Function at 0x10028744
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Check os version
Contain obfuscated stackstrings
Create pipe
Create process on windows
Delete directory
Delete registry key
Enumerate gui resources
Get common file path
Get disk information
Get graphical window text
Identify system language via api
Query environment variable
Read .ini file
Set environment variable
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1140
call fcn.10067680
push ebx
push esi
push edi
push 0xffffffffffffffe7
pop esi
push 0xffffffffffffffff
mov dword [ebp - 0x4c], ecx
pop ecx
push 0
mov dword [ebp - 0x10], 4
mov byte [ebp - 0x51], dl
mov dword [ebp - 0x10], 0xb
pop eax
jmp 0x10028797
mov dword [ebp - 0x14], 0x53aa9ac7
mov dword [ebp - 0x14], 0xffffffea
jmp 0x1002878e
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jne 0x10028794
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1d
jl 0x10028783
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
je 0x10028773
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
push 1
pop ebx
je 0x100287c0
push 0x3a7
push ebx
push 0x88e
call edi
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x10], 0xb
jmp 0x100287f4
mov dword [ebp - 0x14], 0x53aa9ac7
mov dword [ebp - 0x14], 0xffffffea
jmp 0x100287eb
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jne 0x100287f1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1d
jl 0x100287e0
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
je 0x100287d0
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10028811
push 0x3a7
push ebx
push 0x88e
call edi
xor eax, eax
mov dword [ebp - 0xc], 0xf506e60b
or ecx, 0xffffffff
mov dword [ebp - 0x28], 2
mov dword [ebp - 8], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x14], eax
jmp 0x1002884d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc0], 3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002883c
cmp dword [ebp - 0xc], 0xfffffff6
jg 0x100288af
mov eax, dword [ebp - 0xc0]
xor edx, edx
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, ebx
setg dl
xor ecx, ecx
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc0]
add eax, dword [ebp - 0x30]
cmp eax, 0xd130
setg cl
cmp ecx, 0x3fc0233f
jne 0x100288af
mov eax, ebx
jmp 0x100288b1
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esi, dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
cmp eax, dword [ebp - 0xc0]
jge 0x100288fe
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x100288f3
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100288dd
push eax
push eax
push eax
push eax
call ebx
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100288f0
push 0x15e3
push eax
call esi
xor eax, eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffa
je 0x100288cc
jmp 0x100289b1
xor ecx, ecx
inc ecx
xor eax, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], 0x1448afe0
mov dword [ebp - 0x14], eax
jmp 0x10028922
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2e8], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10028915
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setg dl
xor ecx, ecx
imul edx, eax
mov dword [ebp - 0x2e8], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
sete cl
sub ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x10], 0xb
jmp 0x100289ee
mov dword [ebp - 0x14], 0x53aa9ac7
mov dword [ebp - 0x14], 0xffffffea
cmp dword [ebp - 0x14], 0x1d
jge 0x100289eb
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jne 0x100289eb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1d
jl 0x100289da
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe7
je 0x100289c1
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10028a0e
push 0x3a7
inc eax
push eax
push 0x88e
call edi
xor eax, eax
mov dword [ebp - 0xc], 0xf506e60b
or ecx, 0xffffffff
mov dword [ebp - 0x28], 2
mov dword [ebp - 8], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x30], ecx
xor ecx, ecx
inc ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x14], eax
jmp 0x10028a4d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc4], 3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10028a3c
cmp dword [ebp - 0xc], 0xfffffff6
jg 0x10028ab1
mov eax, dword [ebp - 0xc4]
xor edx, edx
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setg dl
xor eax, eax
inc eax
xor ecx, ecx
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0x30]
cmp eax, 0xd130
setg cl
cmp ecx, 0x3fc0233f
jne 0x10028ab1
xor eax, eax
inc eax
jmp 0x10028ab3
xor eax, eax
cmp eax, dword [ebp - 0xc4]
jge 0x10028b35
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x10028ae9
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10028ad3
push eax
push eax
push eax
push eax
call ebx
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10028ae6
push 0x15e3
push eax
call esi
xor eax, eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffa
je 0x10028ac2
xor esi, esi
inc esi
mov dword [ebp - 0x1c], 0xfffffffa
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x17c10977
mov dword [ebp - 0x20], esi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x10028b2a
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1e8], 0x4307e4a9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x10028b11
xor eax, eax
push 2
mov dword [ebp - 0xc], eax
pop ebx
jmp 0x10028bfe
xor esi, esi
inc esi
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], 0x1448afe0
mov dword [ebp - 0x14], eax
jmp 0x10028b59
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2b4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10028b4c
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setg dl
xor ecx, ecx
imul edx, eax
mov dword [ebp - 0x2b4], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
sete cl
sub ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x28], eax
jmp 0x10028af2
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x8f8], 0x4eb856a7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x10028bed
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], esi
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
mov dword [ebp - 0x1e0], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x20], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp dword [ebp - 0x20], eax
jl 0x10028d11
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10028c62
push eax
push 0x2555
push eax
call ebx
mov eax, dword [ebp - 0x20]
xor edx, edx
push 0
mov eax, dword [ebp + eax*4 - 0x1e8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1e8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1e8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1e8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1e8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1e8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1e8]
mov eax, dword [ebp - 0x8f8]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x60a3
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
xor edx, edx
add ecx, dword [ebp - 0x1e0]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x1e8]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setne dl
sub edx, dword [ebp + eax*4 - 0x1e8]
imul edx, dword [ebp - 0x8f8]
pop eax
mov dword [ebp - 0x14], edx
dec dword [ebp - 0x20]
jns 0x10028c50
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10028d35
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1070], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10028d20
xor eax, eax
mov dword [ebp - 0x30], 2
cmp dword [ebp - 0x30], eax
jl 0x10028d6c
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10028d67
push 0x102d
push 0xcaa
push 0xfbe
push 0x3ed
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x10028d41
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10028d7d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [ebp - 0x34], 0xa473eb90
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10028da4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2e4], 0x55683450
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10028d8c
xor eax, eax
inc dword [ebp - 0x2e4]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10028dc2
push eax
push 0x2cf
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor eax, eax
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x1c], 0x42eb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10028df2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x880], 0x2cb1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10028dd9
xor eax, eax
dec dword [ebp - 0x1c]
push 2
mov dword [ebp - 0x1c], eax
pop edx
jmp 0x10028e64
mov dword [ebp - 0xc], 6
mov dword [ebp - 0xc], eax
jmp 0x10028e36
mov dword [ebp - 0x14], 0x3b1a9565
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], eax
jl 0x10028e33
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x880]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x880], ecx
dec dword [ebp - 0x14]
jns 0x10028e18
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jle 0x10028e09
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edx
jg 0x10028e61
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x880]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x880], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jle 0x10028e43
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x10028dfd
mov dword [ebp - 0x18], 0xb
cmp dword [ebp - 0x18], 0xffffffe7
jne 0x1002918e
jmp 0x10028e7e
xor eax, eax
mov dword [ebp - 0x10], 0x53aa9ac7
mov dword [ebp - 0xc], 0xc204e2db
mov dword [ebp - 0x28], 0x6173
mov dword [ebp - 0xc], 0xa
cmp dword [ebp - 0xc], 0xfffffff8
jge 0x10028fe1
jmp 0x10028ea8
xor eax, eax
mov dword [ebp - 0x30], 0xbea12209
mov dword [ebp - 0x24], 0x356d9de3
mov dword [ebp - 0x44], 0x17d239f9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10028ede
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x67c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10028ec9
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10028ef5
push 0x110c
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
cmp dword [ebp - 0xc], eax
je 0x10028f1e
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x30], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10028fd1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x10028fd1
mov dword [ebp - 0x44], 0xdfb1
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 8], 0x883e731e
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10028f55
push eax
push eax
push 0x1b30
push 0x5b2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov eax, dword [ebp - 0x674]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
xor eax, eax
cmp dword [ebp - 8], eax
je 0x10028f71
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x674]
mov eax, dword [ebp - 0x674]
mov eax, dword [ebp - 0x674]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x674]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x674]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xfffffff6
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0xc]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x28]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], esi
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff8
jl 0x10028ea6
push 2
pop edx
mov dword [ebp - 0x10], 0xffffffea
cmp dword [ebp - 0x10], 0x1d
jge 0x10029181
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x594], 0xfffffffc
mov dword [ebp - 0x590], 0xfffffffc
mov dword [ebp - 0x58c], 0xfffffffc
mov dword [ebp - 0x588], 0xfffffffc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0x6c0f1a0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x10029049
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf94], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10029031
xor eax, eax
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], esi
jg 0x100290fe
mov dword [ebp - 0x34], 0x6a3f1540
mov dword [ebp - 0x2c], 0xf874acc0
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10029092
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd5c], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10029079
xor eax, eax
mov dword [ebp - 0xd5c], eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100290ad
push 0x110c
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffff6
ja 0x100290da
mov dword [ebp - 0x24], 0xdf2ddfda
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100290e1
push eax
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
jmp 0x100290e1
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x100290f6
inc dword [ebp - 0x594]
push 0
pop eax
cmp dword [ebp - 0x594], esi
jle 0x1002905b
push 2
xor eax, eax
or ecx, 0xffffffff
pop edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x1dba3399
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x34], 0x3c4ab274
mov dword [ebp - 0x34], 0xd2086bd0
mov dword [ebp - 0x34], 0x7051
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x1002914c
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x10b0], 0x4ffb871c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10029133
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x1002916c
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc94], 0xfffffff8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x10029154
xor eax, eax
dec dword [ebp - 0x44]
cmp dword [ebp - 0x24], eax
jne 0x10029181
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1d
jl 0x10028ff7
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe7
je 0x10028e7c
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x504], eax
mov dword [ebp - 0x500], eax
mov dword [ebp - 0x4fc], eax
mov dword [ebp - 0x4f8], eax
push 3
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x504], 0xffffffea
cmp dword [ebp - 0x504], eax
jg 0x100291ee
mov dword [ebp - 0x34], 0xa3a11c15
mov dword [ebp - 0x34], 0xd72d7671
mov dword [ebp - 0x44], 0x4bedcc59
dec dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x504]
cmp dword [ebp - 0x504], 0xfffffff9
jle 0x100291c4
mov dword [ebp - 0x18], 0x4e064826
xor eax, eax
mov dword [ebp - 0x24], 0x2db8e964
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], 0xfad0d727
mov dword [ebp - 0xc], 0xfffffffd
mov dword [ebp - 0x34], 0xdbc75b16
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x48], 0x75df642d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffe9
jl 0x1002926a
mov dword [ebp - 0x34], 0xf3cc
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x14], eax
jmp 0x10029250
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xea4], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002923f
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe9
push 0
pop eax
jge 0x10029230
cmp dword [ebp - 0xc], 0xfffffff8
jle 0x10029329
mov dword [ebp - 0x28], 0x1ef4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002929b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2ec], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10029283
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x100293c5
jmp 0x100292ab
xor eax, eax
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x2c], 0xc88307b
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x2ec], 0
je 0x10029314
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10029316
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
add eax, dword [ebp - 0x2ec]
cmp eax, 3
setg cl
xor eax, eax
dec ecx
cmp ecx, 0xfffffff8
setg al
cmp eax, dword [ebp - 0x44]
jle 0x100292f8
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x100292ff
jmp 0x100292fa
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10029301
mov eax, esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x10029310
xor eax, eax
cmp dword [ebp - 0xc], eax
je 0x10029314
xor eax, eax
jmp 0x10029316
mov eax, esi
imul eax, eax, 0xe73e
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x14]
jns 0x100292a9
jmp 0x100293c5
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002934c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x814], 0xe2fc3c73
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10029334
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffffc
je 0x100293c5
or ecx, 0xffffffff
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edx
jg 0x100293bc
mov dword [ebp - 0x44], 0x3393
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0xc]
push 2
mov eax, dword [ebp + eax*4 - 0x814]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x814]
cmp eax, esi
mov eax, dword [ebp - 0x48]
setge cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x810]
neg edx
sbb edx, edx
inc edx
sub edx, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x814], edx
inc dword [ebp - 0xc]
pop edx
cmp dword [ebp - 0xc], edx
jle 0x10029363
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffc
jne 0x10029358
xor eax, eax
mov byte [ebp - 1], al
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x17c10977
mov dword [ebp - 0x20], esi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x10029400
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1d0], 0x4307e4a9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x100293e7
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x10029416
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x9d8], 0x4eb856a7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x10029405
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], esi
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
mov dword [ebp - 0x1c8], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], eax
jl 0x10029527
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10029478
push eax
push 0x2555
push eax
call ebx
mov eax, dword [ebp - 0x20]
xor edx, edx
push 0
mov eax, dword [ebp + eax*4 - 0x1d0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1d0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1d0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1d0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1d0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1d0]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1d0]
mov eax, dword [ebp - 0x9d8]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x60a3
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
xor edx, edx
add ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x1d0]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setne dl
sub edx, dword [ebp + eax*4 - 0x1d0]
imul edx, dword [ebp - 0x9d8]
pop eax
mov dword [ebp - 0x14], edx
dec dword [ebp - 0x20]
jns 0x10029466
cmp byte [ebp - 1], 0
je 0x100295f5
mov dword [ebp - 0x30], 0x8070ade2
mov dword [ebp - 0x44], 0xad38dc53
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002956b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x704], 0xc80fc3a0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10029552
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002957a
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
cmp dword [ebp - 0x30], 0xa0d461e3
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xc8f0
setl cl
xor edx, edx
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x700]
cmp ecx, eax
mov eax, dword [ebp - 0x700]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setle bl
xor ecx, ecx
cmp ebx, eax
setle cl
add ecx, 0xc775
cmp dword [ebp - 0x30], ecx
jl 0x100295cd
xor eax, eax
cmp dword [ebp - 0x700], eax
je 0x100295cf
mov eax, esi
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov edx, 0xffff
imul eax, dword [ebp - 0x30]
push 0x3a7
push esi
push 0x88e
cmp eax, edx
setne cl
mov dword [ebp - 0x24], ecx
call edi
or eax, 0xffffffff
mov dword [ebp - 0x720], eax
mov dword [ebp - 0x71c], eax
mov dword [ebp - 0x718], eax
mov dword [ebp - 0x714], eax
xor eax, eax
mov dword [ebp - 0x14], 0x1c443818
mov dword [ebp - 0x44], 0xb964069a
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10029649
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x110], 0x24a8c6a5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10029630
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov dword [ebp - 0x110], 0xfffffff7
jmp 0x100297d1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], eax
jmp 0x100296a7
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002967f
push 0x1ef2
push eax
call ebx
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x100296a4
push 0x1215
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1002966c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x100297cb
xor ecx, ecx
mov dword [ebp - 0xc], eax
inc ecx
cmp dword [ebp - 0xc], ecx
jge 0x100296dd
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x130], 0xbe9fb1c0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x100296c5
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x100296f3
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x488], 0x789328a0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x100296e2
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x720]
mov eax, dword [ebp - 0x110]
cmp ecx, eax
setg dl
xor eax, eax
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x488], eax
jmp 0x100297ae
mov dword [ebp - 0x24], 0x2d3d4782
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002974c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x908], 0x8b4dfecb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10029733
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10029758
push eax
call esi
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x908]
mov eax, dword [ebp - 0x110]
mov edx, dword [ebp - 0x110]
imul ecx, eax
mov eax, dword [ebp - 0x130]
push 0
imul edx, ecx
xor ecx, ecx
cmp edx, eax
sete cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x904]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x480]
cmp eax, ecx
pop eax
setg dl
mov dword [ebp - 0x130], edx
inc dword [ebp - 0x488]
cmp dword [ebp - 0x488], 3
jle 0x10029723
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
push 0
pop eax
jle 0x100296ba
inc dword [ebp - 0x110]
cmp dword [ebp - 0x110], 4
jle 0x10029664
mov dword [ebp - 0x14], 4
cmp dword [ebp - 0x14], 0xfffffffa
push 9
pop edx
jg 0x10029863
xor edi, edi
mov dword [ebp - 0x28], 0xfffe
mov dword [ebp - 0x48], 0xc6a332e5
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002980f
mov ecx, eax
cmp dword [ebp - 0x44], eax
je 0x10029812
lea ecx, [edi + 1]
mov eax, edx
sub eax, ecx
add eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x720]
jl 0x10029824
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x110]
mov edx, dword [ebp - 0x718]
sub eax, 0xca40964
neg eax
push 9
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop edx
setne cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffa
jle 0x100297f0
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xc], 0xf506e60b
or eax, 0xffffffff
mov dword [ebp - 0x28], 2
xor ecx, ecx
mov dword [ebp - 8], eax
inc ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x14], eax
jmp 0x100298a4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe4], 3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10029893
cmp dword [ebp - 0xc], 0xfffffff6
jg 0x1002990d
mov eax, dword [ebp - 0xe4]
xor edx, edx
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setg dl
xor eax, eax
inc eax
xor ecx, ecx
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xe4]
add eax, dword [ebp - 0x30]
cmp eax, 0xd130
setg cl
cmp ecx, 0x3fc0233f
jne 0x1002990a
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x1002990f
xor ecx, ecx
inc ecx
xor eax, eax
cmp eax, dword [ebp - 0xe4]
jge 0x10029960
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xfffffffa
jne 0x10029a13
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002993b
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10029952
push 0x15e3
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor eax, eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffa
je 0x10029926
jmp 0x10029a10
mov dword [ebp - 0x10], ecx
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], 0x1448afe0
mov dword [ebp - 0x14], eax
jmp 0x10029981
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2f4], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10029974
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setg dl
xor ecx, ecx
imul edx, eax
mov dword [ebp - 0x2f4], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
sete cl
sub ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x28], eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], 0xfffffffa
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x17c10977
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x10029a4b
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1a4], 0x4307e4a9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x10029a32
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x10029a61
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x990], 0x4eb856a7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10029a50
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
mov dword [ebp - 0x19c], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], eax
jl 0x10029b77
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10029ac8
push eax
push 0x2555
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov eax, dword [ebp - 0x20]
xor edx, edx
push 0
mov eax, dword [ebp + eax*4 - 0x1a4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1a4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1a4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1a4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1a4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1a4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1a4]
mov eax, dword [ebp - 0x990]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x60a3
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
xor edx, edx
add ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x1a4]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setne dl
sub edx, dword [ebp + eax*4 - 0x1a4]
imul edx, dword [ebp - 0x990]
pop eax
mov dword [ebp - 0x14], edx
dec dword [ebp - 0x20]
jns 0x10029ab2
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x5d4], ecx
mov dword [ebp - 0x5d0], ecx
mov dword [ebp - 0x5cc], ecx
mov dword [ebp - 0x5c8], ecx
mov dword [ebp - 0x5d4], 0xfffffff7
cmp dword [ebp - 0x5d4], 0x15
jl 0x10029c61
or ecx, 0xffffffff
mov dword [ebp - 0x14], 0x5f1dbecc
mov dword [ebp - 0x14], 4
jmp 0x10029c45
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10029be5
push 0x18f
push eax
push 0x97b
push eax
push 0x212d
push eax
call dword [sym.imp.KERNEL32.dll_CompareStringW]
xor eax, eax
or ecx, 0xffffffff
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10029c42
push 0x112f
push 0xaac
push 0x258b
push 0x11f2
push 0x1182
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x2469
push 0x751
push 0xd78
push 0x269d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jg 0x10029bbf
inc dword [ebp - 0x5d4]
cmp dword [ebp - 0x5d4], 0x15
jge 0x10029bac
or ecx, 0xffffffff
mov dword [ebp - 0x7a0], ecx
mov dword [ebp - 0x79c], ecx
mov dword [ebp - 0x798], ecx
mov dword [ebp - 0x794], ecx
mov dword [ebp - 0x14], 0x1c443818
mov dword [ebp - 0x44], 0xb964069a
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10029cb3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x12c], 0x24a8c6a5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10029c9a
xor eax, eax
mov dword [ebp - 0x12c], 0xfffffff7
jmp 0x10029e2f
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], eax
jmp 0x10029d05
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10029cdd
push 0x1ef2
push eax
call ebx
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10029d02
push 0x1215
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x10029cca
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x10029e29
xor ecx, ecx
mov dword [ebp - 0xc], eax
inc ecx
cmp dword [ebp - 0xc], ecx
jge 0x10029d3b
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x100], 0xbe9fb1c0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x10029d23
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x10029d51
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x4e8], 0x789328a0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x10029d40
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x7a0]
mov eax, dword [ebp - 0x12c]
cmp ecx, eax
setg dl
xor eax, eax
mov dword [ebp - 0x100], edx
mov dword [ebp - 0x4e8], eax
jmp 0x10029e0c
mov dword [ebp - 0x24], 0x2d3d4782
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10029daa
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x918], 0x8b4dfecb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10029d91
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10029db6
push eax
call esi
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x918]
mov eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x12c]
imul ecx, eax
mov eax, dword [ebp - 0x100]
push 0
imul edx, ecx
xor ecx, ecx
cmp edx, eax
sete cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x914]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4e0]
cmp eax, ecx
pop eax
setg dl
mov dword [ebp - 0x100], edx
inc dword [ebp - 0x4e8]
cmp dword [ebp - 0x4e8], 3
jle 0x10029d81
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
push 0
pop eax
jle 0x10029d18
inc dword [ebp - 0x12c]
cmp dword [ebp - 0x12c], 4
jle 0x10029cc2
push 0xfffffffffffffffa
mov dword [ebp - 0x14], 4
pop ebx
cmp dword [ebp - 0x14], ebx
jg 0x10029ebd
xor edi, edi
mov dword [ebp - 0x28], 0xfffe
mov dword [ebp - 0x48], 0xc6a332e5
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10029e6c
mov ecx, eax
cmp dword [ebp - 0x44], eax
je 0x10029e6f
lea ecx, [edi + 1]
push 9
pop eax
sub eax, ecx
add eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x7a0]
jl 0x10029e82
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x798]
sub eax, 0xca40964
neg eax
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10029e4d
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1c], ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov dword [ebp - 0x10], 0x17c10977
inc ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x10029ef4
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1b0], 0x4307e4a9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x10029edb
xor eax, eax
push 2
mov dword [ebp - 0xc], eax
pop esi
jmp 0x10029f0d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xa08], 0x4eb856a7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x10029efc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
mov dword [ebp - 0x1a8], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1002a01e
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10029f6f
push eax
push 0x2555
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov eax, dword [ebp - 0x20]
xor edx, edx
push 0
mov eax, dword [ebp + eax*4 - 0x1b0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1b0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1b0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1b0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1b0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1b0]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1b0]
mov eax, dword [ebp - 0xa08]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x60a3
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
xor edx, edx
add ecx, dword [ebp - 0x1a8]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x1b0]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setne dl
sub edx, dword [ebp + eax*4 - 0x1b0]
imul edx, dword [ebp - 0xa08]
pop eax
mov dword [ebp - 0x14], edx
dec dword [ebp - 0x20]
jns 0x10029f59
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], 0x9725245f
mov dword [ebp - 0x24], 0xd5493e62
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002a04f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x338], 0xa07e4fc2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002a037
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002a05f
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [ebp - 0x338]
mov edx, ebx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002a079
mov edx, eax
cmp dword [ebp - 0x338], 0xfe30f587
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 4
setle cl
xor eax, eax
cmp edx, 0x3ddca272
sete al
sub ecx, eax
add ecx, 0xff12
cmp ecx, 0x925b0e44
sbb eax, eax
inc eax
cmp eax, 0xd2466e9f
sbb eax, eax
neg eax
shl eax, 3
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xc], 0xc204e2db
mov dword [ebp - 0x28], 0x6173
mov dword [ebp - 0xc], 0xa
jmp 0x1002a202
mov dword [ebp - 0x30], 0xbea12209
xor eax, eax
mov dword [ebp - 0x24], 0x356d9de3
mov dword [ebp - 0x44], 0x17d239f9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002a10c
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x690], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002a0f7
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002a123
push 0x110c
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
cmp dword [ebp - 0xc], eax
je 0x1002a14c
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0x30], eax
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x1002a1ff
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x1002a1ff
mov dword [ebp - 0x44], 0xdfb1
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 8], 0x883e731e
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002a183
push eax
push eax
push 0x1b30
push 0x5b2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov eax, dword [ebp - 0x688]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
xor eax, eax
cmp dword [ebp - 8], eax
je 0x1002a19f
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x688]
mov eax, dword [ebp - 0x688]
mov eax, dword [ebp - 0x688]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x688]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x688]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xfffffff6
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0xc]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x28]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], ebx
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff8
jl 0x1002a0d4
mov dword [ebp - 0x10], 0xfffffff8
mov eax, 0xed89
mov dword [ebp - 0x760], eax
mov dword [ebp - 0x75c], eax
mov dword [ebp - 0x758], eax
mov dword [ebp - 0x754], eax
xor eax, eax
mov dword [ebp - 0x24], 0xdedc87a9
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x1002a252
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x68], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x1002a241
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x1002a272
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2d0], 0xdad5a519
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x1002a25a
xor eax, eax
cmp dword [ebp - 0x68], eax
je 0x1002a2e3
mov eax, dword [ebp - 0x68]
xor ecx, ecx
mov eax, dword [ebp - 0x2d0]
cmp eax, 0x49bc
mov eax, dword [ebp - 0x68]
setle cl
xor edx, edx
sub ecx, eax
add ecx, 0xfffffff8
mov dword [ebp - 0x2d0], ecx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setl dl
add edx, dword [ebp - 0x68]
je 0x1002a2aa
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x758]
xor edx, edx
inc dword [ebp - 0x758]
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
cmp eax, ecx
mov eax, dword [ebp - 0x68]
setle dl
xor ebx, ebx
cmp edx, esi
setg bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor ebx, ebx
cmp ecx, dword [ebp - 0x10]
jne 0x1002a2e0
inc ebx
mov eax, ebx
jmp 0x1002a2e3
xor eax, eax
inc ebx
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002a30f
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002a30c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jg 0x1002a2ed
mov dword [ebp - 0x18], 0xf506e60b
mov dword [ebp - 0xc], 0x2061f665
mov dword [ebp - 0x14], 0xce3cb5af
push 7
pop ecx
mov dword [ebp - 0x44], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x1c], 0xef9a8551
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0xbfcf419c
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0xfffffff8
push 3
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x48], 0x94a737b7
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x1002a37f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x7e0], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x1002a36a
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x1002a39f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xbe0], 0x86bdae89
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x1002a387
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ecx
jg 0x1002a4a4