Function at 0x1002df3d
Capabilities:
Capture screenshot
Check os version
Create directory
Create process on windows
Delete directory
Extract resource via kernel32 functions
Get file system object information
Get graphical window text
Get system information on windows
Identify system language via api
Log keystrokes via polling
Modify service
Parse pe header
Query or enumerate registry key
Read .ini file
Resume thread
Set registry value
Start service

Disassembly:
mov eax, 0x10079bca
call fcn.10078350
mov eax, 0x1734
call fcn.10074b00
push ebx
push esi
push edi
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x94]
push 2
mov byte [ebp - 0x71], dl
call fcn.100170ca
xor eax, eax
xor edi, edi
mov dword [ebp - 4], eax
inc edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002df8f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x60], 0x40d7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002df7a
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002dfb7
push dword [ebp - 0x18]
lea ecx, [ebp - 0x94]
call fcn.10017168
mov dword [eax], 0xfe7d8a87
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002df98
xor eax, eax
push eax
lea ecx, [ebp - 0x94]
call fcn.10017168
xor ebx, ebx
mov dword [eax], ebx
jmp 0x1002e0af
mov dword [ebp - 0x1c], 0x5b3b9da4
xor eax, eax
mov dword [ebp - 0x44], 0xf4f88039
mov dword [ebp - 0x3c], 0x45cb81ec
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1002e082
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x94]
neg esi
push eax
sbb esi, esi
neg esi
call fcn.10017168
xor ecx, ecx
cmp esi, dword [eax]
setg cl
xor ebx, ebx
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x94]
push ebx
call fcn.10017168
xor ecx, ecx
push ebx
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x44]
cmp eax, 0x1a9c
setle cl
add esi, ecx
lea ecx, [ebp - 0x94]
call fcn.10017168
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x60]
cmp eax, esi
sete cl
xor eax, eax
cmp ecx, 0xd621
jne 0x1002e05b
cmp dword [ebp - 0x1c], eax
je 0x1002e05b
mov eax, edi
xor ebx, ebx
mov dword [ebp - 0x3c], eax
push ebx
lea ecx, [ebp - 0x94]
call fcn.10017168
push ebx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x60]
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], ebx
jle 0x1002dfef
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002e09f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x60], 0x14af
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002e08a
xor eax, eax
push eax
lea ecx, [ebp - 0x94]
call fcn.10017168
inc dword [eax]
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x94]
call fcn.10017168
cmp dword [eax], ebx
jle 0x1002dfcc
push ebx
lea ecx, [ebp - 0x94]
call fcn.10017168
cmp dword [eax], ebx
je 0x1002e0e9
push ebx
lea ecx, [ebp - 0x94]
call fcn.10017168
cmp dword [eax], ebx
je 0x1002e0e9
mov esi, edi
xor eax, eax
jmp 0x1002e0ed
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x94]
call fcn.10017168
lea ecx, [esi - 4]
cmp ecx, dword [eax]
jg 0x1002e10b
xor eax, eax
cmp dword [ebp - 0x60], eax
je 0x1002e10d
mov esi, edi
jmp 0x1002e10f
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x94]
call fcn.10017168
xor ebx, ebx
lea ecx, [ebp - 0x94]
push edi
cmp dword [eax], esi
sete bl
call fcn.10017168
mov ecx, dword [ebp - 0x60]
sub ecx, dword [eax]
sub ecx, ebx
xor ebx, ebx
imul esi, ecx, 0xa
lea ecx, [ebp - 0x94]
push ebx
call fcn.10017168
xor ecx, ecx
push ebx
cmp esi, dword [eax]
mov esi, dword [ebp - 0x60]
setl cl
imul esi, ecx
lea ecx, [ebp - 0x94]
call fcn.10017168
mov ecx, dword [ebp - 0x60]
xor edx, edx
cmp esi, ecx
setg dl
inc ebx
cmp edx, dword [eax]
je 0x1002e185
push ebx
lea ecx, [ebp - 0x94]
call fcn.10017168
cmp dword [eax], 0
jne 0x1002e185
xor eax, eax
mov esi, eax
jmp 0x1002e189
mov esi, ebx
xor eax, eax
push eax
lea ecx, [ebp - 0x94]
call fcn.10017168
mov ecx, dword [ebp - 0x60]
xor edx, edx
cmp esi, ecx
sete dl
xor ecx, ecx
cmp edx, dword [eax]
setl cl
xor eax, eax
cmp ecx, 0x5fcb4448
jl 0x1002e1b7
mov esi, eax
cmp dword [ebp - 0x60], eax
je 0x1002e1b9
mov esi, ebx
push eax
lea ecx, [ebp - 0x94]
call fcn.10017168
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x60]
cmp esi, eax
mov eax, dword [ebp - 0x60]
setg dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x60]
cmp edx, eax
setl cl
cmp dword [ebp - 0x60], ecx
jg 0x1002e1fd
xor eax, eax
lea ecx, [ebp - 0x94]
push eax
call fcn.10017168
xor ecx, ecx
cmp dword [eax], ecx
je 0x1002e1ff
mov eax, ebx
jmp 0x1002e201
xor ecx, ecx
mov eax, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x40], eax
je 0x1002e20f
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x94]
call fcn.10017168
mov ecx, dword [ebp - 0x60]
push 3
cmp dword [eax], ecx
jg 0x1002e332
pop esi
mov dword [ebp - 0x20], 0x6722525a
lea ecx, [ebp - 0xafc]
mov dword [ebp - 0x44], 9
push esi
call fcn.100170ca
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002e26b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6ec], 0xe3649e8e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002e253
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002e287
push dword [ebp - 0x18]
lea ecx, [ebp - 0xafc]
call fcn.10017168
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002e270
push ebx
lea ecx, [ebp - 0x94]
call fcn.10017168
mov ecx, dword [ebp - 0x20]
mov esi, eax
xor eax, eax
cmp ecx, 0xf910
mov ecx, dword [ebp - 0x20]
setle al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x94]
setg dl
xor eax, eax
imul edx, dword [esi]
push eax
mov dword [ebp - 0x44], edx
call fcn.10017168
mov ecx, dword [ebp - 0x44]
mov edx, eax
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
lea ecx, [ebp - 0x94]
setge bl
xor eax, eax
sub ebx, dword [edx]
push eax
inc ebx
call fcn.10017168
xor ecx, ecx
push 2
pop esi
cmp ebx, dword [eax]
push esi
setg cl
mov dword [ebp - 0x6ec], ecx
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0xafc]
call fcn.10017168
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x3c]
lea ecx, [ebp - 0xafc]
setge dl
mov dword [eax], edx
call fcn.1001714c
xor ebx, ebx
inc ebx
jmp 0x1002e371
xor eax, eax
mov dword [ebp - 0x3c], 0x4efd0e68
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x1002e352
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1464], 0x580973f9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002e341
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x94]
push ebx
mov dword [ebp - 0x1464], ebx
call fcn.10017168
push 2
pop esi
mov dword [eax], ebx
or eax, 0xffffffff
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], eax
call fcn.1001714c
push esi
lea ecx, [ebp - 0xa0]
call fcn.100170ca
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002e3b3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x68], 0x40d7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002e39e
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002e3d9
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa0]
call fcn.10017168
mov dword [eax], 0xfe7d8a87
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002e3bb
xor eax, eax
push eax
lea ecx, [ebp - 0xa0]
call fcn.10017168
xor ecx, ecx
push ecx
mov dword [eax], ecx
jmp 0x1002e4d3
mov dword [ebp - 0x1c], 0x5b3b9da4
xor eax, eax
mov dword [ebp - 0x44], 0xf4f88039
mov dword [ebp - 0x3c], 0x45cb81ec
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1002e4a5
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0xa0]
neg esi
push eax
sbb esi, esi
neg esi
call fcn.10017168
xor ecx, ecx
cmp esi, dword [eax]
setg cl
xor eax, eax
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0xa0]
push eax
call fcn.10017168
xor ecx, ecx
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x44]
cmp eax, 0x1a9c
setle cl
xor eax, eax
add esi, ecx
lea ecx, [ebp - 0xa0]
push eax
call fcn.10017168
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x68]
cmp eax, esi
sete cl
xor eax, eax
cmp ecx, 0xd621
jne 0x1002e480
cmp dword [ebp - 0x1c], eax
je 0x1002e480
mov eax, ebx
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0xa0]
xor eax, eax
push eax
call fcn.10017168
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x68]
inc dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jle 0x1002e412
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002e4c2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x68], 0x14af
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002e4ad
xor eax, eax
push eax
lea ecx, [ebp - 0xa0]
call fcn.10017168
inc dword [eax]
xor eax, eax
push eax
lea ecx, [ebp - 0xa0]
call fcn.10017168
cmp dword [eax], 0
jle 0x1002e3ef
xor eax, eax
lea ecx, [ebp - 0xa0]
push eax
call fcn.10017168
xor ecx, ecx
cmp dword [eax], ecx
je 0x1002e512
push ecx
lea ecx, [ebp - 0xa0]
call fcn.10017168
cmp dword [eax], 0
je 0x1002e512
mov esi, ebx
xor eax, eax
jmp 0x1002e516
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xa0]
call fcn.10017168
lea ecx, [esi - 4]
cmp ecx, dword [eax]
jg 0x1002e534
xor eax, eax
cmp dword [ebp - 0x68], eax
je 0x1002e536
mov esi, ebx
jmp 0x1002e538
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xa0]
call fcn.10017168
xor ebx, ebx
lea ecx, [ebp - 0xa0]
cmp dword [eax], esi
sete bl
xor edi, edi
inc edi
push edi
call fcn.10017168
mov ecx, dword [ebp - 0x68]
sub ecx, ebx
xor ebx, ebx
push ebx
sub ecx, dword [eax]
imul esi, ecx, 0xa
lea ecx, [ebp - 0xa0]
call fcn.10017168
xor ecx, ecx
push ebx
cmp esi, dword [eax]
mov esi, dword [ebp - 0x68]
setl cl
imul esi, ecx
lea ecx, [ebp - 0xa0]
call fcn.10017168
mov ecx, dword [ebp - 0x68]
xor edx, edx
cmp esi, ecx
setg dl
cmp edx, dword [eax]
je 0x1002e5af
push edi
lea ecx, [ebp - 0xa0]
call fcn.10017168
cmp dword [eax], ebx
jne 0x1002e5af
xor eax, eax
mov esi, eax
jmp 0x1002e5b3
mov esi, edi
xor eax, eax
push eax
lea ecx, [ebp - 0xa0]
call fcn.10017168
mov ecx, dword [ebp - 0x68]
xor edx, edx
cmp esi, ecx
sete dl
xor ecx, ecx
cmp edx, dword [eax]
setl cl
xor eax, eax
cmp ecx, 0x5fcb4448
jl 0x1002e5e1
mov esi, eax
cmp dword [ebp - 0x68], eax
je 0x1002e5e3
mov esi, edi
push eax
lea ecx, [ebp - 0xa0]
call fcn.10017168
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x68]
cmp esi, eax
mov eax, dword [ebp - 0x68]
setg dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x68]
cmp edx, eax
setl cl
xor ebx, ebx
cmp dword [ebp - 0x68], ecx
jg 0x1002e623
push ebx
lea ecx, [ebp - 0xa0]
call fcn.10017168
cmp dword [eax], ebx
mov eax, edi
jne 0x1002e625
mov eax, ebx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x40], eax
je 0x1002e633
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0xa0]
push ebx
call fcn.10017168
mov ecx, dword [ebp - 0x68]
push 3
pop ebx
cmp dword [eax], ecx
jg 0x1002e754
mov dword [ebp - 0x20], 0x6722525a
lea ecx, [ebp - 0xb14]
mov dword [ebp - 0x44], 9
push ebx
call fcn.100170ca
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002e68f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7cc], 0xe3649e8e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002e677
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002e6ab
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb14]
call fcn.10017168
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002e694
push edi
lea ecx, [ebp - 0xa0]
call fcn.10017168
mov ecx, dword [ebp - 0x20]
mov esi, eax
xor eax, eax
cmp ecx, 0xf910
mov ecx, dword [ebp - 0x20]
setle al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0xa0]
setg dl
xor eax, eax
imul edx, dword [esi]
push eax
mov dword [ebp - 0x44], edx
call fcn.10017168
mov ecx, dword [ebp - 0x44]
mov edx, eax
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
lea ecx, [ebp - 0xa0]
setge bl
xor eax, eax
sub ebx, dword [edx]
push eax
inc ebx
call fcn.10017168
xor ecx, ecx
push 2
cmp ebx, dword [eax]
setg cl
mov dword [ebp - 0x7cc], ecx
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0xb14]
call fcn.10017168
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x3c]
lea ecx, [ebp - 0xb14]
setge dl
mov dword [eax], edx
call fcn.1001714c
push 3
pop ebx
jmp 0x1002e78f
xor eax, eax
mov dword [ebp - 0x3c], 0x4efd0e68
mov dword [ebp - 0x14], eax
jmp 0x1002e773
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x13ec], 0x580973f9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002e762
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0xa0]
push edi
mov dword [ebp - 0x13ec], edi
call fcn.10017168
mov dword [eax], edi
or esi, 0xffffffff
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], esi
call fcn.1001714c
mov eax, 0xd33a4a9b
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002e7d8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd14], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002e7bf
xor eax, eax
mov dword [ebp - 0xd10], ebx
cmp dword [ebp - 0xd10], eax
jl 0x1002e842
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002e808
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3dc], 0xd8987f2f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002e7ef
xor eax, eax
mov dword [ebp - 0x3dc], eax
jmp 0x1002e832
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002e82c
push 0x1ae2
push 0x1a9c
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
inc dword [ebp - 0x3dc]
cmp dword [ebp - 0x3dc], ebx
jle 0x1002e810
dec dword [ebp - 0xd10]
jns 0x1002e7e6
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x44], 0x348f4a8f
cmp dword [ebp - 0x18], eax
je 0x1002e862
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub edx, eax
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, edx
setl cl
xor eax, eax
cmp dword [ebp - 0x18], ecx
mov byte [ebp - 0x29], al
je 0x1002e8a1
cmp byte [ebp - 0x29], al
je 0x1002e8d8
push eax
push eax
push 0xdd5
push 0x1433
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
jmp 0x1002e8d8
cmp byte [ebp - 0x29], al
je 0x1002e8be
push 0x199a
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002e8d8
push 0x19a0
push 0x13cb
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x728]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x20], 0xfffffffe
push 4
call fcn.100170ca
push 4
pop ecx
xor eax, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002e921
push dword [ebp - 0x14]
lea ecx, [ebp - 0x728]
call fcn.10017168
mov dword [eax], 2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002e902
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 9
jl 0x1002e9ea
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002e9a3
mov dword [ebp - 0x14], 0xf82ff40f
mov dword [ebp - 0x14], eax
jmp 0x1002e981
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002e959
push eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x728]
call fcn.10017168
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x728]
mov esi, eax
call fcn.10017168
mov ecx, dword [esi]
push 0
mov dword [eax], ecx
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], ebx
jle 0x1002e949
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x728]
call fcn.10017168
cmp dword [eax], 0
jne 0x1002e9a1
dec dword [ebp - 0x1c]
push 0
pop eax
jns 0x1002e93d
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffb
jmp 0x1002e9d4
mov dword [ebp - 0x14], 0x35e1f6f0
mov dword [ebp - 0x14], eax
jmp 0x1002e9cc
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002e9c9
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1002e9b8
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff0
jg 0x1002e9ac
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jge 0x1002e92e
or esi, 0xffffffff
lea ecx, [ebp - 0x728]
mov dword [ebp - 4], esi
call fcn.1001714c
push 2
lea ecx, [ebp - 0xb8]
call fcn.100170ca
push ebx
lea ecx, [ebp - 0x4bc]
mov dword [ebp - 4], 5
call fcn.100170ca
mov byte [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x20], 0xe1879501
mov dword [ebp - 0x40], 0xb7f609b2
mov dword [ebp - 0x28], 0x85ea6eda
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x14], eax
jmp 0x1002ea4e
push dword [ebp - 0x14]
lea ecx, [ebp - 0x4bc]
call fcn.10017168
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002ea3b
mov eax, dword [ebp - 0x20]
mov ecx, 0xda22
mov eax, dword [ebp - 0x40]
sub ecx, eax
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x40]
jne 0x1002ea7d
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x20], eax
je 0x1002ea7f
mov edx, edi
mov eax, dword [ebp - 0x40]
neg edx
neg edx
push edi
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, 0x842f88d9
setne cl
cmp eax, ecx
lea ecx, [ebp - 0x4bc]
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
call fcn.10017168
push edi
lea ecx, [ebp - 0x4bc]
mov dword [eax], 0x2135
mov dword [ebp - 0x40], 0xcd4a
call fcn.10017168
mov ecx, dword [ebp - 0x40]
mov edx, edi
sub edx, ecx
xor ecx, ecx
push edi
cmp edx, dword [eax]
setge cl
xor ebx, ebx
add ecx, 0xf95e
cmp ecx, 0xf4c6
lea ecx, [ebp - 0x4bc]
setl bl
call fcn.10017168
lea ecx, [ebx + 0x5a165f5c]
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x4bc]
setl dl
xor ebx, ebx
inc ebx
mov dword [ebp - 0x28], edx
push ebx
call fcn.10017168
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x4bc]
push 2
sub esi, dword [eax]
call fcn.10017168
mov edx, dword [ebp - 0x40]
xor ecx, ecx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x20]
setle cl
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setge cl
test ecx, ecx
jg 0x1002eb42
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002eb44
mov eax, ebx
mov dword [ebp - 0x44], eax
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002eb5e
push eax
push 0x209d
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
lea ecx, [ebp - 0x4bc]
mov byte [ebp - 4], 5
call fcn.1001714c
mov dword [ebp - 0x40], ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], 0x513244d5
mov dword [ebp - 0x3c], 0xa3b2b4b2
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002eba9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcc], 0x6834
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002eb91
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop edi
cmp dword [ebp - 0x18], edi
jge 0x1002ebcc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14ac], 0xc6516eae
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002ebb4
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002ed29
mov dword [ebp - 0x24], 0x9ea9831
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1002ecfc
push ebx
lea ecx, [ebp - 0x974]
call fcn.100170ca
mov byte [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x44], 0x6986
mov dword [ebp - 0x14], eax
jmp 0x1002ec16
push dword [ebp - 0x14]
call fcn.10017168
mov dword [eax], 0x3eb60693
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x974]
cmp dword [ebp - 0x14], ebx
jl 0x1002ec05
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp + eax*4 - 0xcc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xcc]
sub esi, eax
xor eax, eax
push eax
call fcn.10017168
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x1002ece2
xor ecx, ecx
mov dword [ebp - 0x28], 0x702377d6
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x974]
call fcn.10017168
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0xcc]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xcc], ecx
xor eax, eax
cmp ecx, ebx
setle al
cmp eax, ebx
jae 0x1002eca3
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002eca5
mov edx, ebx
jmp 0x1002eca7
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
sub ecx, 0x2efe8e60
cmp ecx, 0xfffffffb
setne al
xor ecx, ecx
cmp eax, dword [ebp - 0x28]
jl 0x1002ecd4
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xcc], ecx
mov eax, ecx
je 0x1002ecd6
mov eax, ebx
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x30]
jns 0x1002ec54
lea ecx, [ebp - 0x974]
mov byte [ebp - 4], 5
call fcn.1001714c
dec dword [ebp - 0x24]
jns 0x1002ebe7
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002ed20
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ed1d
push 0x1ae2
push 0x1a9c
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xa
jl 0x1002ed01
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002ebd4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff6
je 0x1002ed84
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x34], 0xd0d8167e
mov dword [ebp - 0x14a8], ebx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff6
jne 0x1002ed3b
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002ed97
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5c], 0x40d7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002ed89
push 4
pop esi
push esi
lea ecx, [ebp - 0x154]
call fcn.100170ca
mov byte [ebp - 4], 8
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x497a847e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002eded
push dword [ebp - 0x14]
lea ecx, [ebp - 0x154]
call fcn.10017168
mov dword [eax], 0xf57a7c2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002edcf
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffc
lea ecx, [ebp - 0x154]
push eax
call fcn.10017168
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x154]
setle dl
xor eax, eax
mov dword [ebp - 0x20], edx
push eax
call fcn.10017168
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x154]
push edi
call fcn.10017168
xor eax, eax
lea ecx, [ebp - 0x154]
push eax
call fcn.10017168
xor eax, eax
lea ecx, [ebp - 0x154]
push eax
call fcn.10017168
xor eax, eax
lea ecx, [ebp - 0x154]
push eax
call fcn.10017168
mov ecx, dword [ebp - 0x1c]
mov esi, dword [sym.imp.USER32.dll_GetDC]
add ecx, dword [eax]
mov ecx, 0xe3a4c638
je 0x1002eed1
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002ee82
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ef86
push 0x21e4
push 0x190e
push 0xcb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
push 0x563
push 0xae6
push 0x8d4
push 0x1932
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x1002ef86
mov dword [ebp - 0x18], 0xfffffff6
xor eax, eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x14], eax
jmp 0x1002eef3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf18], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002eee2
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add eax, 0x48bb
je 0x1002ef14
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002ef16
mov eax, ebx
jmp 0x1002ef16
xor eax, eax
cmp ecx, eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0x8169c147
mov eax, 0x6dfc9b99
setne dl
xor ecx, ecx
sub edx, 0xf3b0
imul edx, dword [ebp - 0x18]
cmp edx, ebx
setg cl
sub eax, ecx
cmp eax, dword [ebp - 0x24]
jl 0x1002ef45
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x3c], eax
push 3
mov dword [ebp - 0x24], ecx
pop eax
cmp dword [ebp - 0x24], eax
jg 0x1002ef83
mov dword [ebp - 0x44], 5
inc dword [ebp - 0x44]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jg 0x1002ef7e
push 7
pop edx
mov dword [ebp - 0xf14], edx
mov dword [ebp - 0x3c], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x1002ef6d
inc dword [ebp - 0x24]
jmp 0x1002ef53
push 3
pop edi
mov dword [ebp - 0x1c], 0x1b
jmp 0x1002f0df
movdqa xmm0, xmmword [0x10007cc0]
lea eax, [ebp - 0x1278]
push eax
lea eax, [ebp - 0x1288]
mov dword [ebp - 0x28], 0x81b2706
mov dword [ebp - 0x44], 6
lea ecx, [ebp - 0x1508]
push eax
movdqu xmmword [ebp - 0x1288], xmm0
call fcn.10017177
lea ecx, [ebp - 0x222]
mov esi, eax
call fcn.10008bd3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xe50]
push dword [esi]
call fcn.10017126
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x44], 0xfffffffb
cmp dword [ebp - 0x44], eax
je 0x1002f000
mov esi, ebx
cmp dword [ebp - 0x20], eax
jne 0x1002f002
mov esi, eax
push eax
lea ecx, [ebp - 0x154]
call fcn.10017168
xor ecx, ecx
mov eax, dword [eax]
sub eax, esi
cmp eax, 0x6b495482
setge cl
xor eax, eax
cmp ecx, 0x4a3a
setne al
sub eax, 0x7b8a
je 0x1002f039
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002f03b
mov eax, ebx
jmp 0x1002f03b
xor eax, eax
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0xe50]
mov esi, dword [ebp - 0x28]
xor eax, eax
push eax
call fcn.10017168
mov dword [eax], esi
test esi, esi
jne 0x1002f06b
xor eax, eax
lea ecx, [ebp - 0x154]
push eax
call fcn.10017168
cmp dword [eax], esi
jne 0x1002f06b
xor eax, eax
mov ebx, eax
push edi
lea ecx, [ebp - 0x154]
call fcn.10017168
mov ecx, dword [ebp - 0x28]
mov esi, eax
xor eax, eax
cmp ebx, ecx
mov ecx, dword [ebp - 0x28]
setg al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x154]
push 2
setle dl
xor ebx, ebx
cmp edx, dword [esi]
setne bl
add ebx, 0x579ab674
neg ebx
sbb ebx, ebx
inc ebx
call fcn.10017168
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, ebx
lea ecx, [ebp - 0xe50]
setle al
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 8
call fcn.1001714c
dec dword [ebp - 0x1c]
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1002ef92
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 5
call fcn.1001714c
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002f121
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb8]
call fcn.10017168
mov dword [eax], 0xfe7d8a87
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002f102
xor eax, eax
push eax
lea ecx, [ebp - 0xb8]
call fcn.10017168
and dword [eax], 0
jmp 0x1002f216
mov dword [ebp - 0x1c], 0x5b3b9da4
xor eax, eax
mov dword [ebp - 0x44], 0xf4f88039
mov dword [ebp - 0x3c], 0x45cb81ec
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1002f1eb
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0xb8]
neg esi
push eax
sbb esi, esi
neg esi
call fcn.10017168
xor ecx, ecx
cmp esi, dword [eax]
setg cl
xor eax, eax
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0xb8]
push eax
call fcn.10017168
xor ecx, ecx
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 0x44]
cmp eax, 0x1a9c
setle cl
xor eax, eax
add esi, ecx
lea ecx, [ebp - 0xb8]
push eax
call fcn.10017168
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x5c]
cmp eax, esi
sete cl
xor eax, eax
cmp ecx, 0xd621
jne 0x1002f1c6
cmp dword [ebp - 0x1c], eax
je 0x1002f1c6
mov eax, ebx
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0xb8]
xor eax, eax
push eax
call fcn.10017168
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x5c]
inc dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jle 0x1002f158
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002f208
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5c], 0x14af
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002f1f3
xor eax, eax
push eax
lea ecx, [ebp - 0xb8]
call fcn.10017168
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0xb8]
push eax
call fcn.10017168
cmp dword [eax], 0
jle 0x1002f135
xor eax, eax
lea ecx, [ebp - 0xb8]
push eax
call fcn.10017168
cmp dword [eax], 0
je 0x1002f259
xor eax, eax
lea ecx, [ebp - 0xb8]
push eax
call fcn.10017168
cmp dword [eax], 0
je 0x1002f259
mov esi, ebx
xor eax, eax
jmp 0x1002f25d
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xb8]
call fcn.10017168
lea ecx, [esi - 4]
cmp ecx, dword [eax]
jg 0x1002f27b
xor eax, eax
cmp dword [ebp - 0x5c], eax
je 0x1002f27d
mov esi, ebx
jmp 0x1002f27f
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xb8]
call fcn.10017168
xor ebx, ebx
lea ecx, [ebp - 0xb8]
cmp dword [eax], esi
sete bl
xor edx, edx
inc edx
push edx
call fcn.10017168
mov ecx, dword [ebp - 0x5c]
sub ecx, ebx
sub ecx, dword [eax]
xor eax, eax
imul esi, ecx, 0xa
lea ecx, [ebp - 0xb8]
push eax
call fcn.10017168
xor ecx, ecx
cmp esi, dword [eax]
mov esi, dword [ebp - 0x5c]
setl cl
xor eax, eax
imul esi, ecx
lea ecx, [ebp - 0xb8]
push eax
call fcn.10017168
mov ecx, dword [ebp - 0x5c]
xor edx, edx
cmp esi, ecx
setg dl
xor ebx, ebx
inc ebx
cmp edx, dword [eax]
je 0x1002f2fc
push ebx
lea ecx, [ebp - 0xb8]
call fcn.10017168
cmp dword [eax], 0
jne 0x1002f2fc
xor eax, eax
mov esi, eax
jmp 0x1002f300
mov esi, ebx
xor eax, eax
push eax
lea ecx, [ebp - 0xb8]
call fcn.10017168
mov ecx, dword [ebp - 0x5c]
xor edx, edx
cmp esi, ecx
sete dl
xor ecx, ecx
cmp edx, dword [eax]
setl cl
xor eax, eax
cmp ecx, 0x5fcb4448
jl 0x1002f32e
mov esi, eax
cmp dword [ebp - 0x5c], eax
je 0x1002f330
mov esi, ebx
push eax
lea ecx, [ebp - 0xb8]
call fcn.10017168
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x5c]
cmp esi, eax
mov eax, dword [ebp - 0x5c]
setg dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x5c]
cmp edx, eax
setl cl
cmp dword [ebp - 0x5c], ecx
jg 0x1002f373
xor eax, eax
lea ecx, [ebp - 0xb8]
push eax
call fcn.10017168
cmp dword [eax], 0
je 0x1002f373
mov eax, ebx
jmp 0x1002f375
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x40], eax
je 0x1002f383
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0xb8]
xor eax, eax
push eax
call fcn.10017168
mov ecx, dword [ebp - 0x5c]
cmp dword [eax], ecx
jg 0x1002f4a4
mov dword [ebp - 0x20], 0x6722525a
lea ecx, [ebp - 0xa9c]
mov dword [ebp - 0x44], 9
push edi
call fcn.100170ca
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002f3df
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6fc], 0xe3649e8e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002f3c7
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002f3fb
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa9c]
call fcn.10017168
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002f3e4
push ebx
lea ecx, [ebp - 0xb8]
call fcn.10017168
mov ecx, dword [ebp - 0x20]
mov esi, eax
xor eax, eax
cmp ecx, 0xf910
mov ecx, dword [ebp - 0x20]
setle al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0xb8]
setg dl
xor eax, eax
imul edx, dword [esi]
push eax
mov dword [ebp - 0x44], edx
call fcn.10017168
mov ecx, dword [ebp - 0x44]
mov edx, eax
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
lea ecx, [ebp - 0xb8]
setge bl
xor eax, eax
sub ebx, dword [edx]
push eax
inc ebx
call fcn.10017168
xor ecx, ecx
push 2
cmp ebx, dword [eax]
setg cl
mov dword [ebp - 0x6fc], ecx
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0xa9c]
call fcn.10017168
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x3c]
lea ecx, [ebp - 0xa9c]
setge dl
mov dword [eax], edx
call fcn.1001714c
xor ebx, ebx
inc ebx
jmp 0x1002f4df
xor eax, eax
mov dword [ebp - 0x3c], 0x4efd0e68
mov dword [ebp - 0x14], eax
jmp 0x1002f4c3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1404], 0x580973f9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002f4b2
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0xb8]
push ebx
mov dword [ebp - 0x1404], ebx
call fcn.10017168
mov dword [eax], ebx
or esi, 0xffffffff
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], esi
call fcn.1001714c
push edi
lea ecx, [ebp - 0x1004]
call fcn.100170ca
xor eax, eax
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002f52b
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1004]
call fcn.10017168
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002f50d
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002f54b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002f56b
push 0x1731
push 0x2126
push eax
push 0x1d3
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 0x1004]
mov dword [ebp - 4], esi
call fcn.1001714c
mov dword [ebp - 0x3c], 0x6318
lea ecx, [ebp - 0xaa8]
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x4c], 0xb03b
push edi
call fcn.100170ca
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002f5ce
push dword [ebp - 0x14]
lea ecx, [ebp - 0xaa8]
call fcn.10017168
mov dword [eax], 0x2e5f0e77
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002f5b0
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002f5e0
push eax
call dword [sym.imp.USER32.dll_CharNextW]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002f60a
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x44]
sub edx, eax
mov eax, dword [ebp - 0x4c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
sub ecx, 0xfffc
je 0x1002f608
mov esi, ebx
jmp 0x1002f60c
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0xaa8]
call fcn.10017168
mov ecx, dword [ebp - 0x44]
sub esi, ecx
lea ecx, [ebp - 0xaa8]
mov dword [eax], esi
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.1001714c
mov dword [ebp - 0x38], 0x12b57e8b
lea ecx, [ebp - 0xe68]
mov dword [ebp - 0x34], 0x14d2edc7
xor eax, eax
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0x819570a5
mov dword [ebp - 0x44], 0x101aae4b
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x3c], 0x8ae505b0
mov dword [ebp - 0x34], 0xfa5f9c71
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x34], ebx
push ebx
call fcn.100170ca
push edi
lea ecx, [ebp - 0xac0]
mov dword [ebp - 4], 0xd
call fcn.100170ca
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x34], 0x4e630971
mov dword [ebp - 0x44], 0x701832d7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002f6d6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10e4], 0xc789
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002f6be
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002f6f8
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xe68]
call fcn.10017168
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002f6de
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002f70a
push dword [ebp - 0x1c]
call fcn.10017168
mov dword [eax], esi
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0xac0]
cmp dword [ebp - 0x1c], edi
jl 0x1002f6fd
push 2
pop esi
push esi
call fcn.10017168
mov ecx, 0xb66c146d
inc dword [eax]
dec dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
lea ecx, [ebp - 0xac0]
sbb eax, eax
neg eax
sub eax, 0x7758a8ce
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
call fcn.1001714c
or eax, 0xffffffff
lea ecx, [ebp - 0xe68]
mov dword [ebp - 4], eax
call fcn.1001714c
push edi
lea ecx, [ebp - 0x248]
call fcn.100170ca
mov dword [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x3c], 0xffbe5849
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002f7aa
push dword [ebp - 0x14]
lea ecx, [ebp - 0x248]
call fcn.10017168
mov dword [eax], 0x61c0f806
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002f78c
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002f7ba
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push ebx
lea ecx, [ebp - 0x248]
call fcn.10017168
push ebx
lea ecx, [ebp - 0x248]
call fcn.10017168
xor eax, eax
lea ecx, [ebp - 0x248]
push eax
call fcn.10017168
xor eax, eax
lea ecx, [ebp - 0x248]
push eax
call fcn.10017168
xor eax, eax
lea ecx, [ebp - 0x248]
push eax
call fcn.10017168
xor eax, eax
lea ecx, [ebp - 0x248]
push eax
call fcn.10017168
xor eax, eax
lea ecx, [ebp - 0x248]
push eax
call fcn.10017168
xor eax, eax
lea ecx, [ebp - 0x248]
push eax
call fcn.10017168
push ebx
lea ecx, [ebp - 0x248]
call fcn.10017168
or eax, 0xffffffff
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], eax
call fcn.1001714c
push esi
lea ecx, [ebp - 0xac]
call fcn.100170ca
push esi
lea ecx, [ebp - 0x19c]
mov dword [ebp - 4], 0x10
call fcn.100170ca
mov byte [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], 0x3e58bfc4
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002f8a8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x19c]
call fcn.10017168
mov dword [eax], 0xac64a684
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002f88a
xor eax, eax
push eax
lea ecx, [ebp - 0x19c]
call fcn.10017168
mov dword [eax], 0xffffffe2
jmp 0x1002f919
mov dword [ebp - 0x34], 0x9924
lea ecx, [ebp - 0xd70]
push edi
call fcn.100170ca
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x44], 0x2daab72b
mov dword [ebp - 0x14], eax
jmp 0x1002f8f2
push dword [ebp - 0x14]
call fcn.10017168
mov dword [eax], 7
inc dword [ebp - 0x14]
lea ecx, [ebp - 0xd70]
cmp dword [ebp - 0x14], edi
jl 0x1002f8e1
dec dword [ebp - 0x44]
mov byte [ebp - 4], 0x11
call fcn.1001714c
xor eax, eax
lea ecx, [ebp - 0x19c]
push eax
call fcn.10017168
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x19c]
push eax
call fcn.10017168
cmp dword [eax], 0xfffffff5
jg 0x1002f8bc
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x19c]
push ebx
call fcn.10017168
cmp dword [eax], 0
jne 0x1002f961
xor eax, eax
lea ecx, [ebp - 0x19c]
push eax
call fcn.10017168
xor ecx, ecx
cmp dword [eax], 4
sete cl
cmp ecx, dword [ebp - 0x20]
jle 0x1002f961
xor eax, eax
mov ebx, eax
jmp 0x1002f963
xor eax, eax
push eax
lea ecx, [ebp - 0x19c]
call fcn.10017168
mov ecx, dword [ebp - 0x28]
imul ecx, ebx
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x19c]
setl bl
xor edi, edi
inc edi
push edi
call fcn.10017168
cmp ebx, dword [eax]
jle 0x1002f99a
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002f99c
mov edx, edi
jmp 0x1002f99e
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
imul ecx, dword [ebp - 0x20]
push eax
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x19c]
call fcn.10017168
mov edx, dword [ebp - 0x28]
xor ecx, ecx
push 8
pop ebx
imul edx, dword [eax]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setl cl
cmp ecx, ebx
jle 0x1002f9dd
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x24], eax
jne 0x1002f9df
mov ecx, edi
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
sete dl
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x19c]
mov esi, dword [ebp - 0x40]
push eax
call fcn.10017168
mov dword [eax], esi
xor eax, eax
test esi, esi
je 0x1002fa16
cmp dword [ebp - 0x28], eax
je 0x1002fa16
mov eax, edi
mov dword [ebp - 0x28], eax
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
lea ecx, [ebp - 0x19c]
setle dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0x10
call fcn.1001714c
mov dword [ebp - 0x48], edi
mov eax, 0xd33a4a9b
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
xor eax, eax
push 4
mov dword [ebp - 0x14], eax
pop esi
cmp dword [ebp - 0x14], esi
jge 0x1002fa76
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xcd4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002fa62
xor eax, eax
push 3
pop ebx
mov dword [ebp - 0xcd0], ebx
cmp dword [ebp - 0xcd0], eax
jl 0x1002fae3
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002faa9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x358], 0xd8987f2f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002fa90
xor eax, eax
mov dword [ebp - 0x358], eax
jmp 0x1002fad3
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002facd
push 0x1ae2
push 0x1a9c
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
inc dword [ebp - 0x358]
cmp dword [ebp - 0x358], ebx
jle 0x1002fab1
dec dword [ebp - 0xcd0]
jns 0x1002fa87
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x44], 0x348f4a8f
cmp dword [ebp - 0x18], eax
je 0x1002faff
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub edx, eax
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, edx
setl cl
xor eax, eax
cmp dword [ebp - 0x18], ecx
mov byte [ebp - 0x29], al
je 0x1002fb3e
cmp byte [ebp - 0x29], al
je 0x1002fb75
push eax
push eax
push 0xdd5
push 0x1433
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
jmp 0x1002fb75
cmp byte [ebp - 0x29], al
je 0x1002fb5b
push 0x199a
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002fb75
push 0x19a0
push 0x13cb
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002fb90
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x64], 0x40d7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002fb82
mov dword [ebp - 0x20], 0xfffffffe
lea ecx, [ebp - 0x740]
push esi
call fcn.100170ca
xor eax, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002fbd4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x740]
call fcn.10017168
mov dword [eax], 2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002fbb6
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002fc8b
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002fc51
cmp dword [ebp - 0x20], 9
jge 0x1002fbdc
lea ecx, [ebp - 0x740]
mov byte [ebp - 4], 0x10
call fcn.1001714c
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002fcc2