Function at 0x100303ab
Capabilities:
Accept command line arguments
Check os version
Clear file content
Create process on windows
Delete file
Enumerate files on windows
Get common file path
Get disk information
Get file attributes
Get file system object information
Identify system language via api
Parse pe header
Query environment variable
Query or enumerate registry key
Query service status
Suspend thread
Terminate process
Write and execute a file

Disassembly:
mov eax, 0x10082baa
call fcn.10081498
mov eax, 0x15e4
call fcn.1007c830
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_CharUpperW]
xor eax, eax
push 0xfffffffffffffffe
pop ebx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x6d], dl
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x1c], ebx
jmp 0x10030401
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x28], eax
jmp 0x100303f8
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x100303f5
push eax
call edi
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 7
jle 0x100303e7
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff8
je 0x100303db
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10030417
push eax
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push 2
pop esi
mov dword [ebp - 0x34], 0x6dd8d130
lea ecx, [ebp - 0x9b8]
mov dword [ebp - 0x24], ebx
push esi
call fcn.10017b45
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], eax
jmp 0x10030451
push dword [ebp - 0x28]
lea ecx, [ebp - 0x9b8]
call fcn.10017bb2
mov dword [eax], 5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1003043a
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x34]
jne 0x10030485
mov dword [ebp - 0x24], 1
jmp 0x1003050b
xor eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], esi
jge 0x100304aa
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x14a0], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10030495
xor eax, eax
inc eax
mov dword [ebp - 0x24], 0xffffffea
cmp dword [ebp - 0x24], 0xffffffea
je 0x10030505
mov dword [ebp - 0x3c], 0xc1d6
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], eax
jg 0x100304f9
push dword [ebp - 0x34]
lea ecx, [ebp - 0x9b8]
call fcn.10017bb2
push dword [ebp - 0x34]
lea ecx, [ebp - 0x9b8]
mov esi, eax
call fcn.10017bb2
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x3c]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 1
jle 0x100304c6
xor eax, eax
inc eax
xor ecx, ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffea
jne 0x100304b7
push 2
pop esi
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9b8]
call fcn.10017bad
xor eax, eax
lea ecx, [ebp - 0x2f0]
mov dword [ebp - 0x10], eax
push esi
call fcn.10017b45
mov dword [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x3c], 0xcc254292
mov dword [ebp - 0x38], 0x8cd54673
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10030576
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2f0]
call fcn.10017bb2
mov dword [eax], 0x4f01c089
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10030558
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x10030644
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2f0]
call fcn.10017bb2
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2f0]
call fcn.10017bb2
xor edi, edi
lea ecx, [ebp - 0x2f0]
inc edi
push edi
call fcn.10017bb2
xor ecx, ecx
cmp dword [eax], 0x5b64
setl cl
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x2f0]
push dword [ebp - 0x18]
call fcn.10017bb2
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2f0]
mov esi, eax
call fcn.10017bb2
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x2f0]
setl bl
xor eax, eax
push eax
call fcn.10017bb2
mov ecx, dword [ebp - 0x3c]
xor edx, edx
push dword [ebp - 0x18]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x2f0]
setle dl
sub ebx, edx
dec ebx
call fcn.10017bb2
push edi
lea ecx, [ebp - 0x2f0]
mov esi, dword [eax]
add esi, ebx
call fcn.10017bb2
xor ecx, ecx
cmp esi, dword [eax]
setge cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x10030583
mov edi, dword [sym.imp.USER32.dll_CharUpperW]
push 2
pop esi
push 0xfffffffffffffffe
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2f0]
call fcn.10017bad
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 0xfffffff8
push 3
pop ebx
jne 0x10030de8
jmp 0x10030668
push 3
pop ebx
push ebx
lea ecx, [ebp - 0xf70]
call fcn.10017b45
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x2c], 0x36432a27
mov dword [ebp - 0x2c], 0xf2000252
mov dword [ebp - 0x2c], 0x18795010
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x2c], 0xbd4dfbd6
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x100306d0
push dword [ebp - 0x30]
lea ecx, [ebp - 0xf70]
call fcn.10017bb2
mov dword [eax], 0x5bb2
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x100306b2
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x100306e6
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1580], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x100306d5
dec dword [ebp - 0x3c]
lea ecx, [ebp - 0xf70]
or dword [ebp - 4], 0xffffffff
call fcn.10017bad
mov dword [ebp - 0x20], 0xfffffff7
xor eax, eax
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10030730
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe7c], 0x4ec2e0cf
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10030717
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ebx
jg 0x10030917
xor ebx, ebx
lea ecx, [ebp - 0x480]
inc ebx
push ebx
call fcn.10017b45
push 3
pop ebx
xor eax, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1003077b
push dword [ebp - 0x28]
lea ecx, [ebp - 0x480]
call fcn.10017bb2
mov dword [eax], 0x532bb11a
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 1
jl 0x1003075c
xor eax, eax
push eax
lea ecx, [ebp - 0x480]
call fcn.10017bb2
and dword [eax], 0
jmp 0x100308de
xor eax, eax
mov dword [ebp - 0x1c], 0x25a80e35
push eax
lea ecx, [ebp - 0x480]
call fcn.10017bb2
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xe7c], 0
jne 0x100308f4
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x100308d0
push esi
lea ecx, [ebp - 0x540]
call fcn.10017b45
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x38], 0x75ee
mov dword [ebp - 0x28], eax
jmp 0x100307f8
push dword [ebp - 0x28]
call fcn.10017bb2
mov dword [eax], 0xc7af5af8
inc dword [ebp - 0x28]
lea ecx, [ebp - 0x540]
cmp dword [ebp - 0x28], esi
jl 0x100307e7
push 1
call fcn.10017bb2
xor ebx, ebx
lea ecx, [ebp - 0x540]
inc ebx
push ebx
and dword [eax], 0
call fcn.10017bb2
push 3
pop edi
jmp 0x10030856
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1003083c
push 0x21bf
push 0x760
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
push ebx
lea ecx, [ebp - 0x540]
call fcn.10017bb2
push ebx
lea ecx, [ebp - 0x540]
inc dword [eax]
call fcn.10017bb2
cmp dword [eax], edi
jle 0x10030821
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100308ac
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0xe7c], 0
jne 0x1003087a
push ebx
lea ecx, [ebp - 0x540]
call fcn.10017bb2
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x480]
mov eax, dword [ebp + eax*4 - 0xe7c]
xor eax, eax
push eax
call fcn.10017bb2
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xe7c]
cmp eax, 0x48b1
setne cl
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x10030861
push 3
pop ebx
lea ecx, [ebp - 0x540]
mov byte [ebp - 4], bl
call fcn.10017bad
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x100307c2
xor eax, eax
push eax
lea ecx, [ebp - 0x480]
call fcn.10017bb2
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x480]
push eax
call fcn.10017bb2
cmp dword [eax], ebx
jle 0x1003078f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x480]
call fcn.10017bad
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jle 0x1003073c
mov edi, dword [sym.imp.USER32.dll_CharUpperW]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1003092b
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 7
jg 0x10030ddb
jmp 0x1003093c
xor eax, eax
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x1c], 0x73d2d672
mov dword [ebp - 0x18], 0xf79facd4
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x13
jg 0x10030ba6
mov dword [ebp - 0x48], 0xfffffff8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x48], eax
jmp 0x1003097e
mov dword [ebp - 0x1c], 0x417be18
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xd
jl 0x10030974
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setg dl
xor ecx, ecx
sub edx, 0xd162
cmp edx, eax
setne cl
cmp ecx, 0xaafb
jge 0x100309b3
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0x534de6f8
mov eax, dword [ebp - 0x1c]
sub eax, 0xedad94e8
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], 0x6652d0da
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
dec eax
neg eax
sbb eax, eax
inc eax
cmp eax, 5
jbe 0x10030b8d
xor eax, eax
mov dword [ebp - 0x30], 0x2467468e
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x10030a1e
mov eax, dword [ebp - 0x28]
xor ebx, ebx
inc ebx
mov dword [ebp + eax*4 - 0x2d4], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10030a07
xor eax, eax
mov dword [ebp - 0x34], 9
jmp 0x10030b81
mov dword [ebp - 0x28], 0xbe663439
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10030a4a
cmp dword [ebp - 0x18], eax
jne 0x10030a4a
mov edx, eax
jmp 0x10030a4d
xor edx, edx
inc edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
inc eax
je 0x10030a6f
mov eax, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x44], 1
cmp dword [ebp - 0x40], eax
je 0x10030adc
mov dword [ebp - 0x3c], 0x58d4
xor edx, edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
xor edx, edx
mov eax, dword [ebp - 0x30]
inc ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
cmp eax, ebx
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
add edx, 0xdf54
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x18]
jg 0x10030adc
inc eax
cmp eax, dword [ebp - 0x28]
jl 0x10030aed
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10030aef
xor edx, edx
inc edx
jmp 0x10030af1
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x44]
jg 0x10030b1e
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10030b16
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 6
je 0x10030b0a
jmp 0x10030b7b
mov dword [ebp - 0x24], 0xfffffffe
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2d4]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
add eax, ecx
add edx, eax
xor eax, eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], eax
jmp 0x10030b76
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x2d4]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2d4], ecx
inc dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], eax
jle 0x10030b5d
dec dword [ebp - 0x34]
push 0
pop eax
cmp dword [ebp - 0x34], 0xffffffee
je 0x10030a2a
jmp 0x10030b94
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10030ba4
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x13
push 0
pop eax
jle 0x1003095e
xor eax, eax
mov byte [ebp - 0x11], al
lea ecx, [ebp - 0x9d0]
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
push eax
call fcn.10017b45
mov dword [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x38], 0xf4cc511e
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x10030bf3
push dword [ebp - 0x28]
lea ecx, [ebp - 0x9d0]
call fcn.10017bb2
mov dword [eax], 0x1c587c7a
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 1
jl 0x10030bd4
xor eax, eax
mov dword [ebp - 0x1c], 0x3342eb9
xor ebx, ebx
mov dword [ebp - 0x1c], eax
inc ebx
cmp dword [ebp - 0x1c], 0x22
jge 0x10030d2e
jmp 0x10030c0e
xor eax, eax
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10030c38
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x2e0], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10030c24
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10030c83
mov eax, dword [ebp - 0x2dc]
xor edx, edx
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [ebp - 0x2e0]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
lea ecx, [ebp - 0x9d0]
setge dl
xor eax, eax
mov dword [ebp - 0x3c], edx
mov esi, dword [ebp - 0x3c]
push eax
call fcn.10017bb2
mov dword [eax], esi
mov eax, dword [ebp - 0x44]
imul eax, esi
test eax, eax
je 0x10030c81
xor edx, edx
xor ebx, ebx
inc edx
inc ebx
jmp 0x10030c85
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x2e0]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x4129
je 0x10030ca8
cmp eax, dword [ebp - 0x2dc]
je 0x10030ce9
xor ebx, ebx
inc eax
inc ebx
cmp eax, dword [ebp - 0x2dc]
je 0x10030ce9
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 8
jl 0x10030d07
mov dword [ebp - 0x38], 0x8c84
cmp dword [ebp - 0x2e0], eax
jne 0x10030d07
push eax
lea ecx, [ebp - 0x9d0]
call fcn.10017bb2
push 0
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 8
pop eax
jge 0x10030cbb
jmp 0x10030d05
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10030cff
push eax
push 0x7d3
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10030d1e
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x22
push 2
pop esi
jl 0x10030c0c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9d0]
call fcn.10017bad
cmp byte [ebp - 0x11], 0
je 0x10030dce
mov dword [ebp - 0x38], 0xd41e
lea ecx, [ebp - 0xb4c]
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x2c], 0x2e08974b
mov dword [ebp - 0x2c], 0x3367f5ed
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], 0xfffffff9
push ebx
call fcn.10017b45
xor eax, eax
mov dword [ebp - 4], 6
mov dword [ebp - 0x28], eax
jmp 0x10030d9e
push dword [ebp - 0x28]
call fcn.10017bb2
or dword [eax], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 1
lea ecx, [ebp - 0xb4c]
jl 0x10030d90
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
xor eax, eax
push eax
call fcn.10017bb2
lea ecx, [ebp - 0xb4c]
dec dword [eax]
or dword [ebp - 4], 0xffffffff
call fcn.10017bad
xor eax, eax
push eax
call edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 7
jle 0x1003093a
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff8
je 0x10030665
mov dword [ebp - 0x28], 0x53b26bdd
lea ecx, [ebp - 0xb10]
push 0xfffffffffffffffe
pop esi
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [ebp - 0x3c], 0x256ee973
inc eax
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], eax
push eax
call fcn.10017b45
push 4
pop ebx
mov dword [ebp - 4], 7
lea ecx, [ebp - 0xc90]
mov dword [ebp - 0x3c], 0x324015fb
push ebx
call fcn.10017b45
push 9
mov byte [ebp - 4], 8
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10030e84
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb10]
call fcn.10017bb2
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10030e69
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10030ea7
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc90]
call fcn.10017bb2
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10030e8c
xor eax, eax
mov dword [ebp - 0x28], 6
cmp dword [ebp - 0x28], 0x11
jle 0x10030fc6
jmp 0x10030ebc
xor eax, eax
mov dword [ebp - 0x1c], 0x85b7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10030ee3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa70], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10030ecb
xor eax, eax
push eax
lea ecx, [ebp - 0xc90]
call fcn.10017bb2
mov ecx, dword [ebp - 0xa70]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
xor ecx, ecx
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0xa70]
cmp eax, 0xffffffff
setle cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
neg eax
cmp dword [ebp - 0x20], eax
jge 0x10030f2a
xor eax, eax
cmp dword [ebp - 0xa64], eax
jne 0x10030f2a
mov esi, eax
jmp 0x10030f2d
xor esi, esi
inc esi
dec dword [ebp - 0x1c]
lea ecx, [ebp - 0xb10]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
xor eax, eax
push eax
call fcn.10017bb2
mov ecx, dword [ebp - 0xa70]
xor edx, edx
cmp esi, ecx
setl dl
xor ebx, ebx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x28]
setne bl
xor ecx, ecx
cmp eax, 1
setg cl
xor edx, edx
sub ecx, ebx
imul eax, ecx, 0xfffe
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setg dl
xor ecx, ecx
cmp edx, 0x422f8dc7
setg cl
mov dword [ebp - 0xa64], ecx
mov eax, dword [ebp - 0x38]
add eax, ecx
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10030fb3
push eax
push 0x180f
push 0x26d7
push 0x21
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x11
push 4
pop ebx
jg 0x10030eba
push 0xfffffffffffffffe
pop esi
lea ecx, [ebp - 0xc90]
call fcn.10017bad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb10]
call fcn.10017bad
push 2
pop ebx
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0xf88]
push ebx
call fcn.10017b45
push 9
pop eax
mov dword [ebp - 4], eax
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1003101d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1164], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10031005
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10031036
push dword [ebp - 0x18]
lea ecx, [ebp - 0xf88]
call fcn.10017bb2
or dword [eax], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10031022
mov eax, dword [ebp - 0x115c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x1164], eax
jl 0x10031075
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100310ad
push 0x1f17
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
jmp 0x100310ad
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003108d
push eax
push 0x1381
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100310ad
push 0x2127
push 0x11ad
push eax
push 0x1f93
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf88]
call fcn.10017bad
xor eax, eax
lea ecx, [ebp - 0xfa0]
mov byte [ebp - 0x11], al
mov dword [ebp - 0x20], 0x5c8094a1
mov dword [ebp - 0x2c], 0xbca9d692
mov dword [ebp - 0x2c], 0x8815cbce
mov dword [ebp - 0x2c], 0x3a3fc4b0
mov dword [ebp - 0x2c], 0xaad9ddce
mov dword [ebp - 0x2c], 0x348cc383
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x2c], 1
push 4
call fcn.10017b45
xor eax, eax
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10031136
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14d0], 0xf9b3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003111e
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1003115b
push dword [ebp - 0x18]
lea ecx, [ebp - 0xfa0]
call fcn.10017bb2
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003113f
xor eax, eax
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], eax
jl 0x100311b9
push ebx
lea ecx, [ebp - 0x10d8]
call fcn.10017b45
mov byte [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x2c], 0x9ea7eb8e
mov dword [ebp - 0x3c], 0x42bbd4aa
mov dword [ebp - 0x10], eax
jmp 0x1003119d
push dword [ebp - 0x10]
call fcn.10017bb2
mov dword [eax], 0x4fe5f36f
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x10d8]
cmp dword [ebp - 0x10], ebx
jl 0x1003118c
inc dword [ebp - 0x3c]
mov byte [ebp - 4], 0xa
call fcn.10017bad
dec dword [ebp - 0x20]
jns 0x10031167
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfa0]
call fcn.10017bad
cmp byte [ebp - 0x11], 0
push 0xfffffffffffffffd
pop ecx
je 0x100312bd
mov dword [ebp - 0x40], 0xcba2afe0
xor eax, eax
mov dword [ebp - 0x20], 0x7045b365
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x40], eax
je 0x100311f0
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1003125c
xor ebx, ebx
inc ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], 0x13
jmp 0x10031254
xor eax, eax
mov dword [ebp - 0x3c], 0x246
cmp dword [ebp - 0x40], eax
je 0x10031232
mov dword [ebp - 0x3c], 0xe65251c6
cmp dword [ebp - 0x3c], eax
je 0x10031232
cmp dword [ebp - 0x10], eax
je 0x10031232
inc eax
neg eax
jne 0x10031241
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x10031241
mov edx, eax
jmp 0x10031244
xor edx, edx
inc edx
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xffffffec
jne 0x10031212
jmp 0x100312b1
mov dword [ebp - 0x10], ecx
xor edx, edx
mov dword [ebp - 0x3c], 0x9efec1a2
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ebx, ebx
cmp edx, 0xffffffff
setl bl
xor ecx, ecx
cmp eax, 0x45c2
setl cl
sub ecx, ebx
sub ecx, dword [ebp - 0x10]
sub ecx, 0x2908cdac
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push 2
pop ebx
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], esi
jmp 0x100312ed
mov dword [ebp - 0x10], 0xfffffff7
mov dword [ebp - 0x10], eax
jmp 0x100312e4
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100312e1
push eax
call edi
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 7
jle 0x100312d3
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff8
je 0x100312c7
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031305
push eax
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], esi
jmp 0x10031333
mov dword [ebp - 0x10], 0xfffffff7
mov dword [ebp - 0x10], eax
jmp 0x1003132a
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031327
push eax
call edi
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 7
jle 0x10031319
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff8
je 0x1003130d
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031349
push eax
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor eax, eax
mov edx, 0xda115252
mov dword [ebp - 0x2c], edx
inc eax
mov dword [ebp - 0x2c], eax
mov esi, 0x45307222
mov dword [ebp - 0x2c], esi
mov edi, 0xf23b1a95
mov dword [ebp - 0x2c], edi
xor ecx, ecx
mov dword [ebp - 0x2c], 0xcddd1d8f
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x3c], 0x1fcc8af9
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100313b0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1460], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10031398
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100313d2
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x18]
push 2
mov dword [ebp + eax*4 - 0x1470], ebx
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x100313bb
push eax
pop ebx
inc dword [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x2c], edx
inc eax
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], 0xcddd1d8f
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x3c], 0x1fcc8af9
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003142d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14c0], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10031415
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003144f
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x18]
push 2
mov dword [ebp + eax*4 - 0x1420], ebx
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x10031438
jmp 0x10031452
xor ebx, ebx
inc ebx
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0x7b8]
mov dword [ebp - 0x28], 0xa48bbca6
push ebx
call fcn.10017b45
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10031499
push dword [ebp - 0x18]
lea ecx, [ebp - 0x7b8]
call fcn.10017bb2
mov dword [eax], 0xb3e90a62
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1003147a
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jge 0x100314bc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xff0], 0xb9ae77ab
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100314a4
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_SetMenuItemInfoW]
mov dword [ebp - 0x28], 0xffffffff
cmp dword [ebp - 0x28], 0xffffffea
jg 0x10031507
jmp 0x100314d3
xor eax, eax
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x7b8]
push eax
call fcn.10017bb2
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0xfec], esi
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100314fe
push eax
push eax
push 0x25e2
push eax
call edi
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffea
jle 0x100314d1
xor eax, eax
lea ecx, [ebp - 0x7b8]
push eax
call fcn.10017bb2
mov esi, eax
lea ecx, [ebp - 0x7b8]
xor eax, eax
push eax
call fcn.10017bb2
mov ecx, dword [esi]
or dword [ebp - 4], 0xffffffff
mov dword [eax], ecx
lea ecx, [ebp - 0x7b8]
call fcn.10017bad
mov dword [ebp - 0x2c], 0xda115252
xor eax, eax
inc eax
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0x45307222
mov dword [ebp - 0x2c], 0xf23b1a95
mov dword [ebp - 0x2c], 0xcddd1d8f
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x3c], 0x1fcc8af9
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003159c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14f0], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10031584
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100315be
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x18]
push 2
mov dword [ebp + eax*4 - 0x1480], ebx
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x100315a7
jmp 0x100315c1
xor ebx, ebx
inc ebx
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0x160]
push ebx
call fcn.10017b45
mov dword [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x24], 0xd329b3a0
inc eax
mov dword [ebp - 0x7ac], eax
mov dword [ebp - 0x7a8], eax
mov dword [ebp - 0x7a4], eax
mov dword [ebp - 0x7a0], eax
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x2c], 0x8dbe583c
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], eax
jge 0x10031645
push dword [ebp - 0x18]
lea ecx, [ebp - 0x160]
call fcn.10017bb2
mov dword [eax], 0x532bb11a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10031628
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10031669
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1364], 0xa2b617f2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10031650
xor eax, eax
push eax
lea ecx, [ebp - 0x160]
call fcn.10017bb2
xor eax, eax
lea ecx, [ebp - 0x160]
push eax
call fcn.10017bb2
mov esi, eax
lea ecx, [ebp - 0x160]
xor eax, eax
push eax
call fcn.10017bb2
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x160]
setle bl
xor eax, eax
push eax
call fcn.10017bb2
xor ecx, ecx
cmp ebx, dword [eax]
setl cl
sub ecx, 0x9dbe
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x160]
push eax
call fcn.10017bb2
mov ecx, dword [ebp - 0x38]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x160]
sete bl
xor eax, eax
push eax
sub ebx, 0x7f2be925
call fcn.10017bb2
xor ecx, ecx
cmp ebx, dword [eax]
setg cl
cmp ecx, 0xf495e3b3
lea ecx, [ebp - 0x160]
sbb eax, eax
xor ebx, ebx
neg eax
cmp eax, 0xa29f
setle bl
xor eax, eax
push eax
call fcn.10017bb2
mov dword [eax], ebx
cmp ebx, dword [ebp - 0x24]
jle 0x10031729
xor eax, eax
lea ecx, [ebp - 0x160]
push eax
call fcn.10017bb2
xor eax, eax
lea ecx, [ebp - 0x160]
push eax
call fcn.10017bb2
mov ecx, dword [ebp - 0x24]
mov esi, 0xfffc
cmp dword [eax], ecx
jne 0x1003176e
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10031764
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031761
push 0x658
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1003174a
jmp 0x10031803
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffff
push eax
lea ecx, [ebp - 0x160]
call fcn.10017bb2
cmp dword [eax], 0
jne 0x1003179c
xor eax, eax
lea ecx, [ebp - 0x160]
push eax
call fcn.10017bb2
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x7a8]
lea ecx, [ebp - 0x160]
cmp dword [ebp - 0x1c], 0xbd3d38e2
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x7a4]
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
cmp eax, 0xdad24015
setne bl
xor eax, eax
push eax
call fcn.10017bb2
mov dword [eax], ebx
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x7a8]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], esi
jb 0x100317ee
cmp dword [ebp - 0x1c], eax
je 0x100317ee
inc eax
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
add edx, eax
mov eax, dword [ebp - 0x7ac]
cmp edx, eax
setg cl
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x135c]
lea ecx, [ebp - 0x160]
or dword [ebp - 4], 0xffffffff
call fcn.10017bad
xor ebx, ebx
mov dword [ebp - 0x28], 0xa48bbca6
inc ebx
lea ecx, [ebp - 0x700]
push ebx
call fcn.10017b45
xor eax, eax
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003185e
push dword [ebp - 0x18]
lea ecx, [ebp - 0x700]
call fcn.10017bb2
mov dword [eax], 0xb3e90a62
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1003183f
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10031881
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xee4], 0xb9ae77ab
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10031869
xor eax, eax
mov dword [ebp - 0x28], 0xffffffff
cmp dword [ebp - 0x28], 0xffffffea
jg 0x100318c6
jmp 0x10031892
xor eax, eax
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x700]
push eax
call fcn.10017bb2
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0xee0], esi
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100318bd
push eax
push eax
push 0x25e2
push eax
call edi
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffea
jle 0x10031890
xor eax, eax
lea ecx, [ebp - 0x700]
push eax
call fcn.10017bb2
mov esi, eax
lea ecx, [ebp - 0x700]
xor eax, eax
push eax
call fcn.10017bb2
mov ecx, dword [esi]
or dword [ebp - 4], 0xffffffff
mov dword [eax], ecx
lea ecx, [ebp - 0x700]
call fcn.10017bad
xor ebx, ebx
mov dword [ebp - 0x28], 0xa48bbca6
inc ebx
lea ecx, [ebp - 0x784]
push ebx
call fcn.10017b45
xor eax, eax
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003193d
push dword [ebp - 0x18]
lea ecx, [ebp - 0x784]
call fcn.10017bb2
mov dword [eax], 0xb3e90a62
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1003191e
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10031960
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1088], 0xb9ae77ab
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10031948
xor eax, eax
mov dword [ebp - 0x28], 0xffffffff
cmp dword [ebp - 0x28], 0xffffffea
jg 0x100319a5
jmp 0x10031971
xor eax, eax
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x784]
push eax
call fcn.10017bb2
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x1084], esi
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003199c
push eax
push eax
push 0x25e2
push eax
call edi
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffea
jle 0x1003196f
xor eax, eax
lea ecx, [ebp - 0x784]
push eax
call fcn.10017bb2
mov esi, eax
lea ecx, [ebp - 0x784]
xor eax, eax
push eax
call fcn.10017bb2
mov ecx, dword [esi]
or dword [ebp - 4], 0xffffffff
mov dword [eax], ecx
lea ecx, [ebp - 0x784]
call fcn.10017bad
push 2
pop edi
push 3
pop ebx
mov dword [ebp - 0x20], 0xea75c96d
lea ecx, [ebp - 0x5bc]
mov dword [ebp - 0x10], edi
push ebx
call fcn.10017b45
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10031a28
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5bc]
call fcn.10017bb2
mov dword [eax], 0x440874b2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10031a0a
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031a48
push 1
push eax
push 0x198d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe3
jge 0x10031b37
jmp 0x10031a59
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10031a6b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3fc], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10031a5e
mov eax, dword [ebp - 0x3f4]
lea ecx, [ebp - 0x5bc]
xor esi, esi
mov dword [ebp - 0x10], eax
inc esi
push esi
call fcn.10017bb2
mov ecx, dword [ebp - 0x3f4]
xor ebx, ebx
push esi
sub ecx, dword [eax]
mov eax, dword [ebp - 0x3fc]
cmp ecx, eax
lea ecx, [ebp - 0x5bc]
setg bl
call fcn.10017bb2
mov ecx, dword [ebp - 0x3fc]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0x5bc]
push esi
setne dl
imul edx, dword [eax]
sub edx, 0x2c8c118a
mov dword [ebp - 0x38], edx
call fcn.10017bb2
xor ecx, ecx
push esi
cmp dword [eax], ecx
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x38]
lea ecx, [ebp - 0x5bc]
setne al
mov dword [ebp - 0x3c], eax
call fcn.10017bb2
mov esi, dword [ebp - 0x3f8]
mov edi, eax
mov ecx, dword [ebp - 0x3f4]
xor eax, eax
mov edx, dword [ebp - 0x3f4]
imul esi, ecx
mov ecx, dword [ebp - 0x3c]
imul ecx, dword [ebp - 0x10]
push 3
pop ebx
imul edx, esi
imul ecx, edx
cmp ecx, dword [edi]
setl al
add eax, eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3f4], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe3
jl 0x10031a57
push 2
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5bc]
call fcn.10017bad
xor eax, eax
lea ecx, [ebp - 0xe10]
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x3c], 0x2c4475ee
push ebx
call fcn.10017b45
mov dword [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10031b95
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x718], 0xec2e0cf5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10031b7d
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10031bbb
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe10]
call fcn.10017bb2
mov dword [eax], 0x34859bb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10031b9d
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10031bdf
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031bdc
push 0x2aa
push 0x1acc
push eax
call dword [sym.imp.GDI32.dll_PtInRegion]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x10031bc0
mov eax, dword [ebp - 0x710]
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x718]
cmp ecx, eax
mov ecx, dword [ebp - 0x710]
mov eax, dword [ebp - 0x710]
setne dl
add ecx, edx
xor ebx, ebx
cmp eax, ecx
lea ecx, [ebp - 0xe10]
push edi
setl bl
call fcn.10017bb2
mov edx, dword [ebp - 0x1c]
mov esi, eax
mov ecx, dword [ebp - 0x1c]
xor eax, eax
cmp edx, ecx
setl al
xor ecx, ecx
add eax, 0xd8b9
cmp eax, ebx
setne cl
xor edx, edx
mov dword [esi], ecx
imul ecx, dword [ebp - 0x20], 0x26c7
mov eax, dword [ebp - 0x710]
cmp ecx, eax
lea ecx, [ebp - 0xe10]
setge dl
mov dword [ebp - 0x38], edx
or dword [ebp - 4], 0xffffffff
call fcn.10017bad
mov dword [ebp - 0x2c], 0xda115252
xor eax, eax
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x10031ca0
mov eax, dword [ebp - 0x10]
xor ebx, ebx
inc ebx
mov dword [ebp + eax*4 - 0x79c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10031c89
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10031cc2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x79c], 0x70bb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10031ca9
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff5
cmp dword [ebp - 0x18], 0xffffffeb
jne 0x10031d20
xor ebx, ebx
inc ebx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031cf8
push 0x1c25
push 0xa61
push 0xca8
push 0x7cf
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031d17
push ebx
push eax
push 0x198d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffeb
je 0x10031cd2
push edi
lea ecx, [ebp - 0x11a0]
call fcn.10017b45
xor eax, eax
mov dword [ebp - 4], 0x12
movdqa xmm0, xmmword [0x100080a0]
lea ecx, [ebp - 0x1410]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1214]
push eax
lea eax, [ebp - 0x1224]
push eax
movdqu xmmword [ebp - 0x1224], xmm0
call fcn.10017bc4
lea ecx, [ebp - 0x2b1]
mov esi, eax
call fcn.10017bc1
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x13b8]
push dword [esi]
call fcn.10017b87
xor eax, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10031dab
push dword [ebp - 0x10]
lea ecx, [ebp - 0x11a0]
call fcn.10017bb2
mov dword [eax], 0xd3df
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10031d8d
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10031dd0
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031dcd
push 0xd42
push eax
push 0xf84
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jle 0x10031db0
lea ecx, [ebp - 0x13b8]
call fcn.10017bad
or edi, 0xffffffff
lea ecx, [ebp - 0x11a0]
mov dword [ebp - 4], edi
call fcn.10017bad
xor ebx, ebx
lea ecx, [ebp - 0xb28]
inc ebx
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], 0xb6318d58
mov dword [ebp - 0x28], 0x4ccb63e
mov dword [ebp - 0x24], eax
push 4
call fcn.10017b45
mov dword [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], 0xe5f0e77d
mov dword [ebp - 0x10], eax
jmp 0x10031e43
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb28]
call fcn.10017bb2
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10031e30
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10031f17
cmp dword [ebp - 0x24], eax
jne 0x10031e68
cmp dword [ebp - 0x1c], eax
jne 0x10031e68
mov ecx, eax
jmp 0x10031e6b
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x24]
imul eax, ecx
test eax, eax
jne 0x10031e7e
cmp dword [ebp - 0x24], eax
jne 0x10031e7e
mov ecx, eax
jmp 0x10031e81
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setge cl
xor edx, edx
cmp ecx, 0x2324015f
setl dl
add eax, 0xfffffffa
add eax, edx
jne 0x10031eb3
cmp dword [ebp - 0x24], eax
jne 0x10031eb3
mov edx, eax
jmp 0x10031eb6
xor edx, edx
inc edx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setle cl
xor ebx, ebx
mov dword [ebp - 0x28], ecx
inc ebx
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xb28]
cmp ebx, eax
sbb esi, esi
neg esi
sub esi, dword [ebp - 0x24]
neg esi
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.10017bb2
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
cmp esi, eax
setle dl
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xf944
setle al
cmp dword [ebp - 0x24], eax
jg 0x10031f17
xor eax, eax
jmp 0x10031f1a
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x38]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xb28]
setg dl
sub eax, edx
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], edi
call fcn.10017bad
lea eax, [ebp - 0x12d4]
mov dword [ebp - 0x2c], 0x45307222
push eax
lea eax, [ebp - 0x12e4]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x1418]
movdqu xmmword [ebp - 0x12e4], xmm0
call fcn.10017bc4
lea ecx, [ebp - 0x2e1]
mov esi, eax
call fcn.10017bc1
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x208]
push dword [esi]
call fcn.10017b87
mov dword [ebp - 4], 0x15
lea ecx, [ebp - 0x208]
xor eax, eax
mov dword [ebp - 0x20], 0xdcefbde2
push eax
mov dword [ebp - 0x3c], 0x4ba09a16
call fcn.10017bb2
and dword [eax], 0
jmp 0x100320cd
xor eax, eax
xor ebx, ebx
inc eax
mov dword [ebp - 0x30], eax
push 3
mov dword [ebp - 0x10], 0x74a71a6e
pop esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x3c], eax
push esi
mov dword [ebp - 0x38], 0x607dbc15
call fcn.10017bb2
cmp dword [eax], ebx
je 0x10031fed
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
lea ecx, [ebp - 0x208]
setne dl
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
xor eax, eax
push eax
call fcn.10017bb2
mov ecx, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
neg ecx
cmp ecx, dword [eax]
jg 0x10032033
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x208]
push esi
call fcn.10017bb2
xor eax, eax
lea ecx, [ebp - 0x208]
push eax
call fcn.10017bb2
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x28], 1
jl 0x10032062
mov eax, dword [ebp - 0x30]
push esi
lea ecx, [ebp - 0x208]
call fcn.10017bb2
mov esi, eax
lea ecx, [ebp - 0x208]
xor eax, eax
push eax
call fcn.10017bb2
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x208]
setne dl
xor eax, eax
sub edx, 0xfff8
mov dword [ebp - 0x3c], edx
push eax
call fcn.10017bb2
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp ecx, dword [eax]
setg dl
xor eax, eax
mov dword [ebp - 0x38], edx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100320bf
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
xor eax, eax
push eax
lea ecx, [ebp - 0x208]
call fcn.10017bb2
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x208]
push eax
call fcn.10017bb2
lea ecx, [ebp - 0x208]
cmp dword [eax], 0x1a
jg 0x10031fbb
mov dword [ebp - 4], edi
call fcn.10017bad
mov dword [ebp - 0x2c], 0xf23b1a95
xor eax, eax
mov dword [ebp - 0x2c], 0xeac8
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10032112
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032131
push 0x1dbc
push eax
push eax
push eax
push 0x1862
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor eax, eax
mov dword [ebp - 0x2c], 0xcddd1d8f
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x3c], 1
push 2
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x10032165
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xab8], 0x7941ce3c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003214d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x10
jne 0x1003221d
xor ebx, ebx
inc ebx
mov dword [ebp - 0x20], 0x5c1d1022
lea ecx, [ebp - 0xca8]
push esi
call fcn.10017b45
mov dword [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x10], eax
jmp 0x100321ae
push dword [ebp - 0x10]
call fcn.10017bb2
mov dword [eax], 0x694d2b5f
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xca8]
cmp dword [ebp - 0x10], esi
jl 0x1003219d
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10017bb2
mov dword [eax], ebx
mov eax, dword [ebp - 0xab4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xab4]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x1c], 0xe4d8d955
jne 0x100321f7
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100321fd
xor eax, eax
xor ebx, ebx
inc eax
inc ebx
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0xca8]
mov dword [ebp - 4], edi
call fcn.10017bad
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x10
je 0x10032175
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
inc eax
push 8
pop ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0xe5c], eax
mov dword [ebp - 0xe58], eax
mov dword [ebp - 0xe54], eax
mov dword [ebp - 0xe50], eax
mov dword [ebp - 0x3c], 0xfffffff6
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x40], 0xfffffffc
cmp dword [ebp - 0x40], 0xffffffe2
jge 0x100323a0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10032285
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xaa0], 0x76eea530
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003226d
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003229f
push eax
push eax
push 0x11e4
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10032333
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x38], 0x2d3f
mov dword [ebp - 0x3c], 0xd393e75c
mov dword [ebp - 0x10], eax
jmp 0x100322d3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa20], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100322c2
mov eax, dword [ebp - 0xa20]
xor ebx, ebx
mov eax, dword [ebp - 0xaa0]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x3c], 4
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xa20]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setne bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x3c]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0xaa0], ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10032390
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10032390
push esi
lea ecx, [ebp - 0xb40]
call fcn.10017b45
xor eax, eax
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003236e
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb40]
call fcn.10017bb2
mov dword [eax], 0xb445acee
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10032350
xor eax, eax
push eax
lea ecx, [ebp - 0xb40]
call fcn.10017bb2
lea ecx, [ebp - 0xb40]
inc dword [eax]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
call fcn.10017bad
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xffffffe2
jl 0x10032260
push 8
pop ebx
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x100323ca
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x40]
je 0x100323c8
xor edi, edi
inc edi
mov eax, edi
jmp 0x100323cd
xor eax, eax
xor edi, edi
inc edi
mov dword [ebp - 0xe54], eax
xor ecx, ecx
mov dword [ebp - 0x3c], edi
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x40]
add edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
cmp edx, eax
push 9
setne cl
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x2c], ebx
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x6c0f1a01
mov dword [ebp - 0x38], 0xc7e7c0ce
mov dword [ebp - 0x2c], ebx
push 3
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jge 0x1003242b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9e8], 0x85f70ad6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10032413
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1003244b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf0], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10032433
xor eax, eax
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x30], eax
jl 0x1003252c
mov dword [ebp - 0x10], eax
jmp 0x1003246d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x98], 0x69bd697e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003245c
mov eax, dword [ebp - 0x98]
mov edx, 0xc8748afa
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x30]
push 0
mov ecx, dword [ebp + eax*4 - 0x9e8]
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x9e8], ecx
xor eax, eax
cmp ecx, 0x58a8
setge al
sub edx, eax
mov eax, dword [ebp - 0x98]
sub eax, 0xf6285890
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 9
setne cl
xor eax, eax
cmp edx, ecx
setge al
xor edx, edx
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x9e8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x9e0]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xf0]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
pop eax
setl cl
add ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
dec dword [ebp - 0x30]
jns 0x10032457
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jg 0x1003263d
mov dword [ebp - 0x38], 0x49a2
lea ecx, [ebp - 0x904]
mov dword [ebp - 0x3c], 0xaf230988
push esi
call fcn.10017b45
xor eax, eax
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003257d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x904]
call fcn.10017bb2
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10032563
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10032617
mov eax, dword [ebp - 0xf0]
add eax, 0x5d5d
je 0x10032601
push ebx
lea ecx, [ebp - 0xa00]
call fcn.10017b45
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x10], eax
jmp 0x100325b7
push dword [ebp - 0x10]
call fcn.10017bb2
or dword [eax], 0xffffffff
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xa00]
cmp dword [ebp - 0x10], ebx
jl 0x100325a9
mov eax, dword [ebp - 0x1c]
push esi
call fcn.10017bb2
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0xa00]
push esi
call fcn.10017bb2
xor eax, eax
mov dword [ebp - 0x3c], edi
push eax
lea ecx, [ebp - 0x904]
call fcn.10017bb2
mov ecx, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x18
mov dword [eax], ecx
lea ecx, [ebp - 0xa00]
call fcn.10017bad
jmp 0x10032614
xor eax, eax
lea ecx, [ebp - 0x904]
push eax
call fcn.10017bb2
cmp dword [eax], 0
jne 0x10032620
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10032585
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x904]
call fcn.10017bad
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x10032538
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x1c], 0x1febaeef
mov dword [ebp - 0x2c], edi
push 4
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1003266d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa18], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10032659
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003268d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x13a0], 0x91208373
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10032675
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100326a3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa18], 0xfe6e3245
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10032692
mov eax, dword [ebp - 0xa10]
imul eax, dword [ebp - 0xa14], 0xfbc7
test eax, eax
je 0x100326c2
mov eax, dword [ebp - 0xa10]
mov eax, dword [ebp - 0xa0c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x139c], edi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0xfb0b0297
mov dword [ebp - 0x2c], 0xc0aa39ed
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x88eb9876
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10032714
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf30], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100326fc
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10032734
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1540], 0x8f3c34ee
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003271c
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10032766
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032763
push eax
push 0x3e4
push 0x1017
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x10032739
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0x48], 0x1fcc8af9
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x3c], 0xfffffff9
push edi
call fcn.10017b45
mov dword [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x20], eax
mov ecx, 0xffff
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], eax
jmp 0x100327b8
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb58]
call fcn.10017bb2
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100327a4
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0xa4df
setg cl
xor eax, eax
cmp ecx, 0x3cc92ea2
lea ecx, [ebp - 0xb58]
setne al
mov dword [ebp - 0x3c], eax
xor eax, eax
push eax
call fcn.10017bb2
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
test eax, eax
mov eax, dword [ebp - 0x24]
sets dl
xor ecx, ecx
cmp eax, 8
setge cl
sub ecx, edx
xor edx, edx
add ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, 0x62395e2d
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp dword [ebp - 0x24], ecx
jne 0x10032852
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003283a
push 0x199b
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100328d1
push 0x1cd
call dword [sym.imp.KERNEL32.dll_ExitThread]
push ebx
lea ecx, [ebp - 0xd68]
call fcn.10017b45
mov byte [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x2c], 0x3bd3e018
mov dword [ebp - 0x2c], 0xcfd8f271
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10032898
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd68]
call fcn.10017bb2
mov dword [eax], 0x1ba8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003287a
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x100328c3
jmp 0x100328a4
xor eax, eax
mov dword [ebp - 0x2c], 4
lea ecx, [ebp - 0xd68]
push eax
call fcn.10017bb2
dec dword [eax]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x100328a2
inc dword [ebp - 0x28]
lea ecx, [ebp - 0xd68]
call fcn.10017bad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb58]
call fcn.10017bad
mov dword [ebp - 0x2c], edi
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1003290e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe9c], 0x4ec2e0cf
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100328f5
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jg 0x10032ad2
push edi
lea ecx, [ebp - 0x408]
call fcn.10017b45
xor eax, eax
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10032955
push dword [ebp - 0x10]
lea ecx, [ebp - 0x408]
call fcn.10017bb2
mov dword [eax], 0x532bb11a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10032937
xor eax, eax
push eax
lea ecx, [ebp - 0x408]
call fcn.10017bb2
and dword [eax], 0
jmp 0x10032a9f
xor eax, eax
lea ecx, [ebp - 0x408]
push eax
call fcn.10017bb2
cmp dword [eax], ebx
jle 0x10032969
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032ae4
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 4
lea ecx, [ebp - 0x1ac]
call fcn.10017b45
mov dword [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x20], 0x244f8a3d
mov dword [ebp - 0x44], 0x1becde87
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x10032b33
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1ac]
call fcn.10017bb2
mov dword [eax], esi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x10032b18
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x10032b53