Function at 0x100304a1
Capabilities:
Allocate thread local storage
Create process on windows
Get file size
Query or enumerate registry value
Query service status

Disassembly:
mov eax, 0x1007700d
call fcn.10076998
mov eax, 0x1144
call fcn.10073150
xor eax, eax
mov dword [ebp - 0x2c], 8
mov byte [ebp - 0x31], al
mov byte [ebp - 0x85], dl
mov dword [ebp - 0x60], ecx
cmp byte [ebp - 0x31], al
je 0x100304d9
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100304f1
push eax
push 0x1398
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
xor eax, eax
push ebx
mov dword [ebp - 0x10], 0x64f14790
xor ebx, ebx
mov dword [ebp - 0x40], 0xe468
inc ebx
push esi
mov dword [ebp - 0x58], 0xfffffff6
push edi
mov dword [ebp - 0x10], eax
jmp 0x10030522
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x124], 0xd435
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10030511
imul eax, dword [ebp - 0x124], 0x63f9
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp eax, ebx
setge cl
xor edx, edx
mov dword [ebp - 0x58], ecx
mov ecx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x58]
cmp eax, ecx
setge dl
or eax, 0xffffffff
cmp edx, 0xd6a5
je 0x1003057c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x40], ebx
dec dword [ebp - 0x40]
jmp 0x100305cb
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003059e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x578], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10030586
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100305ae
cmp dword [ebp - 0x578], eax
jne 0x100305b4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xb
jge 0x100305a3
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100305cd
push 0xbbb
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_DestroyCursor]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x2c], 0xbca6
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100305eb
push eax
call edi
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10030600
push eax
push eax
call ebx
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x40], 0x141e4f1f
mov dword [ebp - 0x20], 0x97f6af11
mov dword [ebp - 0x20], 0xfffffffe
jmp 0x1003064e
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10030634
push 0x1e48
push eax
push eax
call esi
xor eax, eax
mov dword [ebp - 0x10], 0xffffffec
jmp 0x10030645
cmp dword [ebp - 0x10], eax
jne 0x1003064b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xd
jge 0x1003063d
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffd
jl 0x1003061d
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x17716e31
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10030686
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8e8], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1003066d
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x1c], eax
inc ecx
cmp dword [ebp - 0x1c], ecx
jge 0x100306a9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5c8], 0x5c380a38
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10030691
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x17
jl 0x100307b3
jmp 0x100306bb
xor ecx, ecx
inc ecx
mov dword [ebp - 0x28], 0x1813f1a0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x10], eax
jmp 0x100306db
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb7c], 0xd3e018eb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100306ca
inc dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setl dl
xor eax, eax
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], eax
jne 0x10030704
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10030714
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], 0xe08a1101
mov ecx, 0xfffd
mov eax, dword [ebp - 0x44]
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x91ba
setge dl
imul edx, dword [ebp - 0x28]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
add edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setl cl
mov dword [ebp - 0xb78], ecx
test ecx, ecx
jne 0x1003076d
xor eax, eax
cmp dword [ebp - 0xb7c], eax
jne 0x1003076d
mov dword [ebp - 0x8e8], eax
mov eax, dword [ebp - 0x8e8]
jmp 0x10030776
xor eax, eax
inc eax
mov dword [ebp - 0x8e8], eax
mov eax, dword [ebp - 0xb78]
cmp dword [ebp - 0x5c8], 0xe2c23779
sbb eax, eax
neg eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x100307a3
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x17
push 0
pop eax
jge 0x100306b8
mov dword [ebp - 0x2c], 8
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100307cd
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100307e5
push eax
push 0x1398
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
xor eax, eax
mov dword [ebp - 0x10], 0x64f14790
xor edx, edx
mov dword [ebp - 0x40], 0xe468
inc edx
mov dword [ebp - 0x58], 0xfffffff6
mov dword [ebp - 0x10], eax
jmp 0x10030813
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x110], 0xd435
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10030802
imul eax, dword [ebp - 0x110], 0x63f9
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp eax, edx
setge cl
xor edx, edx
mov dword [ebp - 0x58], ecx
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x58]
cmp eax, ecx
setge dl
cmp edx, 0xd6a5
je 0x10030870
or eax, 0xffffffff
mov dword [ebp - 0x2c], eax
xor eax, eax
inc eax
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x40]
jmp 0x100308c2
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
cmp dword [ebp - 0x10], ecx
jge 0x10030895
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x528], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003087d
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100308a5
cmp dword [ebp - 0x528], eax
jne 0x100308ab
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xb
jge 0x1003089a
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100308c4
push 0xbbb
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x2c], 0xbca6
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100308dc
push eax
call edi
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100308eb
push eax
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x40], 0x141e4f1f
mov dword [ebp - 0x20], 0x97f6af11
mov dword [ebp - 0x20], 0xfffffffe
jmp 0x10030933
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10030919
push 0x1e48
push eax
push eax
call esi
xor eax, eax
mov dword [ebp - 0x10], 0xffffffec
jmp 0x1003092a
cmp dword [ebp - 0x10], eax
jne 0x10030930
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xd
jge 0x10030922
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffd
jl 0x10030902
push 0xfffffffffffffffa
pop ebx
mov dword [ebp - 0x40], ebx
or ecx, 0xffffffff
mov dword [ebp - 0x58], 0xfffffffb
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x40], 0x3644bb32
mov dword [ebp - 0x50], 0x71c2
mov dword [ebp - 0x30], ecx
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10030986
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a4], 8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003096e
xor eax, eax
xor edi, edi
mov dword [ebp - 0x1c], eax
inc edi
cmp dword [ebp - 0x1c], ecx
jge 0x100309a5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbb0], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10030991
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100309b5
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1a0], eax
xor eax, eax
cmp dword [ebp - 0x58], eax
jne 0x10030a42
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp eax, 0xa24b
setle cl
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1a4]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
neg ecx
jne 0x10030a01
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0xbac]
neg eax
mov dword [ebp - 0x20], 0x84257392
sbb eax, eax
neg eax
cmp ebx, eax
mov eax, dword [ebp - 0x1a0]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
sete cl
add ecx, dword [ebp - 0x20]
je 0x10030a3c
mov eax, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1a4]
imul eax, dword [ebp - 0x50], 0x2365
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
test eax, eax
je 0x10030abe
mov dword [ebp - 0x44], 0x4206
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0x50], 3
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10030a87
call dword [sym.imp.USER32.dll_EndMenu]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setg dl
add edx, 8
cmp edx, dword [ebp - 0x30]
jg 0x10030a9f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x50], eax
jmp 0x10030b11
mov dword [ebp - 0x28], 0xfffffffb
xor eax, eax
cmp dword [ebp - 0x28], 0xffffffe2
jle 0x10030b11
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10030aec
push eax
push eax
push eax
push eax
push 0x207
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10030b06
push eax
push eax
call ebx
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
xor eax, eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe2
jg 0x10030acd
xor eax, eax
mov dword [ebp - 0x40], eax
mov ecx, 0xf8c7b5c6
mov dword [ebp - 0x28], 0x20f89b54
mov dword [ebp - 0x30], 0xc8748afa
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x730], ecx
mov dword [ebp - 0x72c], ecx
mov dword [ebp - 0x728], ecx
mov dword [ebp - 0x724], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10030b64
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8dc], 0x85f70ad6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10030b4b
xor eax, eax
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], eax
jl 0x10030c03
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x50], 0xfffffffb
dec dword [ebp - 0x724]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x8dc]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x38]
sub ecx, eax
jne 0x10030be3
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10030bdf
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x38], 3
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x8dc]
cmp dword [ebp - 0x30], eax
jl 0x10030bcb
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x8d8], eax
je 0x10030bcd
mov ecx, edi
mov eax, dword [ebp - 0x28]
sub ecx, eax
add ecx, dword [ebp - 0x38]
cmp ecx, 0x1191
jl 0x10030be3
xor eax, eax
mov edx, eax
jmp 0x10030be5
mov edx, edi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setge cl
imul eax, ecx, 0xf154
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x28]
jns 0x10030b74
xor eax, eax
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10030c28
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1008], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10030c13
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10030c4a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10f0], 0x3c4ab274
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10030c31
xor eax, eax
push 2
mov dword [ebp - 0x20], eax
pop edi
jmp 0x10030cad
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x2c], 0x86bd085c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10030c80
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe9c], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10030c68
xor eax, eax
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], eax
jl 0x10030caa
mov dword [ebp - 0x40], 0x35ca4204
inc dword [ebp - 0x40]
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10030ca5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x10030c88
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x10030c52
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10030cd2
push 0x1a2
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
xor eax, eax
xor ebx, ebx
or ecx, 0xffffffff
mov dword [ebp - 0x44], ecx
inc ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10030d00
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb94], 0x40d7f825
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10030ce7
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10030d1c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x710], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10030d08
xor eax, eax
mov dword [ebp - 0x44], 3
cmp dword [ebp - 0x44], eax
jl 0x10030e24
push 0xfffffffffffffffa
pop edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x10], eax
jmp 0x10030d51
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10e0], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10030d40
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0xb94], 0
je 0x10030daa
mov dword [ebp - 0x10], 0xfffffffd
mov ecx, dword [ebp - 0x10]
neg ecx
mov dword [ebp - 0x40], 0x3245
sbb ecx, ecx
xor eax, eax
neg ecx
cmp dword [ebp - 0x40], eax
je 0x10030d85
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0xb94], ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + eax*4 - 0xb94]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
sete dl
mov dword [ebp - 0x50], edx
jmp 0x10030e03
mov dword [ebp - 0x2c], 0x2d621ec2
xor eax, eax
mov dword [ebp - 0x2c], 0x1eca6c84
mov dword [ebp - 0x2c], 0xa83a0f0f
mov dword [ebp - 0x2c], 0x86992f1e
mov dword [ebp - 0x2c], 0x9d20578c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xd91f06e8
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x2c], 0x9f2e0723
inc dword [ebp - 0x710]
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10030e05
push eax
push eax
push 0x3ad
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10030e15
push eax
call dword [sym.imp.USER32.dll_CharNextW]
dec dword [ebp - 0x44]
push 0
pop eax
push 0xffffffffffffffff
pop ecx
jns 0x10030d2c
mov dword [ebp - 0x50], 0x17716e31
mov dword [ebp - 0x20], 0x15fdc8df
mov dword [ebp - 0x50], 0x2206dd2c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10030e59
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x59c], 0xfffffff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10030e41
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10030e6a
call edi
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov ecx, ebx
sub ecx, eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, 0xbe4438be
setne dl
add edx, dword [ebp - 0x598]
cmp eax, edx
mov eax, dword [ebp - 0x598]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0x20]
jge 0x10030eac
mov edx, ebx
cmp dword [ebp - 0x59c], eax
jne 0x10030eae
mov edx, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x2c], 0xfffffffb
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10030ed6
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10030eec
push 0xb54
call dword [sym.imp.KERNEL32.dll_TlsFree]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10030f0e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x894], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10030ef5
xor eax, eax
mov dword [ebp - 0x10], 0x92beaa32
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], 0xbc8f9611
mov dword [ebp - 0x2c], 0x8b4b72b4
mov dword [ebp - 0x18], 0xcbd6cd53
mov dword [ebp - 0x5c], 0x239be99b
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x54], 0x563ade45
mov dword [ebp - 0x50], 0x8b5a47b6
mov dword [ebp - 0x1c], eax
push 2
pop edx
cmp dword [ebp - 0x1c], ebx
jge 0x10030f6f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x158], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030f5b
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10030f85
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x574], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030f74
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x10]
je 0x10030fb8
mov dword [ebp - 0x30], 0x65c829ed
jmp 0x1003114b
mov dword [ebp - 0x58], 0x649bc00e
xor eax, eax
mov dword [ebp - 0x30], 0x2bad479e
mov dword [ebp - 0x40], 0x69d0863e
mov dword [ebp - 0x38], 0xa227283a
mov dword [ebp - 0x44], 0x5446ed9a
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x10030ffd
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x798], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10030fe5
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10031013
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x50c], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10031002
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10031030
cmp dword [ebp - 0x574], eax
je 0x10031032
mov eax, ebx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x28]
neg eax
mov dword [ebp - 0x50], eax
je 0x1003104f
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x10031058
jmp 0x10031051
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x44], eax
je 0x1003105a
mov ecx, ebx
mov eax, dword [ebp - 0x50c]
xor edx, edx
mov dword [ebp - 0x794], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x158]
inc dword [ebp - 0x50c]
mov eax, dword [ebp - 0x798]
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x44], 0x1265a1b
mov ecx, dword [ebp - 0x44]
add ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x158]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, dword [ebp - 0x38]
jg 0x100310c7
cmp dword [ebp - 0x58], eax
je 0x100310c7
mov eax, ebx
cmp eax, 0x95183441
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
imul eax, dword [ebp - 0x5c], 0xe68
cmp dword [ebp - 0x10], eax
jg 0x10031107
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x100310f0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1003114d
push 0x1dd8
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
jmp 0x1003114b
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x10], eax
jmp 0x10031125
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xecc], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10031114
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp eax, ebx
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003116d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x530], 0x5c380a38
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10031155
xor eax, eax
mov dword [ebp - 0x20], 0x97f6af11
mov dword [ebp - 0x20], 0xfffffffe
jmp 0x100311ae
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10031194
push 0x1e48
push eax
push eax
call esi
xor eax, eax
mov dword [ebp - 0x10], 0xffffffec
jmp 0x100311a5
cmp dword [ebp - 0x10], eax
jne 0x100311ab
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xd
jge 0x1003119d
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffd
jl 0x1003117d
mov dword [ebp - 0x44], eax
mov esi, 0xffff
cmp dword [ebp - 0x44], 0x17
jl 0x10031c25
mov edx, 0xd4a0d461
mov dword [ebp - 0x50], 0xbcd8c45c
mov dword [ebp - 0x54], 0x56f9b2cf
mov dword [ebp - 0x2c], 0x99fb023e
push 5
mov dword [ebp - 0x2c], 0x5dae5a60
pop ecx
mov dword [ebp - 0x2c], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x10], eax
jmp 0x10031209
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb04], 0xcb63e8e1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100311f8
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
xor eax, eax
dec dword [ebp - 0x40]
mov dword [ebp - 0x28], 0x1813f1a0
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x30], 0xa20b95ae
mov dword [ebp - 0x8f8], edx
mov dword [ebp - 0x8f4], edx
mov dword [ebp - 0x8f0], edx
mov dword [ebp - 0x8ec], edx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10031257
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov eax, dword [ebp - 0x30]
xor ebx, ebx
cmp eax, 0xcb0b
setg bl
dec dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp esi, eax
mov eax, dword [ebp - 0x40]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
setg dl
xor ecx, ecx
test ebx, ebx
sete cl
xor eax, eax
add ecx, 0x16c9418
cmp edx, ecx
setle al
xor ebx, ebx
mov dword [ebp - 0x8f4], eax
inc ebx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], 0xe55a
xor eax, eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x2c], 8
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x100312c5
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100312dd
push eax
push 0x1398
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
xor eax, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x50], 0xfffffffe
mov dword [ebp - 0x40], ebx
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1003130d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x178], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x100312f5
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1003132d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x308], 0x647dc4b4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10031315
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1003133f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x684], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10031332
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x304], eax
test eax, eax
jne 0x10031370
cmp dword [ebp - 0x304], eax
jne 0x10031372
mov esi, eax
jmp 0x10031374
xor eax, eax
mov esi, ebx
cmp dword [ebp - 0x50], eax
jne 0x100313a3
mov eax, dword [ebp - 0x178]
mov eax, dword [ebp - 0x67c]
mov eax, dword [ebp - 0x174]
sub eax, dword [ebp - 0x178]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xf381
je 0x100313a3
xor eax, eax
mov edx, eax
jmp 0x100313a5
mov edx, ebx
mov eax, dword [ebp - 0x680]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x67c]
setl cl
xor edx, edx
cmp esi, ecx
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x178]
setne bl
xor ecx, ecx
cmp ebx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x174]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x178]
setg bl
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, 0xf26af903
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x10]
je 0x10031438
xor eax, eax
cmp dword [ebp - 0x304], eax
je 0x10031438
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1003145e
push 0x7d5
push eax
push 0x17d
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1003145c
push 5
pop eax
mov dword [ebp - 0x50], eax
xor ecx, ecx
mov eax, dword [ebp - 0x67c]
neg eax
cmp eax, 0xdaff
mov eax, dword [ebp - 0x50]
setl cl
imul eax, ecx
mov dword [ebp - 0x178], eax
xor eax, eax
push 5
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x10], 0x12491e29
mov dword [ebp - 0x50], 0xfffffffe
mov dword [ebp - 0x54], 0x38ec
mov dword [ebp - 0x40], 0x6d238e48
mov dword [ebp - 0x40], eax
mov eax, 0x467356a0
mov dword [ebp - 0x40], 0x2978d8ef
mov dword [ebp - 0x928], eax
mov dword [ebp - 0x924], eax
mov dword [ebp - 0x920], eax
mov dword [ebp - 0x91c], eax
or eax, 0xffffffff
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x100314eb
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x100314e9
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x100314f0
xor eax, eax
xor ebx, ebx
mov ecx, eax
inc ebx
mov eax, dword [ebp - 0x30]
sub eax, ecx
mov ecx, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x920], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10031531
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xba8], 0xd3e018eb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10031518
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], 0xa971
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1003155e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x134], 0xfffffffc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10031546
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x10031581
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb0c], 0x4c38d679
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10031569
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x100315a1
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc64], 0xbc906383
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10031589
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x100315a9
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov esi, 0xffff
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0xee5a9864
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
sub ecx, eax
mov eax, dword [ebp - 0x134]
add edx, ecx
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0xb0c], ecx
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x134], eax
je 0x10031622
mov ecx, ebx
cmp dword [ebp - 0x10], eax
jne 0x10031624
mov ecx, eax
xor eax, eax
cmp ecx, 0xab8a
sete al
xor edx, edx
mov dword [ebp - 0xc60], eax
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setl dl
xor eax, eax
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], eax
jne 0x10031658
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10031668
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], 0xe08a1101
mov ecx, 0xfffd
mov eax, dword [ebp - 0x44]
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x91ba
setge dl
imul edx, dword [ebp - 0x28]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
add edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setl cl
mov dword [ebp - 0xba4], ecx
test ecx, ecx
jne 0x100316c1
xor eax, eax
cmp dword [ebp - 0xba8], eax
jne 0x100316c1
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0x894]
jmp 0x100316c7
mov dword [ebp - 0x894], ebx
mov eax, dword [ebp - 0xba4]
cmp dword [ebp - 0x530], 0xe2c23779
sbb eax, eax
neg eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xf9d4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0xf57440e7
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x18], 0x744e
mov dword [ebp - 0x10], 0xc59c3f90
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x50], 0xe18e6f96
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10031731
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x204], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003171d
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10031747
push 0x1eb2
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp eax, 0x491d0b6b
mov eax, dword [ebp - 0x4c]
setne cl
xor edx, edx
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x4c]
imul edx, dword [ebp - 0x4c]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x10], ebx
jae 0x100317a3
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
test eax, eax
push 2
setle cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x4c]
neg eax
sbb eax, eax
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp eax, ecx
sbb eax, eax
or ecx, 0xffffffff
inc eax
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x204]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], ebx
xor eax, eax
mov dword [ebp - 0x58], 0xfffffffb
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x40], 0x3644bb32
mov dword [ebp - 0x50], 0x71c2
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1003184c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x19c], 8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10031834
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x10031868
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9cc], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10031854
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10031878
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x198], eax
xor eax, eax
cmp dword [ebp - 0x58], eax
jne 0x10031908
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp eax, 0xa24b
setle cl
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x19c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
neg ecx
jne 0x100318c4
mov eax, dword [ebp - 0x19c]
mov eax, dword [ebp - 0x9c8]
neg eax
mov dword [ebp - 0x20], 0x84257392
push 0xfffffffffffffffa
sbb eax, eax
neg eax
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x198]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
sete cl
add ecx, dword [ebp - 0x20]
je 0x10031902
mov eax, dword [ebp - 0x198]
mov eax, dword [ebp - 0x198]
mov eax, dword [ebp - 0x198]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x19c]
imul eax, dword [ebp - 0x50], 0x2365
test eax, eax
je 0x1003197e
mov dword [ebp - 0x18], 0x4206
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0x50], 3
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10031947
call dword [sym.imp.USER32.dll_EndMenu]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setg dl
add edx, 8
cmp edx, dword [ebp - 0x30]
jg 0x1003195f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x50], eax
jmp 0x100319d5
mov dword [ebp - 0x28], 0xfffffffb
xor eax, eax
cmp dword [ebp - 0x28], 0xffffffe2
jle 0x100319d5
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100319ac
push eax
push eax
push eax
push eax
push 0x207
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100319ca
mov byte [ebp - 0x11], al
mov ecx, 0x33efc07e
mov dword [ebp - 0x608], ecx
or edx, 0xffffffff
mov dword [ebp - 0x604], ecx
mov dword [ebp - 0x600], ecx
mov dword [ebp - 0x5fc], ecx
mov dword [ebp - 0x40], 0x684a
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x58], 0xd293e35f
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10031a34
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1f4], 0x110c93b4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10031a1b
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0x1c
jg 0x10031b2a
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xf
jl 0x10031d93
mov dword [ebp - 0x1c], 0x5efa20bd
mov dword [ebp - 0x44], 0x5fec
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10031c68
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1bc], 0x835357f4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10031c4f
xor eax, eax
mov ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
neg ecx
cmp dword [ebp - 0x1c], eax
je 0x10031c7d
mov esi, ebx
cmp dword [ebp - 0x4c], eax
jne 0x10031c7f
mov esi, eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp eax, esi
setge cl
xor eax, eax
cmp edx, ecx
setg al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x1bc]
jg 0x10031d0f
mov dword [ebp - 0x50], 0x415fb57a
xor eax, eax
mov dword [ebp - 0x30], 0xe3bc
mov dword [ebp - 0x40], 0x1cc0e426
mov dword [ebp - 0x54], 0x7220b739
cmp dword [ebp - 0x30], eax
jne 0x10031cda
mov eax, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x1bc]
cmp eax, 0x53bf
jne 0x10031cf6
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1bc], eax
je 0x10031cf8
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
imul eax, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x54], ebx
jmp 0x10031d7a
xor eax, eax
mov dword [ebp - 0x40], 0x1d4d0043
mov dword [ebp - 0x44], eax
jmp 0x10031d74
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0xe
jmp 0x10031d3e
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031d3b
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe8
jle 0x10031d29
cmp dword [ebp - 0x20], eax
jne 0x10031d58
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x40]
sub ecx, eax
sub ecx, dword [ebp - 0x20]
neg ecx
push 0
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x1bc], ecx
inc dword [ebp - 0x44]
pop eax
cmp dword [ebp - 0x44], 0x39
je 0x10031d1d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1bc], eax
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xf
push 0
pop eax
jge 0x10031c38
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
mov dword [ebp - 0x4c], 0xffffffea
jmp 0x10031dbe
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031dbb
push 0x1a97
push eax
push 0x157
push eax
call edi
xor eax, eax
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 8
jge 0x10031da2
mov dword [ebp - 0x44], eax
mov esi, 0x17716e31
mov dword [ebp - 0x40], 0x141e4f1f
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10031e01
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8c4], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10031de8
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10031e21
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5b4], 0x5c380a38
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10031e09
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x17
jl 0x10031f26
mov dword [ebp - 0x28], 0x1813f1a0
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x10], eax
jmp 0x10031e4e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbc0], 0xd3e018eb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10031e3d
inc dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setl dl
xor eax, eax
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], eax
jne 0x10031e77
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10031e87
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], 0xe08a1101
mov ecx, 0xfffd
mov eax, dword [ebp - 0x44]
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x91ba
setge dl
imul edx, dword [ebp - 0x28]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
add edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setl cl
mov dword [ebp - 0xbbc], ecx
test ecx, ecx
jne 0x10031ee0
xor eax, eax
cmp dword [ebp - 0xbc0], eax
jne 0x10031ee0
mov dword [ebp - 0x8c4], eax
mov eax, dword [ebp - 0x8c4]
jmp 0x10031ee6
mov dword [ebp - 0x8c4], ebx
mov eax, dword [ebp - 0xbbc]
cmp dword [ebp - 0x5b4], 0xe2c23779
sbb eax, eax
neg eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10031f13
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x17
push 0
pop eax
jge 0x10031e2e
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 0x141e4f1f
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x50], esi
push 3
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jge 0x10031f5c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8ac], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10031f44
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10031f7c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x544], 0x5c380a38
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10031f64
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x17
jl 0x1003207e
mov dword [ebp - 0x28], 0x1813f1a0
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x10], eax
jmp 0x10031fa9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbdc], 0xd3e018eb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10031f98
inc dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setl dl
xor eax, eax
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], eax
jne 0x10031fd2
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10031fe2
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], 0xe08a1101
mov ecx, 0xfffd
mov eax, dword [ebp - 0x44]
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x91ba
setge dl
imul edx, dword [ebp - 0x28]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
add edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setl cl
mov dword [ebp - 0xbd8], ecx
test ecx, ecx
jne 0x1003203b
xor eax, eax
cmp dword [ebp - 0xbdc], eax
jne 0x1003203b
mov dword [ebp - 0x8ac], eax
mov eax, dword [ebp - 0x8ac]
jmp 0x10032041
mov dword [ebp - 0x8ac], ebx
mov eax, dword [ebp - 0xbd8]
cmp dword [ebp - 0x544], 0xe2c23779
sbb eax, eax
neg eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003206e
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x17
push 0
pop eax
jge 0x10031f89
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003209a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3f8], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10032086
xor eax, eax
mov dword [ebp - 0x3f4], 0xfffffff0
jmp 0x100320de
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100320c8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9d4], 0xea98
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100320af
xor eax, eax
cmp dword [ebp - 0x3f4], eax
jne 0x100320e7
cmp dword [ebp - 0x9d0], eax
jne 0x100320e7
dec dword [ebp - 0x3f4]
cmp dword [ebp - 0x3f4], 0xffffffe6
jge 0x100320a6
push 6
pop ecx
mov dword [ebp - 0x748], ecx
mov dword [ebp - 0x744], ecx
mov dword [ebp - 0x740], ecx
mov dword [ebp - 0x73c], ecx
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032117
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
xor eax, eax
mov dword [ebp - 0x44], eax
jmp 0x100322da
mov dword [ebp - 0x18], 0x33992443
mov dword [ebp - 0x30], 0xfbc6a687
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1003214f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9e8], 0xf738f585
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10032136
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1003216f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe0c], 0xb6bd0d4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10032157
xor eax, eax
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x100322d7
mov dword [ebp - 0x28], 0xad2086bd
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x50], 0x6a83cd0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100321ab
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x558], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032197
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100321c1
push 0x2618
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
xor eax, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x100322ce
mov dword [ebp - 0x10], eax
jmp 0x100321df
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb3c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100321d2
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x748]
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
add eax, 0x956
add eax, ecx
mov ecx, 0xbc0d133f
cmp ecx, eax
mov dword [ebp - 0x9e4], eax
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
add edx, 4
cmp edx, eax
setne cl
xor edx, edx
cmp ecx, 0x5ec5
setg dl
xor ecx, ecx
mov dword [ebp - 0xe08], edx
mov eax, dword [ebp - 0x20]
cmp edx, eax
setg cl
xor eax, eax
test ecx, ecx
mov dword [ebp - 0xb34], ecx
setne al
cmp eax, 0xf744ed25
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov eax, dword [ebp + eax*4 - 0x748]
cmp eax, edx
setl cl
cmp ecx, dword [ebp - 0x18]
jge 0x1003227b
xor eax, eax
mov edx, eax
cmp dword [ebp - 0xb38], eax
je 0x1003227d
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
je 0x100322bc
mov dword [ebp - 0x20], 0xc526
cmp dword [ebp - 0x20], eax
je 0x100322ad
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x100322ab
mov ecx, ebx
jmp 0x100322af
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x50]
add eax, ecx
je 0x100322ba
mov eax, ebx
jmp 0x100322bc
xor eax, eax
mov dword [ebp - 0x558], eax
dec dword [ebp - 0x28]
push 0
pop eax
jns 0x100321cd
dec dword [ebp - 0x18]
jns 0x1003217b
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jle 0x1003211f
mov dword [ebp - 0x28], 0x42eb
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10032309
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa68], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100322f5
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10032329
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe78], 0xc4530722
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10032311
xor eax, eax
dec dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jg 0x10032369
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xa68]
mov dword [ebp - 0xe74], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003235f
push 0x2073
push 0xaa3
push eax
call dword [sym.imp.GDI32.dll_OffsetRgn]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x10032334
xor eax, eax
mov dword [ebp - 0x18], eax
or ecx, 0xffffffff
mov dword [ebp - 0x28], ebx
push 4
pop esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x10], eax
jmp 0x10032394
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x84], 0xcb1a7a81
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032383
mov eax, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x28], 0x9609c3fb
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setge dl
xor ecx, ecx
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 0x18]
test eax, eax
setns cl
imul eax, ecx, 0x3598
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100324ae
mov dword [ebp - 0x10], eax
jmp 0x10032414
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbf4], 0x3b03
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10032403
mov ecx, dword [ebp - 0xbe8]
mov eax, dword [ebp - 0x84]
dec dword [ebp - 0xbe8]
cmp eax, ecx
je 0x10032433
mov eax, ebx
jmp 0x10032435
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x84]
cmp eax, ebx
mov eax, dword [ebp - 0x44]
setge cl
add eax, ecx
cmp eax, 0xb0402ad9
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
neg ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x84]
sbb ecx, ecx
inc ecx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x28], 0xffffffe8
cmp dword [ebp - 0x28], 0xfffffff6
jne 0x100324ce
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100324ce
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x84], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100324b6
xor eax, eax
mov dword [ebp - 0x10], eax
or ecx, 0xffffffff
mov dword [ebp - 0x18], 0x60f57a7c
mov dword [ebp - 0x44], 0x62e08974
mov dword [ebp - 0x10], 0xa3367f5e
mov dword [ebp - 0x40], 0x11151
mov dword [ebp - 0x28], 0x6d4a
mov dword [ebp - 0x648], ecx
mov dword [ebp - 0x644], ecx
mov dword [ebp - 0x640], ecx
mov dword [ebp - 0x63c], ecx
mov dword [ebp - 0x30], 6
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10032535
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x21c], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10032521
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1003254b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc1c], 0x1e2510a7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003253a
inc dword [ebp - 0x28]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x218], esi
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
setne dl
add edx, esi
cmp dword [ebp - 0x18], edx
jge 0x1003257b