Function at 0x1002f523
Capabilities:
Accept command line arguments
Check for time delay via queryperformancecounter
Check os version
Create pipe
Create two anonymous pipes
Delete file
Delete registry key
Delete registry value
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk information
Get graphical window text
Get memory capacity
Identify system language via api
Log keystrokes via polling
Modify service
Parse pe header
Query environment variable
Resume thread
Start service
Terminate process

Disassembly:
mov eax, 0x1008cc0c
call fcn.1008b290
mov eax, 0x153c
call fcn.10087700
push ebx
push esi
push edi
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x584]
push 2
mov byte [ebp - 0x79], dl
call fcn.10016f88
xor eax, eax
xor esi, esi
mov dword [ebp - 4], eax
inc esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002f57b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xff0], 0
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002f55d
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x1002f591
push dword [ebp - 0x14]
call fcn.10016ff9
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
lea ecx, [ebp - 0x584]
jl 0x1002f580
push esi
call fcn.10016ff9
xor ebx, ebx
lea ecx, [ebp - 0x584]
push esi
mov dword [eax], ebx
call fcn.10016ff9
cmp dword [eax], ebx
mov ebx, dword [sym.imp.USER32.dll_GetDC]
jg 0x1002f601
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002f5e2
push eax
push 0x1de
push 0x1698
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push esi
lea ecx, [ebp - 0x584]
call fcn.10016ff9
push esi
lea ecx, [ebp - 0x584]
inc dword [eax]
call fcn.10016ff9
cmp dword [eax], 0
jle 0x1002f5bd
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002f62f
push 0x1704
push 0x3df
push 0x1f50
push 0x2694
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
or ebx, 0xffffffff
lea ecx, [ebp - 0x584]
mov dword [ebp - 4], ebx
call fcn.10016ff4
mov dword [ebp - 0x24], 0x2071b18d
xor eax, eax
mov dword [ebp - 0x4c], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [ebp - 0x24], eax
je 0x1002f718
mov dword [ebp - 0x28], 0x6b0f7383
lea ecx, [ebp - 0x1158]
mov dword [ebp - 0x28], 0x964a53aa
mov dword [ebp - 0x28], 0xfffffff6
push esi
call fcn.10016f88
push 3
mov dword [ebp - 4], esi
lea ecx, [ebp - 0xe58]
pop edi
xor eax, eax
mov dword [ebp - 0x28], 0x2b3b7bed
mov dword [ebp - 0x28], eax
push edi
call fcn.10016f88
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x50], 0x21f7d967
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002f6d3
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1158]
call fcn.10016ff9
mov dword [eax], 0x6580849f
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002f6af
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x1002f6e5
push dword [ebp - 0x14]
call fcn.10016ff9
mov dword [eax], esi
inc dword [ebp - 0x14]
lea ecx, [ebp - 0xe58]
cmp dword [ebp - 0x14], edi
jl 0x1002f6d8
inc dword [ebp - 0x50]
call fcn.10016ff4
or eax, 0xffffffff
lea ecx, [ebp - 0x1158]
mov dword [ebp - 4], eax
call fcn.10016ff4
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002f789
push eax
call ebx
jmp 0x1002f787
push 2
lea ecx, [ebp - 0x9b4]
call fcn.10016f88
push 3
pop edi
xor eax, eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x2c], eax
jmp 0x1002f743
push dword [ebp - 0x2c]
call fcn.10016ff9
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
lea ecx, [ebp - 0x9b4]
jl 0x1002f732
push esi
call fcn.10016ff9
lea ecx, [ebp - 0x9b4]
mov esi, dword [eax]
xor eax, eax
inc eax
add esi, 0x51c76d7b
push eax
call fcn.10016ff9
xor ecx, ecx
cmp esi, dword [eax]
setg cl
or eax, 0xffffffff
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x9b4]
mov dword [ebp - 4], eax
call fcn.10016ff4
xor eax, eax
or esi, 0xffffffff
mov dword [ebp - 0x24], 0x2071b18d
mov dword [ebp - 0x4c], esi
cmp dword [ebp - 0x24], eax
je 0x1002f7ab
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002f822
push eax
call ebx
xor eax, eax
jmp 0x1002f822
push 2
lea ecx, [ebp - 0x9cc]
call fcn.10016f88
push 4
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002f7d6
push dword [ebp - 0x2c]
call fcn.10016ff9
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
lea ecx, [ebp - 0x9cc]
jl 0x1002f7c5
xor eax, eax
inc eax
push eax
call fcn.10016ff9
lea ecx, [ebp - 0x9cc]
mov esi, dword [eax]
xor eax, eax
inc eax
add esi, 0x51c76d7b
push eax
call fcn.10016ff9
xor ecx, ecx
cmp esi, dword [eax]
setg cl
or eax, 0xffffffff
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x9cc]
mov dword [ebp - 4], eax
call fcn.10016ff4
xor eax, eax
or esi, 0xffffffff
mov dword [ebp - 0x24], 0x2071b18d
mov dword [ebp - 0x4c], esi
cmp dword [ebp - 0x24], eax
je 0x1002f83f
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002f8b2
push eax
call ebx
jmp 0x1002f8b2
push 2
lea ecx, [ebp - 0x8a0]
call fcn.10016f88
xor eax, eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x2c], eax
jmp 0x1002f86b
push dword [ebp - 0x2c]
call fcn.10016ff9
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
lea ecx, [ebp - 0x8a0]
jl 0x1002f85a
xor eax, eax
inc eax
push eax
call fcn.10016ff9
lea ecx, [ebp - 0x8a0]
mov esi, dword [eax]
xor eax, eax
inc eax
add esi, 0x51c76d7b
push eax
call fcn.10016ff9
xor ecx, ecx
cmp esi, dword [eax]
setg cl
or eax, 0xffffffff
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x8a0]
mov dword [ebp - 4], eax
call fcn.10016ff4
xor esi, esi
lea ecx, [ebp - 0x320]
inc esi
push esi
call fcn.10016f88
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x24], 0xfd52a42b
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x1002f8fd
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x320]
call fcn.10016ff9
mov dword [eax], 0x9f9b3198
xor eax, eax
inc dword [ebp - 0x2c]
inc eax
cmp dword [ebp - 0x2c], eax
jl 0x1002f8d9
xor esi, esi
xor eax, eax
inc esi
push eax
lea ecx, [ebp - 0x320]
call fcn.10016ff9
lea ecx, [ebp - 0x320]
mov dword [eax], 0xffffffe3
xor eax, eax
push eax
call fcn.10016ff9
jmp 0x1002fa0a
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x1002f947
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xc4], 0xf506e60b
xor eax, eax
inc dword [ebp - 0x2c]
inc eax
cmp dword [ebp - 0x2c], eax
jl 0x1002f92c
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], ecx
jg 0x1002f9eb
mov dword [ebp - 0x2c], 0x3a3f
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc4]
cmp eax, ecx
setl dl
cmp edx, 0x5b1510af
jle 0x1002f97e
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x320]
mov eax, dword [ebp - 0x2c]
xor eax, eax
push eax
call fcn.10016ff9
xor eax, eax
lea ecx, [ebp - 0x320]
push eax
call fcn.10016ff9
push 8
lea ecx, [ebp - 0x320]
mov esi, dword [eax]
pop eax
add esi, eax
xor eax, eax
push eax
call fcn.10016ff9
mov ecx, dword [ebp - 0xc4]
xor edx, edx
cmp esi, ecx
setge dl
imul edx, dword [eax]
mov eax, dword [ebp - 0x2c]
imul eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc4]
dec dword [ebp - 0xc4]
or eax, 0xffffffff
cmp dword [ebp - 0xc4], eax
jle 0x1002f95c
xor eax, eax
push eax
lea ecx, [ebp - 0x320]
call fcn.10016ff9
lea ecx, [ebp - 0x320]
inc dword [eax]
xor eax, eax
push eax
call fcn.10016ff9
push 1
pop esi
cmp dword [eax], 0xe
jge 0x1002f922
or eax, 0xffffffff
lea ecx, [ebp - 0x320]
mov dword [ebp - 4], eax
call fcn.10016ff4
xor eax, eax
xor esi, esi
mov dword [ebp - 0x1c], eax
inc esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x14], 0xe8b01213
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1002fa58
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x18c], 0x5683
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1002fa3f
xor eax, eax
mov dword [ebp - 0x1c], esi
mov ecx, 0xc2076acb
cmp dword [ebp - 0x1c], eax
jl 0x1002fc05
mov dword [ebp - 0x9ec], ecx
xor edx, edx
mov dword [ebp - 0x9e8], ecx
mov dword [ebp - 0x9e4], ecx
mov dword [ebp - 0x9e0], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x18c]
mov eax, dword [ebp - 0x1c]
imul ecx, dword [ebp + eax*4 - 0x18c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x18c]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setl dl
xor ebx, ebx
sub edx, dword [ebp + eax*4 - 0x18c]
mov eax, dword [ebp - 0x18c]
cmp edx, eax
mov eax, dword [ebp - 0x18c]
setne bl
xor ecx, ecx
sub ebx, eax
mov eax, dword [ebp - 0x9e4]
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
sete cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x18c]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne cl
cmp ecx, dword [ebp + eax*4 - 0x18c]
jl 0x1002fb04
xor eax, eax
cmp dword [ebp - 0x9ec], eax
je 0x1002fb06
mov eax, esi
mov dword [ebp - 0x14], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jge 0x1002fb33
xor eax, eax
cmp dword [ebp - 0x188], eax
jne 0x1002fb35
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002fb50
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
jmp 0x1002fb4e
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x4c], 0xfffffffc
cmp dword [ebp - 0x24], eax
jne 0x1002fbfc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x14], 0x19
cmp dword [ebp - 0x14], 0xfffffff0
jne 0x1002fbeb
push 4
pop ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jge 0x1002fb84
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x13e8], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002fb6c
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], edi
jg 0x1002fbc9
mov dword [ebp - 0x2c], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x2c], eax
jge 0x1002fbaf
push 0xfffffffffffffff7
pop edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x7a0], edx
xor eax, eax
inc dword [ebp - 0x2c]
inc eax
cmp dword [ebp - 0x2c], eax
jl 0x1002fb9a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x7a0], eax
mov dword [ebp - 0x13e4], eax
inc dword [ebp - 0x38]
push 0
pop eax
cmp dword [ebp - 0x38], edi
jle 0x1002fb8c
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002fbde
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 4
xor eax, eax
pop ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff0
je 0x1002fb64
dec dword [ebp - 0x1c]
mov ecx, 0xc2076acb
push 1
pop esi
jns 0x1002fa69
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
xor esi, esi
inc esi
mov dword [ebp - 0x24], 0x2071b18d
lea ecx, [ebp - 0x5d8]
push 2
call fcn.10016f88
xor eax, eax
mov dword [ebp - 4], 7
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002fc48
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1000], 0
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002fc2a
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x1002fc5e
push dword [ebp - 0x14]
call fcn.10016ff9
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
lea ecx, [ebp - 0x5d8]
jl 0x1002fc4d
push esi
call fcn.10016ff9
xor esi, esi
lea ecx, [ebp - 0x5d8]
mov dword [eax], esi
xor eax, eax
inc eax
push eax
call fcn.10016ff9
cmp dword [eax], esi
jg 0x1002fcd2
inc esi
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002fcb1
push eax
push 0x1de
push 0x1698
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push esi
lea ecx, [ebp - 0x5d8]
call fcn.10016ff9
push esi
lea ecx, [ebp - 0x5d8]
inc dword [eax]
call fcn.10016ff9
cmp dword [eax], 0
jle 0x1002fc88
jmp 0x1002fcd5
xor esi, esi
inc esi
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002fd07
push 0x1704
push 0x3df
push 0x1f50
push 0x2694
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
or eax, 0xffffffff
lea ecx, [ebp - 0x5d8]
mov dword [ebp - 4], eax
call fcn.10016ff4
or eax, 0xffffffff
lea ecx, [ebp - 0x1084]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x28], 0x6b0f7383
mov dword [ebp - 0x28], 0x964a53aa
mov dword [ebp - 0x28], 0xfffffff6
push esi
call fcn.10016f88
push 8
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xe70]
xor eax, eax
mov dword [ebp - 0x28], 0x2b3b7bed
mov dword [ebp - 0x28], eax
push edi
call fcn.10016f88
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x50], 0x21f7d967
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002fd96
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1084]
call fcn.10016ff9
mov dword [eax], 0x6580849f
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002fd72
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x1002fda8
push dword [ebp - 0x14]
call fcn.10016ff9
mov dword [eax], esi
inc dword [ebp - 0x14]
lea ecx, [ebp - 0xe70]
cmp dword [ebp - 0x14], edi
jl 0x1002fd9b
inc dword [ebp - 0x50]
call fcn.10016ff4
or eax, 0xffffffff
lea ecx, [ebp - 0x1084]
mov dword [ebp - 4], eax
call fcn.10016ff4
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10030031
push edi
lea ecx, [ebp - 0xe88]
call fcn.10016f88
xor eax, eax
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x1002fe15
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xe88]
call fcn.10016ff9
mov dword [eax], 0xfdf99ff6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1002fdf7
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002fe42
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002fe3f
push 0x21dd
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jle 0x1002fe1a
or eax, 0xffffffff
lea ecx, [ebp - 0xe88]
mov dword [ebp - 4], eax
call fcn.10016ff4
push edi
lea ecx, [ebp - 0x1108]
call fcn.10016f88
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], 0x20bd035c
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x1002fe9e
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1108]
call fcn.10016ff9
mov dword [eax], 0x313dd33a
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1002fe80
xor eax, eax
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], eax
jl 0x1002fecd
or edx, 0xffffffff
mov dword [ebp - 0x50], 0xfffffffd
xor ecx, ecx
mov eax, dword [ebp - 0x50]
cmp eax, edx
setg cl
xor eax, eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x50], eax
jne 0x1002fecd
dec dword [ebp - 0x18]
jns 0x1002fead
or eax, 0xffffffff
lea ecx, [ebp - 0x1108]
mov dword [ebp - 4], eax
call fcn.10016ff4
xor eax, eax
lea ecx, [ebp - 0xafc]
mov byte [ebp - 0x39], al
mov eax, 0xffff
mov dword [ebp - 0x14], 0x35c5735e
mov dword [ebp - 0x40], 0x51efdb
mov dword [ebp - 0x50], 0xfffffffc
mov dword [ebp - 0x50], 0xaee50770
mov dword [ebp - 0x48], eax
push edi
call fcn.10016f88
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x1002ff42
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xafc]
call fcn.10016ff9
mov dword [eax], 0x426067bb
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1002ff24
xor eax, eax
or edi, 0xffffffff
mov dword [ebp - 0x40], edi
cmp dword [ebp - 0x40], eax
jne 0x1002ff54
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x1002ff56
mov edx, esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x14]
jl 0x1002ff74
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x40], eax
je 0x1002ff76
mov edx, esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x50], ecx
mov ecx, 0xc4433ac2
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, 0xed7d4130
jne 0x1002ffb0
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x1002ffb2
mov edx, esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setge cl
cmp esi, ecx
lea ecx, [ebp - 0xafc]
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
xor eax, eax
push eax
call fcn.10016ff9
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], edi
mov dword [eax], ecx
lea ecx, [ebp - 0xafc]
call fcn.10016ff4
cmp byte [ebp - 0x39], 0
je 0x100303a7
xor eax, eax
mov dword [ebp - 0x28], 0xa049fe38
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10030016
push eax
push eax
push 0x885
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10030029
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
xor eax, eax
push eax
call ebx
jmp 0x100303a7
mov dword [ebp - 0x14], 0xfffffffc
xor edx, edx
mov dword [ebp - 0x50], 0xd9d08905
mov dword [ebp - 0x50], 0xe1fc6578
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x4c], 0x70e7
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
setle dl
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
inc edx
add edx, 0x2527e907
mov dword [ebp - 0x50], edx
jne 0x100300a9
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x100300ab
mov eax, esi
mov edx, dword [ebp - 0x14]
imul eax, eax, 0x8502
sub edx, eax
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100300ed
push 0x22ad
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x96c]
call fcn.10016f88
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0xc64]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x50], 0xa3eaa3e8
mov dword [ebp - 0x18], 0x616d
mov dword [ebp - 0x24], eax
push ebx
call fcn.10016f88
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1003014b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x10f0], 0x23e64f14
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030133
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10030167
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc64]
call fcn.10016ff9
mov dword [eax], 0x69ff9e6b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030150
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
jne 0x1003017a
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], eax
xor eax, eax
cmp dword [ebp - 0x50], eax
jne 0x10030195
mov eax, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x10ec], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
neg ecx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0xc64]
mov eax, dword [ebp - 0x18]
xor eax, eax
push eax
call fcn.10016ff9
lea ecx, [ebp - 0xc64]
and dword [eax], 0
mov byte [ebp - 4], 0xd
call fcn.10016ff4
push ebx
lea ecx, [ebp - 0x87c]
call fcn.10016f88
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], 0x9c41
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10030216
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x87c]
call fcn.10016ff9
and dword [eax], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x100301fb
xor eax, eax
dec dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x10030269
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1003023e
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x87c]
call fcn.10016ff9
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x87c]
mov esi, eax
call fcn.10016ff9
mov ecx, dword [esi]
xor esi, esi
push 0
mov dword [eax], ecx
inc dword [ebp - 0x1c]
inc esi
pop eax
cmp dword [ebp - 0x1c], esi
jle 0x1003021e
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xd
call fcn.10016ff4
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1003029b
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x96c]
call fcn.10016ff9
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10030284
or edi, 0xffffffff
xor edx, edx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x38], 0x876e6bac
mov dword [ebp - 0x28], ebx
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x2c], 0x1d9
mov dword [ebp - 0x24], 0x8e10
mov dword [ebp - 0x4c], 0x8c74c3ee
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
add ecx, 0xde4b
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x38]
neg edx
sbb edx, edx
inc edx
dec edx
jne 0x10030308
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x38], eax
je 0x1003030a
mov ecx, esi
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp ecx, 0x765e4b
push esi
setne al
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
cmp eax, 0xe311
setne cl
xor edx, edx
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x2c]
sub edx, 0x3ede
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
cmp eax, edx
setg cl
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x96c]
call fcn.10016ff9
lea ecx, [ebp - 0x96c]
mov esi, dword [eax]
xor eax, eax
inc eax
add esi, 0x51c76d7b
push eax
call fcn.10016ff9
xor ecx, ecx
cmp esi, dword [eax]
setg cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x96c]
mov dword [ebp - 4], edi
call fcn.10016ff4
xor esi, esi
inc esi
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
mov eax, 0xb4e1a362
mov dword [ebp - 0x6b4], eax
mov dword [ebp - 0x6b0], eax
mov dword [ebp - 0x6ac], eax
mov dword [ebp - 0x6a8], eax
xor eax, eax
mov dword [ebp - 0x50], 0x5f84255e
mov dword [ebp - 0x28], 0x656540f2
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100303ed
push eax
call edi
xor eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.USER32.dll_GetKeyboardType]
cmp dword [ebp - 0x6b4], eax
je 0x100304c0
mov dword [ebp - 0x2c], 0x28405cef
mov dword [ebp - 0x48], 0x90ae735
push 4
pop ecx
mov dword [ebp - 0x58], ecx
mov ecx, 0xffff
mov dword [ebp - 0x24], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10030437
push 0x26bd
call ebx
mov edx, dword [ebp - 0x2c]
add edx, 0xa165
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg edx
push 8
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x6b0]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x50]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 2
pop ecx
setne al
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x50]
jl 0x10030498
cmp dword [ebp - 0x6b4], eax
je 0x10030498
lea ecx, [eax + 1]
jmp 0x1003049a
mov ecx, eax
mov eax, dword [ebp - 0x2c]
add eax, ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x6b4]
mov eax, dword [ebp - 0x6b4]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x58]
mov dword [ebp - 0x4c], eax
jmp 0x100304df
mov ecx, 0xffff
mov dword [ebp - 0x50], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100304dc
push eax
push eax
push 0x233c
push eax
push eax
call esi
dec dword [ebp - 0x50]
mov ecx, 0xb4e1a362
xor eax, eax
mov dword [ebp - 0x654], ecx
inc eax
mov dword [ebp - 0x650], ecx
mov dword [ebp - 0x64c], ecx
mov dword [ebp - 0x648], ecx
mov dword [ebp - 0x50], 0x5f84255e
mov dword [ebp - 0x28], 0x656540f2
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10030522
push eax
call edi
xor eax, eax
cmp dword [ebp - 0x654], eax
je 0x100305e9
mov dword [ebp - 0x2c], 0x28405cef
mov dword [ebp - 0x48], 0x90ae735
push 4
pop ecx
mov dword [ebp - 0x58], ecx
mov ecx, 0xffff
mov dword [ebp - 0x24], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10030560
push 0x26bd
call ebx
mov edx, dword [ebp - 0x2c]
add edx, 0xa165
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg edx
push 8
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x650]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x50]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 2
pop ecx
setne al
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x50]
jl 0x100305c1
cmp dword [ebp - 0x654], eax
je 0x100305c1
lea ecx, [eax + 1]
jmp 0x100305c3
mov ecx, eax
mov eax, dword [ebp - 0x2c]
add eax, ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x654]
mov eax, dword [ebp - 0x654]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x58]
mov dword [ebp - 0x4c], eax
jmp 0x10030608
mov ecx, 0xffff
mov dword [ebp - 0x50], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10030605
push eax
push eax
push 0x233c
push eax
push eax
call esi
dec dword [ebp - 0x50]
xor eax, eax
lea ecx, [ebp - 0xea0]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x2a2c7c8a
mov dword [ebp - 0x28], 0xa1bf2b29
mov dword [ebp - 0x28], 0xf09cc25f
push 2
call fcn.10016f88
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x50], 0xab5457d6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10030666
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1508], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10030651
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10030691
xor edi, edi
inc edi
push dword [ebp - 0x14]
lea ecx, [ebp - 0xea0]
call fcn.10016ff9
mov dword [eax], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10030672
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
inc dword [ebp - 0x50]
lea ecx, [ebp - 0xea0]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016ff4
mov eax, 0xb4e1a362
mov dword [ebp - 0x694], eax
mov dword [ebp - 0x690], eax
mov dword [ebp - 0x68c], eax
mov dword [ebp - 0x688], eax
xor eax, eax
mov dword [ebp - 0x50], 0x5f84255e
inc eax
mov dword [ebp - 0x28], 0x656540f2
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100306e8
push eax
call edi
xor eax, eax
cmp dword [ebp - 0x694], eax
je 0x100307af
mov dword [ebp - 0x2c], 0x28405cef
or esi, 0xffffffff
mov dword [ebp - 0x48], 0x90ae735
push 4
pop ecx
mov dword [ebp - 0x58], ecx
mov ecx, 0xffff
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x4c], esi
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10030726
push 0x26bd
call ebx
mov edx, dword [ebp - 0x2c]
add edx, 0xa165
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg edx
push 8
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x690]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x50]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 2
pop ecx
setne al
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x50]
jl 0x10030787
cmp dword [ebp - 0x694], eax
je 0x10030787
lea ecx, [eax + 1]
jmp 0x10030789
mov ecx, eax
mov eax, dword [ebp - 0x2c]
add eax, ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x694]
mov eax, dword [ebp - 0x694]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x58]
mov dword [ebp - 0x4c], eax
jmp 0x100307d1
mov ecx, 0xffff
mov dword [ebp - 0x50], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100307cb
push eax
push eax
push 0x233c
push eax
push eax
call esi
dec dword [ebp - 0x50]
or esi, 0xffffffff
xor eax, eax
lea ecx, [ebp - 0x1094]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x2a2c7c8a
mov dword [ebp - 0x28], 0xa1bf2b29
mov dword [ebp - 0x28], 0xf09cc25f
push 2
call fcn.10016f88
mov dword [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x50], 0xab5457d6
push 3
mov dword [ebp - 0x14], eax
pop ebx
cmp dword [ebp - 0x14], ebx
jge 0x1003082d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x146c], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030819
xor eax, eax
xor esi, esi
mov dword [ebp - 0x14], eax
inc esi
cmp dword [ebp - 0x14], 2
lea ecx, [ebp - 0x1094]
jge 0x1003084e
push dword [ebp - 0x14]
call fcn.10016ff9
mov dword [eax], esi
inc dword [ebp - 0x14]
jmp 0x10030833
inc dword [ebp - 0x50]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016ff4
xor eax, eax
lea ecx, [ebp - 0xeb8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x2a2c7c8a
mov dword [ebp - 0x28], 0xa1bf2b29
mov dword [ebp - 0x28], 0xf09cc25f
push 2
call fcn.10016f88
mov dword [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x50], 0xab5457d6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100308b8
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x14b4], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100308a4
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100308ca
push dword [ebp - 0x14]
call fcn.10016ff9
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
lea ecx, [ebp - 0xeb8]
jl 0x100308bd
inc dword [ebp - 0x50]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016ff4
push esi
lea ecx, [ebp - 0x2d8]
call fcn.10016f88
mov dword [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x24], 0xfd52a42b
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x10030926
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2d8]
call fcn.10016ff9
mov dword [eax], 0x9f9b3198
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x10030908
xor eax, eax
push eax
lea ecx, [ebp - 0x2d8]
call fcn.10016ff9
lea ecx, [ebp - 0x2d8]
mov dword [eax], 0xffffffe3
xor eax, eax
push eax
call fcn.10016ff9
cmp dword [eax], 0xe
jl 0x10030a40
or edi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x10030974
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x9c], 0xf506e60b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1003095c
xor eax, eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], edi
jg 0x10030a15
mov dword [ebp - 0x2c], 0x3a3f
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x9c]
cmp eax, ecx
setl dl
cmp edx, 0x5b1510af
jle 0x100309a8
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2d8]
mov eax, dword [ebp - 0x2c]
xor eax, eax
push eax
call fcn.10016ff9
xor eax, eax
lea ecx, [ebp - 0x2d8]
push eax
call fcn.10016ff9
push 8
lea ecx, [ebp - 0x2d8]
mov esi, dword [eax]
pop eax
add esi, eax
xor eax, eax
push eax
call fcn.10016ff9
mov ecx, dword [ebp - 0x9c]
xor edx, edx
cmp esi, ecx
setge dl
imul edx, dword [eax]
mov eax, dword [ebp - 0x2c]
imul eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x9c]
dec dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], edi
jle 0x10030986
xor esi, esi
xor eax, eax
inc esi
push eax
lea ecx, [ebp - 0x2d8]
call fcn.10016ff9
lea ecx, [ebp - 0x2d8]
inc dword [eax]
xor eax, eax
push eax
call fcn.10016ff9
cmp dword [eax], 0xe
jge 0x10030952
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
or eax, 0xffffffff
lea ecx, [ebp - 0x2d8]
mov dword [ebp - 4], eax
call fcn.10016ff4
mov dword [ebp - 0x20], 0x3d837bc7
xor eax, eax
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x1c], 0x644184eb
mov dword [ebp - 0x44], ebx
push 4
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10030a8e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x674], 0x3c47aa29
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10030a76
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10030aa4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x12f0], 0xd89f82a4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030a93
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x10
jg 0x10030bf3
mov dword [ebp - 0x18], 0xfffffff6
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0xa04], ecx
mov dword [ebp - 0xa00], ecx
mov dword [ebp - 0x9fc], ecx
mov dword [ebp - 0x9f8], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x18], eax
je 0x10030b43
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x9fc], eax
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10030b35
cmp dword [ebp - 0x44], eax
je 0x10030b35
mov eax, esi
cmp eax, dword [ebp - 0x668]
jl 0x10030b41
mov edx, esi
jmp 0x10030b45
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x668]
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x674]
mov eax, dword [ebp - 0x2c]
imul edx, eax
mov eax, dword [ebp - 0x674]
cmp edx, eax
setle cl
imul eax, ecx, 0xffffa797
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
cmp ecx, 0xfffe
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x1c]
jne 0x10030b9b
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x674]
inc eax
cmp eax, 0x9b83
jge 0x10030bb7
xor eax, eax
cmp dword [ebp - 0x9f8], eax
je 0x10030bb9
mov ecx, esi
jmp 0x10030bbb
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x20]
sub ecx, eax
jne 0x10030bce
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x674], eax
je 0x10030bd0
mov edx, esi
mov eax, dword [ebp - 0x668]
xor ecx, ecx
cmp eax, edx
push 0
setg cl
mov dword [ebp - 0x12e8], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x10
pop eax
jle 0x10030af1
mov ecx, 0xb4e1a362
mov dword [ebp - 0x644], ecx
mov dword [ebp - 0x640], ecx
mov dword [ebp - 0x63c], ecx
mov dword [ebp - 0x638], ecx
mov dword [ebp - 0x38], 0x3a34c865
mov dword [ebp - 0x2c], eax
jmp 0x10030c2d
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x3b4], 7
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10030c1c
mov eax, dword [ebp - 0x3b0]
mov eax, dword [ebp - 0x3b4]
mov eax, dword [ebp - 0x3b4]
mov eax, dword [ebp - 0x3b4]
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x3b0], eax
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xfffffff2
je 0x10030df8
or edi, 0xffffffff
push ebx
lea ecx, [ebp - 0x1f0]
call fcn.10016f88
mov dword [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x4c], 0x563ade4
mov dword [ebp - 0x2c], eax
jmp 0x10030c99
push dword [ebp - 0x2c]
call fcn.10016ff9
mov dword [eax], esi
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0x1f0]
cmp dword [ebp - 0x2c], ebx
jl 0x10030c8c
push 2
call fcn.10016ff9
push 0xfffffffffffffff7
pop ecx
push 2
mov dword [eax], ecx
lea ecx, [ebp - 0x1f0]
call fcn.10016ff9
cmp dword [eax], 0x1c
jl 0x10030dd5
mov dword [ebp - 0x1c], 0x58e356ec
lea ecx, [ebp - 0x1f0]
push 2
call fcn.10016ff9
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x1f0]
push 2
add esi, dword [eax]
call fcn.10016ff9
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
imul ecx, esi
push 2
cmp dword [eax], ecx
lea ecx, [ebp - 0x1f0]
sete bl
call fcn.10016ff9
xor ecx, ecx
cmp ebx, dword [eax]
setne cl
xor ebx, ebx
cmp ecx, 9
lea ecx, [ebp - 0x1f0]
setl bl
xor esi, esi
inc esi
push esi
call fcn.10016ff9
xor ecx, ecx
cmp dword [eax], ebx
mov eax, dword [ebp - 0x38]
sete cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [ebp - 0x1c]
jg 0x10030d48
mov eax, dword [ebp - 0x3b0]
xor eax, eax
lea ecx, [ebp - 0x1f0]
push eax
call fcn.10016ff9
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
mov edx, dword [ebp - 0x1c]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x3b4]
setge bl
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp ebx, ecx
setl dl
xor ebx, ebx
cmp edx, eax
setl bl
xor ecx, ecx
sub ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp ebx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10030dad
push 0x16bb
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 2
lea ecx, [ebp - 0x1f0]
call fcn.10016ff9
push 2
lea ecx, [ebp - 0x1f0]
inc dword [eax]
call fcn.10016ff9
cmp dword [eax], 0x1c
jge 0x10030cc6
push 3
pop ebx
lea ecx, [ebp - 0x1f0]
mov dword [ebp - 4], edi
call fcn.10016ff4
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff2
jne 0x10030c68
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
xor eax, eax
mov dword [ebp - 0x30], 0x5f84255e
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0x251c6076
mov dword [ebp - 0x14], 0x35240ca7
mov dword [ebp - 0x50], 0x1d0b
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10030e39
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xe40], 0x807220b7
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10030e20
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10030e47
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
je 0x10030ebf
push ebx
lea ecx, [ebp - 0xb14]
call fcn.10016f88
xor eax, eax
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10030e9d
or edi, 0xffffffff
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xb14]
call fcn.10016ff9
mov dword [eax], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10030e7d
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10030eaf
push dword [ebp - 0x14]
call fcn.10016ff9
mov dword [eax], ebx
inc dword [ebp - 0x14]
lea ecx, [ebp - 0xb14]
cmp dword [ebp - 0x14], ebx
jl 0x10030ea2
jmp 0x10030fb7
mov dword [ebp - 0x18], 0xcc1031c3
lea ecx, [ebp - 0xd48]
mov dword [ebp - 0x24], 0xa73a151c
push 2
call fcn.10016f88
mov dword [ebp - 4], 0x16
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x48], 0x674d9070
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10030f1b
push 8
pop edi
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xd48]
call fcn.10016ff9
mov dword [eax], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10030efc
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
cmp eax, ebx
setge cl
xor eax, eax
cmp ecx, 0x41e9
setle al
xor edx, edx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
cmp eax, 0xe73d
mov eax, dword [ebp - 0x34]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0xe3c]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10030f89
mov dword [ebp - 0x34], eax
jmp 0x10030f81
mov dword [ebp - 0x24], 0x85aebc5f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe5
jle 0x10030f71
jmp 0x10030fb1
mov dword [ebp - 0x24], 0xa82d8584
lea ecx, [ebp - 0xd48]
push esi
call fcn.10016ff9
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10030fb1
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
lea ecx, [ebp - 0xd48]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016ff4
mov dword [ebp - 0x28], 0x656540f2
mov dword [ebp - 0x38], 0x256915a
push 4
pop eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], 0x16
cmp dword [ebp - 0x38], ebx
jl 0x10031005
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10030ffd
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
xor eax, eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jge 0x10030fea
push 0xfffffffffffffff7
mov dword [ebp - 0x28], esi
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10031032
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x130], 0xb57f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10031019
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jg 0x100310d0
mov dword [ebp - 0x24], 0x1e60e779
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x130], 0
jne 0x10031058
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x130]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x130]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x130]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x130]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x130]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x130]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x130]
cmp ecx, eax
setge dl
xor ecx, ecx
imul edx, dword [ebp - 0x12c]
imul eax, edx, 0xfdd8
cmp eax, esi
setl cl
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x1003103e
xor eax, eax
push 4
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x128]
pop eax
push eax
call fcn.10016f88
xor eax, eax
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1003110d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x17c], 0xde0bcd8c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100310f4
xor eax, eax
push 4
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1003113e
push ecx
pop edi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x128]
call fcn.10016ff9
mov dword [eax], 0x6f9b2cfb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003111a
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1003114e
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push esi
lea ecx, [ebp - 0x128]
call fcn.10016ff9
push esi
lea ecx, [ebp - 0x128]
and dword [eax], 0
call fcn.10016ff9
cmp dword [eax], esi
jg 0x100314fa
xor edi, edi
inc edi
or ebx, 0xffffffff
mov dword [ebp - 0x20], 0x23ed15de
xor eax, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 0x98b42dcb
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x100312a2
push 4
pop esi
mov dword [ebp - 0x34], 0xf37c04cc
lea ecx, [ebp - 0xb2c]
push esi
call fcn.10016f88
xor eax, eax
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x100311d4
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xb2c]
call fcn.10016ff9
mov dword [eax], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x100311ba
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
jg 0x10031288
mov dword [ebp - 0x50], 0x2949f4ff
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x50], eax
je 0x10031244
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, 0x389a9b8f
setle cl
cmp dword [ebp - 0x50], ecx
jle 0x1003120a
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x20], eax
je 0x1003120c
mov esi, edi
push 2
lea ecx, [ebp - 0xb2c]
call fcn.10016ff9
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp esi, ecx
lea ecx, [ebp - 0x128]
sete dl
sub edx, 0xb8eb
neg edx
sbb edx, edx
inc edx
mov dword [eax], edx
xor eax, eax
push eax
call fcn.10016ff9
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, 0xffff
push 0
mov eax, dword [ebp + eax*4 - 0x17c]
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
mov dword [ebp + eax*4 - 0x17c], edx
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp edx, eax
pop eax
sete cl
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jle 0x100311e0
push 4
pop esi
lea ecx, [ebp - 0xb2c]
mov byte [ebp - 4], 0x17
call fcn.10016ff4
dec dword [ebp - 0x20]
jns 0x10031199
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jg 0x10031497
movdqa xmm0, xmmword [0x10009e30]
lea eax, [ebp - 0x1244]
push eax
lea eax, [ebp - 0x1254]
mov dword [ebp - 0x24], 0xa057
mov dword [ebp - 0x50], 0x9e6264a0
lea ecx, [ebp - 0x1380]
push eax
movdqu xmmword [ebp - 0x1254], xmm0
call fcn.10017008
lea ecx, [ebp - 0x212]
mov esi, eax
call fcn.1000b1a3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xf04]
push dword [esi]
call fcn.10016fca
push edi
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 0x19
call fcn.10016ff9
xor ebx, ebx
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x17c], ebx
jne 0x1003143e
push edi
lea ecx, [ebp - 0x128]
call fcn.10016ff9
push edi
lea ecx, [ebp - 0x128]
mov esi, eax
call fcn.10016ff9
mov ecx, dword [esi]
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x17c]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp dword [ebp - 0x1c], ecx
jl 0x10031360
mov eax, dword [ebp - 0x1c]
push edi
lea ecx, [ebp - 0x128]
call fcn.10016ff9
push edi
lea ecx, [ebp - 0x128]
call fcn.10016ff9
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x17c], ebx
je 0x10031394
push edi
lea ecx, [ebp - 0x128]
call fcn.10016ff9
cmp dword [eax], ebx
jne 0x100313a6
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x17c], ebx
jne 0x100313a6
xor eax, eax
mov esi, eax
jmp 0x100313a8
mov esi, edi
push 2
lea ecx, [ebp - 0x128]
call fcn.10016ff9
xor edx, edx
lea ecx, [esi + 0x25a1]
cmp ecx, dword [eax]
setl dl
or eax, 0xffffffff
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x178]
setge cl
add eax, ecx
jne 0x100313df
cmp dword [ebp - 0x24], eax
je 0x100313e1
mov eax, edi
jmp 0x100313e1
xor eax, eax
mov dword [ebp - 0x50], eax
xor eax, eax
cmp dword [ebp - 0x50], eax
jne 0x10031402
push 2
lea ecx, [ebp - 0x128]
call fcn.10016ff9
cmp dword [eax], ebx
jne 0x10031402
xor eax, eax
mov edx, eax
jmp 0x10031404
mov edx, edi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0xf04]
setge bl
xor eax, eax
push eax
call fcn.10016ff9
push edi
lea ecx, [ebp - 0x128]
mov dword [eax], ebx
call fcn.10016ff9
sub ebx, dword [eax]
test ebx, ebx
jg 0x1003143e
xor eax, eax
jmp 0x10031440
mov eax, edi
push 0xfffffffffffffffa
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x17c]
cmp eax, edx
mov eax, dword [ebp - 0x14]
setl bl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x17c]
cmp ebx, eax
setl cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0xf04]
mov byte [ebp - 4], 0x17
call fcn.10016ff4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x100312ae
xor eax, eax
or ebx, 0xffffffff
mov dword [ebp - 0x1c], eax
jmp 0x100314c7
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100314c4
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x1985
push 0x1887
push 0x319
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x1003149c
push edi
lea ecx, [ebp - 0x128]
call fcn.10016ff9
push edi
lea ecx, [ebp - 0x128]
inc dword [eax]
call fcn.10016ff9
cmp dword [eax], edi
jle 0x10031177
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
xor esi, esi
push 3
pop ebx
inc esi
or eax, 0xffffffff
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], eax
call fcn.10016ff4
push 2
lea ecx, [ebp - 0x1e4]
call fcn.10016f88
mov dword [ebp - 4], 0x1a
or ecx, 0xffffffff
mov dword [ebp - 0x34], esi
xor eax, eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10031555
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1e4]
call fcn.10016ff9
mov dword [eax], 0x9b55bb2c
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10031533
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jg 0x10031700
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x100316ee
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x38], 0xfffffffd
lea ecx, [ebp - 0x1e4]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0x34]
call fcn.10016ff9
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x1e4]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
push esi
call fcn.10016ff9
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1e4]
call fcn.10016ff9
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1e4]
call fcn.10016ff9
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1e4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x34]
call fcn.10016ff9
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x1e4]
neg eax
push esi
sbb eax, eax
neg eax
mov dword [ebp - 0x50], eax
call fcn.10016ff9
imul ecx, dword [ebp - 0x50], 0xb534
xor edi, edi
inc edi
push edi
mov esi, dword [eax]
sub esi, ecx
lea ecx, [ebp - 0x1e4]
call fcn.10016ff9
xor ecx, ecx
mov edx, dword [eax]
mov eax, dword [ebp - 0x1c]
add edx, esi
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
cmp eax, 0xe18a1676
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor esi, esi
inc esi
cmp ecx, 0x9195c588
jae 0x1003165f
push esi
lea ecx, [ebp - 0x1e4]
call fcn.10016ff9
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1e4]
call fcn.10016ff9
xor eax, eax
lea ecx, [ebp - 0x1e4]
push eax
call fcn.10016ff9
imul eax, dword [eax], 0x6ea4
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100316d8
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x38], eax
jl 0x100316c2
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100316bd
push 0x1a1e
push 0x443
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
xor eax, eax
dec dword [ebp - 0x38]
jns 0x10031693
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100316d5
push eax
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1003168b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10031585
xor eax, eax
or ecx, 0xffffffff
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x10031561
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x1e4]
call fcn.10016ff4
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0x34], 0x30f94f37
mov dword [ebp - 0x18], 0xf6a715cc
mov dword [ebp - 0xda8], esi
mov dword [ebp - 0xda4], esi
mov dword [ebp - 0xda0], esi
mov dword [ebp - 0xd9c], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10031759
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x530], 0xec2e0cf5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10031741
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10031779
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x218], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10031761
xor eax, eax
mov dword [ebp - 0x34], 2
cmp dword [ebp - 0x34], eax
jl 0x10031829
jmp 0x1003178d
xor eax, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x24], 0x2b82c447
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100317af
push 0x9b3
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x530]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x530]
cmp eax, 0xa3a9
sete cl
sub ecx, edx
mov dword [ebp - 0x24], ecx
je 0x100317e7
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x100317e9
jmp 0x100317eb
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x34]
xor edx, edx
push 1
mov ecx, dword [ebp + eax*4 - 0x530]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x530]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
mov eax, dword [ebp + eax*4 - 0x530]
imul eax, esi
pop esi
sub edx, eax
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x24], edx
dec dword [ebp - 0x34]
jns 0x1003178b
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x34]
push 4
pop ecx
sub eax, ecx
neg eax
sbb eax, eax
neg eax
add eax, 0xbc21b07f
imul eax, dword [ebp - 0x218]
test eax, eax
je 0x1003185c
xor eax, eax
cmp dword [ebp - 0x218], eax
je 0x1003185e
mov eax, esi
jmp 0x1003185e
xor eax, eax
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x528]
mov eax, dword [ebp - 0x34]
add ecx, eax
mov eax, dword [ebp - 0x218]
cmp ecx, eax
sete dl
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xd9c], esi
cmp byte [ebp - 0xd], 0
je 0x1003194d
mov dword [ebp - 0x50], 0xa6b9
or eax, 0xffffffff
mov dword [ebp - 0x50], 0x4ee87f6f
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x18], 0x795ed7c6
mov dword [ebp - 0x40], 0x18b47430
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x48], 0x7be74fd5
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x100318e3
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x3d0], 0x2f3817d1
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x100318cb
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x50], eax
je 0x100318ec
mov edx, esi
mov dword [ebp - 0x44], 0xfffe
cmp dword [ebp - 0x44], eax
jne 0x100318fe
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x3d0]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
test eax, eax
sets cl
sub edx, ecx
cmp edx, dword [ebp - 0x18]
jle 0x10031926
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x10031926
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x10031928
mov ecx, esi
mov dword [ebp - 0x50], 0x4182
mov eax, dword [ebp - 0x50]
sub eax, ecx
sub eax, dword [ebp - 0x48]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3d0], eax
xor eax, eax
push eax
call edi
mov dword [ebp - 0x14], 5
or edi, 0xffffffff
mov dword [ebp - 0x1c], esi
xor edx, edx
mov dword [ebp - 0x44], 0xe42a
mov dword [ebp - 0x40], 0x475e
mov dword [ebp - 0x4c], 0x33a7
mov dword [ebp - 0x24], 0x9bb7a140
mov dword [ebp - 0x28], 0x5dd4d14b
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], 0x1949f0dc
mov dword [ebp - 0x60], 0xfffffffb
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x44]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setle dl
xor ecx, ecx
cmp edx, 0xb16aac89
setne cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x40]
neg edx
sbb edx, edx
inc edx
cmp dword [ebp - 0x44], edx
jl 0x10031aea
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x864]
call fcn.10016f88
lea eax, [ebp - 0x11c4]
mov dword [ebp - 4], 0x1b
push eax
lea eax, [ebp - 0x11d4]
mov dword [ebp - 0x28], 0xca2589d3
xorps xmm0, xmm0
lea ecx, [ebp - 0x1390]
push eax
movdqu xmmword [ebp - 0x11d4], xmm0
call fcn.10017008
lea ecx, [ebp - 0x25d]
mov esi, eax
call fcn.1000b1a3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xed0]
push dword [esi]
call fcn.10016fca
mov byte [ebp - 4], 0x1c
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x40], 0x3922cbd4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10031a6b
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x864]
call fcn.10016ff9
mov dword [eax], 0x7fb07d0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10031a4d
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031a7b
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
dec dword [ebp - 0x40]
lea ecx, [ebp - 0xed0]
push ebx
call fcn.10016ff9
mov ecx, dword [ebp - 0x40]
xor edx, edx
cmp ecx, 0x4de8cc19
lea ecx, [ebp - 0x864]
setg dl
xor ebx, ebx
cmp edx, dword [eax]
setg bl
xor eax, eax
push eax
call fcn.10016ff9
lea ecx, [ebp - 0x864]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, ebx
call fcn.10016ff9
xor ecx, ecx
cmp esi, dword [eax]
sete cl
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0xed0]
call fcn.10016ff4
lea ecx, [ebp - 0x864]
mov dword [ebp - 4], edi
call fcn.10016ff4
push 3
xor esi, esi
pop ebx
inc esi
jmp 0x10031af4
mov dword [ebp - 0x50], 0x7b70d8ac
dec dword [ebp - 0x50]
mov dword [ebp - 0x1c], 0xfffffff3
jmp 0x10031b9f
push esi
lea ecx, [ebp - 0x984]
call fcn.10016f88
xor eax, eax
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x10031b38
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x984]
call fcn.10016ff9
and dword [eax], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x10031b1d
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031b57
push eax
push eax
push 0x1faf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x10031b8e
push dword [ebp - 0x14]
lea ecx, [ebp - 0x984]
call fcn.10016ff9
push dword [ebp - 0x14]
lea ecx, [ebp - 0x984]
mov esi, eax
call fcn.10016ff9
mov ecx, dword [esi]
mov dword [eax], ecx
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x10031b5f
xor esi, esi
inc esi
lea ecx, [ebp - 0x984]
mov dword [ebp - 4], edi
call fcn.10016ff4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff9
jl 0x10031b00
xor eax, eax
cmp dword [ebp - 0x644], eax
je 0x10032651
mov dword [ebp - 0x38], 0x41ac3dc9
mov dword [ebp - 0x28], 0xcd908fbd
mov dword [ebp - 0x28], 0x51d1a932
mov dword [ebp - 0x2c], eax
jmp 0x10031be2
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xb8], 0x20398070
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10031bd1
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0xb4], 0xd461e3f
jne 0x10031c00
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb8]
xor edx, edx
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb4]
cmp ecx, eax
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xb4]
setne dl
add ecx, dword [ebp - 0xb4]
add eax, edx
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0xb8], eax
je 0x10031da8
mov dword [ebp - 0x1c], 0xfc9b996a
mov dword [ebp - 0x14], 0xa2e255bb
mov dword [ebp - 0x24], 0x9efcf395
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffe6
jl 0x10031cbf
mov dword [ebp - 0x40], 0x1dfe
mov dword [ebp - 0x50], 0x6d9
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], eax
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x1c], eax
jmp 0x10031cae
mov dword [ebp - 0x24], 0x4f57b17b
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], 0x20525c7e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x13
jge 0x10031c85
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe6
jge 0x10031c69
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jg 0x10031db8
jmp 0x10031ccf
xor eax, eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0xc7c]
push ebx
call fcn.10016f88
xor eax, eax
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x2c], eax
jmp 0x10031cf9
push dword [ebp - 0x2c]
call fcn.10016ff9
mov dword [eax], edi
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0xc7c]
cmp dword [ebp - 0x2c], ebx
jl 0x10031cec
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xb8]
xor eax, eax
push eax
call fcn.10016ff9
xor ecx, ecx
and dword [eax], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xb8]
test eax, eax
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
sub ecx, 0x612e76f7
mov eax, dword [ebp + eax*4 - 0xb8]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0xb8]
setl cl
xor edx, edx
cmp ecx, 5
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xb8]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0xc7c]
mov dword [ebp - 4], edi
call fcn.10016ff4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10031ccd
jmp 0x10031db8
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10031db8
push eax
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov dword [ebp - 0x18], 0x28405cef
lea ecx, [ebp - 0x9a8]
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x50], 0x8bb4
mov dword [ebp - 0x58], 0xc3837ace
push 2
call fcn.10016f88
push 4
pop esi
push esi
lea ecx, [ebp - 0xb44]
mov dword [ebp - 4], 0x1f
call fcn.10016f88
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10031e28
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9a8]
call fcn.10016ff9
mov dword [eax], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10031e09
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10031e40
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb44]
call fcn.10016ff9
mov dword [eax], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10031e2d
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp eax, esi
setg cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jne 0x10031ea8
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x9a8]
mov dword [ebp - 0x2c], eax
xor eax, eax
push eax
call fcn.10016ff9
mov ecx, dword [ebp - 0x50]
mov esi, eax
mov edx, dword [ebp - 0x2c]
xor eax, eax
sub edx, ecx
mov ecx, dword [ebp - 0x58]
cmp edx, ecx
mov ecx, dword [ebp - 0x48]
setne al
xor edx, edx
cmp eax, ecx
mov eax, 0xfffe
setne dl
cmp eax, edx
sbb eax, eax
neg eax
sub eax, dword [esi]
neg eax
sbb eax, eax
inc eax
sub eax, 0x219c83a5
jne 0x10031ea8
mov esi, eax
jmp 0x10031ead
xor eax, eax
lea esi, [eax + 1]
push eax
lea ecx, [ebp - 0x9a8]
call fcn.10016ff9
mov ecx, dword [ebp - 0x58]
xor edx, edx
cmp esi, ecx
lea ecx, [ebp - 0xb44]
setg dl
sub edx, dword [eax]
mov eax, 0xffff
neg edx
sbb edx, edx
inc edx
cmp eax, edx
sbb esi, esi
neg esi
sub esi, 0x9220
neg esi
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.10016ff9
lea ecx, [ebp - 0xb44]
mov dword [eax], esi
call fcn.10016ff4
lea ecx, [ebp - 0x9a8]
mov dword [ebp - 4], edi
call fcn.10016ff4
xor esi, esi
mov dword [ebp - 0x50], 0x90ae735
inc esi
mov dword [ebp - 0x2c], 0xfffffff6
push esi
lea ecx, [ebp - 0xd24]
call fcn.10016f88
mov dword [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], eax
push 0xfffffffffffffff8
pop edi
cmp dword [ebp - 0x14], ebx
jge 0x10031f51
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x12fc], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10031f3d
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10031f77
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd24]
call fcn.10016ff9
mov dword [eax], 0x884515fd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10031f59
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031f8c
push 0x15ac
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x12f4], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
or ecx, 0xffffffff
neg eax
sub ecx, eax
neg ecx
sbb esi, esi
xor eax, eax
push eax
lea ecx, [ebp - 0xd24]
neg esi
call fcn.10016ff9
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp esi, ecx
lea ecx, [ebp - 0xd24]
setl dl
mov dword [eax], edx
mov eax, dword [ebp - 0x2c]
or eax, 0xffffffff
mov dword [ebp - 0x24], 0x20274952
mov dword [ebp - 4], eax
call fcn.10016ff4
push 4
pop eax
mov dword [ebp - 0x58], eax
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10032011
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x138], 0xb57f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10031ff8
xor eax, eax
xor esi, esi
mov dword [ebp - 0x20], eax
inc esi
jmp 0x100320a3
mov dword [ebp - 0x24], 0x1e60e779
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x138], 0
jne 0x10032036
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x138]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x138]
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x138]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x138]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x138]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x138]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x138]
cmp ecx, eax
setge dl
xor ecx, ecx
imul edx, dword [ebp - 0x134]
imul eax, edx, 0xfdd8
cmp eax, esi
setl cl
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x1003201c
mov eax, 0xffff
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x60], eax
push esi
call fcn.10016f88
mov dword [ebp - 4], 0x22
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x100320ee
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf7c], 0x8bbca631
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100320d5
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10032114
mov dword [ebp - 0x34], esi
mov ecx, 0xd2eb2fc2
mov dword [ebp - 0x40], 0x773196e8
mov eax, dword [ebp - 0x34]
sub ecx, eax
xor eax, eax
cmp ecx, 9
setne al
imul eax, eax, 0x7b09
cmp eax, 0x12e7
jne 0x10032681
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10032683
mov eax, esi
mov dword [ebp - 0x40], eax
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp dword [ebp - 0x34], ecx
jne 0x100326b9
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
cmp eax, 0x1e6
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x34]
mov byte [ebp - 0xd], al
jg 0x100326f1
cmp byte [ebp - 0xd], al
je 0x100326fd
push 0x19da
push 0xbe2
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x100326fd
cmp byte [ebp - 0xd], al
je 0x100326fd
push eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov eax, 0xffff
lea ecx, [ebp - 0xf10]
mov dword [ebp - 0x48], eax
push ebx
call fcn.10016f88
mov dword [ebp - 4], 0x24
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10032747
push dword [ebp - 0x18]
lea ecx, [ebp - 0xf10]
call fcn.10016ff9
mov dword [eax], 0x313dd33a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10032729
xor eax, eax
mov edi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [ebp - 0x18], eax
jmp 0x10032763
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032760
push eax
call edi
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x10032752
or eax, 0xffffffff
lea ecx, [ebp - 0xf10]
mov dword [ebp - 4], eax
call fcn.10016ff4
xor eax, eax
lea ecx, [ebp - 0xb74]
mov byte [ebp - 0x39], al
push ebx
call fcn.10016f88
lea eax, [ebp - 0x12c4]
mov dword [ebp - 4], 0x25
movdqa xmm0, xmmword [0x10009e10]
lea ecx, [ebp - 0x13b0]
push eax
lea eax, [ebp - 0x12d4]
push eax
movdqu xmmword [ebp - 0x12d4], xmm0
call fcn.10017008
lea ecx, [ebp - 0x211]
mov esi, eax
call fcn.1000b1a3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x6e8]
push dword [esi]
call fcn.10016fca
mov byte [ebp - 4], 0x26
xor eax, eax
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x30], 0x4d99
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10032812
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3f8], 0xaaae
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100327f9
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10032838
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb74]
call fcn.10016ff9
mov dword [eax], 0x4307e4a9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1003281a
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032848
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x3f8]
lea ecx, [ebp - 0xb74]
mov eax, dword [ebp - 0x3f4]
xor eax, eax
push eax
call fcn.10016ff9
lea ecx, [ebp - 0x6e8]
mov dword [eax], 0x1245
xor eax, eax
push eax
call fcn.10016ff9
mov ecx, dword [ebp - 0x3f4]
add ecx, 2
neg ecx
push 2
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x6e8]
setl bl
call fcn.10016ff9
xor ecx, ecx
cmp ebx, dword [eax]
setg cl
xor eax, eax
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x6e8]
push eax
call fcn.10016ff9
xor edx, edx
push 3
pop ebx
mov ecx, dword [eax]
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3f8]
cmp ecx, eax
mov eax, dword [ebp - 0x3f4]
setl dl
sub eax, edx
imul eax, eax, 0xb91
test eax, eax
jne 0x100328ef
push ebx
lea ecx, [ebp - 0x6e8]
call fcn.10016ff9
cmp dword [eax], 0
jne 0x100328ef
xor esi, esi
xor eax, eax
inc esi
jmp 0x100328f4
xor esi, esi
inc esi
mov eax, esi
mov dword [ebp - 0x30], eax
mov ecx, 0x97440271
mov eax, dword [ebp - 0x30]
cmp ecx, eax
lea ecx, [ebp - 0x6e8]
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
call fcn.10016ff4
or eax, 0xffffffff
lea ecx, [ebp - 0xb74]
mov dword [ebp - 4], eax
call fcn.10016ff4
cmp byte [ebp - 0x39], 0
je 0x10032a66
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x5a8]
mov dword [ebp - 0x1c], 0x7257ea0d
push ebx
call fcn.10016f88
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x40], 0xfffffffe
push 4
pop eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x24], 0xe9f81a77
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003298e
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5a8]
call fcn.10016ff9
mov dword [eax], 2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10032970
xor eax, eax
push eax
lea ecx, [ebp - 0x5a8]
call fcn.10016ff9
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor eax, eax
push eax
lea ecx, [ebp - 0x5a8]
call fcn.10016ff9
mov eax, dword [ebp - 0x14]
mov ecx, 0x18670fc2
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x100329ea
mov edx, eax
cmp dword [ebp - 0x30], eax
je 0x100329ec
mov edx, esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x50]
setg cl
add eax, 0xffff8ad9
add eax, ecx
je 0x10032a18
push 2
lea ecx, [ebp - 0x5a8]
call fcn.10016ff9
cmp dword [eax], 0
je 0x10032a18
mov ecx, esi
jmp 0x10032a1c
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x40]
imul eax, ecx
test eax, eax
jne 0x10032a32
push eax
lea ecx, [ebp - 0x5a8]
call fcn.10016ff9
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x5a8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x24], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016ff4
xor eax, eax
push eax
push eax
push 0x233c
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
dec dword [ebp - 0x48]
push esi
lea ecx, [ebp - 0x2f0]
call fcn.10016f88
mov dword [ebp - 4], 0x28
xor eax, eax
mov dword [ebp - 0x24], 0xfd52a42b
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10032aab
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2f0]
call fcn.10016ff9
mov dword [eax], 0x9f9b3198
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10032a8d
xor eax, eax
push eax
lea ecx, [ebp - 0x2f0]
call fcn.10016ff9
lea ecx, [ebp - 0x2f0]
mov dword [eax], 0xffffffe3
xor eax, eax
push eax
call fcn.10016ff9
cmp dword [eax], 0xe
jl 0x10032bc5
or edi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10032af9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc0], 0xf506e60b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10032ae1
xor eax, eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], edi
jg 0x10032b9a
mov dword [ebp - 0x18], 0x3a3f
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc0]
cmp eax, ecx
setl dl
cmp edx, 0x5b1510af
jle 0x10032b2d
push eax
lea ecx, [ebp - 0x2f0]
call fcn.10016ff9
lea ecx, [ebp - 0x2f0]
inc dword [eax]
xor eax, eax
push eax
call fcn.10016ff9
cmp dword [eax], 0xe
jge 0x10032ad7
or eax, 0xffffffff
lea ecx, [ebp - 0x2f0]
mov dword [ebp - 4], eax
call fcn.10016ff4
mov dword [ebp - 0x28], 0x6b0f7383
lea ecx, [ebp - 0xf28]
mov dword [ebp - 0x28], 0x964a53aa
mov dword [ebp - 0x28], 0xfffffff6
push esi
call fcn.10016f88
mov dword [ebp - 4], 0x29
lea ecx, [ebp - 0xee8]
xor eax, eax
mov dword [ebp - 0x28], 0x2b3b7bed
mov dword [ebp - 0x28], eax
push ebx
call fcn.10016f88
mov byte [ebp - 4], 0x2a
xor eax, eax
mov dword [ebp - 0x30], 0x21f7d967
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10032c49
push dword [ebp - 0x14]
lea ecx, [ebp - 0xf28]
call fcn.10016ff9
mov dword [eax], 0x6580849f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10032c2b
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10032c5b
lea ecx, [ebp - 0xee8]
cmp dword [ebp - 0x14], ebx
jl 0x10032c4e