Function at 0x10029e6a
Capabilities:
Accept command line arguments
Allocate thread local storage
Connect pipe
Delete file
Enumerate gui resources
Get common file path
Get graphical window text
Get keyboard layout
Log keystrokes via polling
Query environment variable
Set environment variable

Disassembly:
mov eax, 0x10075696
call fcn.10075420
mov eax, 0x1248
call fcn.10071bd0
push ebx
push esi
push edi
xor edi, edi
mov byte [ebp - 0x71], dl
push 4
inc edi
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0x28], edi
xor eax, eax
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x44], 0x85dc1b6e
pop edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x3c], 0xa37d7c86
mov dword [ebp - 0x40], 0x1521fafb
push 3
mov dword [ebp - 0x3c], edi
pop esi
mov dword [ebp - 0x30], 0x86c7a88f
mov dword [ebp - 0x1c], eax
push 5
pop ecx
cmp dword [ebp - 0x1c], esi
jge 0x10029ee0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xeb8], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10029ecc
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10029f00
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x424], 0x9ca4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10029ee8
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10029f20
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbc0], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10029f08
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10029f81
mov eax, dword [ebp - 0x18]
neg eax
push 4
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x5542
setg dl
xor ecx, ecx
mov dword [ebp - 0xeb0], edx
mov eax, dword [ebp - 0x28]
cmp edx, eax
setl cl
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
sub ecx, 0x6eea
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffffffd
setne al
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x18]
sub edx, eax
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop edx
setg cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x18]
dec eax
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0x28ab
sub eax, dword [ebp - 0x40]
jne 0x10029f9d
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x10029f9f
mov ecx, edi
mov dword [ebp - 0x424], ecx
mov eax, dword [ebp - 0x28]
imul eax, ecx
xor ecx, ecx
cmp eax, 0x714a0256
setne cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0xbbc]
mov dword [ebp - 0x34], 0x7af5
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x14], 0x29f58382
mov dword [ebp - 0x3c], 0x87c7
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jge 0x10029ffc
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xf50], 0xaef1792f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x10029fe4
xor eax, eax
mov ecx, edi
cmp dword [ebp - 0x34], eax
jne 0x1002a005
mov ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], eax
jmp 0x1002a038
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x584], 0xf12afbc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002a027
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], 0xa314
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x57c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp eax, edi
push 2
setg cl
xor eax, eax
cmp eax, ecx
mov eax, dword [ebp - 0x57c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x57c]
setl dl
xor ebx, ebx
cmp edx, 0x2954
setle bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp ecx, eax
sete dl
add edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor eax, eax
inc edx
imul edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x14]
cmp edx, 0x5a02
pop edx
setge al
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002a0d1
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x584]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1002a0c1
mov eax, dword [ebp - 0x20]
neg eax
jne 0x1002a0fc
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002a0f1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002a0f3
mov eax, edi
cmp dword [ebp - 0x14], eax
jge 0x1002a0fc
xor eax, eax
jmp 0x1002a0fe
mov eax, edi
neg eax
mov dword [ebp - 0xf44], eax
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x30], 0xa810d21d
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], 0xe92e
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x1002a14e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1068], 0xd69f4288
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002a136
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002a164
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa7c], 0x2743
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002a153
inc dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002a194
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb8], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002a17c
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002a1b4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xed0], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002a19c
xor eax, eax
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x34], eax
jmp 0x1002a26b
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x20], 0x14
cmp dword [ebp - 0x20], 0xfffffff6
je 0x1002a268
push 4
pop ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002a1fe
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc50], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002a1e6
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002a21e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3c0], 0xba47c9d5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002a206
xor eax, eax
cmp dword [ebp - 0x3bc], eax
jne 0x1002a246
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3bc]
cmp dword [ebp - 0x34], eax
jne 0x1002a23a
mov eax, dword [ebp - 0x3bc]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3bc]
inc dword [ebp - 0xc48]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3bc], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff6
push 0
pop eax
jne 0x1002a1de
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 8
jg 0x1002a1c3
mov byte [ebp - 0x4d], al
mov dword [ebp - 0x4c], 0x44ad72d7
mov dword [ebp - 0x3c], 0x4727cad7
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x44], 0xff8ee1d1
mov dword [ebp - 0x3c], 0x8cf1d65f
mov dword [ebp - 0x38], 0xf6b9
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1002a2c1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x188], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002a2a9
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002a2e1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x42c], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002a2c9
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002a2f7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb7c], 0x4ed832cb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002a2e6
mov eax, dword [ebp - 0x184]
mov ecx, 0xc4ad
mov eax, dword [ebp - 0x38]
dec dword [ebp - 0x38]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x42c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x188]
sub ecx, eax
mov eax, dword [ebp - 0x184]
add eax, ecx
mov ecx, dword [ebp - 0x4c]
add ecx, eax
jne 0x1002a336
mov eax, dword [ebp - 0x188]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xb78]
mov eax, dword [ebp - 0x40]
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x184], edi
mov eax, dword [ebp - 0x188]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
cmp byte [ebp - 0x4d], 0
je 0x1002a370
xor eax, eax
push eax
push eax
push eax
call ebx
push 2
pop edx
mov dword [ebp - 0x14], 0xffffffff
xor eax, eax
mov dword [ebp - 0x44], 0xea2ff3e1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002a3a0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5f0], 0xa8c6a53d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002a388
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002a3c0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x434], 0xc4438182
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002a3a8
xor eax, eax
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], eax
jl 0x1002a438
mov dword [ebp - 0x18], 0x891f782a
mov dword [ebp - 0x44], 0x7439cb61
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], eax
jl 0x1002a421
push 4
pop ecx
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x28], eax
jmp 0x1002a3fe
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xf70], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002a3ed
mov dword [ebp - 0x44], 0x283066c9
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xf70], eax
dec dword [ebp - 0x18]
push 0
pop eax
jns 0x1002a3e1
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x5f0], 0
jne 0x1002a436
dec dword [ebp - 0x14]
push 0
pop eax
jns 0x1002a3c8
xor eax, eax
cmp dword [ebp - 0x5f0], eax
je 0x1002a499
mov eax, dword [ebp - 0x14]
xor edx, edx
imul ecx, dword [ebp - 0x14], 0xc21b984c
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x5f0]
setge dl
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
imul eax, ecx
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x5e8]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x14]
imul edx, eax
mov eax, dword [ebp - 0x434]
imul ecx, edx
xor edx, edx
cmp ecx, eax
setg dl
sub edx, 0xfffb
je 0x1002a497
mov eax, edi
jmp 0x1002a499
xor eax, eax
imul eax, eax, 0x4b83
mov esi, 0x61b583dc
mov edx, esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xb8]
imul eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xb8]
sub edx, eax
mov eax, dword [ebp - 0xb8]
sub edx, 0x244d
neg edx
sbb edx, edx
inc edx
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xb8]
sete dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0xb8]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xb8]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0xec8], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002a528
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002a510
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002a54a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xee8], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002a531
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002a558
push eax
push eax
push eax
call ebx
mov eax, dword [ebp - 0xc4]
mov edx, esi
imul eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc4]
sub edx, eax
mov eax, dword [ebp - 0xc4]
sub edx, 0x244d
neg edx
sbb edx, edx
inc edx
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc4]
sete dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0xc4]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xc4]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0xee0], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002a5d9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xcc], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002a5c1
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002a5fb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf00], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002a5e2
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002a609
push eax
push eax
push eax
call ebx
mov eax, dword [ebp - 0xcc]
mov edx, esi
imul eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0xcc]
mov ebx, dword [sym.imp.USER32.dll_IsZoomed]
mov edi, dword [sym.imp.USER32.dll_ScrollWindow]
sub edx, eax
mov eax, dword [ebp - 0xcc]
sub edx, 0x244d
neg edx
sbb edx, edx
inc edx
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xcc]
sete dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0xcc]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xcc]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0xef8], ecx
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x30], 0xe57bf5cd
mov dword [ebp - 0x20], 0xa6deec54
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x18], 0xfffffffc
cmp dword [ebp - 0x44], eax
je 0x1002a6bd
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1002a717
push eax
push eax
push 0xfc4
push 0x2236
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
jmp 0x1002a717
mov dword [ebp - 0x30], 0xa136951a
xor ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x8f6c74aa
mov dword [ebp - 0x30], 0x6b87d0fa
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002a6ff
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x238], 0x4d14
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002a6e7
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002a711
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
inc dword [ebp - 0x238]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe5
jne 0x1002a7ba
mov dword [ebp - 0x24], 0x177
mov dword [ebp - 0x28], eax
jmp 0x1002a743
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x608], 0x243e5ec3
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002a732
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
je 0x1002a769
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002a766
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x604], 0xfffffffc
cmp dword [ebp - 0x604], eax
jne 0x1002a794
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x38]
jg 0x1002a794
cmp dword [ebp - 0x604], 6
ja 0x1002a797
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x600]
sub eax, 0xc7e12fd8
neg eax
push 0
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe5
pop eax
je 0x1002a726
xor edx, edx
inc edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x44], 0x85dc1b6e
push 4
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x3c], 0xa37d7c86
mov dword [ebp - 0x40], 0x1521fafb
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x30], 0x86c7a88f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002a80d
push 5
pop ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf18], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002a7f8
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1002a82d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x43c], 0x9ca4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002a815
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002a84f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa08], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002a836
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002a8b0
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x5542
setg dl
xor ecx, ecx
mov dword [ebp - 0xf10], edx
mov eax, dword [ebp - 0x28]
cmp edx, eax
setl cl
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
sub ecx, 0x6eea
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffffffd
setne al
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x18]
sub edx, eax
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
inc edx
mov eax, dword [ebp - 0x18]
dec eax
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0x28ab
sub eax, dword [ebp - 0x40]
jne 0x1002a8cc
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x1002a8ce
mov ecx, edx
mov dword [ebp - 0x43c], ecx
mov eax, dword [ebp - 0x28]
imul eax, ecx
xor ecx, ecx
push 4
cmp eax, 0x714a0256
setne cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0xa04]
mov dword [ebp - 0x34], 0x7af5
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x14], 0x29f58382
mov dword [ebp - 0x3c], 0x87c7
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x1002a92e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xf88], 0xaef1792f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002a916
xor eax, eax
mov ecx, edx
cmp dword [ebp - 0x34], eax
jne 0x1002a937
mov ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], eax
jmp 0x1002a96a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x620], 0xf12afbc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002a959
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], 0xa314
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x618]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp eax, edx
push 2
setg cl
xor eax, eax
cmp eax, ecx
mov eax, dword [ebp - 0x618]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x618]
setl dl
xor ecx, ecx
cmp edx, 0x2954
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
pop edx
sete cl
add ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
imul ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x14]
cmp ecx, 0x5a02
setge al
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002aa04
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x620]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1002a9f4
mov eax, dword [ebp - 0x20]
neg eax
jne 0x1002aa37
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002aa29
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002aa29
xor ecx, ecx
inc ecx
jmp 0x1002aa2e
xor ecx, ecx
inc ecx
mov eax, ecx
cmp dword [ebp - 0x14], eax
jge 0x1002aa3a
xor eax, eax
jmp 0x1002aa3c
xor ecx, ecx
inc ecx
mov eax, ecx
neg eax
mov dword [ebp - 0xf7c], eax
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x30], 0xa810d21d
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], 0xe92e
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x1002aa8c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf38], 0xd69f4288
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002aa74
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002aaa2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa8c], 0x2743
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002aa91
inc dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x44], 0xea2ff3e1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002aae2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x638], 0xa8c6a53d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002aac9
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002ab02
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x444], 0xc4438182
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002aaea
xor eax, eax
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], eax
jl 0x1002ab80
push 4
pop edi
mov dword [ebp - 0x18], 0x891f782a
mov dword [ebp - 0x44], 0x7439cb61
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], eax
jl 0x1002ab63
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x28], eax
jmp 0x1002ab40
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xfa0], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1002ab2f
mov dword [ebp - 0x44], 0x283066c9
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xfa0], eax
dec dword [ebp - 0x18]
push 0
pop eax
jns 0x1002ab23
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x638], 0
jne 0x1002ab78
dec dword [ebp - 0x14]
push 0
pop eax
jns 0x1002ab0d
mov edi, dword [sym.imp.USER32.dll_ScrollWindow]
xor eax, eax
cmp dword [ebp - 0x638], eax
je 0x1002abe5
mov eax, dword [ebp - 0x14]
xor edx, edx
imul ecx, dword [ebp - 0x14], 0xc21b984c
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x638]
setge dl
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
imul eax, ecx
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x14]
imul edx, eax
mov eax, dword [ebp - 0x444]
imul ecx, edx
xor edx, edx
cmp ecx, eax
setg dl
xor ecx, ecx
sub edx, 0xfffb
je 0x1002abe2
inc ecx
mov eax, ecx
jmp 0x1002abe5
xor eax, eax
inc ecx
imul eax, eax, 0x4b83
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002ac10
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc0], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002abf8
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002ac32
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xef4], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002ac19
xor eax, eax
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x34], eax
jmp 0x1002aceb
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x20], 0x14
cmp dword [ebp - 0x20], 0xfffffff6
je 0x1002ace8
push 4
pop edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x1002ac7c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc90], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002ac64
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002ac9e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3d0], 0xba47c9d5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002ac85
xor eax, eax
cmp dword [ebp - 0x3cc], eax
jne 0x1002acc6
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3cc]
cmp dword [ebp - 0x34], eax
jne 0x1002acba
mov eax, dword [ebp - 0x3cc]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3cc]
inc dword [ebp - 0xc88]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3cc], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff6
push 0
pop eax
jne 0x1002ac5c
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 8
jg 0x1002ac41
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x3c], 0xffffffff
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002ad19
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x34], 0x17
jmp 0x1002ae27
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x44], 0x8c7fffaa
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x20], 0xfffffff1
cmp dword [ebp - 0x20], 0x14
jge 0x1002ae09
mov dword [ebp - 0x18], 0x4cc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002ad70
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xf30], 0x5a12a2ef
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002ad57
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002aded
cmp dword [ebp - 0x34], eax
je 0x1002ad7c
mov eax, ecx
xor edx, edx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp eax, edx
setne cl
add ecx, dword [ebp - 0x18]
je 0x1002ad96
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0xea2c
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0xf2c], ecx
mov eax, dword [ebp - 0x20]
sub eax, ecx
xor ecx, ecx
imul eax, dword [ebp - 0x20]
inc ecx
cmp eax, ecx
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x18]
jne 0x1002aeaf
cmp dword [ebp - 0x34], eax
jne 0x1002aeb1
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x14
push 0
pop eax
jl 0x1002ad47
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002ae21
push eax
push 0x109f
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor eax, eax
dec dword [ebp - 0x34]
push 1
pop ecx
cmp dword [ebp - 0x34], 0xffffffff
je 0x1002ad25
mov byte [ebp - 0xd], al
xor ecx, ecx
mov dword [ebp - 0x44], 0x7bc75286
inc ecx
mov dword [ebp - 0x20], 0xa1fa147b
mov dword [ebp - 0x44], 0x67f5aee0
mov dword [ebp - 0x18], 0xa0b59785
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x3c], 0x8211abd
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002ae8e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x100], 0x424b969
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002ae76
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002aeaa
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x44c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002ae96
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002aed2
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002adeb
mov eax, ecx
jmp 0x1002aded
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xdd4], 0x151060f3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002aec1
inc dword [ebp - 0x44]
mov dword [ebp - 0x18], 0xffff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x1002aef4
cmp dword [ebp - 0x18], eax
je 0x1002aef6
mov eax, ecx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x100]
add eax, 0x40c41ab7
neg eax
sbb eax, eax
inc eax
neg eax
je 0x1002af46
xor eax, eax
cmp dword [ebp - 0x44c], eax
je 0x1002af48
jmp 0x1002af4a
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0x663b8b2e
mov ecx, dword [ebp - 0x20]
setle al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x100], ecx
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x44], 0x70bb
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
neg edx
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0xdd0], ecx
mov dword [ebp - 0x20], eax
jmp 0x1002afb8
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002afb5
push 0x615
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x11
jge 0x1002af97
cmp byte [ebp - 0xd], 0
je 0x1002b106
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x20], 0x13dce9d
mov dword [ebp - 0x24], 0x72304b25
push 0xfffffffffffffffe
pop edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x38], 0x89f2e072
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x40], 0xa0c09020
mov dword [ebp - 0x4c], 0xffeac8e4
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002b030
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe34], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002b018
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002b042
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xcf0], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002b035
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x28]
jne 0x1002b06a
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002b06a
xor edx, edx
inc edx
jmp 0x1002b06f
xor edx, edx
inc edx
mov eax, edx
mov dword [ebp - 0x44], eax
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1002b080
cmp dword [ebp - 0x28], eax
je 0x1002b080
mov eax, edx
cmp eax, dword [ebp - 0x24]
je 0x1002b08e
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x24], eax
je 0x1002b090
mov ecx, edx
mov eax, dword [ebp - 0x18]
imul eax, ecx
dec dword [ebp - 0x18]
cmp eax, 0x81ec
je 0x1002b0a4
mov eax, edx
jmp 0x1002b0a6
xor eax, eax
imul eax, eax, 0xe7f1
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x1002b0c3
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1002b0c5
mov ecx, edx
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0xe2c], ecx
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xcf0], edx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
sub edx, eax
mov eax, dword [ebp - 0x24]
inc eax
cmp edx, eax
setg cl
xor eax, eax
push eax
push eax
push eax
mov dword [ebp - 0x20], ecx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x4c], 0x44ad72d7
xor eax, eax
mov dword [ebp - 0x3c], 0x4727cad7
xor edx, edx
mov dword [ebp - 0x30], eax
inc edx
mov dword [ebp - 0x44], 0xff8ee1d1
mov dword [ebp - 0x3c], 0x8cf1d65f
mov dword [ebp - 0x38], 0xf6b9
mov dword [ebp - 0x40], edx
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002b157
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x180], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002b13f
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1002b177
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x468], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002b15f
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002b18d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9a4], 0x4ed832cb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002b17c
mov eax, dword [ebp - 0x17c]
mov ecx, 0xc4ad
mov eax, dword [ebp - 0x38]
dec dword [ebp - 0x38]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x468]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x180]
sub ecx, eax
mov eax, dword [ebp - 0x17c]
add eax, ecx
mov ecx, dword [ebp - 0x4c]
add ecx, eax
jne 0x1002b1cc
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x9a0]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x17c], edx
mov edx, esi
mov eax, dword [ebp - 0x180]
neg eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessTimes]
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xc0]
imul eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xc0]
sub edx, eax
mov eax, dword [ebp - 0xc0]
sub edx, 0x244d
neg edx
sbb edx, edx
inc edx
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc0]
sete dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0xc0]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xc0]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0xeec], ecx
inc edx
mov dword [ebp - 0x14], 0xfffffff8
xor eax, eax
mov dword [ebp - 0x44], 0x8f92
mov dword [ebp - 0x3c], 0x4129b857
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x4c], edx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002b292
push eax
push eax
push eax
push eax
push eax
call esi
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
add eax, eax
cmp eax, dword [ebp - 0x14]
jge 0x1002b2a3
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
push 4
pop ecx
sub eax, ecx
je 0x1002b2bb
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1002b2bd
mov ecx, edx
jmp 0x1002b2bf
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x14]
imul eax, ecx
test eax, eax
jne 0x1002b2d0
cmp dword [ebp - 0x14], eax
jne 0x1002b2d0
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
cmp ecx, 0xb37d
setl dl
neg eax
sbb eax, eax
inc eax
imul edx, eax
imul eax, edx, 0xfffa
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x30], 0xe57bf5cd
mov dword [ebp - 0x20], 0xa6deec54
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x18], 0xfffffffc
cmp dword [ebp - 0x44], eax
je 0x1002b357
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002b3b1
push eax
push eax
push 0xfc4
push 0x2236
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
jmp 0x1002b3b1
mov dword [ebp - 0x30], 0xa136951a
xor ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x8f6c74aa
mov dword [ebp - 0x30], 0x6b87d0fa
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002b399
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x274], 0x4d14
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002b381
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b3ab
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
inc dword [ebp - 0x274]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe5
jne 0x1002b454
mov dword [ebp - 0x24], 0x177
mov dword [ebp - 0x28], eax
jmp 0x1002b3dd
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x650], 0x243e5ec3
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002b3cc
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
je 0x1002b403
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002b400
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x64c], 0xfffffffc
cmp dword [ebp - 0x64c], eax
jne 0x1002b42e
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x38]
jg 0x1002b42e
cmp dword [ebp - 0x64c], 6
ja 0x1002b431
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x648]
sub eax, 0xc7e12fd8
neg eax
push 0
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe5
pop eax
je 0x1002b3c0
mov dword [ebp - 0x30], 0xffffffff
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b47a
push 0xe7e
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b493
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
xor eax, eax
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x30], 0xe57bf5cd
mov dword [ebp - 0x20], 0xa6deec54
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x18], 0xfffffffc
cmp dword [ebp - 0x44], eax
je 0x1002b4dd
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b53d
push eax
push eax
push 0xfc4
push 0x2236
call ebx
push eax
call edi
jmp 0x1002b53d
mov dword [ebp - 0x30], 0xa136951a
xor ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x8f6c74aa
mov dword [ebp - 0x30], 0x6b87d0fa
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002b51f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x218], 0x4d14
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002b507
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b531
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
inc dword [ebp - 0x218]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe5
jne 0x1002b5e0
mov dword [ebp - 0x24], 0x177
mov dword [ebp - 0x28], eax
jmp 0x1002b569
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x668], 0x243e5ec3
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002b558
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
je 0x1002b58f
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002b58c
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x664], 0xfffffffc
cmp dword [ebp - 0x664], eax
jne 0x1002b5ba
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x38]
jg 0x1002b5ba
cmp dword [ebp - 0x664], 6
ja 0x1002b5bd
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x660]
sub eax, 0xc7e12fd8
neg eax
push 0
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe5
pop eax
je 0x1002b54c
mov dword [ebp - 0x30], 0x928c176b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b612
push 0x2662
push eax
push 0x107f
push 0x2027
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b624
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor eax, eax
mov dword [ebp - 0x14], 0xfffffff8
xor edx, edx
mov dword [ebp - 0x44], 0x8f92
inc edx
mov dword [ebp - 0x3c], 0x4129b857
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x4c], edx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b660
push eax
push eax
push eax
push eax
push eax
call esi
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
add eax, eax
cmp eax, dword [ebp - 0x14]
jge 0x1002b671
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
push 4
pop ecx
sub eax, ecx
je 0x1002b689
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1002b68b
mov ecx, edx
jmp 0x1002b68d
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x14]
imul eax, ecx
test eax, eax
jne 0x1002b69e
cmp dword [ebp - 0x14], eax
jne 0x1002b69e
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
cmp ecx, 0xb37d
setl dl
neg eax
sbb eax, eax
inc eax
imul edx, eax
imul eax, edx, 0xfffa
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x30], 0xffffffff
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002b6ff
push 0xe7e
push eax
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b714
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
xor eax, eax
mov dword [ebp - 0x30], 0x8c6a53d0
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b72d
push eax
call dword [sym.imp.USER32.dll_CreateIconIndirect]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b741
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
xor eax, eax
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x44], 0x8f92
mov dword [ebp - 0x3c], 0x4129b857
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x4c], 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b77b
push eax
push eax
push eax
push eax
push eax
call esi
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
add eax, eax
cmp eax, dword [ebp - 0x14]
jge 0x1002b78c
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
push 4
pop ecx
sub eax, ecx
je 0x1002b7a7
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1002b7a9
xor esi, esi
inc esi
mov ecx, esi
jmp 0x1002b7ae
xor eax, eax
xor esi, esi
mov ecx, eax
inc esi
mov eax, dword [ebp - 0x14]
imul eax, ecx
test eax, eax
jne 0x1002b7bf
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x1002b7c1
mov edx, esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
cmp ecx, 0xb37d
setl dl
neg eax
sbb eax, eax
inc eax
imul edx, eax
imul eax, edx, 0xfffa
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x30], 0x928c176b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002b832
push 0x2662
push eax
push 0x107f
push 0x2027
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b842
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x4c], 0x1e1e87df
mov eax, 0x888999d9
mov dword [ebp - 0x30], 0x4ea6801f
mov dword [ebp - 0x30], 0xbef7d651
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x3a0], eax
xor eax, eax
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002b89d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa9c], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002b885
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b8c0