Function at 0x1002d3f5
Capabilities:
Clear file content
Create pipe
Create process on windows
Enumerate files on windows
Enumerate gui resources
Get common file path
Get file attributes
Get graphical window text
Get thread local storage value
Identify system language via api
Log keystrokes via polling
Parse pe header
Query environment variable
Query service status
Start service
Write and execute a file

Disassembly:
mov eax, 0x1007aa2a
call fcn.100794c8
mov eax, 0x14b4
call fcn.10074bf0
push ebx
push esi
push edi
push 4
pop eax
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x1e0]
push eax
mov byte [ebp - 0x65], dl
call fcn.100159d0
xor eax, eax
lea ecx, [ebp - 0x11f4]
mov dword [ebp - 4], eax
movdqa xmm0, xmmword [0x10007c70]
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x10d0]
push eax
lea eax, [ebp - 0x10e0]
push eax
movdqu xmmword [ebp - 0x10e0], xmm0
call fcn.10015a80
lea ecx, [ebp - 0x1b4]
mov esi, eax
call fcn.10015a7d
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xcac]
push dword [esi]
call fcn.10015a2c
push 4
xor ebx, ebx
lea ecx, [ebp - 0x694]
inc ebx
pop eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x48], ebx
push eax
call fcn.100159d0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x40], 0x7df39f3c
push 4
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1002d4c8
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1e0]
call fcn.10015a6e
push 4
pop ecx
mov dword [eax], 0x81d2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002d4a7
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002d4e8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x318], 0x2db80ebb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002d4d0
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002d508
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x12bc], 0xdb8846b5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002d4f0
xor eax, eax
mov dword [ebp - 0x20], eax
push 7
pop ebx
cmp dword [ebp - 0x20], ecx
jge 0x1002d52e
push dword [ebp - 0x20]
lea ecx, [ebp - 0x694]
call fcn.10015a6e
push 4
mov dword [eax], ebx
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], eax
jl 0x1002d513
push 3
pop edi
push edi
lea ecx, [ebp - 0x1e0]
call fcn.10015a6e
xor ebx, ebx
cmp dword [eax], ebx
jne 0x1002d605
push edi
lea ecx, [ebp - 0x1e0]
call fcn.10015a6e
cmp dword [eax], ebx
je 0x1002d58b
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1e0]
push edi
call fcn.10015a6e
xor eax, eax
lea ecx, [ebp - 0x1e0]
push eax
call fcn.10015a6e
mov eax, dword [eax]
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002d58d
lea esi, [eax + 1]
jmp 0x1002d58f
xor eax, eax
mov esi, eax
push edi
lea ecx, [ebp - 0x1e0]
call fcn.10015a6e
lea ecx, [esi + 0x11db4d18]
xor ebx, ebx
push edi
cmp ecx, dword [eax]
lea ecx, [ebp - 0xcac]
setge bl
call fcn.10015a6e
push edi
lea ecx, [ebp - 0x1e0]
mov dword [eax], ebx
mov dword [ebp - 0x48], ebx
call fcn.10015a6e
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0x1e0]
mov eax, dword [eax]
add esi, eax
xor eax, eax
mov dword [ebp - 0x12b0], esi
inc eax
push eax
call fcn.10015a6e
mov ecx, dword [ebp - 0x18]
mov edi, eax
xor eax, eax
cmp esi, 0x37fc
setne al
xor edx, edx
cmp eax, ecx
setle dl
cmp dword [edi], edx
jne 0x1002d605
xor eax, eax
xor edi, edi
mov ecx, eax
inc edi
jmp 0x1002d60a
xor edi, edi
inc edi
mov ecx, edi
mov eax, dword [ebp - 0x18]
imul eax, ecx
mov ecx, 0xc4eb0a11
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, 0x6709e149
jle 0x1002d628
mov eax, dword [ebp - 0x318]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x694]
xor eax, eax
push eax
call fcn.10015a6e
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x1e0]
mov dword [eax], 9
call fcn.10015a6e
push 2
lea ecx, [ebp - 0x694]
call fcn.10015a6e
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002d681
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
lea ecx, [ebp - 0x694]
call fcn.10015a52
lea ecx, [ebp - 0xcac]
call fcn.10015a52
or eax, 0xffffffff
lea ecx, [ebp - 0x1e0]
mov dword [ebp - 4], eax
call fcn.10015a52
push 4
pop eax
push eax
lea ecx, [ebp - 0x24c]
call fcn.100159d0
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x125c]
movdqa xmm0, xmmword [0x10007c70]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0xf90]
push eax
lea eax, [ebp - 0xfa0]
push eax
movdqu xmmword [ebp - 0xfa0], xmm0
call fcn.10015a80
lea ecx, [ebp - 0x1c4]
mov esi, eax
call fcn.10015a7d
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xe94]
push dword [esi]
call fcn.10015a2c
push 4
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x814]
mov dword [ebp - 0x48], edi
push eax
call fcn.100159d0
mov byte [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x40], 0x7df39f3c
push 4
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1002d75a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24c]
call fcn.10015a6e
push 4
pop ecx
mov dword [eax], 0x81d2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002d739
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1002d77a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x320], 0x2db80ebb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1002d762
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002d79a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x12d4], 0xdb8846b5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002d782
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002d7c0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x814]
call fcn.10015a6e
push 7
pop ecx
push 4
mov dword [eax], ecx
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], eax
jl 0x1002d7a2
push ebx
lea ecx, [ebp - 0x24c]
call fcn.10015a6e
xor ebx, ebx
cmp dword [eax], ebx
jne 0x1002d895
push 3
lea ecx, [ebp - 0x24c]
call fcn.10015a6e
cmp dword [eax], ebx
je 0x1002d81b
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x24c]
push 3
call fcn.10015a6e
xor eax, eax
lea ecx, [ebp - 0x24c]
push eax
call fcn.10015a6e
mov eax, dword [eax]
mov dword [ebp - 0x320], eax
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002d81d
mov esi, edi
jmp 0x1002d81f
xor eax, eax
mov esi, eax
push 3
lea ecx, [ebp - 0x24c]
call fcn.10015a6e
lea ecx, [esi + 0x11db4d18]
xor ebx, ebx
push 3
cmp ecx, dword [eax]
lea ecx, [ebp - 0xe94]
setge bl
call fcn.10015a6e
push 3
lea ecx, [ebp - 0x24c]
mov dword [eax], ebx
mov dword [ebp - 0x48], ebx
call fcn.10015a6e
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0x24c]
xor ebx, ebx
inc ebx
mov eax, dword [eax]
add esi, eax
mov dword [ebp - 0x12c8], esi
push ebx
call fcn.10015a6e
mov ecx, dword [ebp - 0x18]
mov edi, eax
xor eax, eax
cmp esi, 0x37fc
setne al
xor edx, edx
cmp eax, ecx
setle dl
cmp dword [edi], edx
jne 0x1002d898
xor eax, eax
mov ecx, eax
jmp 0x1002d89a
xor ebx, ebx
inc ebx
mov ecx, ebx
mov eax, dword [ebp - 0x18]
imul eax, ecx
mov ecx, 0xc4eb0a11
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, 0x6709e149
jle 0x1002d8b8
mov eax, dword [ebp - 0x320]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x814]
xor eax, eax
push eax
call fcn.10015a6e
push 3
pop edi
push edi
lea ecx, [ebp - 0x24c]
mov dword [eax], 9
call fcn.10015a6e
push 2
pop esi
push esi
lea ecx, [ebp - 0x814]
call fcn.10015a6e
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002d913
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
lea ecx, [ebp - 0x814]
call fcn.10015a52
lea ecx, [ebp - 0xe94]
call fcn.10015a52
or eax, 0xffffffff
lea ecx, [ebp - 0x24c]
mov dword [ebp - 4], eax
call fcn.10015a52
push 4
pop eax
push eax
lea ecx, [ebp - 0x234]
call fcn.100159d0
mov dword [ebp - 4], 6
or eax, 0xffffffff
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], 0x6a3735b2
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x48], 0x7b051af7
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x40], 0x6d0c11e0
mov dword [ebp - 0x38], 0xc3b7c39c
mov dword [ebp - 0x38], 0x2d683a7e
mov dword [ebp - 0x38], 0x9a488d5
mov dword [ebp - 0x38], 0x4186e145
mov dword [ebp - 0x38], 0xba1dd793
mov dword [ebp - 0x38], 0x2b4cf22a
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], 0xb56bf5e
mov dword [ebp - 0x1c], eax
jmp 0x1002d9c0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x126c], 0xc23782ec
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002d9af
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002d9e8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x18]
test eax, eax
je 0x1002d9e6
mov ecx, ebx
jmp 0x1002d9ea
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
imul eax, ecx, 0xfffffff9
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
imul ecx, dword [ebp - 0x1c], 0xff63
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x30], eax
je 0x1002da3d
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x28]
test eax, eax
jne 0x1002da3b
mov ecx, ebx
jmp 0x1002da3f
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x14]
imul eax, ecx
lea ecx, [ebp - 0x888]
push 0xfffffffffffffff9
mov dword [ebp - 0x1c], eax
pop eax
mov dword [ebp - 0x2c], eax
push esi
call fcn.100159d0
push 7
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002da92
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x888]
call fcn.10015a6e
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002da74
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002dad7
mov dword [ebp - 0x1c], 0x351f2000
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x1002dad4
mov dword [ebp - 0x48], 0xdfbd
lea ecx, [ebp - 0x888]
inc dword [ebp - 0x48]
push dword [ebp - 0x30]
call fcn.10015a6e
cmp dword [eax], 0
jne 0x1002dad2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1002daad
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x1002da97
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], 6
call fcn.10015a52
or eax, 0xffffffff
lea ecx, [ebp - 0x5c0]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], 0x9598aaf0
push edi
call fcn.100159d0
push 8
pop eax
push 4
mov byte [ebp - 4], al
lea ecx, [ebp - 0xabc]
pop eax
mov dword [ebp - 0x48], 0x491ba6b4
push eax
call fcn.100159d0
push ebx
lea ecx, [ebp - 0x894]
mov byte [ebp - 4], 9
call fcn.100159d0
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1002db5c
push dword [ebp - 0x20]
lea ecx, [ebp - 0x5c0]
call fcn.10015a6e
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1002db3e
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002db7c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf2c], 0xfffffffb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002db64
xor eax, eax
push 4
mov dword [ebp - 0x20], eax
pop esi
cmp dword [ebp - 0x20], esi
jge 0x1002dba5
push dword [ebp - 0x20]
lea ecx, [ebp - 0xabc]
call fcn.10015a6e
mov dword [eax], 0x5bb08661
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002db87
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002dbbe
push dword [ebp - 0x20]
lea ecx, [ebp - 0x894]
call fcn.10015a6e
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002dbaa
inc dword [ebp - 0x14]
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
lea ecx, [ebp - 0x5c0]
setne bl
xor esi, esi
inc esi
push esi
call fcn.10015a6e
xor edx, edx
mov dword [eax], ebx
mov eax, dword [ebp - 0x14]
cmp ebx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
add edx, 0x7f191253
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, 0x6572
setg dl
xor eax, eax
cmp edx, 0x17f4
mov dword [ebp - 0xf28], edx
setne al
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002dc2d
mov eax, dword [ebp - 0x14]
push esi
lea ecx, [ebp - 0x5c0]
call fcn.10015a6e
xor eax, eax
lea ecx, [ebp - 0x5c0]
push eax
call fcn.10015a6e
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xabc]
push 2
xor ebx, ebx
cmp eax, 0xffffffff
pop esi
push esi
setge bl
call fcn.10015a6e
lea ecx, [ebp - 0x894]
mov dword [eax], ebx
xor eax, eax
test ebx, ebx
setne al
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
call fcn.10015a6e
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x40]
imul ecx, ecx, 0x3248
mov dword [eax], ecx
lea ecx, [ebp - 0x894]
call fcn.10015a52
lea ecx, [ebp - 0xabc]
call fcn.10015a52
lea ecx, [ebp - 0x5c0]
mov byte [ebp - 4], 6
call fcn.10015a52
xor eax, eax
lea ecx, [ebp - 0xcc4]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], 0x49fe387
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0xfffffffd
push esi
call fcn.100159d0
xor ebx, ebx
mov byte [ebp - 4], 0xb
inc ebx
lea ecx, [ebp - 0x8ac]
mov dword [ebp - 0x38], ebx
push esi
call fcn.100159d0
xor eax, eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002dd14
push dword [ebp - 0x14]
lea ecx, [ebp - 0xcc4]
call fcn.10015a6e
or dword [eax], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002dcf9
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002dd3a
push dword [ebp - 0x14]
lea ecx, [ebp - 0x8ac]
call fcn.10015a6e
mov dword [eax], 0x75158018
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002dd1c
xor eax, eax
push eax
lea ecx, [ebp - 0x8ac]
call fcn.10015a6e
lea ecx, [ebp - 0x8ac]
dec dword [eax]
call fcn.10015a52
lea ecx, [ebp - 0xcc4]
mov byte [ebp - 4], 6
call fcn.10015a52
movdqa xmm0, xmmword [0x10007c70]
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x1080]
push eax
lea ecx, [ebp - 0x13a4]
movdqu xmmword [ebp - 0x1080], xmm0
call fcn.10015a80
lea ecx, [ebp - 0x1d3]
mov esi, eax
call fcn.10015a7d
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xe14]
push dword [esi]
call fcn.10015a2c
push 8
mov byte [ebp - 4], 0xd
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002ddc7
push eax
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
xor eax, eax
mov dword [ebp - 0x30], eax
or ecx, 0xffffffff
jmp 0x1002de0b
mov dword [ebp - 0x1c], 0x22124f84
mov dword [ebp - 0x38], 0x9ac54c97
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff2
jl 0x1002de08
mov dword [ebp - 0x38], 0xa9b64fda
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff2
push 0
pop eax
jge 0x1002ddec
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jg 0x1002ddcf
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
jmp 0x1002de35
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x94], 0xfffffff8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002de24
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, 0x795010f7
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, 0xfffffffd
setle cl
sub eax, ecx
je 0x1002dee6
mov dword [ebp - 0x28], 5
xor eax, eax
mov dword [ebp - 0x40], 0x498d20b5
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x1002deb2
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x94]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002dea3
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002dea0
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002de8c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x1002de78
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002dedb
mov dword [ebp - 0x38], 0xd8ff8cd3
mov dword [ebp - 0x38], 0x177c
mov dword [ebp - 0x40], 0xa1ee3199
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x38
je 0x1002deb7
jmp 0x1002dfe9
mov dword [ebp - 0x28], 0xd7d5
xor eax, eax
mov dword [ebp - 0x48], 0x59a67e99
mov dword [ebp - 0x3c], 0xf6bb026e
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x58], 0xc5df97f
mov dword [ebp - 0x38], 0xffea059e
mov dword [ebp - 0x14], 0xaa6f69a7
mov dword [ebp - 0x40], 2
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002df43
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x14b0], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002df2b
xor eax, eax
mov dword [ebp - 0x20], 0x10
jmp 0x1002df90
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], 0x5f9b
jg 0x1002df67
cmp dword [ebp - 0x94], eax
je 0x1002df67
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], 0x46c64e71
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
cmp eax, edx
push 0
setle cl
mov dword [ebp - 0x94], ecx
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], 0x3b
jg 0x1002df4c
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002dfc6
cmp dword [ebp - 0x48], eax
jne 0x1002dfc6
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x3c]
sub eax, 0x4ef5d9ce
je 0x1002dfe1
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002dfe3
mov eax, ebx
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x820]
push 4
mov dword [ebp - 0x94], eax
pop eax
push eax
call fcn.100159d0
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x40], 0x7df39f3c
push 4
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1002e03a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x234]
call fcn.10015a6e
push 4
pop ecx
mov dword [eax], 0x81d2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002e019
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002e05a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x348], 0x2db80ebb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002e042
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002e07a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x12f4], 0xdb8846b5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002e062
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002e0a0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x820]
call fcn.10015a6e
push 7
pop ecx
push 4
mov dword [eax], ecx
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], eax
jl 0x1002e082
push edi
lea ecx, [ebp - 0x234]
call fcn.10015a6e
xor ebx, ebx
cmp dword [eax], ebx
jne 0x1002e171
push edi
lea ecx, [ebp - 0x234]
call fcn.10015a6e
cmp dword [eax], ebx
je 0x1002e0fa
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x234]
push edi
call fcn.10015a6e
xor eax, eax
lea ecx, [ebp - 0x234]
push eax
call fcn.10015a6e
mov eax, dword [eax]
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002e0fc
lea esi, [eax + 1]
jmp 0x1002e0fe
xor eax, eax
mov esi, eax
push edi
lea ecx, [ebp - 0x234]
call fcn.10015a6e
lea ecx, [esi + 0x11db4d18]
xor ebx, ebx
push edi
cmp ecx, dword [eax]
lea ecx, [ebp - 0xe14]
setge bl
call fcn.10015a6e
push edi
lea ecx, [ebp - 0x234]
mov dword [eax], ebx
mov dword [ebp - 0x48], ebx
call fcn.10015a6e
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0x234]
xor ebx, ebx
inc ebx
mov eax, dword [eax]
add esi, eax
mov dword [ebp - 0x12e8], esi
push ebx
call fcn.10015a6e
mov ecx, dword [ebp - 0x2c]
mov edi, eax
xor eax, eax
cmp esi, 0x37fc
setne al
xor edx, edx
cmp eax, ecx
setle dl
cmp dword [edi], edx
jne 0x1002e174
xor eax, eax
mov ecx, eax
jmp 0x1002e176
xor ebx, ebx
inc ebx
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
imul eax, ecx
mov ecx, 0xc4eb0a11
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, 0x6709e149
jle 0x1002e194
mov eax, dword [ebp - 0x348]
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x820]
xor eax, eax
push eax
call fcn.10015a6e
push 3
pop edi
push edi
lea ecx, [ebp - 0x234]
mov dword [eax], 9
call fcn.10015a6e
push 2
pop esi
push esi
lea ecx, [ebp - 0x820]
call fcn.10015a6e
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002e1ef
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
lea ecx, [ebp - 0x820]
call fcn.10015a52
lea ecx, [ebp - 0xe14]
call fcn.10015a52
or eax, 0xffffffff
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], eax
call fcn.10015a52
push edi
lea ecx, [ebp - 0xcdc]
call fcn.100159d0
mov dword [ebp - 4], 0xf
mov eax, 0xffff
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002e259
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xcdc]
call fcn.10015a6e
mov dword [eax], 0xae9714a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002e23b
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002e271
push eax
push eax
push 0xa4a
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
inc dword [ebp - 0x48]
lea ecx, [ebp - 0xcdc]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10015a52
mov dword [ebp - 0x3c], 5
xor eax, eax
mov dword [ebp - 0x48], ebx
push 4
mov dword [ebp - 0x1c], 0xbaf9eb11
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x1002e2b1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x130c], 0x158f8766
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002e2a0
mov dword [ebp - 0x3c], 0xfffffffd
cmp dword [ebp - 0x3c], 0xffffffef
jg 0x1002e43f
push ebx
lea ecx, [ebp - 0x420]
call fcn.100159d0
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x18], 0xd76d
mov dword [ebp - 0x48], 0x7c4177fd
mov dword [ebp - 0x40], 0x18da91e5
mov dword [ebp - 0x1c], eax
jmp 0x1002e30a
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x420]
call fcn.10015a6e
and dword [eax], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002e2f6
mov eax, dword [ebp - 0x3c]
mov ecx, 0xa9413e45
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
cmp ecx, 0x1982
je 0x1002e345
xor eax, eax
lea ecx, [ebp - 0x420]
push eax
call fcn.10015a6e
cmp dword [eax], 0
je 0x1002e345
xor eax, eax
jmp 0x1002e347
mov eax, ebx
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x420]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x1c]
neg esi
sbb esi, esi
xor eax, eax
push eax
neg esi
call fcn.10015a6e
mov ecx, dword [ebp - 0x3c]
xor edx, edx
add ecx, esi
cmp ecx, dword [eax]
setne dl
sub edx, 0x2b83
neg edx
sbb edx, edx
inc edx
cmp edx, 0xfffa
jne 0x1002e389
mov eax, dword [ebp - 0x18]
xor eax, eax
lea ecx, [ebp - 0x420]
push eax
call fcn.10015a6e
xor eax, eax
lea ecx, [ebp - 0x420]
push eax
call fcn.10015a6e
lea ecx, [ebp - 0x420]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1308], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
xor eax, eax
push eax
call fcn.10015a6e
mov edx, dword [ebp - 0x18]
xor ecx, ecx
imul edx, dword [eax]
mov eax, dword [ebp - 0x3c]
cmp edx, eax
mov eax, 0x975a1448
sete cl
cmp eax, ecx
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x3c]
test eax, eax
je 0x1002e409
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002e40b
mov ecx, ebx
jmp 0x1002e40d
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0x32ca
lea ecx, [ebp - 0x420]
sete al
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10015a52
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffef
jle 0x1002e2c7
push 2
pop esi
push 4
pop ecx
push ecx
lea ecx, [ebp - 0x264]
call fcn.100159d0
mov dword [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x14], 0x1a049fe3
mov dword [ebp - 0x30], 0x6b5b3847
mov dword [ebp - 0x48], 0xd2ae857b
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x14], eax
jmp 0x1002e50d
mov dword [ebp - 0x18], 0x8d9dcee3
or eax, 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp ecx, eax
sbb ecx, ecx
xor eax, eax
neg ecx
imul ecx, dword [ebp - 0x1c]
cmp edx, ecx
setle al
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x14]
je 0x1002e4b8
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov ecx, 0x80c6548a
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x56411d7f
setg cl
inc ecx
neg ecx
sbb ecx, ecx
add ecx, 0xffff00b5
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0xd732
test eax, eax
jne 0x1002e4f5
cmp dword [ebp - 0x30], eax
je 0x1002e4f7
mov eax, ebx
mov dword [ebp - 0x48], eax
xor ecx, ecx
mov eax, dword [ebp - 0x48]
cmp eax, 0x9495
setl cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffd
jle 0x1002e474
push 0xfffffffffffffff9
pop eax
push 4
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x180]
pop eax
push eax
call fcn.100159d0
push 4
pop eax
push eax
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 0x12
call fcn.100159d0
push edi
lea ecx, [ebp - 0x64c]
mov byte [ebp - 4], 0x13
call fcn.100159d0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xe24]
mov dword [ebp - 0x24], 0x1d319d7f
push edi
call fcn.100159d0
mov byte [ebp - 4], 0x15
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x38], 0xff73
push 4
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1002e5a5
push dword [ebp - 0x20]
lea ecx, [ebp - 0x180]
call fcn.10015a6e
push 4
and dword [eax], 0
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], eax
jl 0x1002e584
push 4
xor eax, eax
pop ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002e5cb
push dword [ebp - 0x20]
lea ecx, [ebp - 0x414]
call fcn.10015a6e
push 4
or dword [eax], 0xffffffff
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], eax
jl 0x1002e5ad
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1002e5f1
push dword [ebp - 0x20]
lea ecx, [ebp - 0x64c]
call fcn.10015a6e
mov dword [eax], 0xe1d4595a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1002e5d3
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002e60d
push dword [ebp - 0x20]
lea ecx, [ebp - 0xe24]
call fcn.10015a6e
mov dword [eax], 0xc454
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1002e5f6
push esi
lea ecx, [ebp - 0x414]
call fcn.10015a6e
mov dword [eax], edi
jmp 0x1002e859
mov dword [ebp - 0x3c], 0xb8c3ad3b
xor eax, eax
mov dword [ebp - 0x40], 0x6b93dced
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002e655
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xef4], 0x874acc01
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002e63d
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], edi
jg 0x1002e83f
jmp 0x1002e665
xor eax, eax
mov dword [ebp - 0x28], 0xcf9e8bfa
mov dword [ebp - 0x1c], eax
jmp 0x1002e67e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa14], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002e671
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x180]
call fcn.10015a6e
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x64c]
mov dword [ebp - 0xa10], eax
push ebx
call fcn.10015a6e
mov ecx, dword [ebp - 0x3c]
mov edx, 0xcc5c6a3f
push dword [ebp - 0x3c]
cmp edx, ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x180]
call fcn.10015a6e
mov dword [ebp - 0xef0], ebx
lea ecx, [ebp - 0x180]
push dword [ebp - 0x3c]
call fcn.10015a6e
xor eax, eax
lea ecx, [ebp - 0x180]
push eax
call fcn.10015a6e
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x180]
call fcn.10015a6e
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x180]
call fcn.10015a6e
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x414]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
push ebx
call fcn.10015a6e
push edi
lea ecx, [ebp - 0x180]
mov eax, dword [eax]
mov dword [ebp - 0xa0c], eax
call fcn.10015a6e
cmp dword [eax], 0xfffffffc
jg 0x1002e780
mov dword [ebp - 0x18], 0xfffffffd
lea ecx, [ebp - 0x180]
or eax, 0xffffffff
mov dword [ebp - 0x48], 0xb2de47e5
mov dword [ebp - 0xa0c], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
push dword [ebp - 0x3c]
call fcn.10015a6e
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x180]
mov eax, dword [ebp - 0x40]
push edi
call fcn.10015a6e
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x18]
mov dword [ebp - 0xeec], ebx
jmp 0x1002e830
xor eax, eax
mov dword [ebp - 0x48], 0x845
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002e79c
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002e827
movdqa xmm0, xmmword [0x10007ce0]
lea eax, [ebp - 0xfb0]
push eax
lea eax, [ebp - 0xfc0]
push eax
lea ecx, [ebp - 0x127c]
movdqu xmmword [ebp - 0xfc0], xmm0
call fcn.10015a80
lea ecx, [ebp - 0x1aa]
mov esi, eax
call fcn.10015a7d
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xcf4]
push dword [esi]
call fcn.10015a2c
xor eax, eax
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x48], ebx
lea ecx, [ebp - 0x64c]
push eax
call fcn.10015a6e
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0xcf4]
sub esi, dword [eax]
xor eax, eax
push eax
call fcn.10015a6e
lea ecx, [ebp - 0xcf4]
mov byte [ebp - 4], 0x15
mov dword [eax], esi
call fcn.10015a52
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x1002e7a4
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jle 0x1002e663
push 2
pop esi
push ebx
lea ecx, [ebp - 0x64c]
call fcn.10015a6e
push esi
lea ecx, [ebp - 0x414]
call fcn.10015a6e
dec dword [eax]
push esi
lea ecx, [ebp - 0x414]
call fcn.10015a6e
cmp dword [eax], 0
jge 0x1002e625
or eax, 0xffffffff
lea ecx, [ebp - 0xe24]
mov dword [ebp - 0x24], eax
call fcn.10015a52
lea ecx, [ebp - 0x64c]
call fcn.10015a52
lea ecx, [ebp - 0x414]
call fcn.10015a52
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 0x11
call fcn.10015a52
or eax, 0xffffffff
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], 0x6a3735b2
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x48], 0x7b051af7
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x40], 0x6d0c11e0
mov dword [ebp - 0x38], 0xc3b7c39c
mov dword [ebp - 0x38], 0x2d683a7e
mov dword [ebp - 0x38], 0x9a488d5
mov dword [ebp - 0x38], 0x4186e145
mov dword [ebp - 0x38], 0xba1dd793
mov dword [ebp - 0x38], 0x2b4cf22a
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], 0xb56bf5e
mov dword [ebp - 0x1c], eax
jmp 0x1002e914
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x128c], 0xc23782ec
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002e903
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002e93c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x18]
test eax, eax
je 0x1002e93a
mov ecx, ebx
jmp 0x1002e93e
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
imul eax, ecx, 0xfffffff9
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
imul ecx, dword [ebp - 0x1c], 0xff63
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x30], eax
je 0x1002e991
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x28]
test eax, eax
jne 0x1002e98f
mov ecx, ebx
jmp 0x1002e993
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x14]
imul eax, ecx
lea ecx, [ebp - 0x8c4]
push esi
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x48], eax
call fcn.100159d0
mov byte [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002e9e3
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x8c4]
call fcn.10015a6e
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002e9c5
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002ea28
mov dword [ebp - 0x1c], 0x351f2000
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x1002ea25
mov dword [ebp - 0x48], 0xdfbd
lea ecx, [ebp - 0x8c4]
inc dword [ebp - 0x48]
push dword [ebp - 0x30]
call fcn.10015a6e
cmp dword [eax], 0
jne 0x1002ea23
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1002e9fe
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x1002e9e8
lea ecx, [ebp - 0x8c4]
mov byte [ebp - 4], 0x11
call fcn.10015a52
movdqa xmm0, xmmword [0x10007c70]
lea eax, [ebp - 0x1110]
push eax
lea eax, [ebp - 0x1120]
push eax
lea ecx, [ebp - 0x1404]
movdqu xmmword [ebp - 0x1120], xmm0
call fcn.10015a80
lea ecx, [ebp - 0x1ab]
mov esi, eax
call fcn.10015a7d
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xd3c]
push dword [esi]
call fcn.10015a2c
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x520]
or eax, 0xffffffff
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], 0x9598aaf0
push edi
call fcn.100159d0
push 4
pop esi
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x8dc]
mov dword [ebp - 0x48], 0x491ba6b4
push esi
call fcn.100159d0
push ebx
lea ecx, [ebp - 0xb1c]
mov byte [ebp - 4], 0x1a
call fcn.100159d0
xor eax, eax
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1002eaf6
push dword [ebp - 0x20]
lea ecx, [ebp - 0x520]
call fcn.10015a6e
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1002ead8
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002eb18
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe2c], 0xfffffffb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002eaff
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002eb3e
push dword [ebp - 0x20]
lea ecx, [ebp - 0x8dc]
call fcn.10015a6e
mov dword [eax], 0x5bb08661
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002eb20
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002eb57
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb1c]
call fcn.10015a6e
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002eb43
inc dword [ebp - 0x14]
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
lea ecx, [ebp - 0x520]
setne bl
xor esi, esi
inc esi
push esi
call fcn.10015a6e
xor edx, edx
mov dword [eax], ebx
mov eax, dword [ebp - 0x14]
cmp ebx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
add edx, 0x7f191253
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, 0x6572
setg dl
xor eax, eax
cmp edx, 0x17f4
mov dword [ebp - 0xe28], edx
setne al
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002ebc6
mov eax, dword [ebp - 0x14]
push esi
lea ecx, [ebp - 0x520]
call fcn.10015a6e
xor eax, eax
lea ecx, [ebp - 0x520]
push eax
call fcn.10015a6e
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x8dc]
push 2
xor ebx, ebx
cmp eax, 0xffffffff
pop esi
push esi
setge bl
call fcn.10015a6e
lea ecx, [ebp - 0xb1c]
mov dword [eax], ebx
xor eax, eax
test ebx, ebx
setne al
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
call fcn.10015a6e
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x40]
imul ecx, ecx, 0x3248
mov dword [eax], ecx
lea ecx, [ebp - 0xb1c]
call fcn.10015a52
lea ecx, [ebp - 0x8dc]
call fcn.10015a52
lea ecx, [ebp - 0x520]
mov byte [ebp - 4], 0x18
call fcn.10015a52
xor ebx, ebx
lea ecx, [ebp - 0xd0c]
inc ebx
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x38], 0x49fe387
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0xfffffffd
push esi
call fcn.100159d0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xa2c]
mov dword [ebp - 0x38], ebx
push esi
call fcn.100159d0
xor eax, eax
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002ecad
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd0c]
call fcn.10015a6e
or dword [eax], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002ec92
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002ecd3
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa2c]
call fcn.10015a6e
mov dword [eax], 0x75158018
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002ecb5
xor eax, eax
push eax
lea ecx, [ebp - 0xa2c]
call fcn.10015a6e
lea ecx, [ebp - 0xa2c]
dec dword [eax]
call fcn.10015a52
lea ecx, [ebp - 0xd0c]
mov byte [ebp - 4], 0x18
call fcn.10015a52
push 8
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002ed15
push eax
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
xor eax, eax
mov dword [ebp - 0x30], eax
or ecx, 0xffffffff
jmp 0x1002ed59
mov dword [ebp - 0x1c], 0x22124f84
mov dword [ebp - 0x38], 0x9ac54c97
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff2
jl 0x1002ed56
mov dword [ebp - 0x38], 0xa9b64fda
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff2
push 0
pop eax
jge 0x1002ed3a
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jg 0x1002ed1d
push 4
pop eax
push eax
lea ecx, [ebp - 0x790]
call fcn.100159d0
mov byte [ebp - 4], 0x1e
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
jmp 0x1002ed95
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x80], 0xfffffff8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002ed87
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, 0x795010f7
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, 0xfffffffd
setle dl
sub eax, edx
je 0x1002ee43
mov dword [ebp - 0x28], 5
xor eax, eax
mov dword [ebp - 0x40], 0x498d20b5
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x1002ee0f
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x80]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002ee00
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002edfd
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002ede9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x1002edd8
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002ee38
mov dword [ebp - 0x38], 0xd8ff8cd3
mov dword [ebp - 0x38], 0x177c
mov dword [ebp - 0x40], 0xa1ee3199
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x38
je 0x1002ee14
jmp 0x1002ef32
mov dword [ebp - 0x28], 0xd7d5
xor eax, eax
mov dword [ebp - 0x48], 0x59a67e99
mov dword [ebp - 0x3c], 0xf6bb026e
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x58], 0xc5df97f
mov dword [ebp - 0x38], 0xffea059e
mov dword [ebp - 0x14], 0xaa6f69a7
mov dword [ebp - 0x40], esi
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002ee9c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1460], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002ee84
xor eax, eax
mov dword [ebp - 0x20], 0x10
jmp 0x1002eedf
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], 0x5f9b
jg 0x1002eeb9
cmp dword [ebp - 0x80], eax
je 0x1002eeb9
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], 0x46c64e71
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
cmp eax, edx
push 0
setle cl
mov dword [ebp - 0x80], ecx
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], 0x3b
jg 0x1002eea5
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002ef12
cmp dword [ebp - 0x48], eax
jne 0x1002ef12
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x3c]
sub eax, 0x4ef5d9ce
je 0x1002ef2d
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002ef2f
mov eax, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x40], 0x7df39f3c
mov dword [ebp - 0x28], 0x4e2db58
mov dword [ebp - 0x28], 0xfffffff2
jmp 0x1002eff2
mov dword [ebp - 0x1c], 0x7ca0029b
lea ecx, [ebp - 0x8f4]
call fcn.100159d0
xor eax, eax
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002ef90
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x8f4]
call fcn.10015a6e
mov dword [eax], 0x5a9576c3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002ef72
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffed
jmp 0x1002efc5
mov dword [ebp - 0x30], 0x41b66baf
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x1002efc2
push dword [ebp - 0x30]
lea ecx, [ebp - 0x8f4]
call fcn.10015a6e
mov dword [eax], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1002efa8
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffff
jl 0x1002ef99
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002efe0
push 0x1404
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x8f4]
mov byte [ebp - 4], 0x1e
call fcn.10015a52
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff0
push ebx
jne 0x1002ef52
mov eax, 0xa0e60f95
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x6b8]
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x440], eax
call fcn.100159d0
mov byte [ebp - 4], 0x20
xor eax, eax
mov dword [ebp - 0x28], 0xf14186e1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002f057
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x6b8]
call fcn.10015a6e
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002f03d
xor eax, eax
mov dword [ebp - 0x30], 0xfffffffa
jmp 0x1002f1f8
mov dword [ebp - 0x14], 0x48708ef6
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x48], 0xdfbc43cc
mov dword [ebp - 0x38], 0x9339b884
mov dword [ebp - 0x38], 0xc23782e
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002f0a5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x530], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002f091
xor eax, eax
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], eax
jl 0x1002f1f5
push 4
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002f0d7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd0], 0x4c90d297
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002f0bf
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], edi
jg 0x1002f1c5
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe4
jl 0x1002f063
push eax
lea ecx, [ebp - 0x6b8]
call fcn.10015a6e
lea ecx, [ebp - 0x6b8]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0x1e
call fcn.10015a52
xor eax, eax
push 4
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1002f250