Function at 0x1002cbea
Capabilities:
Create process on windows
Enumerate gui resources
Get common file path
Get disk information
Get graphical window text
Get session user name
Modify service
Parse pe header
Query or enumerate registry key
Set registry value
Start service

Disassembly:
mov eax, 0x100837c9
call fcn.10081e98
mov eax, 0x14dc
call fcn.1007ce80
push ebx
push esi
push edi
xor eax, eax
mov byte [ebp - 0x51], dl
push 3
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x20], eax
pop ebx
jmp 0x1002cc25
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x768], 0xfd3df75d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002cc14
push 0xffffffffffffffef
pop edi
mov dword [ebp - 0x764], edi
jmp 0x1002cc92
lea eax, [ebp - 0xfa4]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0xfb4]
push eax
lea ecx, [ebp - 0x1280]
movdqu xmmword [ebp - 0xfb4], xmm0
call fcn.10014b2b
lea ecx, [ebp - 0x161]
mov esi, eax
call fcn.10009613
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x11cc]
push dword [esi]
call fcn.10014af1
mov dword [ebp - 0x2c], 0xfff7
lea ecx, [ebp - 0x11cc]
dec dword [ebp - 0x2c]
call fcn.10014b17
dec dword [ebp - 0x764]
cmp dword [ebp - 0x764], 0xffffffee
jle 0x1002cc35
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], eax
jmp 0x1002ccb6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6e4], 0xfd3df75d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002cca5
mov dword [ebp - 0x6e0], edi
jmp 0x1002cd20
lea eax, [ebp - 0x10a4]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x10b4]
push eax
lea ecx, [ebp - 0x12d0]
movdqu xmmword [ebp - 0x10b4], xmm0
call fcn.10014b2b
lea ecx, [ebp - 0x169]
mov esi, eax
call fcn.10009613
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1244]
push dword [esi]
call fcn.10014af1
mov dword [ebp - 0x2c], 0xfff7
lea ecx, [ebp - 0x1244]
dec dword [ebp - 0x2c]
call fcn.10014b17
dec dword [ebp - 0x6e0]
cmp dword [ebp - 0x6e0], 0xffffffee
jle 0x1002ccc3
xor ebx, ebx
lea ecx, [ebp - 0x300]
inc ebx
push ebx
call fcn.10014aaf
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 0xed562b99
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002cd6a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x300]
call fcn.10014b1c
mov dword [eax], 0x1713b910
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002cd4c
xor eax, eax
push eax
lea ecx, [ebp - 0x300]
call fcn.10014b1c
lea ecx, [ebp - 0x300]
mov dword [eax], 0x13
xor eax, eax
push eax
call fcn.10014b1c
cmp dword [eax], 0xffffffe6
je 0x1002ce85
mov dword [ebp - 0x24], 0xfff6
lea ecx, [ebp - 0x968]
push 3
call fcn.10014aaf
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x20], eax
jmp 0x1002cdc5
push dword [ebp - 0x20]
lea ecx, [ebp - 0x968]
call fcn.10014b1c
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002cdb1
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x300]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
xor eax, eax
push eax
call fcn.10014b1c
mov ecx, dword [ebp - 0x24]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x300]
setle bl
xor eax, eax
push eax
call fcn.10014b1c
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0x968]
push 2
setl dl
sub edx, 0x9956a218
neg edx
sbb edx, edx
inc edx
cmp edx, 0xed693765
sbb edi, edi
neg edi
sub edi, dword [eax]
neg edi
sbb edi, edi
inc edi
call fcn.10014b1c
xor ebx, ebx
lea ecx, [ebp - 0x968]
inc ebx
push ebx
mov esi, dword [eax]
add esi, edi
call fcn.10014b1c
lea ecx, [ebp - 0x968]
mov dword [eax], esi
xor eax, eax
mov byte [ebp - 4], al
call fcn.10014b17
xor eax, eax
lea ecx, [ebp - 0x300]
push eax
call fcn.10014b1c
lea ecx, [ebp - 0x300]
dec dword [eax]
xor eax, eax
push eax
call fcn.10014b1c
cmp dword [eax], 0xffffffe6
jne 0x1002cd93
push 0xffffffffffffffef
pop edi
or esi, 0xffffffff
lea ecx, [ebp - 0x300]
mov dword [ebp - 4], esi
call fcn.10014b17
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], eax
jmp 0x1002ceb1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x7b0], 0xfd3df75d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002cea0
mov dword [ebp - 0x7ac], edi
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
jmp 0x1002d0d3
lea eax, [ebp - 0xfe4]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0xff4]
push eax
lea ecx, [ebp - 0x12d8]
movdqu xmmword [ebp - 0xff4], xmm0
call fcn.10014b2b
lea ecx, [ebp - 0x22d]
mov esi, eax
call fcn.10009613
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x11e4]
push dword [esi]
call fcn.10014af1
mov dword [ebp - 4], 2
or esi, 0xffffffff
mov dword [ebp - 0x40], 0x9f9b3198
xor eax, eax
mov dword [ebp - 0x2c], 0xf506e60b
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0x3a3fc4b0
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0x348cc383
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x2c], 0x21b0ae28
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x2c], 0x5dea311c
mov dword [ebp - 0x2c], 0xfd52a42b
mov dword [ebp - 0x2c], 0x1a80d1c1
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xeb11
mov dword [ebp - 0x2c], 0x2b83
mov dword [ebp - 0x20], eax
jmp 0x1002cf9f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x148c], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002cf8e
mov dword [ebp - 0x40], 6
jmp 0x1002d034
mov dword [ebp - 0x10], 0x36f6
lea ecx, [ebp - 0xecc]
mov dword [ebp - 0x10], 0xa9d69236
mov dword [ebp - 0x10], 0x393dda37
mov dword [ebp - 0x10], 0xef989b1a
push ebx
call fcn.10014aaf
xor eax, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002d005
push dword [ebp - 0x20]
lea ecx, [ebp - 0xecc]
call fcn.10014b1c
mov dword [eax], 0x7eb8e136
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002cfe7
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002d01f
push 0x1446
push 0x23f2
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0xecc]
mov byte [ebp - 4], 2
call fcn.10014b17
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xd
jge 0x1002cfb1
xor eax, eax
mov dword [ebp - 0x2c], 0xfff7
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002d069
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x145c], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002d050
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002d0a2
push 0x549
push 0x11ec
push 0x2296
push 0x381
push 0x6ea
push 0x2099
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002d0bc
push 0x1446
push 0x23f2
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
dec dword [ebp - 0x2c]
lea ecx, [ebp - 0x11e4]
mov dword [ebp - 4], esi
call fcn.10014b17
dec dword [ebp - 0x7ac]
cmp dword [ebp - 0x7ac], 0xffffffee
jle 0x1002cec8
push 2
lea ecx, [ebp - 0xb88]
call fcn.10014aaf
mov dword [ebp - 4], 4
lea ecx, [ebp - 0xa5c]
mov dword [ebp - 0x24], 0x78144ad7
mov dword [ebp - 0x2c], 0x7cad7d71
push 3
call fcn.10014aaf
mov byte [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002d13d
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb88]
call fcn.10014b1c
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002d121
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002d165
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa5c]
call fcn.10014b1c
mov dword [eax], 0xc007c7be
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002d146
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002d187
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xde4], 0x8cf1d65f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002d16e
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002d19d
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
xor eax, eax
push eax
lea ecx, [ebp - 0xb88]
call fcn.10014b1c
mov edx, dword [ebp - 0x24]
mov edi, ebx
mov ecx, dword [ebp - 0x24]
add edx, dword [eax]
dec dword [eax]
xor eax, eax
cmp edx, ecx
jg 0x1002d1bd
mov edi, eax
mov esi, eax
cmp dword [ebp - 0x2c], eax
je 0x1002d1c6
mov esi, ebx
push eax
lea ecx, [ebp - 0xa5c]
call fcn.10014b1c
mov dword [eax], 0xcdf5ef88
mov eax, dword [ebp - 0xde0]
dec eax
neg eax
sbb eax, eax
neg eax
add eax, esi
je 0x1002d1f4
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002d1f6
mov eax, ebx
jmp 0x1002d1f6
xor eax, eax
cmp eax, dword [ebp - 0xddc]
jge 0x1002d209
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002d20b
mov eax, ebx
jmp 0x1002d20b
xor eax, eax
xor ecx, ecx
cmp edi, eax
setne cl
xor eax, eax
cmp ecx, 0xdd6
lea ecx, [ebp - 0xa5c]
setge al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
call fcn.10014b17
or edi, 0xffffffff
lea ecx, [ebp - 0xb88]
mov dword [ebp - 4], edi
call fcn.10014b17
movdqa xmm0, xmmword [0x10008250]
lea eax, [ebp - 0x1144]
push eax
lea eax, [ebp - 0x1154]
push eax
lea ecx, [ebp - 0x13e0]
movdqu xmmword [ebp - 0x1154], xmm0
call fcn.10014b2b
lea ecx, [ebp - 0x205]
mov esi, eax
call fcn.10009613
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x122c]
push dword [esi]
call fcn.10014af1
xor eax, eax
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x20], eax
jmp 0x1002d2a4
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x2c], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x1002d297
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002d2b9
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
lea ecx, [ebp - 0x122c]
call fcn.10014b17
mov dword [ebp - 0x2c], 0xb642c70b
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x2c], 0xe871d976
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0x61c0f806
mov dword [ebp - 0x2c], ebx
push 2
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0xbe39
mov dword [ebp - 0x2c], 0x51cf
push 4
pop esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0x7857
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002d339
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x12e8], 0xeb59008c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002d321
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002d355
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0xa38]
mov dword [ebp - 0x14], 0x32667a87
mov dword [ebp - 0x2c], 0xc863cc1d
push ebx
call fcn.10014aaf
xor eax, eax
mov dword [ebp - 4], 6
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jge 0x1002d39b
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1378], 0x2b96ce02
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x1002d383
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x1002d3c1
push dword [ebp - 0x30]
lea ecx, [ebp - 0xa38]
call fcn.10014b1c
mov dword [eax], 0x17f215a
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1002d3a3
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002d432
mov eax, dword [ebp - 0x14]
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
setl bl
xor edx, edx
cmp ecx, eax
setne dl
xor ecx, ecx
sub ebx, edx
mov dword [ebp - 0x1374], ebx
mov eax, dword [ebp - 0x14]
cmp ebx, eax
setne cl
imul ecx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub edx, 0x395e2de4
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
neg edx
cmp edx, eax
setge cl
xor ebx, ebx
add ecx, 5
inc ebx
xor eax, eax
mov esi, ebx
cmp ecx, edi
jg 0x1002d434
mov esi, eax
push eax
lea ecx, [ebp - 0xa38]
call fcn.10014b1c
lea ecx, [ebp - 0xa38]
mov dword [ebp - 4], edi
mov dword [eax], esi
call fcn.10014b17
xor eax, eax
lea ecx, [ebp - 0x378]
mov dword [ebp - 0x2c], eax
push ebx
call fcn.10014aaf
mov dword [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x2c], 0xed562b99
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002d497
push dword [ebp - 0x20]
lea ecx, [ebp - 0x378]
call fcn.10014b1c
mov dword [eax], 0x1713b910
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002d479
xor eax, eax
push eax
lea ecx, [ebp - 0x378]
call fcn.10014b1c
lea ecx, [ebp - 0x378]
mov dword [eax], 0x13
xor eax, eax
push eax
call fcn.10014b1c
cmp dword [eax], 0xffffffe6
je 0x1002d5b2
mov dword [ebp - 0x24], 0xfff6
lea ecx, [ebp - 0x980]
push 3
call fcn.10014aaf
xor eax, eax
mov byte [ebp - 4], 8
mov dword [ebp - 0x20], eax
jmp 0x1002d4f3
push dword [ebp - 0x20]
lea ecx, [ebp - 0x980]
call fcn.10014b1c
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002d4df
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x378]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
xor eax, eax
push eax
call fcn.10014b1c
mov ecx, dword [ebp - 0x24]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x378]
setle bl
xor eax, eax
push eax
call fcn.10014b1c
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0x980]
push 2
setl dl
sub edx, 0x9956a218
neg edx
sbb edx, edx
inc edx
cmp edx, 0xed693765
sbb edi, edi
neg edi
sub edi, dword [eax]
neg edi
sbb edi, edi
inc edi
call fcn.10014b1c
xor ebx, ebx
lea ecx, [ebp - 0x980]
inc ebx
push ebx
mov esi, dword [eax]
add esi, edi
call fcn.10014b1c
lea ecx, [ebp - 0x980]
mov byte [ebp - 4], 7
mov dword [eax], esi
call fcn.10014b17
xor eax, eax
lea ecx, [ebp - 0x378]
push eax
call fcn.10014b1c
lea ecx, [ebp - 0x378]
dec dword [eax]
xor eax, eax
push eax
call fcn.10014b1c
cmp dword [eax], 0xffffffe6
jne 0x1002d4c0
or edi, 0xffffffff
lea ecx, [ebp - 0x378]
mov dword [ebp - 4], edi
call fcn.10014b17
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002d5e4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6fc], 0xfd3df75d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002d5cb
xor eax, eax
mov dword [ebp - 0x6f8], 0xffffffef
cmp dword [ebp - 0x6f8], 0xffffffee
jg 0x1002d8a3
jmp 0x1002d5ff
xor eax, eax
mov dword [ebp - 0x40], 0x9f9b3198
mov dword [ebp - 0x2c], 0xf506e60b
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0x3a3fc4b0
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], 0x348cc383
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x2c], 0x21b0ae28
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x2c], 0x5dea311c
mov dword [ebp - 0x2c], 0xfd52a42b
mov dword [ebp - 0x2c], 0x1a80d1c1
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xeb11
mov dword [ebp - 0x2c], 0x2b83
mov dword [ebp - 0x20], eax
jmp 0x1002d688
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x14bc], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002d677
mov dword [ebp - 0x40], 6
jmp 0x1002d71f
mov dword [ebp - 0x10], 0x36f6
lea ecx, [ebp - 0xee4]
mov dword [ebp - 0x10], 0xa9d69236
mov dword [ebp - 0x10], 0x393dda37
mov dword [ebp - 0x10], 0xef989b1a
push ebx
call fcn.10014aaf
xor eax, eax
mov dword [ebp - 4], 9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002d6f1
push dword [ebp - 0x20]
lea ecx, [ebp - 0xee4]
call fcn.10014b1c
mov dword [eax], 0x7eb8e136
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002d6d3
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002d70b
push 0x1446
push 0x23f2
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0xee4]
mov dword [ebp - 4], edi
call fcn.10014b17
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xd
jge 0x1002d69a
lea eax, [ebp - 0x1004]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x1380]
movdqu xmmword [ebp - 0x1014], xmm0
call fcn.10014b2b
lea ecx, [ebp - 0x155]
mov esi, eax
call fcn.10009613
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x11fc]
push dword [esi]
call fcn.10014af1
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002d78f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x14a4], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002d776
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002d7cc
push 0x549
push 0x11ec
push 0x2296
push 0x381
push 0x6ea
push 0x2099
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002d7e8
push 0x1446
push 0x23f2
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
xor eax, eax
mov dword [ebp - 0x10], 0xfff7
mov dword [ebp - 0x2c], 0xb642c70b
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x2c], 0xe871d976
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0x61c0f806
mov dword [ebp - 0x2c], ebx
push 2
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0xbe39
mov dword [ebp - 0x2c], 0x51cf
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0x7857
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002d863
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x12f8], 0xeb59008c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002d84b
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002d87f
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0x11fc]
dec dword [ebp - 0x10]
call fcn.10014b17
dec dword [ebp - 0x6f8]
cmp dword [ebp - 0x6f8], 0xffffffee
jle 0x1002d5fd
push 2
lea ecx, [ebp - 0xa50]
call fcn.10014aaf
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0xc90]
mov dword [ebp - 0x24], 0x78144ad7
mov dword [ebp - 0x2c], 0x7cad7d71
push 3
call fcn.10014aaf
mov byte [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002d900
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa50]
call fcn.10014b1c
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002d8e4
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002d928
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc90]
call fcn.10014b1c
mov dword [eax], 0xc007c7be
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002d909
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002d94a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xdf4], 0x8cf1d65f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002d931
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002d964
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
xor eax, eax
push eax
lea ecx, [ebp - 0xa50]
call fcn.10014b1c
mov edx, dword [ebp - 0x24]
mov edi, ebx
mov ecx, dword [ebp - 0x24]
add edx, dword [eax]
dec dword [eax]
xor eax, eax
cmp edx, ecx
jg 0x1002d984
mov edi, eax
mov esi, eax
cmp dword [ebp - 0x2c], eax
je 0x1002d98d
mov esi, ebx
push eax
lea ecx, [ebp - 0xc90]
call fcn.10014b1c
mov dword [eax], 0xcdf5ef88
mov eax, dword [ebp - 0xdf0]
dec eax
neg eax
sbb eax, eax
neg eax
add eax, esi
je 0x1002d9bb
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002d9bd
mov eax, ebx
jmp 0x1002d9bd
xor eax, eax
cmp eax, dword [ebp - 0xdec]
jge 0x1002d9d0
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002d9d2
mov eax, ebx
jmp 0x1002d9d2
xor eax, eax
xor ecx, ecx
cmp edi, eax
setne cl
xor eax, eax
cmp ecx, 0xdd6
lea ecx, [ebp - 0xc90]
setge al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
call fcn.10014b17
or esi, 0xffffffff
lea ecx, [ebp - 0xa50]
mov dword [ebp - 4], esi
call fcn.10014b17
push 2
lea ecx, [ebp - 0xa68]
call fcn.10014aaf
mov dword [ebp - 4], 0xc
lea ecx, [ebp - 0xba0]
mov dword [ebp - 0x24], 0x78144ad7
mov dword [ebp - 0x2c], 0x7cad7d71
push 3
call fcn.10014aaf
mov byte [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002da66
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa68]
call fcn.10014b1c
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002da4a
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002da8e
push dword [ebp - 0x14]
lea ecx, [ebp - 0xba0]
call fcn.10014b1c
mov dword [eax], 0xc007c7be
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002da6f
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002dab0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xefc], 0x8cf1d65f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002da97
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002daca
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
xor eax, eax
push eax
lea ecx, [ebp - 0xa68]
call fcn.10014b1c
mov edx, dword [ebp - 0x24]
mov edi, ebx
mov ecx, dword [ebp - 0x24]
add edx, dword [eax]
dec dword [eax]
xor eax, eax
cmp edx, ecx
jg 0x1002daea
mov edi, eax
mov esi, eax
cmp dword [ebp - 0x2c], eax
je 0x1002daf3
mov esi, ebx
push eax
lea ecx, [ebp - 0xba0]
call fcn.10014b1c
mov dword [eax], 0xcdf5ef88
mov eax, dword [ebp - 0xef8]
dec eax
neg eax
sbb eax, eax
neg eax
add eax, esi
je 0x1002db21
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002db23
mov eax, ebx
jmp 0x1002db23
xor eax, eax
cmp eax, dword [ebp - 0xef4]
jge 0x1002db36
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002db38
mov eax, ebx
jmp 0x1002db38
xor eax, eax
xor ecx, ecx
cmp edi, eax
setne cl
xor eax, eax
cmp ecx, 0xdd6
lea ecx, [ebp - 0xba0]
setge al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
call fcn.10014b17
or esi, 0xffffffff
lea ecx, [ebp - 0xa68]
mov dword [ebp - 4], esi
call fcn.10014b17
push 2
lea ecx, [ebp - 0x998]
call fcn.10014aaf
push ebx
lea ecx, [ebp - 0x184]
mov dword [ebp - 4], 0xe
call fcn.10014aaf
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002dbc4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x998]
call fcn.10014b1c
mov dword [eax], 0xea75c96
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002dba5
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002dbea
push dword [ebp - 0x14]
lea ecx, [ebp - 0x184]
call fcn.10014b1c
mov dword [eax], 0xf2f4a8b1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002dbcc
xor eax, eax
push eax
lea ecx, [ebp - 0x184]
call fcn.10014b1c
lea ecx, [ebp - 0x184]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10014b1c
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [eax], ebx
jg 0x1002dd7c
push ebx
lea ecx, [ebp - 0x780]
call fcn.10014aaf
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x10], 0xe495761b
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002dc62
push dword [ebp - 0x20]
lea ecx, [ebp - 0x780]
call fcn.10014b1c
mov dword [eax], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002dc44
xor eax, eax
push eax
lea ecx, [ebp - 0x780]
call fcn.10014b1c
xor eax, eax
lea ecx, [ebp - 0x184]
push eax
call fcn.10014b1c
xor ebx, ebx
lea ecx, [ebp - 0x184]
cmp dword [eax], esi
setne bl
xor eax, eax
push eax
call fcn.10014b1c
lea ecx, [ebp - 0x998]
push dword [eax]
call fcn.10014b1c
lea ecx, [ebp - 0x184]
mov dword [eax], ebx
xor eax, eax
push eax
call fcn.10014b1c
push 1
lea ecx, [ebp - 0x998]
mov esi, eax
call fcn.10014b1c
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x184]
setl dl
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
xor eax, eax
push eax
call fcn.10014b1c
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x780]
xor eax, eax
push eax
call fcn.10014b1c
xor ebx, ebx
lea ecx, [ebp - 0x780]
cmp dword [eax], ebx
setne bl
xor eax, eax
push eax
call fcn.10014b1c
xor ecx, ecx
cmp dword [eax], ebx
setne cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x184]
push eax
call fcn.10014b1c
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002dd3f
push eax
push eax
push 0x1bc3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
lea ecx, [ebp - 0x780]
mov byte [ebp - 4], 0xf
call fcn.10014b17
xor eax, eax
lea ecx, [ebp - 0x184]
push eax
call fcn.10014b1c
lea ecx, [ebp - 0x184]
inc dword [eax]
xor eax, eax
push eax
call fcn.10014b1c
xor ebx, ebx
inc ebx
push 0xffffffffffffffff
pop esi
cmp dword [eax], ebx
jle 0x1002dc15
or esi, esi
lea ecx, [ebp - 0x184]
call fcn.10014b17
lea ecx, [ebp - 0x998]
mov dword [ebp - 4], esi
call fcn.10014b17
push 2
lea ecx, [ebp - 0x9b0]
call fcn.10014aaf
push ebx
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x11
call fcn.10014aaf
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002ddea
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9b0]
call fcn.10014b1c
mov dword [eax], 0xea75c96
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002ddcb
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002de10
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1f8]
call fcn.10014b1c
mov dword [eax], 0xf2f4a8b1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002ddf2
xor eax, eax
push eax
lea ecx, [ebp - 0x1f8]
call fcn.10014b1c
lea ecx, [ebp - 0x1f8]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10014b1c
cmp dword [eax], ebx
jg 0x1002df9c
push ebx
lea ecx, [ebp - 0x714]
call fcn.10014aaf
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x10], 0xe495761b
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002de82
push dword [ebp - 0x20]
lea ecx, [ebp - 0x714]
call fcn.10014b1c
mov dword [eax], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002de64
xor eax, eax
push eax
lea ecx, [ebp - 0x714]
call fcn.10014b1c
xor eax, eax
lea ecx, [ebp - 0x1f8]
push eax
call fcn.10014b1c
xor ebx, ebx
lea ecx, [ebp - 0x1f8]
cmp dword [eax], esi
setne bl
xor eax, eax
push eax
call fcn.10014b1c
lea ecx, [ebp - 0x9b0]
push dword [eax]
call fcn.10014b1c
push 1
lea ecx, [ebp - 0x9b0]
mov dword [eax], ebx
call fcn.10014b1c
mov esi, eax
lea ecx, [ebp - 0x1f8]
xor eax, eax
push eax
call fcn.10014b1c
xor edx, edx
mov ecx, dword [eax]
cmp ecx, dword [esi]
lea ecx, [ebp - 0x1f8]
setl dl
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
xor eax, eax
push eax
call fcn.10014b1c
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x714]
xor eax, eax
push eax
call fcn.10014b1c
xor ebx, ebx
lea ecx, [ebp - 0x714]
cmp dword [eax], ebx
setne bl
xor eax, eax
push eax
call fcn.10014b1c
xor ecx, ecx
cmp dword [eax], ebx
setne cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x1f8]
push eax
call fcn.10014b1c
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002df5f
push eax
push eax
push 0x1bc3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
lea ecx, [ebp - 0x714]
mov byte [ebp - 4], 0x12
call fcn.10014b17
xor eax, eax
lea ecx, [ebp - 0x1f8]
push eax
call fcn.10014b1c
lea ecx, [ebp - 0x1f8]
inc dword [eax]
xor eax, eax
push eax
call fcn.10014b1c
xor ebx, ebx
inc ebx
push 0xffffffffffffffff
pop esi
cmp dword [eax], ebx
jle 0x1002de35
or esi, esi
lea ecx, [ebp - 0x1f8]
call fcn.10014b17
lea ecx, [ebp - 0x9b0]
mov dword [ebp - 4], esi
call fcn.10014b17
push 2
pop ecx
mov dword [ebp - 0x2c], 0xfffffff8
xor eax, eax
mov dword [ebp - 0x2c], ecx
push ecx
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0xe04]
mov dword [ebp - 0x2c], 0xb1c2a2c7
call fcn.10014aaf
mov dword [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], eax
jmp 0x1002dffc
push dword [ebp - 0x20]
call fcn.10014b1c
mov dword [eax], 0xba1bf2b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
lea ecx, [ebp - 0xe04]
jl 0x1002dfeb
inc dword [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.10014b17
push 2
lea ecx, [ebp - 0xc48]
call fcn.10014aaf
mov dword [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002e05b
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc48]
call fcn.10014b1c
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002e03f
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002e07d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x394], 0x5d16df25
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002e064
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002e090
push eax
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
xor eax, eax
mov dword [ebp - 0x390], eax
jmp 0x1002e0cd
mov dword [ebp - 0x2c], 5
inc dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jg 0x1002e0c7
push dword [ebp - 0x24]
lea ecx, [ebp - 0xc48]
call fcn.10014b1c
cmp dword [eax], 0
jne 0x1002e0c5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1002e0aa
xor eax, eax
inc dword [ebp - 0x390]
cmp dword [ebp - 0x390], ebx
jle 0x1002e098
lea ecx, [ebp - 0xc48]
mov dword [ebp - 4], esi
call fcn.10014b17
push 2
lea ecx, [ebp - 0xab0]
call fcn.10014aaf
mov dword [ebp - 4], 0x16
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x10], 0x5720
mov dword [ebp - 0x30], 9
push ebx
call fcn.10014aaf
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x9c8]
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x67bc620
mov dword [ebp - 0x2c], 0x3925b974
push ebx
call fcn.10014aaf
push 4
lea ecx, [ebp - 0xa80]
mov byte [ebp - 4], 0x18
call fcn.10014aaf
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002e171
push dword [ebp - 0x14]
lea ecx, [ebp - 0x108]
call fcn.10014b1c
mov dword [eax], 0x37831e42
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002e153
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002e197
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9c8]
call fcn.10014b1c
mov dword [eax], 0xdbd3d38e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002e179
xor eax, eax
push 0xfffffffffffffffb
mov dword [ebp - 0x14], eax
pop edi
jmp 0x1002e1b2
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa80]
call fcn.10014b1c
mov dword [eax], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002e19f
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x30], eax
xor eax, eax
push eax
call fcn.10014b1c
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x1002e3d3
mov dword [ebp - 0x1c], 0x5e1b460d
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x2c], 0x7d0d
push dword [ebp - 0x30]
call fcn.10014b1c
push dword [ebp - 0x30]
lea ecx, [ebp - 0x108]
mov esi, eax
call fcn.10014b1c
mov ecx, dword [esi]
xor ebx, ebx
push dword [ebp - 0x30]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x108]
setge bl
call fcn.10014b1c
cmp ebx, dword [eax]
jle 0x1002e229
mov eax, dword [ebp - 0x3c]
xor eax, eax
lea ecx, [ebp - 0x108]
push eax
call fcn.10014b1c
push dword [ebp - 0x30]
lea ecx, [ebp - 0x108]
call fcn.10014b1c
push dword [ebp - 0x30]
lea ecx, [ebp - 0x108]
call fcn.10014b1c
mov esi, eax
lea ecx, [ebp - 0x108]
xor eax, eax
push eax
call fcn.10014b1c
mov ecx, dword [esi]
xor ebx, ebx
push dword [ebp - 0x30]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x108]
setle bl
sub ebx, 7
neg ebx
sbb ebx, ebx
inc ebx
call fcn.10014b1c
mov eax, dword [eax]
add eax, ebx
je 0x1002e296
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002e298
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x1002e29d
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
push dword [ebp - 0x30]
lea ecx, [ebp - 0x108]
call fcn.10014b1c
xor ecx, ecx
cmp dword [eax], esi
mov eax, 0xb16aac89
setne cl
sub eax, ecx
jne 0x1002e2d4
push dword [ebp - 0x30]
lea ecx, [ebp - 0x108]
call fcn.10014b1c
cmp dword [eax], 0
jne 0x1002e2d4
xor eax, eax
mov edi, eax
jmp 0x1002e2d6
mov edi, ebx
push dword [ebp - 0x30]
lea ecx, [ebp - 0x108]
call fcn.10014b1c
xor ecx, ecx
mov esi, eax
mov eax, dword [ebp - 0x3c]
cmp edi, 3
setne cl
cmp ebx, ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x9dda3143
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, dword [esi]
je 0x1002e315
cmp dword [ebp - 0x30], eax
je 0x1002e315
mov eax, ebx
xor ecx, ecx
cmp eax, ebx
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x30]
setle cl
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0x108]
setl bl
call fcn.10014b1c
xor edx, edx
mov dword [eax], ebx
mov eax, dword [ebp - 0x30]
cmp ebx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor ebx, ebx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
lea ecx, [ebp - 0x9c8]
setg bl
xor eax, eax
push eax
call fcn.10014b1c
mov ecx, dword [ebp - 0x10]
xor edx, edx
imul ecx, ebx
mov dword [eax], ebx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
add eax, 0xffff9d6b
add eax, edx
cmp eax, 0xfffe
jbe 0x1002e399
push dword [ebp - 0x30]
lea ecx, [ebp - 0x108]
call fcn.10014b1c
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x9c8]
xor eax, eax
push eax
call fcn.10014b1c
push 3
lea ecx, [ebp - 0xa80]
mov esi, eax
call fcn.10014b1c
mov ecx, dword [esi]
mov dword [eax], ecx
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002e3cd
dec dword [ebp - 0x30]
jns 0x1002e1df
xor ebx, ebx
inc ebx
or esi, 0xffffffff
lea ecx, [ebp - 0xa80]
call fcn.10014b17
lea ecx, [ebp - 0x9c8]
call fcn.10014b17
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 0x16
call fcn.10014b17
mov dword [ebp - 0x44], 0x78144ad7
lea ecx, [ebp - 0xf14]
push 2
call fcn.10014aaf
mov byte [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x20], 0x3532fe22
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002e43e
push dword [ebp - 0x20]
lea ecx, [ebp - 0xf14]
call fcn.10014b1c
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002e422
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002e45a
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002e457
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1002e443
lea ecx, [ebp - 0xf14]
mov byte [ebp - 4], 0x16
call fcn.10014b17
mov dword [ebp - 0x1c], 0x7cad7d71
lea ecx, [ebp - 0x190]
push 4
call fcn.10014aaf
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xbb8]
mov dword [ebp - 0x24], 0x1b17d72b
push 3
call fcn.10014aaf
mov byte [ebp - 4], 0x1c
xor eax, eax
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002e4cb
push dword [ebp - 0x14]
lea ecx, [ebp - 0x190]
call fcn.10014b1c
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002e4b0
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002e4f3
push dword [ebp - 0x14]
lea ecx, [ebp - 0xbb8]
call fcn.10014b1c
mov dword [eax], 0x338886a6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002e4d4
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002e508
push 0x2427
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 3
lea ecx, [ebp - 0x190]
call fcn.10014b1c
cmp dword [eax], 0
je 0x1002e55c
mov dword [ebp - 0x24], 0x11d01887
lea ecx, [ebp - 0x190]
mov eax, dword [ebp - 0x24]
push 2
call fcn.10014b1c
push 2
lea ecx, [ebp - 0x190]
call fcn.10014b1c
mov ecx, dword [ebp - 0x24]
imul ecx, dword [eax]
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x190]
mov eax, dword [ebp - 0x24]
xor eax, eax
push eax
call fcn.10014b1c
mov esi, ebx
jmp 0x1002e560
xor eax, eax
mov esi, eax
push 3
lea ecx, [ebp - 0x190]
call fcn.10014b1c
cmp esi, dword [eax]
jge 0x1002e57a
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x24], eax
je 0x1002e57c
mov esi, ebx
push ebx
lea ecx, [ebp - 0xbb8]
call fcn.10014b1c
lea ecx, [ebp - 0x190]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.10014b1c
push 2
lea ecx, [ebp - 0x190]
call fcn.10014b1c
push 2
lea ecx, [ebp - 0x190]
call fcn.10014b1c
push 2
lea ecx, [ebp - 0x190]
mov esi, dword [eax]
add esi, 0x636c1cd7
neg esi
sbb esi, esi
inc esi
call fcn.10014b1c
xor ecx, ecx
cmp esi, dword [eax]
setne cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0xbb8]
call fcn.10014b17
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x16
call fcn.10014b17
push 3
lea ecx, [ebp - 0xcc0]
call fcn.10014aaf
mov byte [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x38], 0xb3ae3556
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002e62c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe78], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002e613
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x1002e6a5
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002e67f
push 0x22de
push 0x1c9d
push 0x62f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x1731
push 0x26f1
push 0x1c79
push 0xc52
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002e6a2
push 0xb35
push eax
push 0xb6f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 9
jg 0x1002e631
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], eax
jl 0x1002e6e5
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002e6ce
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0xe78], 0
jne 0x1002e6e3
dec dword [ebp - 0x38]
push 0
pop eax
jns 0x1002e6b3
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x2c], 0xa684
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002e706
call edi
push eax
call dword [sym.imp.USER32.dll_SetCapture]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002e719
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor eax, eax
or esi, 0xffffffff
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], 0xc64a6847
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002e74f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1440], 0x85c9e53
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002e736
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002e763
mov dword [ebp - 0x2c], 0x99244325
cmp dword [ebp - 0x2c], eax
jne 0x1002e769
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xd
jl 0x1002e754
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xb
jne 0x1002e7a6
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], eax
jmp 0x1002e789
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
jne 0x1002e79b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1002e77d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x14]
xor eax, eax
jmp 0x1002e76c
push 0x79e
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov dword [ebp - 0x14], eax
jmp 0x1002e7bf
push dword [ebp - 0x14]
lea ecx, [ebp - 0xab0]
call fcn.10014b1c
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002e7ab
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0xa98]
push 3
call fcn.10014aaf
xor eax, eax
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002e803
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa98]
call fcn.10014b1c
mov dword [eax], 0xf54c3c69
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002e7e4
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002e84e
mov dword [ebp - 0x24], 0x182eac45
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002e823
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002e84b
push dword [ebp - 0x24]
lea ecx, [ebp - 0xa98]
call fcn.10014b1c
mov dword [eax], 0x72226312
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002e82c
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x16
jl 0x1002e808
lea ecx, [ebp - 0xa98]
mov byte [ebp - 4], 0x1d
call fcn.10014b17
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002e881
push dword [ebp - 0x14]
lea ecx, [ebp - 0xcc0]
call fcn.10014b1c
mov dword [eax], 0xc007c7be
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002e86a
push 4
lea ecx, [ebp - 0x318]
call fcn.10014aaf
mov byte [ebp - 4], 0x1f
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x24], 0xf30836b1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002e8c6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe14], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002e8ad
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002e8dc
cmp dword [ebp - 0x14], 4
lea ecx, [ebp - 0x318]
jl 0x1002e8cb