Function at 0x1003b5b1
Capabilities:
Accept command line arguments
Delete file
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10068822
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1e0
push ebx
push esi
mov dword [esp + 0x44], ecx
mov esi, edx
mov dword [esp + 0x1c], 0xfffffff7
push edi
mov dword [esp + 0x18], 0x88a137b1
cmp dword [esp + 0x20], 0xfffffffe
push 0
sbb eax, eax
mov dword [esp + 0x7c], esi
pop ebx
inc eax
push 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1c], 9
pop edi
jmp 0x1003b6aa
mov dword [esp + 0x14], 8
mov dword [esp + 0x1c], ebx
jmp 0x1003b62f
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x170], 4
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x1003b61c
mov dword [esp + 0x1c], ebx
jmp 0x1003b64f
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xa8], 6
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x1003b63c
mov eax, dword [esp + 0x174]
xor edx, edx
mov eax, dword [esp + 0x174]
mov ecx, dword [esp + 0x174]
mov eax, dword [esp + 0x20]
dec ecx
cmp eax, ecx
setle dl
xor ecx, ecx
cmp edx, 0xfffe
setne cl
xor eax, eax
cmp ecx, 0x5613
setne al
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add eax, 0xffff
imul eax, eax, 0x5ee5
mov dword [esp + 0xa8], eax
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 5
je 0x1003b60e
mov dword [esp + 0x1c], 0xb2906c90
or ecx, 0xffffffff
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], 0x8c04
mov dword [esp + 0x2c], 0xfffffffe
mov dword [esp + 0x20], ebx
jmp 0x1003b6e6
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x38], ecx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x1003b6da
mov eax, dword [esp + 0x38]
mov dword [esp + 0x38], eax
test eax, eax
je 0x1003b724
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov edx, dword [esp + 0x1c]
cmp eax, 0x981f
mov eax, dword [esp + 0x1c]
setl cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, edi
setg cl
sub ecx, dword [esp + 0x38]
jne 0x1003b726
mov eax, ebx
mov ecx, 0xef66b17b
cmp ecx, eax
sbb edx, edx
inc edx
add edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
sub ecx, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
jne 0x1003b764
mov eax, dword [esp + 0x38]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setl dl
xor eax, eax
add edx, dword [esp + 0x14]
cmp edx, 0xffffffff
setge al
cmp eax, 0x82b3
jg 0x1003b7a6
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
add edx, 0xffff512c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, dword [esp + 0x14]
jle 0x1003b7ce
mov ecx, edi
cmp dword [esp + 0x18], ebx
jne 0x1003b7d0
mov ecx, ebx
mov eax, dword [esp + 0x1c]
inc ecx
xor edx, edx
cmp ecx, eax
setne dl
cmp edx, dword [esp + 0x2c]
jge 0x1003b7ea
mov edx, edi
cmp dword [esp + 0x18], ebx
jne 0x1003b7ec
mov edx, ebx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
sub edx, eax
imul edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp edx, eax
mov eax, dword [0x10bfc274]
setg cl
mov dword [esp + 0x1c], ecx
test al, 1
jne 0x1003b8ac
or eax, edi
mov dword [0x10bfc274], eax
push ebx
mov dword [esp + 0x1f8], ebx
push ebx
mov dword [0x10bfc2a0], ebx
mov dword [0x10bfc2a4], ebx
call fcn.1003dd10
mov dword [0x10bfc2a0], eax
mov dword [0x10bfc2a8], ebx
mov dword [0x10bfc2b0], ebx
mov byte [esp + 0x1f4], 2
mov ecx, 0x10bfc2a8
mov dword [esp + 0xdc], eax
lea eax, [esp + 0xdc]
push eax
push 0x10
push ebx
lea eax, [esp + 0x178]
mov dword [0x10bfc2bc], 0x3f800000
push eax
mov dword [0x10bfc2ac], ebx
call fcn.1003dae8
push 0x10068ed6
mov dword [0x10bfc2b4], 7
mov dword [0x10bfc2b8], 8
call fcn.1004fe78
or eax, 0xffffffff
pop ecx
mov dword [esp + 0x1f4], eax
jmp 0x1003b8af
or eax, 0xffffffff
mov dword [esp + 0x24], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003b8dd
push 0xd6b
push 0x208a
push 0x189a
push 0x1d45
push 0x187c
call dword [sym.imp.GDI32.dll_Rectangle]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003b8f1
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
imul eax, dword [esp + 0x48], 0x2710
add eax, esi
mov dword [esp + 0x80], eax
mov dword [esp + 0x24], 0x5720e83c
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003b91c
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003b92e
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea eax, [esp + 0x80]
push eax
call fcn.1003d1ef
mov eax, dword [eax]
mov dword [esp + 0x24], eax
test eax, eax
je 0x1003bcb2
mov dword [esp + 0x1c], 0x5d811f07
lea ecx, [esp + 0x5c]
mov dword [esp + 0x30], ebx
push 2
call fcn.1002b976
mov dword [esp + 0x1f4], 3
mov dword [esp + 0x2c], 0xfffffff6
mov dword [esp + 0x18], 0x1b4d09d5
mov dword [esp + 0x14], 0x4bca0f96
mov dword [esp + 0x20], ebx
jmp 0x1003b999
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x5c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1003b989
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
imul eax, dword [esp + 0x1c]
test eax, eax
je 0x1003b9bf
cmp dword [esp + 0x1c], ebx
je 0x1003b9bb
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
mov dword [esp + 0x30], ecx
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x1c], ebx
jl 0x1003bc99
push 3
lea ecx, [esp + 0xb4]
call fcn.1002b976
mov dword [esp + 0x10], 0xb81230b6
mov dword [esp + 0x28], 0x1f9531de
mov dword [esp + 0x54], 0x2b15
mov dword [esp + 0x20], ebx
jmp 0x1003ba29
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xb0]
mov dword [eax + ecx*4], 0xf7626a9d
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x1003ba13
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x5c]
cmp dword [eax + ecx*4], ebx
je 0x1003ba5b
cmp dword [esp + 0x1c], ebx
je 0x1003ba5b
mov eax, dword [esp + 0x5c]
cmp dword [eax], ebx
je 0x1003ba5b
mov esi, edi
cmp dword [esp + 0x30], ebx
jne 0x1003ba5d
mov esi, ebx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0xb0]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x78], edx
mov eax, dword [eax + ecx*4]
mov dword [edx + 4], eax
mov dword [esp + 0x28], esi
mov esi, dword [edx + 4]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor eax, eax
cmp esi, ecx
setne al
test eax, eax
js 0x1003baa2
mov edx, ebx
test esi, esi
je 0x1003baa4
mov edx, edi
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x5c]
push 2
sub edx, dword [ecx + eax*4]
mov dword [esp + 0x24], edx
xor edx, edx
mov eax, dword [esp + 0x24]
cmp dword [ecx + esi*4], eax
mov eax, dword [esp + 0x14]
setg dl
imul eax, edx
pop edx
push 0
add eax, edx
pop eax
sets al
neg eax
cmp eax, dword [esp + 0x2c]
jne 0x1003bc1a
or eax, 0xffffffff
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], 0x7b1ecbc5
mov dword [esp + 0x34], edx
xor edx, edx
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x5c]
mov eax, dword [ecx + eax*4]
cmp eax, dword [ecx + esi*4]
setne dl
xor eax, eax
cmp edx, 0x624e
setl al
xor ecx, ecx
sub eax, 0x4064
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x20]
mov eax, dword [esp + 0x5c]
setg cl
xor edx, edx
cmp ecx, dword [eax + edi*4]
setge dl
imul edx, dword [eax]
xor eax, eax
cmp edx, 7
setge al
xor ecx, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xb0]
cmp dword [eax], 0xfffc
mov eax, dword [esp + 0x28]
sete cl
xor edx, edx
cmp ecx, dword [esp + 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [esp + 0x28]
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x5c]
cmp dword [eax], ebx
je 0x1003bbaa
mov eax, dword [esp + 0x78]
cmp dword [eax + 4], ebx
je 0x1003bbaa
xor edi, edi
inc edi
mov ecx, edi
jmp 0x1003bbaf
xor edi, edi
mov ecx, ebx
inc edi
mov eax, dword [esp + 0x28]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x20]
sete dl
xor ecx, ecx
cmp edx, eax
setg cl
imul ecx, dword [esp + 0x10]
cmp ecx, dword [esp + 0x20]
jne 0x1003bbd8
mov edx, ebx
cmp dword [esp + 0x54], ebx
je 0x1003bbda
mov edx, edi
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x5c]
cmp edx, dword [eax + ecx*4]
jl 0x1003bbef
mov edx, ebx
cmp dword [esp + 0x34], ebx
je 0x1003bbf1
mov edx, edi
mov ecx, dword [esp + 0x5c]
neg edx
mov eax, dword [esp + 0x28]
mov ecx, dword [ecx + 4]
sub ecx, eax
cmp ecx, edx
jle 0x1003bc08
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], 0xfffffffe
jmp 0x1003bc72
mov dword [esp + 0x14], ebx
jmp 0x1003bc6b
mov dword [esp + 0x28], ebx
jmp 0x1003bc60
mov dword [esp + 0x18], ebx
jmp 0x1003bc56
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xb0]
cmp dword [eax + ecx*4], ebx
jne 0x1003bc5c
mov dword [esp + 0x10], ebx
jmp 0x1003bc4c
cmp dword [esp + 0x10], ebx
jne 0x1003bc52
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jle 0x1003bc42
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jle 0x1003bc2c
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0x13
jg 0x1003bc26
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xa
jne 0x1003bc20
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003bc83
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0xb0]
call fcn.1002c9a6
dec dword [esp + 0x1c]
jns 0x1003b9e7
lea ecx, [esp + 0x5c]
call fcn.1002c9a6
mov eax, dword [esp + 0x24]
mov dword [esp + 0xe0], eax
jmp 0x1003cf9a
mov eax, dword [0x10bfc274]
test al, 2
jne 0x1003bd5b
or eax, 2
mov dword [0x10bfc274], eax
push ebx
mov dword [esp + 0x1f8], 4
push ebx
mov dword [0x10bfc280], ebx
mov dword [0x10bfc284], ebx
call fcn.1003dd10
mov dword [0x10bfc280], eax
mov dword [0x10bfc288], ebx
mov dword [0x10bfc290], ebx
mov byte [esp + 0x1f4], 6
mov ecx, 0x10bfc288
mov dword [esp + 0xa4], eax
lea eax, [esp + 0xa4]
push eax
push 0x10
push ebx
lea eax, [esp + 0x88]
mov dword [0x10bfc29c], 0x3f800000
push eax
mov dword [0x10bfc28c], ebx
call fcn.1003dae8
push 0x10068ed1
mov dword [0x10bfc294], 7
mov dword [0x10bfc298], 8
call fcn.1004fe78
or eax, 0xffffffff
pop ecx
mov dword [esp + 0x1f4], eax
push 3
pop esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x2c], 0x77a14a9c
mov dword [esp + 0x2c], 0x72e7eb66
mov dword [esp + 0x20], ebx
jmp 0x1003bd84
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x3c], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1003bd78
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x1c], ebx
jl 0x1003bf2a
mov dword [esp + 0x18], 0x5c62e089
mov dword [esp + 0x20], 9
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003bdc0
push ebx
push 0xc9b
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
mov eax, dword [esp + 0x1c]
cmp dword [esp + eax*4 + 0x3c], ebx
jne 0x1003bf2a
mov dword [esp + 0x18], edi
cmp dword [esp + 0x18], ebx
jl 0x1003bf20
mov dword [esp + 0x34], 0x8d911aca
mov dword [esp + 0x20], ebx
jmp 0x1003bdf6
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x68], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x1003bdea
mov dword [esp + 0x6c], ebx
jmp 0x1003bf0c
mov dword [esp + 0x24], 0x493a50eb
or ecx, 0xffffffff
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x6c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x3c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x3c]
cmp ecx, eax
mov eax, dword [esp + 0x6c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
xor eax, eax
test edx, edx
setle al
xor ecx, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x3c]
cmp eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
sete cl
xor edx, edx
cmp ecx, 0xfffffffc
setle dl
xor ecx, ecx
add edx, dword [esp + eax*4 + 0x3c]
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x2c]
sub edx, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x3c]
sub edx, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x3c]
cmp edx, eax
setl cl
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
cmp eax, 0x8f982a4c
setne cl
cmp ecx, dword [esp + 0x6c]
jg 0x1003beec
mov ecx, ebx
cmp dword [esp + 0x34], ebx
je 0x1003beee
mov ecx, edi
mov eax, dword [esp + 0x6c]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x6c]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x24], ecx
inc dword [esp + 0x6c]
cmp dword [esp + 0x6c], edi
jle 0x1003be05
dec dword [esp + 0x18]
jns 0x1003bddc
dec dword [esp + 0x1c]
jns 0x1003bd99
xorps xmm0, xmm0
lea ecx, [esp + 0x14c]
push 2
movdqu xmmword [esp + 0x98], xmm0
call fcn.1002b976
mov dword [esp + 0x1f4], 7
lea ecx, [esp + 0x134]
mov dword [esp + 0x18], edi
mov dword [esp + 0x30], 0x999d94b4
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], 0xfffffffd
mov dword [esp + 0x14], 0xd26ec17e
push esi
call fcn.1002b976
mov dword [esp + 0x24], 0x179a
cmp dword [esp + 0x24], 0x1366
jge 0x1003bfe7
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x5c]
push eax
push 0x1000a6dc
call fcn.1004f9db
add esp, 0xc
or eax, 0xffffffff
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xac]
mov dword [esp + 0x20], eax
cmp eax, dword [esp + 0x58]
jle 0x1003bfd6
mov edx, dword [esp + 0x58]
mov ecx, eax
call fcn.1003b43b
test al, al
mov eax, dword [esp + 0x20]
jne 0x1003bfda
dec eax
jmp 0x1003bfb6
mov eax, dword [esp + 0x2c]
push eax
push 0x1000a6e4
call fcn.1004fea2
pop ecx
pop ecx
mov dword [esp + 0x20], 0x70ab
mov dword [esp + 0x24], 0xd485
mov dword [esp + 0x10], ebx
jmp 0x1003c013
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14c]
mov dword [eax + ecx*4], 0x5c96
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003bffd
mov dword [esp + 0x10], ebx
jmp 0x1003c036
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], 0xce96b779
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1003c020
mov edx, dword [esp + 0x14c]
mov eax, dword [edx + 4]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x134]
mov dword [eax + 8], ecx
mov eax, dword [edx + 4]
imul eax, ecx
inc dword [esp + 0x20]
test eax, eax
jne 0x1003c06e
mov ecx, ebx
cmp dword [esp + 0x30], ebx
je 0x1003c070
mov ecx, edi
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], ecx
cmp dword [esp + 0x2c], edi
jge 0x1003c097
mov dword [esp + 0x24], 0x52280335
mov dword [esp + 0x24], 0xf7bdd484
jmp 0x1003c14b
mov dword [esp + 0x20], 0xa36a
or eax, 0xffffffff
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003c0bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], esi
jmp 0x1003c140
mov dword [esp + 0x24], 0xfffffff7
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003c0f1
push 0xefd
push ebx
push ebx
push 0x8e3
push 0x4eb
push ebx
push 0x2515
call dword [sym.imp.GDI32.dll_GetDIBits]
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp ecx, eax
setne dl
imul eax, edx, 0xfff9
cmp eax, 0xc5a4a104
mov eax, dword [esp + 0x20]
sbb ecx, ecx
add eax, 0xfffffffd
neg ecx
add eax, ecx
jne 0x1003c12e
mov eax, ebx
cmp dword [esp + 0x30], ebx
je 0x1003c130
mov eax, edi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x13
jne 0x1003c0c1
lea ecx, [esp + 0x134]
call fcn.1002c9a6
or eax, 0xffffffff
lea ecx, [esp + 0x14c]
mov dword [esp + 0x1f4], eax
call fcn.1002c9a6
lea eax, [esp + 0x48]
push eax
call fcn.1003d251
push 2
lea ecx, [esp + 0x114]
mov eax, dword [eax]
mov dword [esp + 0x24], eax
or eax, 0xffffffff
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], 0x160c
mov dword [esp + 0x1c], 0xfffffffb
call fcn.1002b976
push 2
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1003c1ba
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x8c], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1003c1ab
mov dword [esp + 0x10], ebx
jmp 0x1003c1dc
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x110]
mov dword [eax + ecx*4], 0xdc86695c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1003c1c6
cmp dword [esp + 0x14], ebx
jne 0x1003c20b
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x90]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x90]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x90], ebx
je 0x1003c230
mov dword [esp + 0x2c], ebx
cmp dword [esp + 0x8c], ebx
jne 0x1003c234
mov dword [esp + 0x2c], edi
mov ecx, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x14]
cmp ecx, eax
setle dl
cmp edx, dword [esp + 0x2c]
jge 0x1003c251
mov ecx, edi
cmp dword [esp + 0x18], ebx
jne 0x1003c253
mov ecx, ebx
mov eax, dword [esp + 0x110]
mov dword [eax], ecx
lea ecx, [esp + 0x110]
call fcn.1002c9a6
cmp byte [ebp + 0xc], 0
jne 0x1003c27a
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x1003cc9b
mov dword [esp + 0x10], 0xfffffff8
mov dword [esp + 0x10], ebx
jmp 0x1003c2be
mov dword [esp + 0x14], 0x31e42a43
mov dword [esp + 0x14], 0xf
jmp 0x1003c2b4
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003c2b0
push 0x12b2
call dword [sym.imp.USER32.dll_GetKeyState]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jge 0x1003c29a
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff8
jg 0x1003c288
mov dword [esp + 0x10], ebx
jmp 0x1003c2f0
mov dword [esp + 0x24], 0x580d416d
cmp dword [esp + 0x24], ebx
jne 0x1003c2f6
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003c2ec
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
je 0x1003c2cb
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x1d8]
mov ecx, dword [esp + 0x48]
push eax
call fcn.10031fc1
cmp byte [ebp + 0xc], 0
lea edi, [esp + 0x98]
mov esi, eax
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x1003c4ed
cmp dword [esp + 0x9c], 0
je 0x1003c4ed
push 2
lea ecx, [esp + 0xd4]
call fcn.1002b976
mov dword [esp + 0x1f4], 8
lea eax, [esp + 0x1b0]
push dword [esp + 0x7c]
movdqa xmm0, xmmword [0x1000ad50]
lea ecx, [esp + 0xc4]
push eax
mov dword [esp + 0x20], 0xfffa
lea eax, [esp + 0x1a8]
mov dword [esp + 0x34], 0xb94d0f4f
push eax
mov dword [esp + 0x3c], 0xf839e071
mov dword [esp + 0x38], 0xa130dfdd
mov dword [esp + 0x40], 0x3813bf58
push ebx
movdqu xmmword [esp + 0x1b0], xmm0
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
call fcn.10031190
mov dword [esp + 0x24], 0x440271db
mov dword [esp + 0x14], ebx
jmp 0x1003c3dc
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xd0]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1003c3c6
mov eax, dword [esp + 0x18]
sub eax, 2
neg eax
sbb eax, eax
inc eax
imul eax, dword [esp + 0x18]
test eax, eax
je 0x1003c411
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp eax, 0xfffffff6
setge cl
sub ecx, 0x1f8ef230
je 0x1003c411
xor eax, eax
inc eax
jmp 0x1003c413
mov eax, ebx
xor edx, edx
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
cmp eax, ecx
mov eax, dword [esp + 0xd0]
setg dl
xor ecx, ecx
cmp dword [eax], edx
mov eax, dword [esp + 0x18]
sete cl
mov dword [esp + 0x24], ecx
xor ecx, ecx
cmp dword [esp + 0x24], eax
sete cl
xor edx, edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
cmp ecx, eax
mov eax, dword [esp + 0xd0]
setne dl
xor ecx, ecx
cmp edx, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [esp + 0x34]
setg cl
mov dword [esp + 0x24], ecx
xor ecx, ecx
cmp dword [esp + 0x24], eax
setle cl
sub ecx, 0x7ea4c57
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, edx
jge 0x1003c492
test edx, edx
je 0x1003c492
xor ecx, ecx
inc ecx
jmp 0x1003c494
mov ecx, ebx
mov eax, dword [esp + 0xc0]
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0xd0]
mov eax, dword [eax]
add eax, ecx
lea ecx, [esp + 0xc0]
mov dword [esp + 0x24], eax
call fcn.1002c9a6
or esi, 0xffffffff
lea ecx, [esp + 0xd0]
mov dword [esp + 0x1f4], esi
call fcn.1002c9a6
mov eax, dword [esp + 0xa0]
mov dword [esp + 0xe4], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0xe8], eax
jmp 0x1003c4f0
or esi, 0xffffffff
cmp dword [esp + 0x20], 0
jne 0x1003cc95
cmp dword [esp + 0x94], 0
jle 0x1003cc95
mov dword [esp + 0x24], esi
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003c537
push 0xd6b
push 0x208a
push 0x189a
push 0x1d45
push 0x187c
call dword [sym.imp.GDI32.dll_Rectangle]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003c54b
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
xor edi, edi
mov dword [esp + 0x1c], esi
inc edi
lea ecx, [esp + 0x128]
push edi
call fcn.1002b976
mov dword [esp + 0x1f4], 9
mov dword [esp + 0x24], 0xb51f0ef2
mov dword [esp + 0x10], ebx
jmp 0x1003c58b
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xcc], 0xe2db
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1003c578
mov dword [esp + 0x10], ebx
jmp 0x1003c5ad
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1003c597
mov dword [esp + 0x1c], 0xffffffe9
cmp dword [esp + 0x1c], 0xfffffff6
jge 0x1003c7bd
mov dword [esp + 0x14], 0xfffffff7
mov dword [esp + 0x14], 0x14
jmp 0x1003c786
push edi
lea ecx, [esp + 0x18c]
call fcn.1002b976
mov byte [esp + 0x1f4], 0xa
mov dword [esp + 0x24], 0x231c
cmp dword [esp + 0x24], 0xba0
jge 0x1003c672
lea eax, [esp + 0x84]
mov dword [esp + 0x84], ebx
push eax
push 0x1000a6d0
call fcn.1004f9db
pop ecx
pop ecx
mov ecx, dword [esp + 0x84]
mov eax, ebx
push 2
pop esi
mov dword [esp + 0x18], eax
cmp ecx, esi
jle 0x1003c649
mov edx, esi
call fcn.1003b599
add ebx, eax
inc esi
cmp esi, ecx
jl 0x1003c631
mov dword [esp + 0x18], ebx
xor ebx, ebx
mov eax, dword [esp + 0x18]
lea esi, [ecx - 2]
mov ecx, eax
mov edx, esi
call fcn.1003b580
mov ecx, eax
mov eax, esi
cdq
idiv ecx
push eax
mov eax, dword [esp + 0x1c]
cdq
idiv ecx
push eax
push 0x1000aab4
call fcn.1004fea2
add esp, 0xc
push 2
lea ecx, [esp + 0x120]
call fcn.1002b976
mov dword [esp + 0x10], ebx
jmp 0x1003c69c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x188]
mov dword [eax + ecx*4], 7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1003c686
mov dword [esp + 0x10], ebx
jmp 0x1003c6be
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], 0xe2bbef7d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003c6a8
mov esi, dword [esp + 0x11c]
mov dword [esi + 4], ebx
mov dword [esp + 0x2c], 0x24b5
xor ecx, ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x9b4af7bd
mov dword [esp + 0x2c], 0x3674
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x128]
mov dword [esp + 0xcc], edi
mov dword [eax], ebx
mov eax, dword [esp + 0x1c]
test eax, eax
setg cl
add ecx, dword [esi + 4]
mov dword [esp + 0x2c], ecx
xor ecx, ecx
cmp dword [esi + 4], 0xfffffffa
mov eax, dword [esp + 0x2c]
setl cl
xor edx, edx
cmp ecx, eax
sete dl
xor ecx, ecx
add edx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
cmp eax, edx
mov eax, dword [esp + 0x1c]
setg cl
add eax, 0x407374fd
add eax, ecx
xor ecx, ecx
cmp eax, 0x881
setne cl
add ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x30]
inc dword [esi + 4]
cmp dword [esi + 4], 0
jle 0x1003c6cf
lea ecx, [esp + 0x11c]
call fcn.1002c9a6
lea ecx, [esp + 0x188]
mov byte [esp + 0x1f4], 9
call fcn.1002c9a6
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe9
je 0x1003c5db
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003c7ab
push ebx
push ebx
push 0x200d
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff6
jl 0x1003c5c6
or esi, 0xffffffff
lea ecx, [esp + 0x128]
mov dword [esp + 0x1f4], esi
call fcn.1002c9a6
mov dword [esp + 0x18], 0x694d
mov dword [esp + 0x24], 0x2b2e
mov dword [esp + 0x14], ebx
jmp 0x1003c7f2
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x4c], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1003c7e6
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003c80b
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 3
mov dword [esp + 0x50], 0xfffffff5
pop esi
cmp dword [esp + 0x4c], 0xffffffec
jl 0x1003c8bf
mov dword [esp + 0x2c], 0xfffffff8
mov ecx, 0xfffd
mov dword [esp + 0x14], 0xdd972c40
mov dword [esp + 0x30], 0xfffffff6
mov dword [esp + 0x34], edi
cmp dword [esp + 0x2c], 0xffff
sbb eax, eax
neg eax
add eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x18]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
mov eax, ebx
setl cl
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x14], ebx
je 0x1003c871
mov eax, edi
xor ecx, ecx
cmp eax, esi
mov eax, dword [esp + 0x18]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [esp + 0x50]
jg 0x1003c89c
mov eax, edi
cmp dword [esp + 0x50], ebx
jne 0x1003c89e
mov eax, ebx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], 0xbac0
dec dword [esp + 0x4c]
jmp 0x1003c816
mov dword [esp + 0x24], 0x1f3f
cmp dword [esp + 0x24], 0x9f7
jge 0x1003c939
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x48]
push eax
push 0x1000aaac
call fcn.1004f9db
mov eax, dword [esp + 0x94]
add esp, 0xc
cmp eax, 0xa
jne 0x1003c95e
cmp dword [esp + 0x44], edi
jne 0x1003c90a
push 0x1000a7fc
call fcn.10050732
pop ecx
jmp 0x1003c939
push 0x1000a8fc
call fcn.1004fea2
mov eax, dword [esp + 0x48]
dec eax
mov dword [esp + 0x28], ebx
pop ecx
test eax, eax
jle 0x1003c939
push 0x1000aac0
call fcn.1004fea2
mov eax, dword [esp + 0x48]
inc ebx
dec eax
pop ecx
cmp ebx, eax
jl 0x1003c922
xor ebx, ebx
cmp dword [esp + 0x98], 0
je 0x1003cc9b
push esi
lea ecx, [esp + 0x144]
call fcn.1002b976
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], ebx
jmp 0x1003c99c
cmp dword [esp + 0x44], 0
mov dword [esp + 0x24], ebx
jle 0x1003c939
push eax
push 0x1000a6cc
call fcn.1004fea2
inc ebx
pop ecx
pop ecx
cmp ebx, dword [esp + 0x44]
jge 0x1003c937
mov eax, dword [esp + 0x88]
jmp 0x1003c969
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], 0xb110c93b
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x1003c986
mov ecx, dword [esp + 0x140]
mov dword [ecx + 8], 0xffffffec
mov dword [esp + 0x24], 0x7e17
mov dword [esp + 0x34], esi
mov eax, dword [esp + 0x24]
inc dword [ecx + 8]
cmp dword [ecx + 8], 0xc
mov dword [esp + 0x34], eax
jle 0x1003c9b0
lea ecx, [esp + 0x140]
call fcn.1002c9a6
mov ecx, dword [esp + 0x98]
call fcn.1003b403
push dword [esp + 0x7c]
movdqa xmm0, xmmword [0x1000adb0]
lea ecx, [esp + 0xf0]
mov dword [esp + 0x24], eax
or eax, 0xffffffff
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1d4]
push eax
mov dword [esp + 0x20], 0xfffffffe
lea eax, [esp + 0x1c8]
mov dword [esp + 0x34], 0xc4307e4
push eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x30], 0x3d37f4a1
mov dword [esp + 0x30], 0xfaa9634d
push ebx
movdqu xmmword [esp + 0x1d0], xmm0
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0x104], ebx
call fcn.10031190
mov dword [esp + 0x1f4], 0xb
mov dword [esp + 0x28], ebx
jmp 0x1003ca7f
mov eax, dword [esp + 0x28]
mov dword [esp + eax*4 + 0x164], edi
inc dword [esp + 0x28]
cmp dword [esp + 0x28], edi
jl 0x1003ca70
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003ca96
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
cmp eax, dword [esp + 0x18]
jle 0x1003cab0
mov edx, ebx
cmp dword [esp + 0x18], ebx
je 0x1003cab2
mov edx, edi
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x14]
setle cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
setg dl
mov dword [esp + 0x24], edx
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x18]
setl dl
sub edx, dword [esp + 0x24]
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp esi, eax
setl cl
xor eax, eax
add ecx, dword [esp + 0x10]
cmp ecx, 0xfffffffe
setl al
cmp edi, eax
sbb eax, eax
neg eax
cmp eax, dword [esp + 0x10]
jne 0x1003cc0a
cmp dword [esp + 0x18], ebx
jne 0x1003cc0a
push 4
lea ecx, [esp + 0x198]
call fcn.1002b976
mov byte [esp + 0x1f4], 0xc
mov dword [esp + 0x10], ebx
jmp 0x1003cb4d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x194]
mov dword [eax + ecx*4], 6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1003cb37
mov dword [esp + 0x10], ebx
jmp 0x1003cb6d
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x168], 0xfffffff6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1003cb5a
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003cb85
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 3
mov dword [esp + 0x18], ebx
pop esi
jmp 0x1003cbf6
push 2
lea ecx, [esp + 0x15c]
call fcn.1002b976
push 2
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1003cbb4
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1d0], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1003cba5
mov dword [esp + 0x10], ebx
jmp 0x1003cbd6
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x158]
mov dword [eax + ecx*4], 0x1ffbe626
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1003cbc0
mov eax, dword [esp + 0x158]
lea ecx, [esp + 0x158]
inc dword [eax + 4]
call fcn.1002c9a6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x1003cb8e
lea ecx, [esp + 0x194]
call fcn.1002c9a6
jmp 0x1003cc6d
mov dword [esp + 0x14], edi
or eax, 0xffffffff
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], 0x15
jmp 0x1003cc2b
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1c
jne 0x1003cc1f
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 0xffffffe9
jle 0x1003cc6a
mov dword [esp + 0x18], ebx
jmp 0x1003cc56
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1b0], 0xc44d9964
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1003cc43
dec dword [esp + 0x1b0]
dec dword [esp + 0x14]
jmp 0x1003cc36
push 3
pop esi
or eax, 0xffffffff
lea ecx, [esp + 0xec]
mov dword [esp + 0x1f4], eax
call fcn.1002c9a6
lea eax, [esp + 0x48]
push eax
call fcn.1003d251
mov ecx, dword [esp + 0x20]
mov dword [eax], ecx
jmp 0x1003cc9b
push 3
xor edi, edi
pop esi
inc edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x10], ebx
jmp 0x1003ccca
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], ebx
jne 0x1003ccd1
mov dword [esp + 0x14], ebx
jmp 0x1003ccbf
cmp dword [esp + 0x10], ebx
jne 0x1003ccc6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xd
jl 0x1003ccb5
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffea
jg 0x1003cca5
mov dword [esp + 0x10], 0xfffffffd
jmp 0x1003cd4b
push 2
lea ecx, [esp + 0xfc]
call fcn.1002b976
mov dword [esp + 0x14], ebx
jmp 0x1003cd05
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0x7e4fc22
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1003ccef
mov eax, dword [esp + 0xf8]
mov dword [eax], ebx
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003cd2d
push 0x11f0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [esp + 0xf8]
dec dword [eax]
cmp dword [eax], 0xfffffff4
jne 0x1003cd15
lea ecx, [esp + 0xf8]
call fcn.1002c9a6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 6
jge 0x1003ccdb
lea ecx, [esp + 0x94]
call section..rodqr_1
mov dword [esp + 0x28], 0x16df251d
mov dword [esp + 0x14], ebx
jmp 0x1003cd7c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x74], 0x4a8c6a53
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1003cd6c
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x28], ebx
jl 0x1003cdc6
mov dword [esp + 0x18], ebx
mov dword [esp + 0x18], ebx
jmp 0x1003cdba
mov dword [esp + 0x14], 0x1dfe4b28
mov dword [esp + 0x14], ebx
jmp 0x1003cdb0
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x74], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1003cda4
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x1003cd96
dec dword [esp + 0x28]
jns 0x1003cd8c
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x28], ebx
jl 0x1003cdfe
mov dword [esp + 0x18], 0xfffffffb
mov dword [esp + 0x18], ebx
jmp 0x1003cdf2
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + eax*4 + 0x74]
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x74], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x1003cdde
dec dword [esp + 0x28]
jns 0x1003cdd0
cmp dword [esp + 0x20], 0
je 0x1003ceea
push esi
lea ecx, [esp + 0x108]
call fcn.1002b976
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], 0x54c97515
mov dword [esp + 0x34], 0xfffffff7
mov dword [esp + 0x54], 0x3e19f23e
mov dword [esp + 0x10], ebx
jmp 0x1003ce4e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x104]
mov dword [eax + ecx*4], 5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1003ce38
mov dword [esp + 0x10], ebx
jmp 0x1003ce6d
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xbc], 0xd56974ed
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1003ce5a
mov eax, dword [esp + 0x104]
cmp dword [eax], ebx
jne 0x1003ceac
mov dword [esp + 0x14], 0xfffffffb
xor edx, edx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x104]
cmp dword [eax], ecx
setg dl
mov dword [esp + 0x34], edx
mov eax, dword [esp + 0x54]
add eax, dword [esp + 0x14]
jne 0x1003ceac
mov edi, ebx
imul eax, edi, 0x509e
lea ecx, [esp + 0x104]
mov dword [esp + 0xbc], eax
call fcn.1002c9a6
mov edx, dword [esp + 0x78]
mov ecx, dword [esp + 0x20]
call fcn.1003b431
mov esi, eax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0xe4], esi
call fcn.1003d1ef
mov dword [eax], esi
mov dword [esp + 0x30], 0xbeaa
mov dword [esp + 0x28], 0x57102d14
mov dword [esp + 0x24], 0xadd5d088
mov dword [esp + 0x14], 0x88c5540f
mov dword [esp + 0x24], 0x88d239be
mov dword [esp + 0x20], ebx
jmp 0x1003cf2b
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x180], 0xb69b2e41
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1003cf18
mov eax, dword [esp + 0x30]
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], 5
cmp dword [esp + 0x28], 0x1d
jne 0x1003cf9a
push 3
pop ecx
mov dword [esp + 0x2c], 6
mov dword [esp + 0x24], 0x21fbb9cf
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x184], ecx
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0x1d
je 0x1003cf4c
mov eax, dword [ebp + 8]
lea esi, [esp + 0xe0]
mov ecx, dword [esp + 0x1ec]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret