea ecx, [ebp - 0x250]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
call fcn.10013557
mov ecx, dword [ebp - 0x4c]
push esi
sub ecx, dword [eax]
xor eax, eax
cmp ecx, 8
setg al
xor ebx, ebx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
lea ecx, [ebp - 0xc48]
setge bl
call fcn.10013557
xor edx, edx
mov dword [eax], ebx
mov eax, dword [ebp - 0x38]
cmp eax, ebx
mov eax, dword [ebp - 0x38]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xc48]
call fcn.10013552
or ebx, 0xffffffff
lea ecx, [ebp - 0x250]
mov dword [ebp - 4], ebx
call fcn.10013552
mov dword [ebp - 0x4c], 0xfffd
xor eax, eax
mov dword [ebp - 0x24], 0x62e08974
mov dword [ebp - 0x28], 0xddbf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002c054
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x145c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002c03f
xor eax, eax
mov ebx, 0xc0001115
cmp dword [ebp - 0x4c], eax
je 0x1002c089
mov dword [ebp - 0x3c], 3
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
setg dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ebx, eax
sbb eax, eax
neg eax
or ebx, 0xffffffff
mov dword [ebp - 0x24], eax
jmp 0x1002c0cc
mov dword [ebp - 0x40], 0xe649
or ebx, 0xffffffff
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], 0xe0184dcc
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], 0x996a
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x10], eax
jmp 0x1002c0c3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x16e0], 0x5c2dd78f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002c0b2
dec dword [ebp - 0x28]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002c0e4
push 0x1083
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov dword [ebp - 0x18], 0x5912491e
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], 0xb9a31c0a
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002c109
push eax
push eax
push eax
call edi
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x18]
test eax, eax
je 0x1002c116
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, esi
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
sub ecx, eax
sub ecx, dword [ebp - 0x24]
neg ecx
push 4
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x468]
mov eax, dword [ebp - 0x28]
cmp ebx, eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
call fcn.100134ea
mov dword [ebp - 4], 0x2b
xor eax, eax
mov dword [ebp - 0x18], 0xb4c23afc
mov dword [ebp - 0x28], 0x2324
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002c196
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x161c], 0xec2e0cf5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002c17d
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002c1ac
push dword [ebp - 0x18]
call fcn.10013557
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
lea ecx, [ebp - 0x468]
jl 0x1002c19b
push 3
call fcn.10013557
xor ebx, ebx
lea ecx, [ebp - 0x468]
push 3
mov dword [eax], ebx
call fcn.10013557
cmp dword [eax], 2
jg 0x1002c214
xor eax, eax
mov dword [ebp - 0x4c], 6
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002c1ee
push 7
mov dword [ebp - 0x18], 0x15
pop eax
cmp dword [ebp - 0x18], eax
jle 0x1002c2e4