Function at 0x1002f115
Capabilities:
Check os version
Create process on windows
Get common file path
Get disk size
Get file size
Get graphical window text
Identify system language via api
Query service status
Resume thread
Set registry value

Disassembly:
mov eax, 0x100831a6
call fcn.10082b58
mov eax, 0x1148
call fcn.1007dc40
mov eax, 0x469ad59e
mov byte [ebp - 0x85], dl
mov dword [ebp - 0x2d4], eax
or edx, 0xffffffff
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2cc], eax
mov dword [ebp - 0x2c8], eax
xor eax, eax
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x6c], ecx
inc esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x48], 0x4361a6b7
mov dword [ebp - 0x10], 0xb090aec5
mov dword [ebp - 0x2c], 0xe3268dd2
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x10], eax
push edi
cmp dword [ebp - 0x10], esi
jge 0x1002f19c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x184], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002f184
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], eax
jg 0x1002f20b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002f1d2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x448], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002f1b9
xor eax, eax
mov dword [ebp - 0x448], eax
jmp 0x1002f1f2
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002f1ec
push eax
push eax
push eax
push eax
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x448]
cmp dword [ebp - 0x448], eax
jle 0x1002f1da
inc dword [ebp - 0x2d0]
cmp dword [ebp - 0x2d0], eax
jle 0x1002f1b0
or edx, 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x18], 0x19
cmp dword [ebp - 0x18], 0xffffffe8
jne 0x1002f3da
mov dword [ebp - 0x38], 0x53e1
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, 0xffff
cmp dword [ebp - 0x2d0], eax
ja 0x1002f25a
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x184], eax
je 0x1002f25c
mov ecx, esi
mov eax, dword [ebp - 0x48]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x44]
jg 0x1002f385
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002f385
mov ecx, 0x2149
mov dword [ebp - 0x844], ecx
mov dword [ebp - 0x840], ecx
mov dword [ebp - 0x83c], ecx
mov dword [ebp - 0x838], ecx
mov dword [ebp - 0x30], 0x1d584d75
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], eax
jg 0x1002f3c7
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x184]
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x2d4]
test eax, eax
mov eax, dword [ebp - 0x2c]
sete dl
xor ecx, ecx
cmp eax, 0xffff
setne cl
imul edx, ecx
dec edx
neg edx
sbb edx, edx
xor eax, eax
neg edx
dec edx
cmp edx, dword [ebp - 0x2d0]
jl 0x1002f306
mov edx, esi
cmp dword [ebp - 0x844], eax
jne 0x1002f308
mov edx, eax
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov dword [ebp + eax*4 - 0x2c8], edx
mov eax, dword [ebp - 0x44]
cmp edx, eax
sete cl
imul eax, ecx, 0xfffa
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002f346
cmp dword [ebp - 0x184], eax
je 0x1002f337
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x844]
mov eax, dword [ebp - 0x844]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov ecx, 0xfff9
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
sub ecx, eax
xor eax, eax
cmp ecx, 0x4b34d7ae
setl al
xor ecx, ecx
test eax, eax
setle cl
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
setl al
mov dword [ebp - 0x30], eax
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jle 0x1002f2b4
jmp 0x1002f3ca
mov dword [ebp - 0x54], esi
xor edx, edx
push 6
pop eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2d0]
cmp ecx, eax
setne dl
xor eax, eax
mov dword [ebp - 0x2c], edx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002f3c7
push eax
push eax
push 0x188e
push eax
push 0x1547
push eax
push 0x1b51
push eax
call edi
or edx, 0xffffffff
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe8
push 0
pop eax
je 0x1002f222
mov ecx, 0x469ad59e
mov dword [ebp - 0x2ec], ecx
mov dword [ebp - 0x2e8], ecx
mov dword [ebp - 0x2e4], ecx
mov dword [ebp - 0x2e0], ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x48], 0x4361a6b7
mov dword [ebp - 0x10], 0xb090aec5
mov dword [ebp - 0x2c], 0xe3268dd2
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002f439
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x208], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002f421
xor eax, eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], eax
jg 0x1002f4a2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002f469
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x41c], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002f450
xor eax, eax
mov dword [ebp - 0x41c], eax
jmp 0x1002f489
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002f483
push eax
push eax
push eax
push eax
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x41c]
cmp dword [ebp - 0x41c], eax
jle 0x1002f471
inc dword [ebp - 0x2e8]
cmp dword [ebp - 0x2e8], eax
jle 0x1002f447
or edx, 0xffffffff
mov dword [ebp - 0x18], 0x19
cmp dword [ebp - 0x18], 0xffffffe8
jne 0x1002f668
mov ebx, 0xffff
mov dword [ebp - 0x38], 0x53e1
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x208]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x2e8], ebx
ja 0x1002f4eb
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x208], eax
je 0x1002f4ed
mov ecx, esi
mov eax, dword [ebp - 0x48]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x44]
jg 0x1002f613
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002f613
mov ecx, 0x2149
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x820], ecx
mov dword [ebp - 0x81c], ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x30], 0x1d584d75
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], eax
jg 0x1002f655
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x208]
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x2ec]
test eax, eax
mov eax, dword [ebp - 0x2c]
sete dl
xor ecx, ecx
cmp eax, ebx
setne cl
imul edx, ecx
dec edx
neg edx
sbb edx, edx
xor eax, eax
neg edx
dec edx
cmp edx, dword [ebp - 0x2e8]
jl 0x1002f594
mov edx, esi
cmp dword [ebp - 0x824], eax
jne 0x1002f596
mov edx, eax
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov dword [ebp + eax*4 - 0x2e0], edx
mov eax, dword [ebp - 0x44]
cmp edx, eax
sete cl
imul eax, ecx, 0xfffa
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002f5d4
cmp dword [ebp - 0x208], eax
je 0x1002f5c5
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x824]
mov eax, dword [ebp - 0x824]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov ecx, 0xfff9
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
sub ecx, eax
xor eax, eax
cmp ecx, 0x4b34d7ae
setl al
xor ecx, ecx
test eax, eax
setle cl
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
setl al
mov dword [ebp - 0x30], eax
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jle 0x1002f545
jmp 0x1002f658
mov dword [ebp - 0x54], esi
xor edx, edx
push 6
pop eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2e8]
cmp ecx, eax
setne dl
xor eax, eax
mov dword [ebp - 0x2c], edx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002f655
push eax
push eax
push 0x188e
push eax
push 0x1547
push eax
push 0x1b51
push eax
call edi
or edx, 0xffffffff
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe8
push 0
pop eax
je 0x1002f4b8
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x34], 0x25b3
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002f69e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdf8], 0x7d8a8701
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002f685
xor eax, eax
dec dword [ebp - 0x48]
mov ebx, dword [sym.imp.KERNEL32.dll_WinExec]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002f6ba
push 0xa74
push eax
call ebx
xor eax, eax
push 0xfffffffffffffffb
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x48], 0x439fcb6e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002f6e5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe0], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002f6d0
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0xdc], 0xfffffff1
cmp dword [ebp - 0xdc], 0xc
jne 0x1002f84e
jmp 0x1002f706
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x48], 0xa051aaf1
mov dword [ebp - 0x10], eax
jmp 0x1002f731
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x36c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002f720
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xdc]
add eax, ecx
cmp eax, dword [ebp - 0xdc]
jge 0x1002f792
mov dword [ebp - 0x20], 0xffffffed
cmp dword [ebp - 0x20], 0xffffffe4
jg 0x1002f7d6
or eax, 0xffffffff
mov dword [ebp - 0x368], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe4
jle 0x1002f781
jmp 0x1002f7d6
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002f7b3
xor ecx, ecx
inc ecx
push ecx
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002f7d6
push 0x1859
push 0x1e9f
push 0x981
push 0x2307
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov eax, dword [ebp - 0xdc]
xor edx, edx
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x368]
mov ecx, dword [ebp - 0x36c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
inc edx
neg edx
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x368]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
setg dl
cmp dword [ebp - 0x20], edx
jne 0x1002f826
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x36c], eax
inc dword [ebp - 0xdc]
cmp dword [ebp - 0xdc], 0xc
je 0x1002f704
push 0xfffffffffffffffb
pop ecx
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
jmp 0x1002f890
mov dword [ebp - 0x5b0], ecx
mov dword [ebp - 0x5ac], ecx
mov dword [ebp - 0x5a8], ecx
mov dword [ebp - 0x5a4], ecx
mov dword [ebp - 0x5a4], eax
jmp 0x1002f884
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x48]
dec dword [ebp - 0x5a4]
cmp dword [ebp - 0x5a4], 0xffffffe9
jle 0x1002f878
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe8
je 0x1002f858
mov ecx, 0x469ad59e
xor edx, edx
mov dword [ebp - 0x304], ecx
inc edx
mov dword [ebp - 0x300], ecx
mov dword [ebp - 0x2fc], ecx
mov dword [ebp - 0x2f8], ecx
mov dword [ebp - 0x20], 0x477862f
mov dword [ebp - 0x18], 0x2dd78f4f
mov dword [ebp - 0x44], 0x3a4c6382
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002f8eb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x138], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002f8d3
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xa
je 0x1002fb31
mov dword [ebp - 0x2c], edx
or ecx, 0xffffffff
mov dword [ebp - 0x864], ecx
mov dword [ebp - 0x860], ecx
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 0x858], ecx
mov dword [ebp - 0x24], 0x35c0
mov dword [ebp - 0x30], 0x9552053
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x60], 0x4d441147
mov dword [ebp - 0x10], eax
jmp 0x1002f947
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x510], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002f936
mov eax, dword [ebp - 0x20]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x2c], eax
je 0x1002f95b
mov ecx, edx
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x20]
jge 0x1002f977
mov eax, dword [ebp - 0x24]
xor edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, 0x3aaf
setle cl
mov dword [ebp - 0x860], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp edx, eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x138], eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x138]
imul edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setne cl
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xa9ef8169
setne al
imul eax, dword [ebp - 0x24]
test eax, eax
je 0x1002fa03
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002faa4
push eax
call dword [sym.imp.GDI32.dll_GetObjectType]
jmp 0x1002faa2
mov dword [ebp - 0x10], 0xfffffff9
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x3c], 0xb4499c77
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x860]
inc dword [ebp - 0x10]
cmp eax, ecx
jg 0x1002fa2f
xor eax, eax
lea edx, [eax + 1]
jmp 0x1002fa33
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x50c]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
jne 0x1002fa52
cmp dword [ebp - 0x138], eax
je 0x1002fa55
xor eax, eax
inc eax
mov edx, dword [ebp - 0x2c]
sub edx, eax
mov eax, dword [ebp - 0x50c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x138]
cmp eax, 6
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xfffffff9
mov eax, dword [ebp - 0x50c]
setne cl
xor edx, edx
cmp ecx, 0x6f739807
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x3c], ecx
xor eax, eax
cmp dword [ebp - 0x138], eax
jne 0x1002fac9
mov eax, dword [ebp - 0x50c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x85c]
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x1002fad7
cmp dword [ebp - 0x60], eax
jne 0x1002fad7
mov ecx, eax
jmp 0x1002fadc
xor eax, eax
lea ecx, [eax + 1]
xor eax, eax
cmp ecx, 0x38d0
setg al
cmp eax, dword [ebp - 0x30]
jle 0x1002fb06
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x1002fb08
cmp dword [ebp - 0x60], eax
jne 0x1002fb08
mov dword [ebp - 0x3c], 0x9286df49
cmp dword [ebp - 0x3c], eax
jne 0x1002fb2c
jmp 0x1002fb19
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002fb19
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xa
push 0
pop eax
push 1
pop edx
jne 0x1002f8f8
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], 0x36951ad3
mov dword [ebp - 0x10], 0xf47a6dee
mov dword [ebp - 0x10], 0x5dc1b6ea
mov dword [ebp - 0x48], 0xec352115
mov dword [ebp - 0x48], 0xca4f0670
mov dword [ebp - 0x48], 0xe44fa3fd
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x10], 0xc6e5
cmp dword [ebp - 0x10], eax
push 0xfffffffffffffffc
pop eax
jne 0x1002fbe2
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov eax, dword [ebp - 0x10]
neg eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp eax, 0xd7c8
setle cl
cmp ecx, dword [ebp - 0x20]
jg 0x1002fba0
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002fba0
mov edx, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
inc edx
imul eax, ecx, 0x8217
xor ecx, ecx
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
cmp eax, edx
setle cl
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], 9
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x20]
jne 0x1002fbe2
mov ecx, eax
jmp 0x1002fbe4
mov ecx, edx
mov eax, dword [ebp - 0x20]
sub eax, ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002fc04
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor eax, eax
mov dword [ebp - 0x30], 0x4361a6b7
mov dword [ebp - 0x18], 0x642c70bb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002fc34
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xac4], 0xfff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002fc1b
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002fc4a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1028], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002fc39
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xac4], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002fcc6
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x1d
jmp 0x1002fcbd
mov dword [ebp - 0x10], 0xc4185a1f
mov dword [ebp - 0x10], 0xf
jmp 0x1002fca1
mov dword [ebp - 0x48], 0xd6f1860e
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002fc9b
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
dec dword [ebp - 0x48]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1a
jle 0x1002fc7f
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002fcba
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
xor eax, eax
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xfffffff4
jge 0x1002fc6f
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffb
jge 0x1002fc60
mov dword [ebp - 0x10], 0xb090aec5
or ecx, 0xffffffff
mov dword [ebp - 0x2c], 0xe3268dd2
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x34], ecx
xor ecx, ecx
mov dword [ebp - 0x18], 0x81c2900
inc ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002fd11
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3c0], 0x1713b910
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002fcf9
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1002fd9d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002fd3f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3fc], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002fd26
xor eax, eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], eax
jg 0x1002fd95
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x3c0]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3c0], ecx
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002fd85
push 0x1221
push eax
push 0x4d4
push 0xea3
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
inc dword [ebp - 0x3f8]
cmp dword [ebp - 0x3f8], eax
jle 0x1002fd4d
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002fd1d
xor ecx, ecx
inc ecx
push 4
pop edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002fdde
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa0], 0x648261f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002fdc6
xor eax, eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], eax
jg 0x1002fedd
jmp 0x1002fdf5
xor ecx, ecx
inc ecx
mov dword [ebp - 0x3c], 0xcccaea0a
mov dword [ebp - 0x10], eax
jmp 0x1002fe0e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x258], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002fe01
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0xa0], ecx
test ecx, ecx
je 0x1002fea8
mov eax, dword [ebp - 0x154]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xa0]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0xa0]
cmp eax, ecx
mov eax, dword [ebp - 0x154]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xa0]
sub edx, eax
mov eax, dword [ebp - 0x20]
add eax, edx
or edx, 0xffffffff
cmp eax, edx
setle cl
cmp ecx, dword [ebp - 0x14c]
jle 0x1002fea8
xor eax, eax
inc eax
jmp 0x1002feaa
xor eax, eax
mov ecx, dword [ebp - 0x258]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x258]
cmp ecx, eax
setne dl
xor eax, eax
mov dword [ebp - 0x258], edx
mov dword [ebp - 0x3c], edx
inc dword [ebp - 0x154]
cmp dword [ebp - 0x154], eax
jle 0x1002fdf2
cmp dword [ebp - 0x20], eax
jne 0x1002ff53
mov eax, dword [ebp - 0x158]
xor ecx, ecx
cmp eax, 2
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x154]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x158]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x74f0e4f2
setg al
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002ff36
cmp dword [ebp - 0x20], eax
jne 0x1002ff36
mov edx, eax
jmp 0x1002ff3b
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0x4ef21ddb
jle 0x1002ff53
xor eax, eax
mov edx, eax
jmp 0x1002ff58
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 1
setg al
xor edx, edx
cmp eax, 0x20c256fa
mov eax, dword [ebp - 0x158]
setne dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x20]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
xor eax, eax
neg edx
cmp edx, 0x7db40437
setne al
xor ecx, ecx
mov dword [ebp - 0x154], eax
inc ecx
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002ffc2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x190], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002ffaa
xor eax, eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], eax
jg 0x1003002f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002fff2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x378], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002ffd9
xor eax, eax
mov dword [ebp - 0x378], eax
jmp 0x10030016
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030010
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor eax, eax
inc dword [ebp - 0x378]
cmp dword [ebp - 0x378], eax
jle 0x1002fffa
inc dword [ebp - 0x300]
cmp dword [ebp - 0x300], eax
jle 0x1002ffd0
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], 0x19
cmp dword [ebp - 0x18], 0xffffffe8
jne 0x100301fb
mov dword [ebp - 0x38], 0x53e1
mov dword [ebp - 0x44], eax
or eax, 0xffffffff
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, 0xffff
cmp dword [ebp - 0x300], eax
ja 0x1003007b
xor eax, eax
cmp dword [ebp - 0x190], eax
jne 0x1003007b
mov ecx, eax
mov eax, dword [ebp - 0x30]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x44]
jg 0x100301a3
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100301a3
mov ecx, 0x2149
mov dword [ebp - 0x804], ecx
mov dword [ebp - 0x800], ecx
mov dword [ebp - 0x7fc], ecx
mov dword [ebp - 0x7f8], ecx
mov dword [ebp - 0x3c], 0x1d584d75
mov dword [ebp - 0x38], eax
jmp 0x10030198
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x190]
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x304]
test eax, eax
mov eax, dword [ebp - 0x2c]
sete dl
xor ecx, ecx
cmp eax, 0xffff
setne cl
imul edx, ecx
dec edx
neg edx
sbb edx, edx
xor eax, eax
neg edx
dec edx
cmp edx, dword [ebp - 0x300]
jl 0x10030124
cmp dword [ebp - 0x804], eax
je 0x10030124
lea edx, [eax + 1]
jmp 0x10030126
mov edx, eax
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov dword [ebp + eax*4 - 0x2f8], edx
mov eax, dword [ebp - 0x44]
cmp edx, eax
sete cl
imul eax, ecx, 0xfffa
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10030164
cmp dword [ebp - 0x190], eax
je 0x10030155
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x804]
mov eax, dword [ebp - 0x804]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
mov ecx, 0xfff9
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
sub ecx, eax
xor eax, eax
cmp ecx, 0x4b34d7ae
setl al
xor ecx, ecx
test eax, eax
setle cl
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
setl al
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x38], eax
jle 0x100300cf
jmp 0x100301e8
xor eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x3c], eax
push 6
pop eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x300]
cmp ecx, eax
setne dl
xor eax, eax
mov dword [ebp - 0x2c], edx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x100301e8
push eax
push eax
push 0x188e
push eax
push 0x1547
push eax
push 0x1b51
push eax
call edi
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe8
push 0
pop eax
push 1
pop ecx
je 0x10030040
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x34], 0x25b3
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10030231
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf40], 0x7d8a8701
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10030218
xor eax, eax
dec dword [ebp - 0x48]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030247
push 0xa74
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x20], 0xfffffff6
xor ebx, ebx
mov dword [ebp - 0x48], 0x9323d1bc
inc ebx
mov dword [ebp - 0x3c], ebx
or ecx, 0xffffffff
mov dword [ebp - 0x30], 0x9822cb3a
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x34], 0x820b275c
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030292
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x294], 0x9f9b3198
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003027a
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x100302b4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x90c], 0xaad9ddce
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1003029b
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x100303e4
mov dword [ebp - 0x34], 0xfd94fe5f
mov dword [ebp - 0x34], 0x8d13034d
mov dword [ebp - 0x48], 0x5cbcef05
mov dword [ebp - 0x34], 0xda37bb00
mov dword [ebp - 0x34], 0xaf9eb11d
mov dword [ebp - 0x60], 0xcec51938
mov dword [ebp - 0x48], 8
mov dword [ebp - 0x10], 6
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1003031b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10a4], 0x6e348cc3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10030303
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10030331
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe60], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10030320
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x294]
inc dword [ebp - 0x10]
mov dword [ebp - 0x48], 0xfffffffa
mov ecx, dword [ebp - 0x48]
sub ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
sub eax, dword [ebp - 0x3c]
jne 0x10030369
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x1003036b
mov edx, ebx
mov eax, dword [ebp - 0x908]
xor ecx, ecx
cmp eax, edx
setge cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
imul eax, dword [ebp - 0x48], 9
cmp eax, 8
mov eax, dword [ebp - 0x54]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0xe5c]
jg 0x100303a8
mov edx, ebx
cmp dword [ebp - 0x60], eax
jne 0x100303aa
mov edx, eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x294]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x294], ecx
xor eax, eax
cmp ecx, edx
sete al
sub eax, dword [ebp - 0x54]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x90c], eax
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x100302c0
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x48], 0xae4f78d7
mov dword [ebp - 0x48], 0x5d3e9973
mov dword [ebp - 0x48], 0xf77722ab
mov dword [ebp - 0x3c], 0x6a1c3d07
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1003042f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe78], 0x2fe81720
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10030416
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10030445
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd60], 0x83acdd71
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10030434
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
push 0xfffffffffffffffb
setge dl
xor ecx, ecx
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
test eax, eax
mov dword [ebp - 0xe70], eax
mov eax, 0xd6dbc1c2
sete cl
cmp eax, ecx
sbb eax, eax
neg eax
cmp eax, 2
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setl dl
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x48], edx
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 7
setne al
xor edx, edx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, 0xc7ba3f30
setg dl
sub eax, edx
mov dword [ebp - 0xd60], eax
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x3c], eax
xor eax, eax
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x48], 0x439fcb6e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003050c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xec], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100304f7
xor eax, eax
mov dword [ebp - 0xe8], 0xfffffff1
cmp dword [ebp - 0xe8], 0xc
jne 0x1003066c
jmp 0x10030527
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x48], 0xa051aaf1
mov dword [ebp - 0x10], eax
jmp 0x10030552
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x428], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10030541
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe8]
add eax, ecx
cmp eax, dword [ebp - 0xe8]
jge 0x100305b3
mov dword [ebp - 0x20], 0xffffffed
cmp dword [ebp - 0x20], 0xffffffe4
jg 0x100305f4
or eax, 0xffffffff
mov dword [ebp - 0x424], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe4
jle 0x100305a2
jmp 0x100305f4
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x100305d1
push ebx
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100305f4
push 0x1859
push 0x1e9f
push 0x981
push 0x2307
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov eax, dword [ebp - 0xe8]
xor edx, edx
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x428]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
inc edx
neg edx
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x424]
cmp eax, ecx
setg dl
cmp dword [ebp - 0x20], edx
jne 0x10030644
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x428], eax
inc dword [ebp - 0xe8]
cmp dword [ebp - 0xe8], 0xc
je 0x10030525
push 0xfffffffffffffffb
pop ecx
mov eax, 0x469ad59e
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x320], eax
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x318], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
jmp 0x100306cb
mov dword [ebp - 0x650], ecx
mov dword [ebp - 0x64c], ecx
mov dword [ebp - 0x648], ecx
mov dword [ebp - 0x644], ecx
mov dword [ebp - 0x644], eax
jmp 0x100306bf
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x48]
dec dword [ebp - 0x644]
cmp dword [ebp - 0x644], 0xffffffe9
jle 0x100306b3
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe8
je 0x10030693
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], 0x477862f
mov dword [ebp - 0x18], 0x2dd78f4f
mov dword [ebp - 0x44], 0x3a4c6382
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10030709
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x134], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100306f1
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xa
je 0x1003093d
mov dword [ebp - 0x2c], ebx
or ecx, 0xffffffff
mov dword [ebp - 0x814], ecx
mov dword [ebp - 0x810], ecx
mov dword [ebp - 0x80c], ecx
mov dword [ebp - 0x808], ecx
mov dword [ebp - 0x24], 0x35c0
mov dword [ebp - 0x30], 0x9552053
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x60], 0x4d441147
mov dword [ebp - 0x10], eax
jmp 0x10030765
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x508], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10030754
mov eax, dword [ebp - 0x20]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x2c], eax
je 0x10030779
mov ecx, ebx
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x20]
jge 0x10030795
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 0x3aaf
setle cl
mov dword [ebp - 0x810], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp ebx, eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x134], eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x134]
imul edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setne cl
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xa9ef8169
setne al
imul eax, dword [ebp - 0x24]
test eax, eax
je 0x1003081e
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x100308bb
push eax
call dword [sym.imp.GDI32.dll_GetObjectType]
jmp 0x100308b9
mov dword [ebp - 0x10], 0xfffffff9
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x3c], 0xb4499c77
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x810]
inc dword [ebp - 0x10]
cmp eax, ecx
jg 0x10030847
mov edx, ebx
jmp 0x1003084b
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x504]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
jne 0x1003086a
cmp dword [ebp - 0x134], eax
je 0x1003086c
mov eax, ebx
mov edx, dword [ebp - 0x2c]
sub edx, eax
mov eax, dword [ebp - 0x504]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x134]
cmp eax, 6
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xfffffff9
mov eax, dword [ebp - 0x504]
setne cl
xor edx, edx
cmp ecx, 0x6f739807
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x3c], ecx
xor eax, eax
cmp dword [ebp - 0x134], eax
jne 0x100308e0
mov eax, dword [ebp - 0x504]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x80c]
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x100308ec
mov ecx, eax
cmp dword [ebp - 0x60], eax
je 0x100308ee
mov ecx, ebx
xor eax, eax
cmp ecx, 0x38d0
setg al
cmp eax, dword [ebp - 0x30]
jle 0x10030918
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x1003091a
cmp dword [ebp - 0x60], eax
jne 0x1003091a
mov dword [ebp - 0x3c], 0x9286df49
cmp dword [ebp - 0x3c], eax
jne 0x1003093b
jmp 0x1003092b
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003092b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xa
push 0
pop eax
jne 0x10030716
xor eax, eax
mov dword [ebp - 0x54], 0x4361a6b7
mov dword [ebp - 0x20], 0x36951ad3
mov dword [ebp - 0x10], 0xf47a6dee
mov dword [ebp - 0x10], 0x5dc1b6ea
mov dword [ebp - 0x48], 0xec352115
mov dword [ebp - 0x48], 0xca4f0670
mov dword [ebp - 0x48], 0xe44fa3fd
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x10], 0xc6e5
cmp dword [ebp - 0x10], eax
jne 0x100309f1
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov eax, dword [ebp - 0x10]
neg eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp eax, 0xd7c8
setle cl
cmp ecx, dword [ebp - 0x20]
jg 0x100309b0
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x100309b2
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0x8217
xor ecx, ecx
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
cmp eax, ebx
setle cl
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], 9
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x20]
jne 0x100309f1
mov ecx, eax
jmp 0x100309f3
mov ecx, ebx
mov eax, dword [ebp - 0x20]
sub eax, ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10030a13
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor eax, eax
mov dword [ebp - 0x44], 0xb090aec5
mov dword [ebp - 0x18], 0x642c70bb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10030a43
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xad0], 0xfff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10030a2a
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10030a59
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1088], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10030a48
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xad0], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10030ad5
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x1d
jmp 0x10030acc
mov dword [ebp - 0x10], 0xc4185a1f
mov dword [ebp - 0x10], 0xf
jmp 0x10030ab0
mov dword [ebp - 0x48], 0xd6f1860e
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030aaa
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
dec dword [ebp - 0x48]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1a
jle 0x10030a8e
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030ac9
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
xor eax, eax
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xfffffff4
jge 0x10030a7e
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffb
jge 0x10030a6f
mov dword [ebp - 0x18], 0xe3268dd2
mov dword [ebp - 0x58], 7
mov dword [ebp - 0x18], 0x81c2900
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10030b10
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x42c], 0x1713b910
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10030af8
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x10030b95
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10030b3a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x384], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10030b21
xor eax, eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], eax
jg 0x10030b90
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x42c]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x42c], ecx
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10030b80
push 0x1221
push eax
push 0x4d4
push 0xea3
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
inc dword [ebp - 0x380]
cmp dword [ebp - 0x380], eax
jle 0x10030b48
xor eax, eax
dec dword [ebp - 0x18]
jns 0x10030b18
or ecx, 0xffffffff
mov dword [ebp - 0x34], ecx
push 4
pop ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10030bdc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9c], 0x648261f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10030bc4
xor eax, eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], eax
jg 0x10030cd5
mov dword [ebp - 0x3c], 0xcccaea0a
mov dword [ebp - 0x10], eax
jmp 0x10030c07
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x26c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10030bfa
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x9c], ecx
test ecx, ecx
je 0x10030ca0
mov eax, dword [ebp - 0x164]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x9c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x9c]
cmp eax, ecx
mov eax, dword [ebp - 0x164]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x9c]
sub edx, eax
mov eax, dword [ebp - 0x20]
add eax, edx
or edx, 0xffffffff
cmp eax, edx
setle cl
cmp ecx, dword [ebp - 0x15c]
jle 0x10030ca0
mov eax, ebx
jmp 0x10030ca2
xor eax, eax
mov ecx, dword [ebp - 0x26c]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x26c]
cmp ecx, eax
setne dl
xor eax, eax
mov dword [ebp - 0x26c], edx
mov dword [ebp - 0x3c], edx
inc dword [ebp - 0x164]
cmp dword [ebp - 0x164], eax
jle 0x10030bee
cmp dword [ebp - 0x20], eax
jne 0x10030d46
mov eax, dword [ebp - 0x168]
xor ecx, ecx
cmp eax, 2
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x164]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x168]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x74f0e4f2
setg al
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10030d2c
mov edx, eax
cmp dword [ebp - 0x20], eax
je 0x10030d2e
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0x4ef21ddb
jle 0x10030d46
xor eax, eax
mov edx, eax
jmp 0x10030d48
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, ebx
setg al
xor ecx, ecx
cmp eax, 0x20c256fa
mov eax, dword [ebp - 0x168]
setne cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x20]
setne dl
sub ecx, edx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x7db40437
setne al
mov dword [ebp - 0x164], eax
xor eax, eax
mov dword [ebp - 0x18], 0x5299dada
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10030db5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x668], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10030d9d
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x10030df1
or ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x10030de9
mov dword [ebp - 0x48], 0x77ab3921
dec dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x668]
inc dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
jle 0x10030dcb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x10030dc0
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030e02
call dword [sym.imp.USER32.dll_WaitMessage]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10030e18
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1d8], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10030e07
mov eax, 0x2d5e48d3
mov dword [ebp - 0x3dc], eax
mov dword [ebp - 0x3d8], eax
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x3d0], eax
xor eax, eax
mov dword [ebp - 0x10], 0x52061f6
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], eax
jl 0x10030e6a
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030e65
push 0x1273
call dword [sym.imp.USER32.dll_MessageBeep]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x10030e4f
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030e93
push eax
push eax
push eax
push 0x15c9
push 0x5cd
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
mov dword [ebp - 0x320], eax
push 0xfffffffffffffffd
pop ecx
cmp dword [ebp - 0x320], eax
jg 0x1003183f
mov dword [ebp - 0x44], 0x13532fe2
or edx, 0xffffffff
mov dword [ebp - 0x34], 0x34aafbeb
mov dword [ebp - 0x3c], edx
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10030edb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8b4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10030ec7
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ebx
jg 0x10030fa0
mov dword [ebp - 0x18], 0x25260
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x8b4], 0
jne 0x10030f9b
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x10030f8f
jmp 0x10030f11
xor eax, eax
mov dword [ebp - 0x34], 0x94e8fe75
mov dword [ebp - 0x34], 0xfffffff8
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030f3c
push eax
push 0x68e
push 0x14ed
call esi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x8b4], 0
je 0x10030f5c
mov dword [ebp - 0x34], 0x282d564c
mov dword [ebp - 0x34], 0x21a07835
mov dword [ebp - 0x3c], ebx
jmp 0x10030f87
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10030f87
push 0x203a
push eax
push 0x1b0d
push 0x216f
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10030f0f
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jle 0x10030ee7
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x38], 0xe76f5020
mov edx, 0xffff
mov dword [ebp - 0x30], 0xa964a90c
mov dword [ebp - 0x48], edx
push 4
mov dword [ebp - 0x28], eax
pop edx
cmp dword [ebp - 0x28], edx
jge 0x10030fd9
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x630], 0xdc85
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x10030fc1
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10030ff9
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x7a4], 0xfffffffe
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10030fe1
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jge 0x10031019
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xba4], 0x197
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x10031001
xor eax, eax
mov dword [ebp - 0x38], 3
cmp dword [ebp - 0x38], eax
jl 0x1003117d
mov dword [ebp - 0x5f0], ecx
mov dword [ebp - 0x5ec], ecx
mov dword [ebp - 0x5e8], ecx
mov dword [ebp - 0x5e4], ecx
mov dword [ebp - 0x10], 0x7e780ca9
mov dword [ebp - 0x30], 0x1350
mov dword [ebp - 0x10], eax
jmp 0x10031065
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6e4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10031054
mov dword [ebp - 0x5e4], ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x630], 0
je 0x100310a5
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x630]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x630]
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x630], eax
je 0x100310a7
mov eax, ebx
jmp 0x100310a7
xor eax, eax
mov edx, dword [ebp - 0x10]
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x38]
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x48]
cmp dword [ebp - 0x5e4], eax
jne 0x10031128
mov eax, dword [ebp - 0x5e4]
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x630], 0
jne 0x100310e6
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x5e4], eax
je 0x100310e8
mov ecx, ebx
mov eax, dword [ebp - 0x7a4]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xb98]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x5f0], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x630]
mov eax, dword [ebp - 0x6e4]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x630]
mov eax, dword [ebp - 0xba4]
mov eax, dword [ebp - 0x38]
push 0
mov eax, dword [ebp + eax*4 - 0x630]
mov eax, dword [ebp - 0x6e4]
cmp ebx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x431b
setle cl
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
cmp eax, 0x3d00
setge cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x6e4]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
pop eax
setg dl
mov dword [ebp - 0x30], edx
dec dword [ebp - 0x38]
push 2
pop ecx
jns 0x10031029
push 0xfffffffffffffffd
mov dword [ebp - 0x2c], 0x90da
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x10], eax
jmp 0x100311a7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4b8], 0x23b1a956
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031196
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 9
cmp dword [ebp - 0x20], 0xffffffee
jle 0x1003140d
or edx, 0xffffffff
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x2c], 0xfffffff9
cmp dword [ebp - 0x2c], 0xd
jge 0x10031400
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x48], 0xf2ec2878
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003120b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x74], 0x1d8f8f57
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100311f6
xor eax, eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], ecx
jg 0x100313f3
mov dword [ebp - 0x1c], 0x6c902da
mov dword [ebp - 0x30], 0x558
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x1003127b
mov dword [ebp - 0x10], 0xff29acd4
mov dword [ebp - 0x10], eax
jmp 0x1003126e
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003126b
push 0x1a3a
push 0x248d
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x10031243
dec dword [ebp - 0x1c]
jns 0x10031237
or edx, 0xffffffff
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x100313e2
mov dword [ebp - 0x10], eax
jmp 0x10031299
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6b0], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003128c
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp + eax*4 - 0x4b8]
mov eax, dword [ebp - 0x1c]
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x74]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setle cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x4b8]
setne bl
xor edx, edx
imul ebx, eax
mov eax, dword [ebp - 0x18]
cmp ebx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
add ecx, dword [ebp - 0x30]
je 0x100312fd
cmp dword [ebp - 0x4b8], eax
je 0x100312fd
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x10031302
xor ebx, ebx
mov ecx, eax
inc ebx
mov eax, dword [ebp - 0x18]
add ecx, 0xffff6a23
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
imul eax, ecx, 0x2764
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x74]
setle dl
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
je 0x10031346
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x74]
cmp dword [ebp + eax*4 - 0x4b8], ebx
jne 0x10031360
xor eax, eax
cmp dword [ebp - 0x74], eax
je 0x10031362
mov esi, ebx
jmp 0x10031364
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x74]
xor edx, edx
push 0
mov ecx, dword [ebp + eax*4 - 0x4b8]
mov eax, dword [ebp - 0x74]
cmp ecx, eax
sete dl
xor ecx, ecx
cmp esi, 0x5f0a8622
setge cl
sub ecx, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
setg al
xor edx, edx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp + eax*4 - 0x4b8]
mov eax, dword [ebp - 0x4b8]
cmp eax, ecx
setg dl
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x48], 0xb8bf5144
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x6b0], eax
dec dword [ebp - 0x1c]
pop eax
push 0xffffffffffffffff
pop edx
jns 0x10031287
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 2
pop ecx
inc dword [ebp - 0x74]
push 0xffffffffffffffff
pop edx
cmp dword [ebp - 0x74], ecx
jle 0x10031217
or edx, edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xd
jl 0x100311e0
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffee
jg 0x100311c7
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10031431
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x404], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10031418
xor eax, eax
mov dword [ebp - 0x18], 0xe1757117
mov dword [ebp - 0x18], eax
jmp 0x1003150c
mov dword [ebp - 0x20], 0xe3245f1d
mov dword [ebp - 0x48], 0x1a62a969
mov dword [ebp - 0x20], 0xc
cmp dword [ebp - 0x20], 0xffffffee
jle 0x10031504
mov dword [ebp - 0x3c], 0xb2c57e71
cmp dword [ebp - 0x18], eax
je 0x10031488
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100314f1
push 0x1057
push eax
push eax
push eax
push eax
call esi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x100314f1
mov dword [ebp - 0x2c], 0x8fbc781c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100314b1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc24], 0x923e64f1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10031498
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x100314eb
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
jne 0x100314d2
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0xc24], ecx
jne 0x100314d2
xor eax, eax
mov edx, eax
jmp 0x100314d4
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xc24]
cmp eax, edx
setne cl
mov dword [ebp - 0x48], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x100314b6
mov eax, dword [ebp - 0x20]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffee
push 0
pop eax
jg 0x1003145f
cmp dword [ebp - 0x20], eax
jne 0x10031516
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff0
je 0x10031440
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], eax
jg 0x10031827
push 5
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003154e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd4], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10031536
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1003156c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7d4], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10031557
xor eax, eax
cmp dword [ebp - 0xd4], eax
je 0x10031598
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x7d0]
mov eax, dword [ebp - 0x7d0]
mov eax, dword [ebp - 0x7d4]
xor eax, eax
mov dword [ebp - 0xd4], 0xfffffffa
mov dword [ebp - 0x2c], eax
jmp 0x100315d7
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100315d4
push 0x837
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x100315bb
mov byte [ebp - 0x11], al
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], 0xffffffe4
jmp 0x1003161b
mov dword [ebp - 0x10], 0x31e42a43
mov dword [ebp - 0x10], eax
jmp 0x10031612
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003160f
push eax
push eax
push 0x36b
call dword [sym.imp.ADVAPI32.dll_CopySid]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffb
jne 0x100315f7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffea
je 0x100315eb
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10031635
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_UnionRect]
xor eax, eax
cmp byte [ebp - 0x11], 0
je 0x10031813
mov dword [ebp - 0x2c], 0xac204e2d
or ecx, 0xffffffff
mov dword [ebp - 0x50], 0xa0029bf3
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xe95aad85
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x60], 0xee94ccb0
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x18], 0xd2dc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003169f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x784], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10031687
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100316c5
push eax
push 0xf42
push 0xafb
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
xor eax, eax
mov dword [ebp - 0x2c], 3
cmp dword [ebp - 0x2c], 0x12
jge 0x10031806
jmp 0x100316da
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
inc dword [ebp - 0x404]
xor eax, eax
cmp dword [ebp - 0x404], eax
jle 0x10031528
inc dword [ebp - 0x320]
cmp dword [ebp - 0x320], eax
push 0
pop eax
jle 0x10030ea8
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], ecx
push 3
pop ecx
mov dword [ebp - 0x34], ecx
push 0xfffffffffffffffc
pop edx
mov dword [ebp - 0x34], edx
or edx, 0xffffffff
mov dword [ebp - 0x34], 0x3250e6da
mov dword [ebp - 0x34], 0xab274bf9
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], 0x9e53e58b
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x10031896
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1040], 0x72b21a35
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003187e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x100318b2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa50], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003189e
xor eax, eax
inc dword [ebp - 0xa4c]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100318ca
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
xor eax, eax
mov dword [ebp - 0x10], 0x19
cmp dword [ebp - 0x10], 0xffffffe8
jne 0x1003329c
jmp 0x100318df
mov dword [ebp - 0x2c], 0x86e871d9
mov dword [ebp - 0x48], 0x8cf5a8b0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1003190e
push 0xfffffffffffffffc
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa3c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100318f9
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003191f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
or edx, 0xffffffff
mov eax, dword [ebp - 0x2c]
cmp eax, edx
mov eax, dword [ebp - 0x2c]
setg cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setg bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp eax, edx
setg cl
imul ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x48], ecx
imul eax, dword [ebp - 0x48], 0x6fe6
or edx, 0xffffffff
mov dword [ebp - 0xa38], eax
mov dword [ebp - 0x38], 0x53e1
mov dword [ebp - 0x4c], 0xe0a8eac8
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x20], 0x14fa
mov dword [ebp - 0x4c], edx
jmp 0x10031991
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xd
jl 0x10031988
mov dword [ebp - 0x4c], 0xffffffeb
jmp 0x10031a66
mov dword [ebp - 0x18], 0xb14f4e79
mov dword [ebp - 0x44], 0xa3191b49
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x4c], eax
jne 0x100319f0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
sub eax, 0x43e
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
inc ecx
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], eax
jmp 0x10031a5d
mov dword [ebp - 0x48], 0x2f25
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x3c], 0x8360e569
cmp dword [ebp - 0x20], eax
jne 0x10031a63
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
sub ecx, 0x6a9c
neg ecx
push 0
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x3f0a
setg al
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
sub eax, 0xdd8e
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], 0x2e
jg 0x100319fd
inc dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x4c], 0x14
jle 0x100319a3
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x28], 0xf57a7c2
mov dword [ebp - 0x3c], 0x997ec53a
mov dword [ebp - 0x34], 0xd1456014
push 3
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x10031ab0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x23c], 0x77862fd4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10031a98
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10031ad3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8ac], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10031abb
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x28], ecx
inc ebx
cmp dword [ebp - 0x28], eax
jl 0x10031b74
mov dword [ebp - 0x20], 0xc62e0897
mov dword [ebp - 0x48], 0xefcdf11b
mov dword [ebp - 0x3c], 0xfffe
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], eax
jmp 0x10031b10
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x23c], 0x666a756a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10031aff
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x23c], 0
je 0x10031b2e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x8a8], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
push 0
mov eax, dword [ebp + eax*4 - 0x23c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x23c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x23c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x23c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], ebx
dec dword [ebp - 0x28]
pop eax
jns 0x10031ae2
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jg 0x10031c14
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x23c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x23c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x23c]
mov eax, dword [ebp - 0x28]
add ecx, dword [ebp + eax*4 - 0x23c]
mov eax, dword [ebp - 0x28]
sub ecx, dword [ebp + eax*4 - 0x23c]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x8a8], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x23c]
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10031bec
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031bff
push eax
push eax
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
xor eax, eax
cmp dword [ebp - 0x234], eax
jne 0x10031c14
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x10031b80
mov eax, dword [ebp - 0x1d8]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, 0xffff
cmp dword [ebp - 0x320], eax
ja 0x10031c3f
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1d8], eax
je 0x10031c41
mov ecx, ebx
mov eax, dword [ebp - 0x54]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, dword [ebp - 0x24]
jg 0x1003274c
cmp dword [ebp - 0x10], eax
je 0x1003274c
or edx, 0xffffffff
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], 0xff1eb7e5
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x10031ca1
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xa44], 0
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 2
jl 0x10031c88
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xb
jg 0x10031dba
mov dword [ebp - 0x3c], 0x57e71f09
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10031cd7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6fc], 0x1e2c0d37
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10031cbe
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10031cf9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x880], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10031ce0
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031d08
call dword [sym.imp.USER32.dll_DestroyCaret]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x880]
add eax, 2
push 0xfffffffffffffffd
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
neg ecx
sub ecx, eax
mov eax, dword [ebp - 0x880]
add ecx, eax
mov eax, dword [ebp - 0x87c]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
inc dword [ebp - 0x20]
cmp eax, edx
je 0x10031d4b
mov edx, ebx
jmp 0x10031d4f
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x6f8]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x87c], ecx
test ecx, ecx
je 0x10031d6f
cmp dword [ebp - 0x18], eax
je 0x10031d6f
mov eax, ebx
push 0xfffffffffffffffc
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
push 0
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x6f8]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov ecx, dword [ebp - 0x6f8]
setg dl
lea eax, [edx - 0x421]
imul ecx, eax
pop eax
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xb
jle 0x10031cae
or edx, 0xffffffff
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jl 0x10031e16
mov eax, 0x9c36c1d6
mov dword [ebp - 0x92c], eax
mov dword [ebp - 0x928], eax
mov dword [ebp - 0x924], eax
mov dword [ebp - 0x920], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x928]
mov eax, dword [ebp - 0xa44]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
setne cl
mov dword [ebp - 0x928], eax
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jge 0x10031dc3
xor eax, eax
mov ecx, 0x2149
mov dword [ebp - 0x834], ecx
mov dword [ebp - 0x830], ecx
mov dword [ebp - 0x82c], ecx
mov dword [ebp - 0x828], ecx
mov dword [ebp - 0x48], 0x59b8bc58
mov dword [ebp - 0x944], edx
mov dword [ebp - 0x940], edx
mov dword [ebp - 0x93c], edx
mov dword [ebp - 0x938], edx
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x3c], 0x26a056eb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10031e80
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x28c], 0xfffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10031e68
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10031e96
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd90], 2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10031e85
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x48]
jle 0x10031eba
inc dword [ebp - 0x28c]
mov eax, dword [ebp - 0x28c]
cmp eax, ebx
je 0x10031eba
xor eax, eax
mov edx, eax
jmp 0x10031ebc
mov edx, ebx
mov eax, dword [ebp - 0xd8c]
xor ecx, ecx
cmp edx, eax
push 3
setg cl
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x944]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setge dl
sub edx, 0xd562
neg edx
sbb edx, edx
or ecx, 0xffffffff
inc edx
xor eax, eax
mov dword [ebp - 0x938], edx
mov dword [ebp - 0x3c], 0x1d584d75
mov dword [ebp - 0x48], 0x915a1369
mov dword [ebp - 0x44], 0xcce57bf5
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], 0x44fa3fda
mov dword [ebp - 0x3c], 0x887c5c6a
mov dword [ebp - 0x34], 0xfe2499e6
mov dword [ebp - 0x18], eax
pop edx
cmp dword [ebp - 0x18], edx
jge 0x10031f48
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x674], 0xfffffff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10031f30
xor eax, eax
dec dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jg 0x10031fe6
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x48], eax
xor edx, edx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x4c]
push 0xffffffffffffffff
mov eax, dword [ebp + eax*4 - 0x674]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x674]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x674]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x674]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x674]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
pop ecx
setg dl
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 2
jle 0x10031f58
push 3
xor eax, eax
or ecx, ecx
pop edx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1003200b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x45c], 0xfffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10031ff2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10032028
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003276e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003275a
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003278a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x19c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10032776
xor eax, eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 4
jle 0x10032884
mov dword [ebp - 0x610], eax
mov dword [ebp - 0x60c], eax
mov dword [ebp - 0x608], eax
mov dword [ebp - 0x604], eax
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x610]
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x8c]
sub edx, eax
mov eax, dword [ebp - 0x8c]
test eax, eax
push 0
setg cl
xor eax, eax
cmp ecx, edx
setle al
xor edx, edx
cmp eax, 0xf3cc
setle dl
xor ecx, ecx
mov dword [ebp - 0x19c], edx
mov eax, dword [ebp - 0x608]
cmp edx, eax
mov eax, dword [ebp - 0x604]
sete cl
xor edx, edx
imul ecx, ecx, 0x4709
cmp ecx, eax
mov eax, dword [ebp - 0x610]
setg dl
xor ecx, ecx
cmp edx, ebx
mov edx, dword [ebp - 0x8c]
setl cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x8c]
sete bl
xor ecx, ecx
imul edx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x610]
setne cl
xor edx, edx
cmp ecx, 0xa12a
setge dl
xor ecx, ecx
imul eax, edx
cmp eax, 0xb6d6
pop eax
setge cl
push 1
mov dword [ebp - 0x20], ecx
pop ebx
mov dword [ebp - 0x20], 0xae9f9034
inc dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], 4
push 0xffffffffffffffff
pop ecx
jg 0x1003279d
mov dword [ebp - 0x20], 0xf
cmp dword [ebp - 0x20], 0xffffffea
jge 0x10032955
jmp 0x10032899
xor eax, eax
mov dword [ebp - 0x18], 0x59baaa4f
mov dword [ebp - 0x44], 0x5379a1d1
mov dword [ebp - 0x48], 0xc256fae
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100328cb
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp - 0x19c]
xor eax, eax
cmp dword [ebp - 0x8c], eax
je 0x100328f5
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
je 0x100328f3
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100328f3
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xe074
add eax, dword [ebp - 0x44]
jne 0x1003291a
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x18], 0xfffffff9
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
sub eax, 0x860c
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x19c], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffea
jl 0x10032897
mov dword [ebp - 0x60], ebx
or ecx, 0xffffffff
mov dword [ebp - 0x18], ecx
xor eax, eax
mov dword [ebp - 0x2c], 0x32a17d0b
push 3
mov dword [ebp - 0x48], 0x66c4a87f
pop edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], eax
jmp 0x1003298d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6f4], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003297c
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100329cf
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], eax
je 0x100329bf
xor eax, eax
cmp dword [ebp - 0x6e8], eax
je 0x100329c1
mov eax, ebx
jmp 0x100329c1
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
je 0x100329cd
mov eax, ebx
jmp 0x100329cf
xor eax, eax
imul eax, eax, 0xfffa
mov ecx, 0xffff
cmp ecx, eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x6e8]
cmp eax, 0xbf90edca
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x6e8]
sbb ecx, ecx
inc ecx
imul ecx, eax
mov eax, dword [ebp - 0x6e8]
imul eax, ecx
mov dword [ebp - 0x6e8], eax
test eax, eax
je 0x10032a75
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10032a6e
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jl 0x10032a4a
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032a42
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032a6b
cmp dword [ebp - 0x2c], edx
jle 0x10032a25
jmp 0x10032aba
mov dword [ebp - 0x48], 7
xor ecx, ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x30], 0x4c3e
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x6ec]
mov eax, dword [ebp - 0x20]
cmp eax, 0x54f8
setge cl
xor eax, eax
add ecx, dword [ebp - 0x3c]
add ecx, dword [ebp - 0x48]
je 0x10032aad
mov ecx, ebx
cmp dword [ebp - 0x30], eax
jne 0x10032aaf
mov ecx, eax
xor eax, eax
cmp ecx, 5
setg al
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x2c], 2
cmp dword [ebp - 0x2c], 5
jg 0x10032b72
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x34], 0x26ae69ed
mov dword [ebp - 0x34], 0x3f85024d
mov dword [ebp - 0x34], 0x31fc5313
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x5278539a
mov dword [ebp - 0x34], 0x69002fce
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x34], 0x84085efb
mov dword [ebp - 0x34], 0x8a218178
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x34], 0x62392e18
mov dword [ebp - 0x34], 0x54d1843a
mov dword [ebp - 0x34], 0x7655505f
mov dword [ebp - 0x34], 0x1979
mov dword [ebp - 0x48], 0xe9e61979
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10032b62
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xabc], 0x66fa41d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10032b4a
dec dword [ebp - 0x48]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 5
jle 0x10032ad0
push 6
pop eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x845d
mov dword [ebp - 0x44], 0xfffffff8
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x18], eax
jmp 0x10032ba5
cmp dword [ebp - 0x18], edx
jl 0x10032b94
or eax, 0xffffffff
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x1c], 0x1d
cmp dword [ebp - 0x1c], 0xf
jge 0x100332cd
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 7
setl cl
mov dword [ebp - 0x58], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
jl 0x100332b4
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_TranslateMDISysAccel]
mov dword [ebp - 0x1c], eax
jmp 0x100332f0
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100332ed
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jne 0x100332d8
mov dword [ebp - 0x34], 0xfffffff6
mov esi, 0x25b3
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003332d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xef8], 0x7d8a8701
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10033314
xor eax, eax
dec dword [ebp - 0x48]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033347
push 0xa74
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
or edx, 0xffffffff
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x1c], 0x1d
cmp dword [ebp - 0x1c], 0xf
jge 0x10033376
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 7
setl cl
mov dword [ebp - 0x58], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
jl 0x1003335d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
je 0x100333a0
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033394
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jne 0x1003337f
or edx, 0xffffffff
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x1c], 0x1d
cmp dword [ebp - 0x1c], 0xf
jge 0x100333cc
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 7
setl cl
mov dword [ebp - 0x58], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
jl 0x100333b3
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
je 0x100333f6
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100333ea
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jne 0x100333d5
or edx, 0xffffffff
mov dword [ebp - 0x20], 0xc03342eb
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003341c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3c8], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10033408
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffa
cmp dword [ebp - 0x20], 7
jle 0x10033528
jmp 0x10033431
xor eax, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x58], 0x95342363
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10033459
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2bc], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10033444
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1003346f
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
add eax, 0x222e2708
jne 0x1003346f
mov ecx, eax
jmp 0x10033471
mov ecx, ebx
mov dword [ebp - 0x2bc], ecx
mov eax, dword [ebp - 0x2c]
imul eax, ecx
mov dword [ebp - 0x3c8], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1003350f
mov dword [ebp - 0x2bc], 0x9934b0b4
xor ebx, ebx
mov eax, dword [ebp - 0x24]
mov edx, 0xa720
mov eax, dword [ebp + eax*4 - 0x2bc]
test eax, eax
mov eax, dword [ebp - 0x2c]
sete bl
sub edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setle cl
sub ebx, ecx
lea ecx, [ebx - 0x62c4df8e]
mov dword [ebp - 0x2bc], ecx
mov eax, dword [ebp - 0x3c8]
add eax, ecx
jne 0x100334dc
cmp dword [ebp - 0x2bc], eax
je 0x100334df
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x10033509
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033504
push eax
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x100334f2
inc dword [ebp - 0x24]
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x24], ebx
jle 0x1003348d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 7
push 0xffffffffffffffff
pop edx
jg 0x1003342f
mov dword [ebp - 0x34], 0xf75d
xor eax, eax
mov dword [ebp - 0x34], 0xd490c4d8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1003355a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1070], 0xa35f394
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10033541
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1003357c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe68], 9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x10033563
xor eax, eax
mov dword [ebp - 0x28], eax
or ecx, 0xffffffff
cmp dword [ebp - 0x28], ebx
jge 0x1003359b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x44c], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10033587
xor eax, eax
inc dword [ebp - 0x44c]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100335c0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x84], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100335ac
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100335dc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a8], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100335c8
xor eax, eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jle 0x100336d6
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5bc], eax
mov dword [ebp - 0x5b8], eax
mov dword [ebp - 0x5b4], eax
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x5c0]
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x84]
sub edx, eax
mov eax, dword [ebp - 0x84]
test eax, eax
push 0
setg cl
xor eax, eax
cmp ecx, edx
setle al
xor edx, edx
cmp eax, 0xf3cc
setle dl
xor ecx, ecx
mov dword [ebp - 0x1a8], edx
mov eax, dword [ebp - 0x5b8]
cmp edx, eax
mov eax, dword [ebp - 0x5b4]
sete cl
xor edx, edx
imul ecx, ecx, 0x4709
cmp ecx, eax
mov eax, dword [ebp - 0x5c0]
setg dl
xor ecx, ecx
cmp edx, ebx
mov edx, dword [ebp - 0x84]
setl cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x84]
sete bl
xor ecx, ecx
imul edx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x5c0]
setne cl
xor edx, edx
cmp ecx, 0xa12a
setge dl
xor ecx, ecx
imul eax, edx
cmp eax, 0xb6d6
pop eax
setge cl
push 1
mov dword [ebp - 0x20], ecx
pop ebx
mov dword [ebp - 0x20], 0xae9f9034
inc dword [ebp - 0x84]
cmp dword [ebp - 0x84], 4
push 0xffffffffffffffff
pop ecx
jg 0x100335ef
mov dword [ebp - 0x20], 0xf
cmp dword [ebp - 0x20], 0xffffffea
jge 0x100337ab
jmp 0x100336eb
xor eax, eax
mov dword [ebp - 0x10], 0x59baaa4f
mov dword [ebp - 0x18], 0x5379a1d1
mov dword [ebp - 0x48], 0xc256fae
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033721
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp - 0x1a8]
xor eax, eax
cmp dword [ebp - 0x84], eax
je 0x1003374b
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
je 0x10033749
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10033749
mov edx, ebx
jmp 0x1003374d
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xe074
add eax, dword [ebp - 0x18]
jne 0x10033770
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x10], 0xfffffff9
mov eax, dword [ebp - 0x10]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
sub eax, 0x860c
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1a8], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffea
jl 0x100336e9
mov dword [ebp - 0x34], 0xfffffff6
xor eax, eax
mov dword [ebp - 0x2c], 0x96960f57
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100337d9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9a4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100337c4
xor eax, eax
push 2
mov dword [ebp - 0x2c], eax
pop edx
cmp dword [ebp - 0x2c], edx
jg 0x1003385e
mov dword [ebp - 0x10], 9
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x48], 0xfffffffa
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], eax
jl 0x10033809
mov dword [ebp - 0x30], 0x3367f5ed
dec dword [ebp - 0x10]
jns 0x100337fd
cmp dword [ebp - 0x99c], eax
jne 0x10033818
mov ecx, eax
cmp dword [ebp - 0x2c], eax
je 0x1003381a
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
push 0
mov eax, dword [ebp + eax*4 - 0x9a4]
mov eax, dword [ebp - 0x48]
sub eax, 4
neg eax
sbb eax, eax
inc eax
sub eax, ecx
neg eax
sbb eax, eax
add eax, 0x77509cb1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x9a0]
mov ecx, dword [ebp - 0x48]
sub ecx, eax
neg ecx
pop eax
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jle 0x100337e4
mov dword [ebp - 0x30], eax
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
mov eax, 0x1edd1edb
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x9c0], eax
mov dword [ebp - 0x9bc], eax
mov dword [ebp - 0x9b8], eax
mov dword [ebp - 0x9b4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100338ad
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3e4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10033895
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100338cd
push 0x7a6
push 0x2360
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, dword [ebp - 0x3e4]
mov eax, dword [ebp - 0x3e4]
sub ecx, 0x9689
neg ecx
push 6
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
imul eax, ecx, 0x4e688188
mov ecx, 0xffff2014
sub ecx, eax
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x9b4], eax
mov eax, 0xffff
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x18], eax
pop eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x24], 0x4067bc62
push 3
mov dword [ebp - 0x10], 0x65ad6cad
mov dword [ebp - 0x10], eax
pop esi
jmp 0x10033950
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1e4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10033943
mov eax, dword [ebp - 0x1dc]
mov ecx, 0xbb7a1405
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
add edx, 0x87223b17
cmp eax, edx
setne cl
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
add eax, dword [ebp - 0x1dc]
cmp eax, 0xfffffff6
mov eax, dword [ebp - 0x1e0]
setne dl
sub edx, 0xd35
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
neg ecx
je 0x100339b9
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x1dc]
xor edx, edx
mov eax, dword [ebp - 0x1dc]
mov ecx, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x1e4]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1dc]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1dc]
setne bl
xor ecx, ecx
cmp ebx, eax
setge cl
inc ecx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
dec eax
neg eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x17
jl 0x10033aab
xor edi, edi
or eax, 0xffffffff
mov dword [ebp - 0x20], 0xbec7a429
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x58], 0xfbecdb59
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x44], 0xfff8
jbe 0x10033a75
cmp dword [ebp - 0x20], eax
je 0x10033a75
cmp dword [ebp - 0x24], eax
je 0x10033a75
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x20]
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x58], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10033a96
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x17
jge 0x10033a1c
mov dword [ebp - 0x34], eax
or ecx, 0xffffffff
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x58], 0x955a6194
mov dword [ebp - 0x58], 0x2b2e5f58
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x58], ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033af7
push 0x1057
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x24], eax
jmp 0x10033c03
cmp dword [ebp - 0x24], 0x13
jl 0x10033aff