Function at 0x1002d0e0
Capabilities:
Accept command line arguments
Check os version
Compare security identifiers
Enumerate gui resources
Get common file path
Get disk information
Get file size
Get graphical window text
Get keyboard layout
Identify system language via api
Modify service
Parse pe header
Query or enumerate registry key
Resume thread

Disassembly:
mov eax, 0x10081203
call fcn.1007fad8
mov eax, 0x12cc
call fcn.1007c500
push ebx
xor eax, eax
mov dword [ebp - 0x14], 0xea5d6c05
push esi
mov byte [ebp - 0x49], al
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov byte [ebp - 0x5d], dl
mov dword [ebp - 0x5c], ecx
cmp byte [ebp - 0x49], al
je 0x1002d11e
push 0x1afb
push eax
call edi
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_CharUpperBuffW]
xor esi, esi
mov dword [ebp - 0x14], 0xfffffff8
inc esi
jmp 0x1002d146
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002d143
push 0x1ebc
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002d130
mov dword [ebp - 0x14], 0xea5d6c05
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002d165
push 0x1afb
push eax
call edi
xor eax, eax
mov dword [ebp - 0x14], 0xfffffff8
jmp 0x1002d184
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002d181
push 0x1ebc
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002d16e
mov dword [ebp - 0x14], 0xea5d6c05
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002d1a3
push 0x1afb
push eax
call edi
xor eax, eax
mov dword [ebp - 0x14], 0xfffffff8
jmp 0x1002d1c2
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002d1bf
push 0x1ebc
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002d1ac
push 3
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
pop edx
cmp dword [ebp - 0x14], ecx
jge 0x1002d1ec
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe4c], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002d1d8
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x18], eax
jmp 0x1002d20f
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002d20c
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1002d1f7
mov dword [ebp - 0x18], 0xfffffff4
jmp 0x1002d2fb
push esi
lea ecx, [ebp - 0x4b8]
call fcn.10016499
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002d258
push dword [ebp - 0x14]
lea ecx, [ebp - 0x4b8]
call fcn.10016537
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002d23a
xor eax, eax
push eax
lea ecx, [ebp - 0x4b8]
call fcn.10016537
and dword [eax], 0
jmp 0x1002d2d4
mov dword [ebp - 0x3c], 0x365653d4
xor eax, eax
mov dword [ebp - 0x3c], 2
cmp dword [ebp - 0x3c], eax
jl 0x1002d2c6
mov dword [ebp - 0x14], 0x8eb98764
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], eax
jl 0x1002d2ac
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0xe4c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xe4c], ecx
dec dword [ebp - 0x14]
jns 0x1002d291
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002d2c1
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
xor eax, eax
dec dword [ebp - 0x3c]
jns 0x1002d27e
push eax
lea ecx, [ebp - 0x4b8]
call fcn.10016537
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x4b8]
push eax
call fcn.10016537
cmp dword [eax], 2
jle 0x1002d269
or eax, 0xffffffff
lea ecx, [ebp - 0x4b8]
mov dword [ebp - 4], eax
call fcn.1001651b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x12
jle 0x1002d221
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x3ac]
call fcn.10016499
mov dword [ebp - 4], esi
lea ecx, [ebp - 0xc18]
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], 0xfffffff6
push ebx
call fcn.10016499
mov byte [ebp - 4], bl
or eax, 0xffffffff
mov dword [ebp - 0x38], 0x6a4137d6
mov dword [ebp - 0x38], 0x2d50fa8f
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x38], 0xf57f54ab
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002d37c
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x3ac]
call fcn.10016537
mov dword [eax], 0x5d6c
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002d35e
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002d3a4
or esi, 0xffffffff
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc18]
call fcn.10016537
mov dword [eax], esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002d387
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x1c], eax
jmp 0x1002d472
mov dword [ebp - 0x34], 0xfe23a266
lea ecx, [ebp - 0x3ac]
mov dword [ebp - 0x48], esi
push dword [ebp - 0x1c]
call fcn.10016537
dec dword [ebp - 0x48]
je 0x1002d3d8
push esi
lea ecx, [ebp - 0x3ac]
call fcn.10016537
mov eax, dword [ebp - 0x1c]
xor eax, eax
lea ecx, [ebp - 0x3ac]
push eax
call fcn.10016537
mov eax, dword [ebp - 0x34]
xor ecx, ecx
or eax, 0xffffffff
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp eax, 0xfffffff6
push dword [ebp - 0x1c]
setl cl
xor ebx, ebx
test ecx, ecx
lea ecx, [ebp - 0x3ac]
sets bl
call fcn.10016537
cmp ebx, dword [eax]
jg 0x1002d42d
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002d42f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3ac]
call fcn.10016537
cmp dword [eax], 0
jne 0x1002d431
xor eax, eax
mov esi, eax
xor eax, eax
lea ecx, [ebp - 0x3ac]
inc eax
push eax
call fcn.10016537
mov eax, dword [eax]
imul eax, esi
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002d46c
push eax
push eax
push 0x1a1a
push eax
push 0x5d0
push eax
push 0x870
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
inc dword [ebp - 0x1c]
xor esi, esi
inc esi
cmp dword [ebp - 0x1c], esi
jle 0x1002d3ac
dec dword [ebp - 0x30]
lea ecx, [ebp - 0xc18]
call fcn.1001651b
or eax, 0xffffffff
lea ecx, [ebp - 0x3ac]
mov dword [ebp - 4], eax
call fcn.1001651b
movdqa xmm0, xmmword [0x10008120]
lea ecx, [ebp - 0x11c8]
xor eax, eax
mov dword [ebp - 0x54], 0xea5d6c05
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0xfcc]
push eax
lea eax, [ebp - 0xfdc]
push eax
movdqu xmmword [ebp - 0xfdc], xmm0
call fcn.10016546
lea ecx, [ebp - 0x177]
mov esi, eax
call fcn.100092a3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x998]
push dword [esi]
call fcn.100164f5
push 3
pop ebx
push ebx
lea ecx, [ebp - 0xd98]
mov dword [ebp - 4], ebx
call fcn.10016499
mov byte [ebp - 4], 4
or esi, 0xffffffff
mov dword [ebp - 0x38], esi
xor eax, eax
mov dword [ebp - 0x38], 0xac507b39
mov dword [ebp - 0x14], eax
jmp 0x1002d52e
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd98]
call fcn.10016537
mov dword [eax], 0xd40a7fc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002d517
mov dword [ebp - 0x34], 0xfc37
xor edx, edx
mov dword [ebp - 0x40], 0xb3a0
mov dword [ebp - 0x44], esi
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
add ecx, dword [ebp - 0x34]
cmp ecx, 4
jne 0x1002d571
cmp dword [ebp - 0x48], eax
je 0x1002d571
xor edx, edx
lea esi, [edx + 1]
jmp 0x1002d573
mov esi, eax
push eax
lea ecx, [ebp - 0x998]
call fcn.10016537
xor ecx, ecx
cmp esi, 0x9cc099a5
push 3
setne cl
xor ebx, ebx
add ecx, dword [ebp - 0x34]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x998]
pop eax
push eax
setg bl
call fcn.10016537
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
xor eax, eax
mov dword [ebp - 0x44], ecx
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002d5ca
push eax
push 0x32d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea ecx, [ebp - 0xd98]
call fcn.1001651b
or eax, 0xffffffff
lea ecx, [ebp - 0x998]
mov dword [ebp - 4], eax
call fcn.1001651b
mov dword [ebp - 0x54], 0xfd3df75d
xor eax, eax
mov dword [ebp - 0x1c], 0xe7308f47
xor esi, esi
mov dword [ebp - 0x44], eax
inc esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x3c], 0xc7be0218
mov dword [ebp - 0x48], 0x7289c089
push 2
mov dword [ebp - 0x14], eax
pop ebx
cmp dword [ebp - 0x14], ebx
jge 0x1002d630
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x724], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002d618
xor eax, eax
mov dword [ebp - 0x54], 0x14
cmp dword [ebp - 0x54], 0xffffffee
je 0x1002d7cf
jmp 0x1002d645
xor eax, eax
mov dword [ebp - 0x30], 0x1ad67a4b
or ecx, 0xffffffff
mov dword [ebp - 0x28], 0x11e7bff4
mov dword [ebp - 0x48], 0xee1d1102
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], 0x836ea0e4
mov dword [ebp - 0x18], 0x31cf6a12
cmp dword [ebp - 0x30], eax
jne 0x1002d6de
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
imul ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
imul ecx, ecx, 0x95d
cmp ecx, eax
mov ecx, dword [ebp - 0x3c]
setne dl
cmp esi, edx
sbb eax, eax
inc eax
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
sub eax, 0x296e8fb3
je 0x1002d6d5
mov eax, dword [ebp - 0x30]
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
xor ecx, ecx
imul edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
jmp 0x1002d7b8
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x1002d7b5
mov dword [ebp - 0x48], 0x5aad
mov dword [ebp - 0xad0], eax
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0x40], 0xb13f4b1a
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1002d7ac
mov dword [ebp - 0x40], 0xbfad241d
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x724]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x724]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x724], ecx
xor eax, eax
cmp ecx, 0xfffffffb
mov ecx, 0xd1afc438
setne al
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, 0xfffc
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x40]
jge 0x1002d785
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1002d787
mov eax, esi
jmp 0x1002d787
xor eax, eax
cmp eax, dword [ebp - 0x48]
je 0x1002d797
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002d799
mov eax, esi
jmp 0x1002d799
xor eax, eax
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002d736
xor eax, eax
dec dword [ebp - 0x28]
jns 0x1002d708
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x17
jge 0x1002d6fc
dec dword [ebp - 0x54]
cmp dword [ebp - 0x54], 0xffffffee
jne 0x1002d643
xor eax, eax
lea ecx, [ebp - 0x33c]
push 3
mov byte [ebp - 0xd], al
pop eax
push eax
call fcn.10016499
push ebx
lea ecx, [ebp - 0x10c]
mov dword [ebp - 4], 6
call fcn.10016499
xor eax, eax
mov byte [ebp - 4], 7
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002d829
push 3
pop esi
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x33c]
call fcn.10016537
mov dword [eax], 9
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002d808
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002d84f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x10c]
call fcn.10016537
mov dword [eax], 0x76f5020f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002d831
xor eax, eax
push eax
lea ecx, [ebp - 0x10c]
call fcn.10016537
lea ecx, [ebp - 0x10c]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10016537
cmp dword [eax], ebx
jg 0x1002d99f
xor eax, eax
lea ecx, [ebp - 0x10c]
push eax
call fcn.10016537
lea ecx, [ebp - 0x33c]
push dword [eax]
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x33c]
push eax
call fcn.10016537
cmp dword [eax], 0
jne 0x1002d8fa
xor eax, eax
lea ecx, [ebp - 0x10c]
push eax
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x10c]
push eax
call fcn.10016537
xor ebx, ebx
lea ecx, [ebp - 0x33c]
cmp dword [eax], esi
setg bl
xor eax, eax
push eax
call fcn.10016537
xor ecx, ecx
cmp ebx, dword [eax]
setge cl
xor ebx, ebx
cmp ecx, 9
lea ecx, [ebp - 0x10c]
setl bl
xor eax, eax
push eax
call fcn.10016537
cmp ebx, dword [eax]
je 0x1002d8fa
xor eax, eax
mov esi, eax
jmp 0x1002d8fc
xor eax, eax
push eax
lea ecx, [ebp - 0x10c]
call fcn.10016537
lea ecx, [ebp - 0x33c]
push dword [eax]
call fcn.10016537
cmp dword [eax], esi
jge 0x1002d940
xor eax, eax
lea ecx, [ebp - 0x10c]
push eax
call fcn.10016537
lea ecx, [ebp - 0x33c]
push dword [eax]
call fcn.10016537
cmp dword [eax], 0
je 0x1002d940
xor eax, eax
lea esi, [eax + 1]
jmp 0x1002d944
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x10c]
call fcn.10016537
lea ecx, [ebp - 0x33c]
sub esi, dword [eax]
xor eax, eax
push eax
call fcn.10016537
mov dword [eax], esi
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002d977
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor eax, eax
push eax
lea ecx, [ebp - 0x10c]
call fcn.10016537
lea ecx, [ebp - 0x10c]
inc dword [eax]
xor eax, eax
push eax
call fcn.10016537
push 1
pop esi
cmp dword [eax], 2
jle 0x1002d874
lea ecx, [ebp - 0x10c]
call fcn.1001651b
or ebx, 0xffffffff
lea ecx, [ebp - 0x33c]
mov dword [ebp - 4], ebx
call fcn.1001651b
cmp byte [ebp - 0xd], 0
je 0x1002d9cb
push 0x1afb
xor eax, eax
push eax
call edi
xor eax, eax
push 3
mov dword [ebp - 0x2c], eax
pop esi
cmp dword [ebp - 0x2c], esi
jge 0x1002d9f0
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1ec], 0x31713b91
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002d9d8
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x1002da10
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x10cc], 7
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002d9f8
xor eax, eax
mov dword [ebp - 0x1ec], 0x17
cmp dword [ebp - 0x1ec], 0xfffffffa
jne 0x1002da42
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x54], 0xfffffff8
inc ebx
push 2
pop edi
cmp dword [ebp - 0x54], ebx
jge 0x1002df59
jmp 0x1002db2c
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x18], 0xaa43b2b
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], 0x300d
mov eax, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x1e4]
cmp eax, 0xfffffffc
mov eax, dword [ebp - 0x18]
setg cl
imul eax, ecx
xor ecx, ecx
imul eax, eax, 0xffff
cmp eax, 0x48abb75d
setne cl
imul ecx, dword [ebp - 0x18]
imul eax, ecx, 0xbec0
mov ecx, ebx
xor ebx, ebx
mov dword [ebp - 0x10cc], eax
mov eax, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg bl
sub ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
neg ebx
mov eax, dword [ebp - 0x1ec]
sbb ebx, ebx
inc ebx
sub edx, ebx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x1ec]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1ec]
setle cl
add eax, ecx
mov ecx, dword [ebp - 0x18]
add ecx, eax
xor eax, eax
cmp ecx, dword [ebp - 0x18]
jg 0x1002db06
cmp dword [ebp - 0x18], eax
je 0x1002db06
mov dword [ebp - 0x40], 0x28464d91
mov dword [ebp - 0x40], 0x76522452
cmp dword [ebp - 0x34], eax
jmp 0x1002db09
cmp dword [ebp - 0x40], eax
jne 0x1002da25
dec dword [ebp - 0x1ec]
cmp dword [ebp - 0x1ec], 0xfffffffa
push 0xffffffffffffffff
pop ebx
jne 0x1002da40
jmp 0x1002da25
xor eax, eax
mov dword [ebp - 0x1c], 0xa4a12b57
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002db53
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd44], 0x799ac789
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002db3b
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002db78
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002db73
push eax
push 0x2582
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002db5b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1002dbc2
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002dba3
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x6bc
push eax
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002dbb7
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002db80
xor ebx, ebx
inc ebx
push edi
lea ecx, [ebp - 0x95c]
call fcn.10016499
mov dword [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x28], 0x8c45cdbe
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002dc08
push dword [ebp - 0x14]
lea ecx, [ebp - 0x95c]
call fcn.10016537
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002dbed
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002dcaf
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], 0xd9b4
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002dc47
push eax
push 0x110e
push 0x1a0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002dca7
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002dc6c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd8], 0x5dae5a60
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002dc54
xor eax, eax
mov dword [ebp - 0xd8], ebx
cmp dword [ebp - 0xd8], eax
jl 0x1002dc9d
push dword [ebp - 0x28]
lea ecx, [ebp - 0x95c]
call fcn.10016537
cmp dword [eax], 0
jne 0x1002dc9b
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
dec dword [ebp - 0xd8]
jns 0x1002dc7a
xor eax, eax
mov dword [ebp - 0x44], 0x28fdeb77
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jle 0x1002dc4c
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x1002dc10
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002dcde
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x98d
push 0x80f
push 0x2255
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
or eax, 0xffffffff
lea ecx, [ebp - 0x95c]
mov dword [ebp - 4], eax
call fcn.1001651b
xor eax, eax
mov ecx, 0xffff
mov byte [ebp - 0xd], al
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0x50db8561
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x1002dd29
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x674], 0xc443
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1002dd11
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002dd3f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xc30], 0x4b83
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002dd2e
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c], 6
cmp eax, ebx
setg cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
xor eax, eax
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x1c], eax
jne 0x1002dd7b
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
jne 0x1002dd7b
mov esi, eax
jmp 0x1002dd7d
mov esi, ebx
imul edx, dword [ebp - 0x28], 0xf
xor ecx, ecx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setle cl
cmp ecx, 0xf3e1
jl 0x1002dd9f
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x1002dda1
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
add eax, ecx
xor ecx, ecx
cmp esi, eax
setne cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x674]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc28]
mov eax, dword [ebp - 0xc28]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002dddf
cmp dword [ebp - 0x674], eax
je 0x1002dddf
mov eax, ebx
xor edx, edx
cmp eax, 0xb017
mov eax, dword [ebp - 0x18]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x674]
setle cl
imul edx, ecx, 0x851f
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, ebx
setg al
mov dword [ebp - 0x18], eax
cmp byte [ebp - 0xd], 0
je 0x1002df4a
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 0x204e2db5
mov dword [ebp - 0x1c], 0xc
jmp 0x1002df32
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x584]
push edi
call fcn.10016499
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x14], 0x34111d01
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x14], eax
jmp 0x1002de6f
push dword [ebp - 0x14]
call fcn.10016537
and dword [eax], 0
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x584]
cmp dword [ebp - 0x14], edi
jl 0x1002de61
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
push ebx
call fcn.10016537
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
add eax, esi
jne 0x1002de94
cmp dword [ebp - 0x1c], eax
je 0x1002de96
mov eax, ebx
mov dword [ebp - 0x14], eax
mov ecx, 0x4e828d47
mov eax, dword [ebp - 0x1c]
sub ecx, eax
add ecx, dword [ebp - 0x14]
cmp ecx, ebx
lea ecx, [ebp - 0x584]
push ebx
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
call fcn.10016537
mov dword [eax], esi
test esi, esi
jne 0x1002df0f
push ebx
lea ecx, [ebp - 0x584]
call fcn.10016537
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
neg ecx
jne 0x1002dee9
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002def7
mov esi, ebx
cmp dword [ebp - 0x28], eax
jne 0x1002def9
mov esi, eax
push ebx
lea ecx, [ebp - 0x584]
call fcn.10016537
cmp esi, dword [eax]
jl 0x1002df0f
xor eax, eax
mov edx, eax
jmp 0x1002df11
mov edx, ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setg cl
or eax, 0xffffffff
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x584]
mov dword [ebp - 4], eax
call fcn.1001651b
inc dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], 0x13
jne 0x1002de36
push 0x1ebc
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffW]
inc dword [ebp - 0x54]
push 3
pop esi
cmp dword [ebp - 0x54], ebx
jl 0x1002db2a
mov esi, 0x82eac453
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
mov edi, 0x2c03342e
jge 0x1002df85
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2e0], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002df70
xor eax, eax
mov dword [ebp - 0x2e0], 0x1b
jmp 0x1002df9f
cmp dword [ebp - 0x2dc], eax
jne 0x1002dfa8
dec dword [ebp - 0x2e0]
cmp dword [ebp - 0x2e0], 0xffffffe7
jl 0x1002df91
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002dfbc
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002dfdd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2c8], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002dfc8
xor eax, eax
mov dword [ebp - 0x2c8], 0x1b
jmp 0x1002dff7
cmp dword [ebp - 0x2c4], eax
jne 0x1002e000
dec dword [ebp - 0x2c8]
cmp dword [ebp - 0x2c8], 0xffffffe7
jl 0x1002dfe9
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e00e
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002e02f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2d8], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002e01a
xor eax, eax
mov dword [ebp - 0x2d8], 0x1b
jmp 0x1002e049
cmp dword [ebp - 0x2d4], eax
jne 0x1002e052
dec dword [ebp - 0x2d8]
cmp dword [ebp - 0x2d8], 0xffffffe7
jl 0x1002e03b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e05e
push eax
call ebx
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x2ac]
call fcn.10016499
mov dword [ebp - 4], 0xa
or eax, 0xffffffff
mov dword [ebp - 0x48], 0x249aaed6
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002e0b0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2ac]
call fcn.10016537
mov dword [eax], 0xb7c7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002e092
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetMenuStringW]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e0d4
push 0x84c
push 0x1bea
push eax
push 0xdaa
push eax
call edi
xor eax, eax
push eax
lea ecx, [ebp - 0x2ac]
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x2ac]
push eax
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x2ac]
push eax
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x2ac]
push eax
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x2ac]
push eax
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x2ac]
push eax
call fcn.10016537
xor ebx, ebx
lea ecx, [ebp - 0x2ac]
inc ebx
push ebx
call fcn.10016537
mov esi, eax
lea ecx, [ebp - 0x2ac]
xor eax, eax
push eax
call fcn.10016537
mov ecx, dword [esi]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x2ac]
cmp dword [ebp - 0x48], 0xfffffffc
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1001651b
push 3
pop esi
push esi
lea ecx, [ebp - 0x1b0]
call fcn.10016499
mov dword [ebp - 4], 0xb
or eax, 0xffffffff
mov dword [ebp - 0x48], 0x249aaed6
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002e1bf
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1b0]
call fcn.10016537
mov dword [eax], 0xb7c7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002e1a1
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e1dd
push 0x84c
push 0x1bea
push eax
push 0xdaa
push eax
call edi
xor eax, eax
push eax
lea ecx, [ebp - 0x1b0]
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x1b0]
push eax
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x1b0]
push eax
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x1b0]
push eax
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x1b0]
push eax
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x1b0]
push eax
call fcn.10016537
push ebx
lea ecx, [ebp - 0x1b0]
call fcn.10016537
mov esi, eax
lea ecx, [ebp - 0x1b0]
xor eax, eax
push eax
call fcn.10016537
mov ecx, dword [esi]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x1b0]
cmp dword [ebp - 0x48], 0xfffffffc
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1001651b
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x14], 0xfffffff0
cmp dword [ebp - 0x14], 0xe
jge 0x1002e2a4
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e29b
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xe
jl 0x1002e289
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002e2c2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
push 3
pop esi
push esi
lea ecx, [ebp - 0x204]
call fcn.10016499
mov dword [ebp - 4], 0xc
or eax, 0xffffffff
mov dword [ebp - 0x48], 0x249aaed6
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002e314
push dword [ebp - 0x14]
lea ecx, [ebp - 0x204]
call fcn.10016537
mov dword [eax], 0xb7c7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002e2f6
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e332
push 0x84c
push 0x1bea
push eax
push 0xdaa
push eax
call edi
xor eax, eax
push eax
lea ecx, [ebp - 0x204]
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x204]
push eax
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x204]
push eax
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x204]
push eax
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x204]
push eax
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x204]
push eax
call fcn.10016537
push ebx
lea ecx, [ebp - 0x204]
call fcn.10016537
mov esi, eax
lea ecx, [ebp - 0x204]
xor eax, eax
push eax
call fcn.10016537
mov ecx, dword [esi]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x204]
cmp dword [ebp - 0x48], 0xfffffffc
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1001651b
xor eax, eax
push 3
mov dword [ebp - 0x2c], eax
pop esi
cmp dword [ebp - 0x2c], esi
jge 0x1002e3ed
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x264], 0x31713b91
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002e3d5
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x1002e40d
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x112c], 7
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002e3f5
xor eax, eax
mov dword [ebp - 0x264], 0x17
cmp dword [ebp - 0x264], 0xfffffffa
je 0x1002e50f
or edi, 0xffffffff
jmp 0x1002e42b
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x18], 0xaa43b2b
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], 0x300d
mov eax, dword [ebp - 0x25c]
mov eax, dword [ebp - 0x25c]
cmp eax, 0xfffffffc
mov eax, dword [ebp - 0x18]
setg cl
imul eax, ecx
xor ecx, ecx
imul eax, eax, 0xffff
cmp eax, 0x48abb75d
setne cl
xor ebx, ebx
imul ecx, dword [ebp - 0x18]
imul eax, ecx, 0xbec0
mov ecx, edi
mov dword [ebp - 0x112c], eax
mov eax, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg bl
sub ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
neg ebx
mov eax, dword [ebp - 0x264]
sbb ebx, ebx
inc ebx
sub edx, ebx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x264]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x264]
setle cl
add eax, ecx
mov ecx, dword [ebp - 0x18]
add ecx, eax
xor eax, eax
cmp ecx, dword [ebp - 0x18]
jg 0x1002e4ef
cmp dword [ebp - 0x18], eax
je 0x1002e4ef
mov dword [ebp - 0x40], 0x28464d91
mov dword [ebp - 0x40], 0x76522452
cmp dword [ebp - 0x34], eax
jmp 0x1002e4f2
cmp dword [ebp - 0x40], eax
jne 0x1002e507
dec dword [ebp - 0x264]
cmp dword [ebp - 0x264], 0xfffffffa
jne 0x1002e429
mov edi, dword [sym.imp.USER32.dll_GetMenuStringW]
jmp 0x1002e511
xor eax, eax
mov dword [ebp - 0x14], 0x91a049fe
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e535
push eax
push eax
push eax
push eax
push eax
push eax
push 0x1b5e
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor eax, eax
push 4
mov dword [ebp - 0x14], 0xa
pop ebx
cmp dword [ebp - 0x14], 0x1d
jl 0x1002e631
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002e569
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xd34], 0xfffffffc
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002e551
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1002e58b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x2d0], 0x4768c0aa
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1002e572
xor eax, eax
mov dword [ebp - 0x2d0], eax
jmp 0x1002e61d
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x1002e5cd
mov dword [ebp - 0x28], 0x1b055cc2
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002e5c8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xd34], 0xfc88
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002e5b0
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002e5a1
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x1002e617
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e5f8
push 0x350
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
mov eax, dword [ebp - 0x2d0]
push 0
mov ecx, dword [ebp + eax*4 - 0xd34]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd34], ecx
dec dword [ebp - 0x1c]
pop eax
jns 0x1002e5d5
inc dword [ebp - 0x2d0]
cmp dword [ebp - 0x2d0], esi
jle 0x1002e596
inc dword [ebp - 0x14]
jmp 0x1002e53f
mov dword [ebp - 0x38], 0x82eac453
lea ecx, [ebp - 0x4dc]
push ebx
call fcn.10016499
mov dword [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x18], 0xa32b1cec
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002e67a
push dword [ebp - 0x14]
lea ecx, [ebp - 0x4dc]
call fcn.10016537
mov dword [eax], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002e65c
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_PostMessageA]
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x1002e7af
xor edi, edi
inc edi
mov dword [ebp - 0x20], 0x9f7fd1e8
mov dword [ebp - 0x40], 0xd46758e3
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e6ce
push 0x21da
push eax
push eax
push 0x1a56
push 0x9a0
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1002e778
cmp dword [ebp - 0x20], eax
je 0x1002e717
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x4dc]
neg esi
push edi
sbb esi, esi
neg esi
call fcn.10016537
push 5
pop ecx
cmp ecx, esi
sbb edx, edx
neg edx
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp dword [eax], edx
sete cl
cmp ecx, dword [ebp - 0x20]
jg 0x1002e715
mov esi, edi
jmp 0x1002e719
xor eax, eax
mov esi, eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4dc]
call fcn.10016537
xor ecx, ecx
test esi, esi
sete cl
imul ecx, dword [ebp - 0x18]
mov eax, dword [eax]
sub eax, ecx
jne 0x1002e73f
mov esi, eax
cmp dword [ebp - 0x20], eax
je 0x1002e741
mov esi, edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4dc]
call fcn.10016537
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x40], esi
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002e769
push 0x265d
call dword [sym.imp.USER32.dll_GetSystemMetrics]
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x1002e6da
push 3
pop esi
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1002e7a0
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e79b
push eax
push eax
push 0x20ac
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002e780
dec dword [ebp - 0x18]
jns 0x1002e68f
mov edi, dword [sym.imp.USER32.dll_GetMenuStringW]
push 2
lea ecx, [ebp - 0x4dc]
call fcn.10016537
mov edx, dword [ebp - 0x18]
mov esi, eax
mov ecx, dword [ebp - 0x18]
xor eax, eax
cmp edx, ecx
setne al
imul eax, dword [ebp - 0x18]
imul ecx, eax, 0xffff
or eax, 0xffffffff
mov dword [ebp - 4], eax
mov dword [esi], ecx
lea ecx, [ebp - 0x4dc]
call fcn.1001651b
xor esi, esi
lea ecx, [ebp - 0x788]
inc esi
push esi
call fcn.10016499
mov dword [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002e82d
push dword [ebp - 0x14]
lea ecx, [ebp - 0x788]
call fcn.10016537
mov dword [eax], 0x9f9b3198
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002e80f
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x1002e8b4
mov dword [ebp - 0x14], 0xd13034d0
lea ecx, [ebp - 0x788]
push dword [ebp - 0x28]
call fcn.10016537
push dword [ebp - 0x28]
lea ecx, [ebp - 0x788]
mov esi, eax
call fcn.10016537
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
setne dl
xor eax, eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1002e8af
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e88b
push eax
push eax
push 0x20ac
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002e8aa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1002e870
dec dword [ebp - 0x28]
jns 0x1002e835
or esi, 0xffffffff
lea ecx, [ebp - 0x788]
mov dword [ebp - 4], esi
call fcn.1001651b
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop ebx
jmp 0x1002e8e0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2e8], 0x2c03342e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002e8cf
push ebx
lea ecx, [ebp - 0x2f4]
call fcn.10016499
mov dword [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x48], 0xcb8ce3e
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], 0xcefd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002e934
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2f4]
call fcn.10016537
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002e916
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x2c], eax
inc ebx
cmp dword [ebp - 0x2c], ebx
jg 0x1002e9ea
or edi, 0xffffffff
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2f4]
call fcn.10016537
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2f4]
mov esi, eax
call fcn.10016537
mov ecx, dword [esi]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x2f4]
push dword [ebp - 0x2c]
call fcn.10016537
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp eax, edi
setne cl
sub ecx, 0x3e13
jne 0x1002e99e
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2f4]
call fcn.10016537
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2f4]
call fcn.10016537
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2f4]
call fcn.10016537
mov ecx, dword [ebp - 0x40]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x2f4]
setge dl
mov dword [ebp - 0x44], edx
push dword [ebp - 0x2c]
call fcn.10016537
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1002e946
mov edi, dword [sym.imp.USER32.dll_GetMenuStringW]
or esi, 0xffffffff
lea ecx, [ebp - 0x2f4]
mov dword [ebp - 4], esi
call fcn.1001651b
mov dword [ebp - 0x2e8], 0x1b
jmp 0x1002eaf4
push 3
mov dword [ebp - 0x34], 0xfffffff7
lea ecx, [ebp - 0x890]
pop ebx
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x48], 0x89a9b8fa
mov dword [ebp - 0x40], 4
push ebx
call fcn.10016499
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x40], 0x91920b24
mov dword [ebp - 0x14], eax
jmp 0x1002ea5e
push dword [ebp - 0x14]
lea ecx, [ebp - 0x890]
call fcn.10016537
mov dword [eax], 0x5fb26c4f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002ea47
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], 0xad9b
mov eax, dword [ebp - 0x28]
cmp eax, 0x10e5
mov eax, dword [ebp - 0x34]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setl dl
xor ebx, ebx
cmp edx, eax
setl bl
xor ecx, ecx
imul ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x48]
cmp ebx, eax
setl cl
add ecx, dword [ebp - 0x48]
mov dword [ebp - 0x40], ecx
je 0x1002eaad
mov eax, dword [ebp - 0x34]
xor eax, eax
lea ecx, [ebp - 0x890]
push eax
call fcn.10016537
xor eax, eax
lea ecx, [ebp - 0x890]
push eax
call fcn.10016537
xor ecx, ecx
xor ebx, ebx
inc ebx
cmp dword [eax], ebx
setg cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x890]
mov dword [ebp - 4], esi
call fcn.1001651b
xor eax, eax
cmp dword [ebp - 0x2e4], eax
jne 0x1002eb01
dec dword [ebp - 0x2e8]
cmp dword [ebp - 0x2e8], 0xffffffe7
jl 0x1002ea07
movdqa xmm0, xmmword [0x10008080]
lea eax, [ebp - 0xf4c]
push eax
lea eax, [ebp - 0xf5c]
push eax
lea ecx, [ebp - 0x11d8]
movdqu xmmword [ebp - 0xf5c], xmm0
call fcn.10016546
lea ecx, [ebp - 0x15d]
mov esi, eax
call fcn.100092a3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xac]
push dword [esi]
call fcn.100164f5
mov dword [ebp - 4], 0x11
or eax, 0xffffffff
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x18], 0x8f4727c
mov dword [ebp - 0x1c], eax
xor eax, eax
push 3
mov dword [ebp - 0x34], 0xfffffff7
pop esi
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1002ee79
push 2
lea ecx, [ebp - 0x184]
call fcn.10016499
or eax, 0xffffffff
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002ebbc
push dword [ebp - 0x14]
lea ecx, [ebp - 0x184]
call fcn.10016537
mov dword [eax], 0x8b42
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002eb9d
xor eax, eax
push eax
lea ecx, [ebp - 0x184]
call fcn.10016537
mov esi, eax
lea ecx, [ebp - 0x184]
xor eax, eax
push eax
call fcn.10016537
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x1002ebf5
xor eax, eax
lea ecx, [ebp - 0x184]
push eax
call fcn.10016537
cmp dword [eax], 0
je 0x1002ebf5
mov esi, ebx
jmp 0x1002ebf9
xor eax, eax
mov esi, eax
push 2
lea ecx, [ebp - 0xac]
call fcn.10016537
xor ecx, ecx
push 3
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
cmp esi, eax
pop eax
setl cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xac]
push eax
call fcn.10016537
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x184]
add esi, dword [eax]
xor eax, eax
push eax
call fcn.10016537
push dword [ebp - 0x20]
lea ecx, [ebp - 0xac]
mov edi, dword [eax]
imul edi, esi
call fcn.10016537
push dword [ebp - 0x20]
xor ecx, ecx
cmp edi, dword [eax]
mov eax, 0xe85ec415
sete cl
cmp eax, ecx
lea ecx, [ebp - 0xac]
sbb eax, eax
inc eax
cmp ebx, eax
sbb esi, esi
neg esi
call fcn.10016537
push dword [ebp - 0x20]
xor ebx, ebx
lea ecx, [ebp - 0xac]
cmp esi, dword [eax]
setl bl
call fcn.10016537
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax]
sub eax, 0xcacf
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, ebx
lea ecx, [ebp - 0xac]
setne al
mov dword [ebp - 0x34], eax
push dword [ebp - 0x20]
call fcn.10016537
mov ecx, dword [ebp - 0x34]
mov eax, dword [eax]
sub eax, ecx
je 0x1002ecd3
xor ebx, ebx
lea ecx, [ebp - 0x184]
inc ebx
push ebx
call fcn.10016537
cmp dword [eax], 0
je 0x1002ecd3
mov esi, ebx
xor eax, eax
jmp 0x1002ecd7
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xac]
call fcn.10016537
xor ebx, ebx
lea ecx, [ebp - 0xac]
push 2
cmp esi, dword [eax]
sete bl
call fcn.10016537
xor ecx, ecx
push 3
pop esi
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x20]
setl cl
imul eax, ecx
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1002ee58
mov dword [ebp - 0x40], 0xbb31cf6a
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x40], 8
push dword [ebp - 0x20]
call fcn.10016537
lea ecx, [ebp - 0xac]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x20]
call fcn.10016537
push dword [ebp - 0x20]
lea ecx, [ebp - 0xac]
call fcn.10016537
mov ecx, dword [ebp - 0x18]
or edx, 0xffffffff
sub edx, ecx
xor ebx, ebx
lea ecx, [ebp - 0x184]
cmp edx, dword [eax]
setge bl
xor eax, eax
push eax
call fcn.10016537
mov eax, dword [eax]
add eax, ebx
je 0x1002ed8c
push dword [ebp - 0x20]
lea ecx, [ebp - 0xac]
call fcn.10016537
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002ed9d
cmp dword [ebp - 0x1c], eax
jne 0x1002ed9d
xor ebx, ebx
inc ebx
jmp 0x1002eda2
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1002ee4a
push 3
pop ebx
mov dword [ebp - 0x48], 0x874340ca
lea ecx, [ebp - 0x184]
push dword [ebp - 0x18]
call fcn.10016537
push dword [ebp - 0x20]
lea ecx, [ebp - 0xac]
mov esi, eax
call fcn.10016537
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x1002eded
push ebx
lea ecx, [ebp - 0xac]
call fcn.10016537
push dword [ebp - 0x20]
lea ecx, [ebp - 0xac]
call fcn.10016537
push dword [ebp - 0x18]
lea ecx, [ebp - 0x184]
call fcn.10016537
lea ecx, [ebp - 0x184]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x18]
call fcn.10016537
mov ecx, dword [ebp - 0x24]
mov edx, dword [eax]
mov eax, dword [ebp - 0x48]
sub edx, ecx
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0x923b
setg al
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x18]
jns 0x1002edb6
xor ebx, ebx
push 3
inc ebx
pop esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002ed18
jmp 0x1002ee5b
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 0x11
call fcn.1001651b
dec dword [ebp - 0x20]
jns 0x1002eb7b
mov edi, dword [sym.imp.USER32.dll_GetMenuStringW]
or eax, 0xffffffff
lea ecx, [ebp - 0xac]
mov dword [ebp - 4], eax
call fcn.1001651b
push 4
lea ecx, [ebp - 0x434]
call fcn.10016499
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x20], ebx
push 5
pop eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], 0x8b35edad
mov dword [ebp - 0x24], 0x1d102278
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x34], 0x6729694d
mov dword [ebp - 0x3c], 0xdb821342
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002eefe
push dword [ebp - 0x14]
lea ecx, [ebp - 0x434]
call fcn.10016537
mov dword [eax], 0xe48d327c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002eedf
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1002efae
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x434]
push dword [ebp - 0x20]
call fcn.10016537
push dword [ebp - 0x20]
lea ecx, [ebp - 0x434]
mov esi, eax
call fcn.10016537
mov esi, dword [esi]
lea ecx, [ebp - 0x434]
push dword [ebp - 0x20]
imul esi, dword [eax]
call fcn.10016537
mov ecx, dword [ebp - 0x20]
xor edx, edx
push dword [ebp - 0x20]
cmp esi, ecx
lea ecx, [ebp - 0x434]
sete dl
xor ebx, ebx
cmp dword [eax], edx
sete bl
call fcn.10016537
xor ecx, ecx
push 3
pop esi
cmp dword [eax], ebx
setne cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], eax
jmp 0x1002ef96
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ef93
push 0x49a
push 0xdb6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x1002ef71
dec dword [ebp - 0x20]
jns 0x1002ef0a
xor ebx, ebx
xor eax, eax
inc ebx
cmp dword [ebp - 0x20], eax
je 0x1002f00a
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2c], eax
jne 0x1002efd1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x48]
jne 0x1002eff2
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002eff4
mov eax, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002f008
mov eax, ebx
jmp 0x1002f00a
xor eax, eax
cmp eax, dword [ebp - 0x28]
jge 0x1002f012
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x3c]
lea ecx, [ebp - 0x434]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
push 2
pop esi
push esi
call fcn.10016537
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x434]
setge dl
or eax, 0xffffffff
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
call fcn.1001651b
xor eax, eax
mov byte [ebp - 0x49], al
mov dword [ebp - 0x38], 0xde0bcd8c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002f067
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f0a1
push eax
push 0xc86
push 0xbf7
push 0x8fd
push 0xa2d
push 0xc72
push 0x1f4a
push 0x210a
push 0x268c
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp byte [ebp - 0x49], 0
je 0x1002f1d6
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0xa04]
push 5
mov dword [ebp - 0x18], 0x2a90
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], 0x19b8
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x48], 0xfffffffa
mov dword [ebp - 0x44], 0x8afb1cad
push esi
call fcn.10016499
xor eax, eax
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002f110
mov ebx, 0xffff
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa04]
call fcn.10016537
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002f0f5
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp ecx, eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x40], ecx
jne 0x1002f14e
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002f150
mov eax, ebx
mov edx, dword [ebp - 0x18]
xor ecx, ecx
add edx, eax
mov eax, dword [ebp - 0x18]
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, 0x1fe90568
jge 0x1002f187
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002f189
mov eax, ebx
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0xa04]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
push ebx
call fcn.10016537
mov edx, dword [ebp - 0x18]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0xc245
setge cl
or esi, 0xffffffff
mov dword [eax], ecx
lea ecx, [ebp - 0xa04]
mov dword [ebp - 4], esi
call fcn.1001651b
xor eax, eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x1002f1d9
or esi, 0xffffffff
push 4
lea ecx, [ebp - 0x8a8]
call fcn.10016499
mov dword [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x44], 0xaf066b7a
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002f227
push dword [ebp - 0x14]
lea ecx, [ebp - 0x8a8]
call fcn.10016537
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002f20c
xor eax, eax
mov esi, dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x1c], eax
push 3
pop eax
cmp dword [ebp - 0x1c], eax
jg 0x1002f432
or edi, 0xffffffff
push 4
lea ecx, [ebp - 0x21c]
call fcn.10016499
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xc48]
mov dword [ebp - 0x38], 0x39ab1b57
push ebx
call fcn.10016499
mov byte [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1002f294
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x21c]
call fcn.10016537
mov dword [eax], 0xcce1e2c0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1002f275
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002f2ac
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc48]
call fcn.10016537
mov dword [eax], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002f299
push ebx
lea ecx, [ebp - 0x21c]
call fcn.10016537
mov dword [eax], 3
jmp 0x1002f3ee
mov dword [ebp - 0x40], 0xfffffffc
lea ecx, [ebp - 0x8a8]
mov dword [ebp - 0x48], 0x8e2294b
mov dword [ebp - 0x38], 0x3265c9e2
mov eax, dword [ebp - 0x1c]
push 2
call fcn.10016537
mov ecx, dword [ebp - 0x40]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x21c]
setle bl
xor edi, edi
inc edi
push edi
call fcn.10016537
xor ecx, ecx
cmp ebx, dword [eax]
setne cl
cmp ecx, 0x1bf07968
jne 0x1002f321
push edi
lea ecx, [ebp - 0x21c]
call fcn.10016537
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x21c]
push edi
call fcn.10016537
lea ecx, [ebp - 0x8a8]
push dword [eax]
call fcn.10016537
mov ecx, dword [ebp - 0x48]
xor edx, edx
cmp ecx, edi
setg dl
xor ebx, ebx
cmp dword [eax], edx
mov eax, dword [ebp - 0x44]
setne bl
xor ecx, ecx
cmp ebx, eax
setne cl
add ecx, 0x6c89
je 0x1002f3cc
push 3
pop ebx
push ebx
lea ecx, [ebp - 0xef4]
call fcn.10016499
or edi, 0xffffffff
mov byte [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x14], eax
jmp 0x1002f397
push dword [ebp - 0x14]
lea ecx, [ebp - 0xef4]
call fcn.10016537
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002f380
xor ebx, ebx
lea ecx, [ebp - 0x21c]
inc ebx
push ebx
call fcn.10016537
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
test eax, eax
setns cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xef4]
mov dword [ebp - 0x40], edi
mov byte [ebp - 4], 0x17
call fcn.1001651b
jmp 0x1002f3e0
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002f3da
push eax
push eax
call esi
xor ebx, ebx
inc ebx
or edi, 0xffffffff
push ebx
lea ecx, [ebp - 0x21c]
call fcn.10016537
dec dword [eax]
push ebx
lea ecx, [ebp - 0x21c]
call fcn.10016537
cmp dword [eax], 0
jge 0x1002f2c8
lea ecx, [ebp - 0xc48]
call fcn.1001651b
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0x15
call fcn.1001651b
inc dword [ebp - 0x1c]
push 3
pop eax
cmp dword [ebp - 0x1c], eax
jle 0x1002f23f
mov edi, dword [sym.imp.USER32.dll_GetMenuStringW]
or eax, 0xffffffff
lea ecx, [ebp - 0x8a8]
mov dword [ebp - 4], eax
call fcn.1001651b
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x14], 0xfffffff0
cmp dword [ebp - 0x14], 0xe
jge 0x1002f474
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f46b
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xe
jl 0x1002f459
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002f496
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
xor eax, eax
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x14], 0xfffffff0
jmp 0x1002f4b8
cmp byte [ebp - 0xd], 0
je 0x1002f4b5
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xe
mov byte [ebp - 0xd], al
jl 0x1002f4a6
cmp byte [ebp - 0xd], 0
je 0x1002f4d9
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
xor eax, eax
mov dword [ebp - 0x34], 0x62ee6d05
or edx, 0xffffffff
mov dword [ebp - 0x28], edx
xor ecx, ecx
mov dword [ebp - 0x38], 4
inc ecx
mov dword [ebp - 0x38], 0x9f8d19c9
mov dword [ebp - 0x3c], 0xbacde9e8
mov dword [ebp - 0x30], 0xe19e95d1
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], 0x78acc4b7
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 4
cmp dword [ebp - 0x34], eax
je 0x1002f586
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setle dl
add edx, 0x3b15a8df
neg edx
sbb edx, edx
neg edx
cmp edx, dword [ebp - 0x40]
jg 0x1002f542
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x48]
add ecx, 0x12c5
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl cl
dec dword [ebp - 0x24]
cmp eax, ecx
jl 0x1002f576
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x1002f57b
xor ecx, ecx
xor eax, eax
inc ecx
cmp eax, dword [ebp - 0x30]
jne 0x1002f584
mov eax, ecx
jmp 0x1002f586
xor eax, eax
xor edx, edx
cmp eax, 0xfffffff9
mov eax, dword [ebp - 0x44]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x3c]
push 3
setle cl
imul eax, ecx
xor ecx, ecx
cmp eax, 0x10cbedfa
pop eax
setl cl
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x974]
push eax
call fcn.10016499
xor eax, eax
mov dword [ebp - 4], 0x19
inc eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002f5fc
push 3
pop edi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x974]
call fcn.10016537
mov dword [eax], 0x4778
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002f5d8
mov edi, dword [sym.imp.USER32.dll_GetMenuStringW]
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x1002f623
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x974]
call fcn.10016537
cmp dword [eax], 0
jne 0x1002f621
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jle 0x1002f605
xor eax, eax
mov dword [ebp - 0x2c], 0xffffffed
jmp 0x1002f64d
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f64a
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x16
je 0x1002f62c
or eax, 0xffffffff
lea ecx, [ebp - 0x974]
mov dword [ebp - 4], eax
call fcn.1001651b
push 4
lea ecx, [ebp - 0x8c0]
call fcn.10016499
mov dword [ebp - 4], 0x1a
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x44], 0xaf066b7a
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002f6bb
or ebx, 0xffffffff
push dword [ebp - 0x14]
lea ecx, [ebp - 0x8c0]
call fcn.10016537
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002f69d
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x1c], eax
push 3
pop eax
cmp dword [ebp - 0x1c], eax
jg 0x1002f8c0
or edi, 0xffffffff
push 4
lea ecx, [ebp - 0x294]
call fcn.10016499
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xc60]
mov dword [ebp - 0x38], 0x39ab1b57
push ebx
call fcn.10016499
mov byte [ebp - 4], 0x1c
xor eax, eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1002f722
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x294]
call fcn.10016537
mov dword [eax], 0xcce1e2c0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1002f703
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002f73a
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc60]
call fcn.10016537
mov dword [eax], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002f727
push ebx
lea ecx, [ebp - 0x294]
call fcn.10016537
mov dword [eax], 3
jmp 0x1002f87c
or eax, 0xffffffff
lea ecx, [ebp - 0x8c0]
mov dword [ebp - 4], eax
call fcn.1001651b
xor eax, eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x54], eax
jmp 0x1002f9db
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], eax
jmp 0x1002f9ce
cmp dword [ebp - 0x3c], 0xffffffe7
jge 0x1002f8e9
cmp dword [ebp - 0x54], 0xfffffffb
jge 0x1002f8de
push 4
lea ecx, [ebp - 0x89c]
call fcn.10016499
mov dword [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x44], 0xaf066b7a
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002fa39
or ebx, 0xffffffff
push dword [ebp - 0x14]
lea ecx, [ebp - 0x89c]
call fcn.10016537
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002fa1b
mov dword [ebp - 0x1c], eax
push 3
pop eax
cmp dword [ebp - 0x1c], eax
jg 0x1002fc3e