Function at 0x10031fc1
Capabilities:
Accept command line arguments
Delete file
Get common file path
Get disk information
Get session user name
Log keystrokes via polling

Disassembly:
mov eax, 0x10068672
call fcn.10067358
sub esp, 0x854
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x48], ecx
push edi
inc ebx
mov byte [ebp - 0x49], dl
push ebx
lea ecx, [ebp - 0x3f4]
call fcn.1002b976
xor edx, edx
push 0xfffffffffffffffd
mov dword [ebp - 0x14], edx
pop esi
jmp 0x10032002
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3f4]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10031ff3
push 3
mov dword [ebp - 0x14], edx
pop edi
jmp 0x1003201c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x194], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003200f
mov dword [ebp - 0x18c], edx
jmp 0x10032042
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x3f4]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x18c]
cmp dword [ebp - 0x18c], ebx
jl 0x10032029
lea ecx, [ebp - 0x3f4]
call fcn.1002c9a6
push ebx
lea ecx, [ebp - 0x400]
call fcn.1002b976
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x10032077
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x400]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10032068
mov dword [ebp - 0x14], edx
jmp 0x1003208e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1a0], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10032081
mov dword [ebp - 0x198], edx
jmp 0x100320b4
mov ecx, dword [ebp - 0x198]
mov eax, dword [ebp - 0x400]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x198]
cmp dword [ebp - 0x198], ebx
jl 0x1003209b
lea ecx, [ebp - 0x400]
call fcn.1002c9a6
push ebx
lea ecx, [ebp - 0x328]
call fcn.1002b976
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x14], edx
jmp 0x100320ee
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x624], 0x7862
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100320dd
mov dword [ebp - 0x14], edx
jmp 0x10032108
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x328]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100320f9
mov eax, dword [ebp - 0x328]
or esi, 0xffffffff
mov dword [eax], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], edx
jl 0x10032151
xor ebx, ebx
mov dword [ebp - 0x3c], 0x1151c3c3
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], bl
je 0x10032140
push 0x130
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0x3c], 0xfffffffb
dec dword [ebp - 0x1c]
jns 0x10032125
xor ebx, ebx
inc ebx
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x328]
dec dword [eax]
jns 0x10032118
mov dword [ebp - 0x28], edx
jmp 0x10032186
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], edx
jl 0x10032183
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x624], edx
jne 0x10032183
dec dword [ebp - 0x1c]
jns 0x10032172
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x10032163
lea ecx, [ebp - 0x328]
call fcn.1002c9a6
xor ecx, ecx
mov dword [ebp - 0x14], 0x77e8edf1
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x1c], ecx
jmp 0x100321b4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10c], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100321a7
cmp dword [ebp - 0x14], ecx
je 0x10032272
movdqa xmm0, xmmword [0x1000ad60]
lea ecx, [ebp - 0x6b4]
push ecx
lea eax, [ebp - 0x6a4]
push eax
push ecx
lea ecx, [ebp - 0x710]
movdqu xmmword [ebp - 0x6b4], xmm0
call fcn.1002ba27
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1003220e
push 0x15f3
push 0x1016
push eax
push 0xa13
call dword [sym.imp.USER32.dll_DrawFrameControl]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 7
jle 0x10032262
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], bl
je 0x10032234
push 0x82b
push 0x13fc
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], ebx
jl 0x10032256
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], bl
je 0x10032251
push ebx
push 0x3c6
push ebx
call dword [sym.imp.GDI32.dll_GetRegionData]
dec dword [ebp - 0x10]
jns 0x1003223c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 7
jg 0x10032219
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x710]
call fcn.1002c9a6
jmp 0x100323cf
mov dword [ebp - 0x20], esi
xor edx, edx
mov dword [ebp - 0x30], 0xfffffffc
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
sub ecx, 5
cmp ecx, eax
setge dl
xor ecx, ecx
imul edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x20], eax
jmp 0x100323c5
mov dword [ebp - 0x24], eax
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp + eax*4 - 0x10c]
mov eax, dword [ebp - 0x20]
imul edx, dword [ebp + eax*4 - 0x10c]
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setne cl
test ecx, ecx
jne 0x100322e3
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x100322e5
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, 0x6bcfb656
setg dl
sub edx, 0xe07a
neg edx
sbb edx, edx
inc edx
cmp edx, dword [ebp + eax*4 - 0x10c]
je 0x1003231b
cmp dword [ebp - 0x40], 0
je 0x1003231b
mov eax, ebx
jmp 0x1003231d
xor eax, eax
mov ecx, 0xd5d51814
cmp ecx, eax
sbb ecx, ecx
xor eax, eax
inc ecx
add ecx, dword [ebp - 0x40]
neg ecx
cmp ecx, 0x2a60
setge al
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
neg ecx
cmp ecx, 0x3993911e
setle dl
xor ecx, ecx
add edx, dword [ebp + eax*4 - 0x10c]
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x20]
setg cl
mov dword [ebp + eax*4 - 0x10c], ecx
mov dword [ebp - 0x24], 0xfffffff5
jmp 0x100323b9
mov dword [ebp - 0x14], 0
jmp 0x100323b1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x10c], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100323a0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x3a
jne 0x10032397
inc dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], 2
jle 0x100322b0
mov dword [ebp - 0x2c], 9
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0x2c], 0xc7730f94
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0xfffffff6
push ebx
call fcn.1002b976
mov dword [ebp - 0x2c], 0x85ca
xor edx, edx
mov dword [ebp - 0x2c], 0x6e523240
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x20], edx
jmp 0x10032418
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x7a8], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1003240b
mov dword [ebp - 0x20], edx
jmp 0x10032431
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5b4]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10032422
mov dword [ebp - 0x20], edx
jmp 0x10032448
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x7b4], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1003243b
mov byte [ebp - 0x31], dl
cmp byte [ebp - 0x31], dl
je 0x10032460
push 0x1fd4
call dword [sym.imp.KERNEL32.dll_TlsFree]
inc dword [ebp - 0x40]
lea ecx, [ebp - 0x5b4]
call fcn.1002c9a6
push ebx
lea ecx, [ebp - 0x430]
call fcn.1002b976
and dword [ebp - 4], 0
lea ecx, [ebp - 0x508]
push ebx
call fcn.1002b976
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x100324a4
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x508]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10032491
mov dword [ebp - 0x14], edx
jmp 0x100324bb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x164], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100324ae
mov dword [ebp - 0x15c], edx
jmp 0x100324e1
mov ecx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x508]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x15c]
cmp dword [ebp - 0x15c], ebx
jl 0x100324c8
lea ecx, [ebp - 0x508]
call fcn.1002c9a6
mov dword [ebp - 0x30], 0x6e83
lea ecx, [ebp - 0x4a8]
mov dword [ebp - 0x10], 0x38b6b0e1
push ebx
call fcn.1002b976
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x1c], 0x465c
push ebx
call fcn.1002b976
mov byte [ebp - 4], 2
mov dword [ebp - 0x28], 0x1aa2
mov dword [ebp - 0x3c], 0x1733
cmp dword [ebp - 0x3c], 0x778
jge 0x100325e1
lea eax, [ebp - 0xfc]
mov ecx, 0x10659d70
push eax
call fcn.1002afe3
mov edi, dword [ebp - 0xfc]
mov eax, edi
and dword [ebp - 0x40], 0
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x3c], eax
mov esi, eax
test edi, edi
jle 0x100325de
lea ecx, [esi + esi]
sub edi, ecx
test esi, esi
jle 0x10032588
mov ebx, esi
mov dl, 0x2a
mov ecx, 0x10659cb8
call fcn.10030517
dec ebx
jne 0x10032579
test edi, edi
jle 0x1003259d
mov ebx, edi
mov dl, 0x44
mov ecx, 0x10659cb8
call fcn.10030517
dec ebx
jne 0x1003258e
test esi, esi
jle 0x100325b2
mov ebx, esi
mov dl, 0x2a
mov ecx, 0x10659cb8
call fcn.10030517
dec ebx
jne 0x100325a3
push 0x10659cb8
call fcn.1003046c
mov eax, dword [ebp - 0x40]
pop ecx
cmp eax, dword [ebp - 0x3c]
jge 0x100325cb
dec esi
add edi, 2
jmp 0x100325cf
inc esi
sub edi, 2
inc eax
mov dword [ebp - 0x40], eax
cmp eax, dword [ebp - 0xfc]
jl 0x10032573
xor ebx, ebx
inc ebx
push 3
pop edi
push ebx
lea ecx, [ebp - 0x418]
call fcn.1002b976
xor edx, edx
mov dword [ebp - 0x40], 0xd3b
mov dword [ebp - 0x20], edx
jmp 0x1003260e
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4a8]
mov dword [eax + ecx*4], 0x2bf33880
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x100325fb
mov dword [ebp - 0x20], edx
jmp 0x1003262b
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2b0]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10032618
mov dword [ebp - 0x20], edx
jmp 0x10032648
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x418]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10032635
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2b0]
mov edx, dword [ebp - 0x30]
mov esi, dword [eax]
mov eax, dword [ebp - 0x2b0]
lea ecx, [esi - 1]
mov dword [eax], ecx
cmp esi, edx
jg 0x1003266e
mov esi, ebx
jmp 0x10032670
xor esi, esi
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setne dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setge bl
neg esi
xor ecx, ecx
cmp esi, eax
setg cl
xor eax, eax
cmp ecx, ebx
setne al
sub eax, 0x5327
imul eax, dword [ebp - 0x10]
cmp eax, 0x2a2c7a2e
jge 0x100326c2
mov eax, dword [ebp - 0x418]
xor ecx, ecx
cmp dword [eax], ecx
jne 0x100326c2
cmp dword [ebp - 0x40], ecx
jne 0x100326c2
xor ebx, ebx
mov edx, ecx
inc ebx
jmp 0x100326c7
xor ebx, ebx
inc ebx
mov edx, ebx
mov eax, dword [ebp - 0x4a8]
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x40]
sete cl
sub ecx, eax
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x418]
call fcn.1002c9a6
lea ecx, [ebp - 0x2b0]
call fcn.1002c9a6
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 0
call fcn.1002c9a6
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x1003271b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x430]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10032708
mov dword [ebp - 0x14], edx
jmp 0x10032732
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x14c], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10032725
mov dword [ebp - 0x14], 0x565e08cc
lea ecx, [ebp - 0x25c]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], 0x1c587c7a
push 4
mov dword [ebp - 0x28], 0xf928d9ba
pop esi
mov dword [ebp - 0x38], 0xa01c77dc
mov dword [ebp - 0x40], 0x3997b09b
mov dword [ebp - 0x40], 0x1fcc8af9
push esi
call fcn.1002b976
xor edx, edx
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x1c], edx
jmp 0x10032790
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x25c]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10032781
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], edx
je 0x1003279f
mov edx, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x28]
jne 0x100327b1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x100327c3
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp eax, 0xf576
setle cl
imul edx, ecx
test edx, edx
je 0x100327f7
cmp dword [ebp - 0x28], 0
je 0x100327f7
mov ecx, ebx
jmp 0x100327f9
xor ecx, ecx
xor eax, eax
cmp ecx, ebx
push 0xfffffffffffffffb
sete al
xor edx, edx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x25c]
setne dl
mov dword [eax + 0xc], edx
pop eax
sub eax, edx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 0xfffffff7
jmp 0x1003284a
mov dword [ebp - 0x24], 0
jmp 0x10032842
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x25c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10032833
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe3
jle 0x1003282a
lea ecx, [ebp - 0x25c]
call fcn.1002c9a6
mov dword [ebp - 0x144], 0
jmp 0x10032996
mov dword [ebp - 0x1c], 0xa860
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x28], 0xc4ab274b
push ebx
call fcn.1002b976
mov dword [ebp - 0x38], 0xfc4f27d2
xor edx, edx
mov dword [ebp - 0x10], 0xffff
mov dword [ebp - 0x40], 0xa1434a93
mov dword [ebp - 0x3c], 0xabac
mov dword [ebp - 0x1c], edx
jmp 0x100328ba
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x370]
mov dword [eax + ecx*4], 0x2086bd08
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100328a7
mov dword [ebp - 0x1c], 0xfffffffa
cmp dword [ebp - 0x1c], edx
je 0x100328ed
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x370]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp edx, ecx
je 0x100328eb
mov eax, ebx
jmp 0x100328ef
xor edx, edx
mov eax, edx
mov dword [ebp - 0x40], eax
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
test eax, eax
sets cl
xor eax, eax
cmp ecx, 0x25ec
setge al
cmp eax, 0xfffffffe
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setl dl
imul edx, dword [ebp - 0x10]
test edx, edx
jne 0x10032934
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x40], eax
je 0x10032936
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
sub ecx, dword [ebp - 0x3c]
sub ecx, 0x8bb12d8
je 0x10032959
mov eax, dword [ebp - 0x370]
mov ecx, ebx
cmp dword [eax], edx
jne 0x1003295b
mov ecx, edx
mov eax, dword [ebp - 0x38]
imul eax, ecx
lea ecx, [ebp - 0x370]
add eax, dword [ebp - 0x1c]
dec dword [ebp - 0x38]
cmp eax, 9
mov eax, ebx
cmovne eax, edx
mov dword [ebp - 0x28], eax
call fcn.1002c9a6
mov ecx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x430]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x144]
cmp dword [ebp - 0x144], ebx
jl 0x1003286a
or eax, 0xffffffff
lea ecx, [ebp - 0x430]
mov dword [ebp - 4], eax
call fcn.1002c9a6
push ebx
lea ecx, [ebp - 0x2c8]
call fcn.1002b976
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x14], edx
jmp 0x100329da
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5a8], 0x7862
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100329c9
mov dword [ebp - 0x14], edx
jmp 0x100329f4
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c8]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100329e5
mov eax, dword [ebp - 0x2c8]
mov dword [eax], ebx
or eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], edx
jl 0x10032a3d
xor ebx, ebx
mov dword [ebp - 0x3c], 0x1151c3c3
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], bl
je 0x10032a2c
push 0x130
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0x3c], 0xfffffffb
dec dword [ebp - 0x1c]
jns 0x10032a11
xor ebx, ebx
inc ebx
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c8]
dec dword [eax]
jns 0x10032a01
mov dword [ebp - 0x28], edx
jmp 0x10032a72
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], edx
jl 0x10032a6f
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x5a8], edx
jne 0x10032a6f
dec dword [ebp - 0x1c]
jns 0x10032a5e
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x10032a4f
lea ecx, [ebp - 0x2c8]
call fcn.1002c9a6
movdqa xmm0, xmmword [0x1000ada0]
lea ecx, [ebp - 0x6f4]
push ecx
lea eax, [ebp - 0x6e4]
push eax
push ecx
lea ecx, [ebp - 0x74c]
movdqu xmmword [ebp - 0x6f4], xmm0
call fcn.1002ba27
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x1c], 0xfffffff6
push ebx
call fcn.1002b976
xor edx, edx
mov dword [ebp - 0x1c], edx
jmp 0x10032adc
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x558]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10032ac9
mov dword [ebp - 0x1c], edx
jmp 0x10032af5
mov dword [ebp - 0x3c], 0xfffffffc
cmp dword [ebp - 0x3c], edx
jne 0x10032afa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x10032ae6
lea ecx, [ebp - 0x558]
call fcn.1002c9a6
or eax, 0xffffffff
lea ecx, [ebp - 0x74c]
mov dword [ebp - 4], eax
call fcn.1002c9a6
mov dword [ebp - 0x14], 0x565e08cc
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0x1c587c7a
mov dword [ebp - 0x28], 0xf928d9ba
mov dword [ebp - 0x38], 0xa01c77dc
mov dword [ebp - 0x40], 0x3997b09b
mov dword [ebp - 0x40], 0x1fcc8af9
push esi
call fcn.1002b976
xor edx, edx
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x1c], edx
jmp 0x10032b70
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x340]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10032b61
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], edx
je 0x10032b7f
mov edx, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x28]
jne 0x10032b91
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x10032ba3
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp eax, 0xf576
setle cl
imul edx, ecx
test edx, edx
je 0x10032bd7