Function at 0x1002fbb7
Capabilities:
Accept command line arguments
Check os version
Contain obfuscated stackstrings
Create thread
Delete file
Delete registry key
Enumerate files on windows
Enumerate gui resources
Get common file path
Get disk information
Get geographical location
Identify system language via api
Query environment variable
Read .ini file
Set registry value
Set thread local storage value
Suspend thread
Terminate process

Disassembly:
mov eax, 0x1007dfd6
call fcn.1007d990
mov eax, 0x119c
call fcn.1007b5b0
push ebx
push esi
mov dword [ebp - 0x38], 0x632667a8
xor eax, eax
push edi
mov dword [ebp - 0x34], 0x31137833
mov dword [ebp - 0x3c], 0x73f5cfeb
push 3
mov dword [ebp - 0x14], eax
pop esi
mov byte [ebp - 0x9d], dl
mov dword [ebp - 0x60], ecx
cmp dword [ebp - 0x14], esi
jge 0x1002fc11
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x934], 0xf99f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002fbf9
xor eax, eax
mov dword [ebp - 0x14], eax
push 1
pop ebx
cmp dword [ebp - 0x14], esi
jge 0x1002fc30
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xea8], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002fc1c
xor eax, eax
mov dword [ebp - 0x38], 2
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x38], eax
jl 0x1002fce8
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0x4d41bd43
cmp dword [ebp - 0x38], eax
je 0x1002fc58
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x930]
mov eax, dword [ebp - 0x934]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setge dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x38], eax
je 0x1002fc91
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setl cl
imul eax, dword [ebp - 0x4c]
cmp eax, ecx
jl 0x1002fcbe
xor eax, eax
cmp eax, dword [ebp - 0x28]
je 0x1002fcc5
mov eax, ebx
jmp 0x1002fcc0
xor eax, eax
cmp eax, dword [ebp - 0x28]
jne 0x1002fccf
xor eax, eax
cmp dword [ebp - 0x92c], eax
je 0x1002fcd1
mov eax, ebx
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0xea8], eax
dec dword [ebp - 0x38]
push 0xffffffffffffffff
pop ecx
jns 0x1002fc43
mov dword [ebp - 0x2c], 0x90ac204e
mov dword [ebp - 0x18], 0x95aad853
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x4c], 0xc33bab72
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002fd2e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc68], 7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002fd16
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff3
jmp 0x1002fd9f
mov dword [ebp - 0x20], 0xa29
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0x9f361739
mov dword [ebp - 0x28], eax
jmp 0x1002fd5e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xdf4], 0x15898f01
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002fd4d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc68], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc68]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xdf0], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x2c]
push 0
pop eax
cmp dword [ebp - 0x2c], 0x19
jge 0x1002fd37
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x38], 0x632667a8
mov dword [ebp - 0x44], 0x648261f9
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002fdd1
push 0x26c7
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002fdf7
push eax
push eax
push eax
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
xor eax, eax
mov dword [ebp - 0x3c], 0x31137833
mov dword [ebp - 0x20], 0x73f5cfeb
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], eax
jmp 0x1002fe1e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc48], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1002fe0d
mov eax, dword [ebp - 0x34]
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0xc48], eax
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002fe4b
push eax
push eax
push 0x1d24
call esi
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x4c], eax
or ecx, 0xffffffff
mov dword [ebp - 0x2c], 0x46a1c17c
mov dword [ebp - 0x44], 0x3d8b3d38
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x1002fe78
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe30], 0x631615e8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002fe67
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x1002fec3
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
sub ecx, 0x7dcd
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setl cl
xor edx, edx
cmp ecx, 0x693009c
setl dl
sub eax, edx
mov dword [ebp - 0x2c], eax
jne 0x1002fec3
xor eax, eax
jmp 0x1002fec6
xor eax, eax
inc eax
mov ecx, 0xfff9
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
xor eax, eax
inc edx
mov dword [ebp - 0xe2c], edx
mov edx, 0x91a83acd
mov dword [ebp - 0x2c], 0xffffffe8
cmp dword [ebp - 0x2c], eax
jg 0x1002ff3d
or ecx, 0xffffffff
mov dword [ebp - 0x44], 0x1c234ac0
mov dword [ebp - 0x44], 0xa4b15d3e
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x44], 4
mov dword [ebp - 0x44], 0xae4c7ba3
mov dword [ebp - 0x44], 0x77d6446b
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x24]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x1002fef7
push 3
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x1002ff60
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x91c], 0xf99f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002ff48
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x14], eax
inc ecx
cmp dword [ebp - 0x14], edx
jge 0x1002ff7f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf8c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002ff6b
xor eax, eax
mov dword [ebp - 0x38], 2
cmp dword [ebp - 0x38], eax
jl 0x10030041
jmp 0x1002ff93
xor eax, eax
mov dword [ebp - 0x4c], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0x4d41bd43
cmp dword [ebp - 0x38], eax
je 0x1002ffab
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x918]
mov eax, dword [ebp - 0x91c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setge dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x38], eax
je 0x1002ffe4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setl cl
imul eax, dword [ebp - 0x4c]
cmp eax, ecx
jl 0x10030014
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10030016
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x10030019
xor eax, eax
xor ecx, ecx
inc ecx
cmp eax, dword [ebp - 0x28]
jne 0x10030028
xor eax, eax
cmp dword [ebp - 0x914], eax
je 0x1003002a
mov eax, ecx
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0xf8c], eax
dec dword [ebp - 0x38]
jns 0x1002ff91
push 3
pop edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x34], 0x273942
mov dword [ebp - 0x1c], 0x1c29
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x3c]
je 0x10030104
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x10030082
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5cc], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1003006e
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffe6
cmp dword [ebp - 0x1c], 0xfffffff0
jle 0x100300d2
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100300b2
push 0x1d6
push eax
push 0x4f8
push 0xf02
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100300c6
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff0
jg 0x1003008f
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x18], eax
je 0x100300f0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100300ee
mov edx, ecx
jmp 0x100300f2
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x5cc], ecx
jmp 0x10030154
or eax, 0xffffffff
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x24], 0x1639956a
cmp dword [ebp - 0x1c], eax
jne 0x10030121
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
sub eax, 7
cmp eax, dword [ebp - 0x2c]
jl 0x1003012f
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
mov dword [ebp - 0x34], edx
xor eax, eax
mov dword [ebp - 0x38], 0x632667a8
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
inc ecx
cmp dword [ebp - 0x28], ecx
jge 0x10030183
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5d4], 0x1bd97a8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1003016b
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffb
jmp 0x1003019c
cmp dword [ebp - 0x2c], eax
jne 0x100301a2
cmp dword [ebp - 0x5d4], eax
jne 0x100301a2
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff1
jge 0x1003018c
mov dword [ebp - 0x1c], 0x31137833
mov dword [ebp - 0x50], 0x73f5cfeb
mov dword [ebp - 0x30], 0x7b04800f
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0xc6ea
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], 6
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x100301ec
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
test eax, eax
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, 0x4d4b
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp ecx, eax
setne dl
xor ecx, ecx
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setne cl
xor eax, eax
add ecx, 0x1589afca
imul ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x30]
jg 0x1003026d
or edx, 0xffffffff
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1003027f
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
xor ecx, ecx
xor eax, eax
inc ecx
or edx, 0xffffffff
jmp 0x10030282
xor ecx, ecx
mov dword [ebp - 0x44], 0xfffffffb
inc ecx
mov dword [ebp - 0x44], ecx
inc dword [ebp - 0x3c]
jmp 0x10030268
xor ecx, ecx
inc ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100302a4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x904], 0xf99f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1003028b
xor eax, eax
mov dword [ebp - 0x2c], 0xb9f9b31
mov dword [ebp - 0x34], 0xdbaf9eb1
mov dword [ebp - 0x20], 0xd1fe9056
mov dword [ebp - 0x28], 0x788afb1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x100302e2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x464], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100302c9
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10030302
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x36c], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100302ea
xor eax, eax
mov dword [ebp - 0x2c], 0xe
cmp dword [ebp - 0x2c], 0x1c
jle 0x100303e4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x44], 0x2cb3a3fc
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10030345
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x734], 0xda37bb00
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1003032c
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1003035b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb78], 0xe0d6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003034a
mov eax, dword [ebp - 0x2c]
xor edx, edx
neg eax
mov dword [ebp - 0x464], eax
dec dword [ebp - 0x36c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x460]
mov eax, dword [ebp - 0x464]
mov eax, dword [ebp - 0x730]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x730]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x464]
mov eax, dword [ebp - 0xb78]
cmp ecx, eax
mov eax, dword [ebp - 0x730]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x730]
push 0
setg cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x28]
cmp ecx, eax
pop eax
setge dl
mov dword [ebp - 0x18], edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x1c
push 0xffffffffffffffff
pop edx
jg 0x10030313
xor ecx, ecx
inc ecx
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10030404
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf44], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100303ef
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1003042b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xce4], 0xfffffffc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10030413
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1003044d
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10030445
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x10030433
xor ecx, ecx
inc ecx
push 2
pop edx
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], eax
jl 0x10030611
jmp 0x10030461
xor ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], 0x4d41bd43
mov dword [ebp - 0x2c], 0x90ac204e
mov dword [ebp - 0x58], 0x95aad853
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x40], 0xc33bab72
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x100304b9
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc7c], 7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x100304a0
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff3
jmp 0x1003052b
mov dword [ebp - 0x20], 0xa29
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0x9f361739
mov dword [ebp - 0x28], eax
jmp 0x100304e9
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xee4], 0x15898f01
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x100304d8
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xc7c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0xc7c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xee0], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x2c]
push 0
pop eax
cmp dword [ebp - 0x2c], 0x19
jge 0x100304c2
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10030541
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x900]
mov eax, dword [ebp - 0x904]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x38], eax
je 0x1003057a
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setl cl
imul eax, dword [ebp - 0x4c]
cmp eax, ecx
jl 0x100305aa
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100305ac
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x100305af
xor eax, eax
xor ecx, ecx
inc ecx
cmp eax, dword [ebp - 0x18]
jne 0x100305be
xor eax, eax
cmp dword [ebp - 0x8fc], eax
je 0x100305c0
mov eax, ecx
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x44], 0x648261f9
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x100305e2
push 0x26c7
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100305fc
push eax
push eax
push eax
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
xor eax, eax
mov dword [ebp - 0xf44], eax
dec dword [ebp - 0x38]
push 0
pop eax
jns 0x1003045e
push 2
pop edx
xor ecx, ecx
mov dword [ebp - 0x28], edx
inc ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1003063b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1118], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10030626
xor eax, eax
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], eax
jl 0x10030657
mov dword [ebp - 0x44], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x28], eax
jne 0x10030657
dec dword [ebp - 0x28]
jns 0x10030647
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x28], eax
jmp 0x10030670
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xb80], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1003065f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xb80], eax
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10030696
push eax
push eax
push 0x1d24
call esi
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x4c], eax
or ecx, 0xffffffff
mov dword [ebp - 0x2c], 0x46a1c17c
mov dword [ebp - 0x44], 0x3d8b3d38
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x100306c3
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xefc], 0x631615e8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x100306b2
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x1003070e
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
sub ecx, 0x7dcd
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setl cl
xor edx, edx
cmp ecx, 0x693009c
setl dl
sub eax, edx
mov dword [ebp - 0x2c], eax
jne 0x1003070e
xor eax, eax
jmp 0x10030711
xor eax, eax
inc eax
mov ecx, 0xfff9
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
xor eax, eax
inc edx
mov dword [ebp - 0xef8], edx
or edx, 0xffffffff
mov dword [ebp - 0x2c], 0xffffffe8
cmp dword [ebp - 0x2c], eax
jg 0x10030788
mov ecx, 0x91a83acd
mov dword [ebp - 0x44], 0x1c234ac0
mov dword [ebp - 0x44], 0xa4b15d3e
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x44], 4
mov dword [ebp - 0x44], 0xae4c7ba3
mov dword [ebp - 0x44], 0x77d6446b
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x24]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x10030742
mov dword [ebp - 0x3c], 3
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x34], 0x273942
mov dword [ebp - 0x1c], 0x1c29
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x3c]
je 0x10030852
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x100307d0
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5dc], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x100307bc
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffe6
cmp dword [ebp - 0x1c], 0xfffffff0
jle 0x10030820
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10030800
push 0x1d6
push eax
push 0x4f8
push 0xf02
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10030814
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff0
jg 0x100307dd
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x18], eax
je 0x1003083e
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1003083c
mov edx, ecx
jmp 0x10030840
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x5dc], ecx
jmp 0x1003089f
mov dword [ebp - 0x2c], edx
xor eax, eax
mov dword [ebp - 0x24], 0x1639956a
cmp dword [ebp - 0x1c], eax
jne 0x1003086c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
sub eax, 7
cmp eax, dword [ebp - 0x2c]
jl 0x1003087a
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
mov dword [ebp - 0x34], edx
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x2c], eax
inc ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x100308c7
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5c8], 0x1bd97a8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x100308af
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffb
jmp 0x100308e0
cmp dword [ebp - 0x2c], eax
jne 0x100308e6
cmp dword [ebp - 0x5c8], eax
jne 0x100308e6
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff1
jge 0x100308d0
mov dword [ebp - 0x14], 0x632667a8
mov dword [ebp - 0x30], 0x7b04800f
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0xc6ea
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], 6
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10030929
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
test eax, eax
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, 0x4d4b
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp ecx, eax
setne dl
xor ecx, ecx
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setne cl
xor eax, eax
add ecx, 0x1589afca
imul ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x30]
jg 0x100309aa
or edx, 0xffffffff
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x100309bc
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
xor ecx, ecx
xor eax, eax
inc ecx
or edx, 0xffffffff
jmp 0x100309bf
xor ecx, ecx
mov dword [ebp - 0x44], 0xfffffffb
inc ecx
mov dword [ebp - 0x44], ecx
inc dword [ebp - 0x3c]
jmp 0x100309a5
xor ecx, ecx
inc ecx
mov dword [ebp - 0x40], 0x31137833
mov dword [ebp - 0x2c], 0xb9f9b31
mov dword [ebp - 0x34], 0xdbaf9eb1
mov dword [ebp - 0x20], 0xd1fe9056
mov dword [ebp - 0x28], 0x788afb1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10030a04
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x46c], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100309eb
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10030a24
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3ac], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10030a0c
xor eax, eax
mov dword [ebp - 0x2c], 0xe
cmp dword [ebp - 0x2c], 0x1c
jle 0x10030b06
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x44], 0x2cb3a3fc
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10030a67
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x74c], 0xda37bb00
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10030a4e
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10030a7d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb94], 0xe0d6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10030a6c
mov eax, dword [ebp - 0x2c]
xor edx, edx
neg eax
mov dword [ebp - 0x46c], eax
dec dword [ebp - 0x3ac]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x468]
mov eax, dword [ebp - 0x46c]
mov eax, dword [ebp - 0x748]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x748]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xb94]
mov eax, dword [ebp - 0x46c]
cmp eax, ecx
mov eax, dword [ebp - 0x748]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x748]
push 0
setg cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x28]
cmp ecx, eax
pop eax
setge dl
mov dword [ebp - 0x18], edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x1c
push 0xffffffffffffffff
pop edx
jg 0x10030a35
xor ecx, ecx
inc ecx
mov dword [ebp - 0x30], 0x73f5cfeb
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x10030b36
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc04], 0xfffffffc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10030b1e
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x10030b58
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10030b50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x10030b3e
xor ecx, ecx
inc ecx
mov dword [ebp - 0x2c], 0x90ac204e
mov dword [ebp - 0x18], 0x95aad853
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x4c], 0xc33bab72
push 3
mov dword [ebp - 0x28], eax
pop edx
cmp dword [ebp - 0x28], edx
jge 0x10030ba1
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc90], 7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x10030b89
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff3
jmp 0x10030c12
mov dword [ebp - 0x20], 0xa29
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0x9f361739
mov dword [ebp - 0x28], eax
jmp 0x10030bd1
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xf74], 0x15898f01
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x10030bc0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc90], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc90]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xf70], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x2c]
push 0
pop eax
cmp dword [ebp - 0x2c], 0x19
jge 0x10030baa
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x10030c40
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x910], 0xf99f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10030c28
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x10030c5c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe0c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10030c48
xor eax, eax
mov dword [ebp - 0x44], 0x648261f9
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10030c7a
push 0x26c7
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10030c94
push eax
push eax
push eax
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
xor eax, eax
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], eax
jl 0x10031026
xor ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x28], eax
jmp 0x10030cc0
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xba8], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x10030caf
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xba8], eax
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10030cea
push eax
push eax
push 0x1d24
call esi
push eax
call ebx
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x58], ecx
or edx, 0xffffffff
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x2c], 0x46a1c17c
mov dword [ebp - 0x44], 0x3d8b3d38
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
jmp 0x10030d1a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe00], 0x631615e8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10030d09
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10030d68
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
sub ecx, 0x7dcd
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setl cl
xor edx, edx
cmp ecx, 0x693009c
setl dl
sub eax, edx
mov dword [ebp - 0x2c], eax
jne 0x10030d65
xor eax, eax
jmp 0x10030d6a
xor ecx, ecx
inc ecx
mov eax, ecx
mov ecx, 0xfff9
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
xor eax, eax
inc edx
or ecx, 0xffffffff
mov dword [ebp - 0xdfc], edx
mov dword [ebp - 0x2c], 0xffffffe8
cmp dword [ebp - 0x2c], eax
jg 0x10030de1
mov edx, 0x91a83acd
mov dword [ebp - 0x44], 0x1c234ac0
mov dword [ebp - 0x44], 0xa4b15d3e
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x44], 4
mov dword [ebp - 0x44], 0xae4c7ba3
mov dword [ebp - 0x44], 0x77d6446b
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x24]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x10030d9b
mov dword [ebp - 0x2c], ecx
mov ecx, 0xece3051e
mov dword [ebp - 0x18], 0xe9714a02
mov dword [ebp - 0x28], 0x36951ad3
mov dword [ebp - 0x83c], ecx
mov dword [ebp - 0x838], ecx
mov dword [ebp - 0x834], ecx
mov dword [ebp - 0x830], ecx
xor ecx, ecx
mov dword [ebp - 0x24], 0x85dc1b6e
inc ecx
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x28], eax
jmp 0x10030e36
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x598], 0xd5943e2f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10030e25
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10030e56
cmp dword [ebp - 0x830], eax
jne 0x10030e53
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov edx, 0xee61780e
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x830]
mov eax, dword [ebp - 0x28]
cmp edx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x598], eax
xor eax, eax
mov dword [ebp - 0x24], 0x4d41bd43
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0xa38], ecx
mov dword [ebp - 0xa34], ecx
mov dword [ebp - 0xa30], ecx
mov dword [ebp - 0xa2c], ecx
mov dword [ebp - 0x854], eax
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], eax
mov dword [ebp - 0x848], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x10030ee5
push 0xfffffffffffffff6
pop edx
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x11c], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10030ed3
mov dword [ebp - 0x38], 0x42eb90da
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x11c], eax
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffeb
jle 0x10030f8b
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], 4
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x65835a7
neg ecx
push 5
sbb ecx, ecx
xor eax, eax
inc ecx
pop edx
cmp ecx, edx
mov ecx, 0xffff
setge al
cmp ecx, eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x20]
je 0x10030f62
mov eax, dword [ebp - 0xa34]
mov ecx, dword [ebp - 0x11c]
xor edx, edx
mov eax, dword [ebp - 0x850]
cmp eax, ecx
push 0
setl dl
mov dword [ebp - 0x850], edx
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffeb
pop eax
jg 0x10030f04
cmp dword [ebp - 0x14], eax
je 0x10030f93
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x90c]
mov eax, dword [ebp - 0x910]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setge dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x14], eax
je 0x10030fcc
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x58]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x58]
setl cl
imul eax, dword [ebp - 0x58]
cmp eax, ecx
jl 0x10030ffc
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10030ffe
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x10031001
xor eax, eax
xor ecx, ecx
inc ecx
cmp eax, dword [ebp - 0x2c]
jne 0x10031010
xor eax, eax
cmp dword [ebp - 0x908], eax
je 0x10031012
mov eax, ecx
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0xe0c], eax
dec dword [ebp - 0x14]
jns 0x10030ca7
mov dword [ebp - 0x2c], 0x6960f57a
or ecx, 0xffffffff
mov dword [ebp - 0x44], 0xc8fbfc75
mov edx, 0x9a5c
mov dword [ebp - 0x24], ecx
mov ecx, 0xe2ff5ff7
mov dword [ebp - 0x24], 0x5300ce3d
mov dword [ebp - 0x44], 0x8299fa9e
mov dword [ebp - 0x44], 0x9c79ebef
mov dword [ebp - 0x44], 0x93d7f28
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x34], eax
push 4
mov dword [ebp - 0x14], eax
pop ebx
cmp dword [ebp - 0x14], ebx
jge 0x100310a6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa78], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10031092
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100310c8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe24], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100310af
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x10031262
mov dword [ebp - 0x38], 0x8974b66
xor ecx, ecx
mov dword [ebp - 0x18], 0xfffffffe
inc ecx
mov dword [ebp - 0x44], 0xbb101eb
mov dword [ebp - 0x24], 0xe8b7dd14
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1003111a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x308], 0x1466ac3a
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10031102
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1003113f
push 0x128d
push 0xcf8
push 0x1dcd
push 0x17b8
push eax
call ebx
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x1003124b
mov dword [ebp - 0x4c], 0xbf74
mov dword [ebp - 0x44], 0xd9e9
push 8
mov dword [ebp - 0x20], 0xbb7a2e25
pop edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x28], eax
jmp 0x10031179
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xcf8], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1003116c
dec dword [ebp - 0x3c]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setge dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100311b1
cmp dword [ebp - 0x38], eax
je 0x100311c7
mov eax, dword [ebp - 0x308]
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x100311c7
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0xa78], 0
je 0x100311c5
xor eax, eax
lea edx, [eax + 1]
jmp 0x100311c9
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xa78]
push 0
setle cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xa78]
setl dl
imul ecx, edx
xor edx, edx
inc edx
add ecx, eax
mov eax, dword [ebp - 0x18]
inc eax
add eax, ecx
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x308], ecx
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x38]
imul eax, ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe20]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xa78]
cmp eax, edx
pop eax
setle cl
mov dword [ebp - 0xcf4], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
push 1
pop ecx
jle 0x1003114c
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x100310db
mov ecx, 0xe2ff5ff7
mov edx, 0x9a5c
mov dword [ebp - 0x2c], 0x6960f57a
mov dword [ebp - 0x44], 0xc8fbfc75
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0x5300ce3d
mov dword [ebp - 0x44], 0x8299fa9e
mov dword [ebp - 0x44], 0x9c79ebef
mov dword [ebp - 0x44], 0x93d7f28
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x100312dc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x998], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100312c3
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100312fe
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe3c], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100312e5
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10031479
mov dword [ebp - 0x38], 0x8974b66
xor ecx, ecx
mov dword [ebp - 0x18], 0xfffffffe
inc ecx
mov dword [ebp - 0x44], 0xbb101eb
mov dword [ebp - 0x24], 0xe8b7dd14
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x10031345
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x3c8], 0x1466ac3a
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1003132d
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1003136a
push 0x128d
push 0xcf8
push 0x1dcd
push 0x17b8
push eax
call ebx
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x10031476
mov dword [ebp - 0x4c], 0xbf74
mov dword [ebp - 0x44], 0xd9e9
push 8
mov dword [ebp - 0x20], 0xbb7a2e25
pop edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x28], eax
jmp 0x100313a4
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc70], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x10031397
dec dword [ebp - 0x3c]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setge dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100313dc
cmp dword [ebp - 0x38], eax
je 0x100313f2
mov eax, dword [ebp - 0x3c8]
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x100313f2
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x998], 0
je 0x100313f0
xor eax, eax
lea edx, [eax + 1]
jmp 0x100313f4
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x998]
push 0
setle cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x998]
setl dl
imul ecx, edx
xor edx, edx
inc edx
add ecx, eax
mov eax, dword [ebp - 0x18]
inc eax
add eax, ecx
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x3c8], ecx
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x38]
imul eax, ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe38]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x998]
cmp eax, edx
pop eax
setle cl
mov dword [ebp - 0xc6c], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
push 1
pop ecx
jle 0x10031377
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x10031306
mov dword [ebp - 0x30], 0xcea5d6c0
mov dword [ebp - 0x24], 0x3a266d21
push 2
mov dword [ebp - 0x2c], 0xd25bb086
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x100314be
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x7ac], 0xdd2e91c8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x100314a6
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x30], eax
inc ecx
cmp dword [ebp - 0x30], ecx
jne 0x1003164a
push 0xfffffffffffffffd
pop edx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0xfffb
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0xaf8], edx
mov dword [ebp - 0xaf4], edx
mov dword [ebp - 0xaf0], edx
mov dword [ebp - 0xaec], edx
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10031522
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xdd8], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10031509
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jg 0x1003163e
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0xc98aac1e
mov dword [ebp - 0x34], 0x4549c4b
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x3c], 0xdab5
jg 0x10031555
mov edx, ecx
cmp dword [ebp - 0x30], eax
jne 0x10031557
mov edx, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
push 0
setne cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
imul ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xaf8]
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xdd8]
cmp ecx, eax
setne dl
xor eax, eax
inc eax
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setle cl
xor edx, edx
sub ecx, eax
add ecx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x3c]
sub ecx, 3
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xdd4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setg dl
xor eax, eax
cmp eax, edx
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0xf0a061fa
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0x4c01
mov eax, dword [ebp - 0x40]
setne dl
xor ecx, ecx
cmp eax, edx
pop eax
setne cl
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 3
push 1
pop ecx
jle 0x1003152f
push 0xfffffffffffffffd
pop edx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
je 0x100314d0
cmp dword [ebp - 0x20], 0xfffffff8
je 0x10031662
cmp dword [ebp - 0x2c], eax
je 0x1003165d
mov eax, dword [ebp - 0x7a8]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10031664
mov eax, ecx
mov dword [ebp - 0x30], eax
or eax, 0xffffffff
mov dword [ebp - 0x2c], 0x6960f57a
mov dword [ebp - 0x44], 0xc8fbfc75
mov dword [ebp - 0x24], eax
mov eax, 0xe2ff5ff7
mov dword [ebp - 0x24], 0x5300ce3d
mov dword [ebp - 0x44], 0x8299fa9e
mov dword [ebp - 0x44], 0x9c79ebef
mov dword [ebp - 0x44], 0x93d7f28
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov eax, 0x9a5c
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x100316ec
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9b8], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100316d3
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1003170e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe54], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100316f5
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10031889
mov dword [ebp - 0x38], 0x8974b66
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x44], 0xbb101eb
mov dword [ebp - 0x24], 0xe8b7dd14
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x10031752
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x35c], 0x1466ac3a
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1003173a
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10031777
push 0x128d
push 0xcf8
push 0x1dcd
push 0x17b8
push eax
call ebx
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x10031883
mov dword [ebp - 0x4c], 0xbf74
mov dword [ebp - 0x44], 0xd9e9
push 8
mov dword [ebp - 0x20], 0xbb7a2e25
pop edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x28], eax
jmp 0x100317b1
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xd88], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x100317a4
dec dword [ebp - 0x3c]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setge dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100317e9
cmp dword [ebp - 0x38], eax
je 0x100317ff
mov eax, dword [ebp - 0x35c]
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x100317ff
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x9b8], 0
je 0x100317fd
xor eax, eax
lea edx, [eax + 1]
jmp 0x10031801
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x9b8]
push 0
setle cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x9b8]
setl dl
imul ecx, edx
xor edx, edx
inc edx
add ecx, eax
mov eax, dword [ebp - 0x18]
inc eax
add eax, ecx
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x35c], ecx
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x38]
imul eax, ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe50]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x9b8]
cmp eax, edx
pop eax
setle cl
mov dword [ebp - 0xd84], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
push 1
pop ecx
jle 0x10031784
inc dword [ebp - 0x2c]
push 1
pop ecx
cmp dword [ebp - 0x2c], 3
jle 0x10031716
mov dword [ebp - 0x30], 0xcea5d6c0
mov dword [ebp - 0x24], 0x3a266d21
mov dword [ebp - 0x2c], 0xd25bb086
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x100318d1
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x82c], 0xdd2e91c8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x100318b8
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x30], eax
inc ebx
cmp dword [ebp - 0x30], ebx
jne 0x10031a55
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], 0xfffb
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0xa98], ecx
mov dword [ebp - 0xa94], ecx
mov dword [ebp - 0xa90], ecx
mov dword [ebp - 0xa8c], ecx
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10031935
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xdb8], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1003191c
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jg 0x10031a49
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0xc98aac1e
mov dword [ebp - 0x34], 0x4549c4b
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x3c], 0xdab5
jg 0x10031968
mov edx, ebx
cmp dword [ebp - 0x30], eax
jne 0x1003196a
mov edx, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
push 0
setne cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul eax, dword [ebp - 0x828]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xa98]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xdb8]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, ebx
setle cl
xor edx, edx
sub ecx, eax
add ecx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x3c]
sub ecx, 3
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xdb4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setg dl
xor eax, eax
cmp eax, edx
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0xf0a061fa
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0x4c01
mov eax, dword [ebp - 0x40]
setne dl
xor ecx, ecx
cmp eax, edx
pop eax
setne cl
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 3
jle 0x10031942
push 0xfffffffffffffffd
pop ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
je 0x100318e3
cmp dword [ebp - 0x20], 0xfffffff8
je 0x10031a6d
cmp dword [ebp - 0x2c], eax
je 0x10031a68
mov eax, dword [ebp - 0x828]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10031a6f
mov eax, ebx
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], 0xb9f9b31
mov dword [ebp - 0x34], 0xdbaf9eb1
mov dword [ebp - 0x20], 0xd1fe9056
mov dword [ebp - 0x28], 0x788afb1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10031ab2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x47c], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10031a99
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10031ad2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x39c], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10031aba
xor eax, eax
mov dword [ebp - 0x2c], 0xe
cmp dword [ebp - 0x2c], 0x1c
jle 0x10031bb4
or ebx, 0xffffffff
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x44], 0x2cb3a3fc
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10031b18
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x764], 0xda37bb00
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10031aff
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10031b2e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc84], 0xe0d6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10031b1d
mov eax, dword [ebp - 0x2c]
xor edx, edx
neg eax
mov dword [ebp - 0x47c], eax
dec dword [ebp - 0x39c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x478]
mov eax, dword [ebp - 0x47c]
mov eax, dword [ebp - 0x760]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x760]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc84]
mov eax, dword [ebp - 0x47c]
cmp eax, ecx
mov eax, dword [ebp - 0x760]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x760]
push 0
setg cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x28]
cmp ecx, eax
pop eax
setge dl
mov dword [ebp - 0x18], edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x1c
jg 0x10031ae6
xor ebx, ebx
inc ebx
mov dword [ebp - 0x50], 0xfffffffd
or eax, 0xffffffff
mov dword [ebp - 0x1c], 0x17e5c285
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10031bf0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x74], 0x56a9ef72
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10031bdb
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10031c06
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe6c], 0xd7774ca6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10031bf5
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x74]
jge 0x10031c1e
xor eax, eax
cmp dword [ebp - 0x74], eax
je 0x10031c20
mov edx, ebx
jmp 0x10031c22
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x74]
xor ecx, ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
cmp eax, 0x281d21f1
setg cl
xor eax, eax
add ecx, dword [ebp - 0x74]
cmp edx, ecx
setle al
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10031d07
mov dword [ebp - 0x20], 0x227d373e
xor ecx, ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x3c], 0x5533f2a6
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x20]
cmp eax, ebx
mov eax, dword [ebp - 0x50]
setg cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
setle al
sub eax, dword [ebp - 0x74]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1c], eax
imul eax, dword [ebp - 0x3c], 0xd73c
test eax, eax
je 0x10031cbd
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10031cbf
mov eax, ebx
jmp 0x10031cbf
xor eax, eax
mov ecx, dword [ebp - 0x74]
imul ecx, eax
xor eax, eax
neg ecx
cmp ecx, edx
setl al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x28]
je 0x10031ce6
mov eax, dword [ebp - 0x74]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10031e16
push eax
push 0x1c4a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x10031e16
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x34], 0x53d1739c
mov dword [ebp - 0x1c], eax
jmp 0x10031e0d
mov dword [ebp - 0x3c], 0xb132dc1b
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], eax
jg 0x10031dd7
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x40]
add eax, ecx
add edx, eax
sub edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x74]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setl cl
add eax, ecx
xor ecx, ecx
cmp eax, 0x2523
mov eax, dword [ebp - 0x40]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x74]
cmp edx, eax
mov eax, dword [ebp - 0x40]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x40]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x3c], ebx
je 0x10031dac
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x40], eax
je 0x10031dae
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x74]
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jle 0x10031d33
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x10031e0a
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10031df2
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x74], ecx
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x10031ddf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10031d19
mov eax, dword [ebp - 0x74]
xor edx, edx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setge dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xe68], eax
xor eax, eax
mov dword [ebp - 0x24], 0xa22e974a
mov dword [ebp - 0x44], 0x4952f341
mov dword [ebp - 0x44], 0x88753e1e
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x3c], 0x206d
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10031e90
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa8], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10031e78
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10031eb1
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2ac], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10031e9c
xor eax, eax
mov dword [ebp - 0xa8], 0xffffffeb
jmp 0x10031f0c
mov dword [ebp - 0x28], 0xa290be44
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10031ee6
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xff0], 0x7ca0029b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10031ecd
xor eax, eax
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], eax
jl 0x10031f06
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0xff0], 0
jne 0x10031f04
dec dword [ebp - 0x28]
jns 0x10031ef2
xor eax, eax
inc dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], 0xfffffff5
jle 0x10031ebd
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xa8]
xor eax, eax
cmp dword [ebp - 0x2a8], eax
jge 0x10031f32