Function at 0x1002bc5a
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081aa1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xdf4
push esi
push edi
push 4
lea ecx, [ebp - 0x804]
call fcn.1000e8cf
and dword [ebp - 4], 0
mov dword [ebp - 0x90], 0
jmp 0x1002bca4
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x1002bcc0
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0xde8], 8
jmp 0x1002bc97
mov dword [ebp - 0x90], 0
jmp 0x1002bcd9
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 4
jge 0x1002bcfb
push dword [ebp - 0x90]
lea ecx, [ebp - 0x804]
call fcn.1000e93c
mov dword [eax], 0xca4f833f
jmp 0x1002bccc
push 3
lea ecx, [ebp - 0x804]
call fcn.1000e93c
mov dword [eax], 2
jmp 0x1002bd34
push 3
lea ecx, [ebp - 0x804]
call fcn.1000e93c
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x560]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x560]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x804]
call fcn.1000e93c
cmp dword [eax], 0
jl 0x1002be02
mov dword [ebp - 0xa4], 0x76942a1e
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1002bd6e
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [ebp - 0xa4], 2
jmp 0x1002bd87
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jl 0x1002bdb8
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x1002bdb6
push 0x14e3
push 0
push 0x175
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1002bd7a
mov dword [ebp - 0xa4], 2
jmp 0x1002bdd1
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jl 0x1002bdfd
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1002bdfb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
jmp 0x1002bdc4
jmp 0x1002bd10
push 3
lea ecx, [ebp - 0x804]
call fcn.1000e93c
cmp dword [eax], 0x6b471dfd
je 0x1002be23
mov dword [ebp - 0x7f4], 1
jmp 0x1002be2a
and dword [ebp - 0x7f4], 0
push 2
lea ecx, [ebp - 0x804]
call fcn.1000e93c
mov ecx, dword [ebp - 0x7f4]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x804]
call fcn.1000e937
push 2
lea ecx, [ebp - 0x93c]
call fcn.1000e8cf
mov dword [ebp - 4], 1
mov dword [ebp - 0x1fc], 0
jmp 0x1002be7b
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 2
jge 0x1002be9d
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0x93c]
call fcn.1000e93c
mov dword [eax], 1
jmp 0x1002be6e
push 0
lea ecx, [ebp - 0x93c]
call fcn.1000e93c
mov dword [eax], 0xfffffff3
jmp 0x1002bed6
push 0
lea ecx, [ebp - 0x93c]
call fcn.1000e93c
mov dword [ebp - 0x5e0], eax
mov eax, dword [ebp - 0x5e0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5e0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x93c]
call fcn.1000e93c
cmp dword [eax], 4
je 0x1002bf91
push 2
lea ecx, [ebp - 0xbf0]
call fcn.1000e8cf
mov byte [ebp - 4], 2
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x174], 0
jmp 0x1002bf20
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 2
jge 0x1002bf3f
push dword [ebp - 0x174]
lea ecx, [ebp - 0xbf0]
call fcn.1000e93c
and dword [eax], 0
jmp 0x1002bf13
mov dword [ebp - 0x244], 0
jmp 0x1002bf58
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 1
jg 0x1002bf7d
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x1002bf7b
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
jmp 0x1002bf4b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xbf0]
call fcn.1000e937
jmp 0x1002beb2
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1002bfab
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x93c]
call fcn.1000e937
mov dword [ebp - 0xcc8], 0xd41
mov dword [ebp - 0x10], 0x7ddc85f7
mov dword [ebp - 0x10], 0
jmp 0x1002bfdb
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffec
je 0x1002c0fd
mov dword [ebp - 0x8c8], 0x1462ccd2
mov dword [ebp - 0x17c], 0
jmp 0x1002c008
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 1
jge 0x1002c024
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x814], 0x796d
jmp 0x1002bffb
cmp dword [ebp - 0x10], 0
je 0x1002c045
mov eax, dword [ebp - 0x10]
inc eax
jne 0x1002c039
mov eax, 0x5ea9
test eax, eax
je 0x1002c045
mov dword [ebp - 0x33c], 1
jmp 0x1002c04c
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x33c], eax
je 0x1002c063
mov dword [ebp - 0x6a4], 1
jmp 0x1002c06a
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x6a4]
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x10]
jg 0x1002c088
mov dword [ebp - 0x344], 1
jmp 0x1002c08f
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
imul edx, dword [ebp - 0x344]
sub ecx, edx
add eax, ecx
sub eax, dword [ebp - 0x10]
je 0x1002c0ba
cmp dword [ebp - 0x10], 0
je 0x1002c0ba
mov dword [ebp - 0x6ac], 1
jmp 0x1002c0c1
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x6ac], eax
jg 0x1002c0d8
mov dword [ebp - 0x34c], 1
jmp 0x1002c0df
and dword [ebp - 0x34c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x814]
add eax, dword [ebp - 0x34c]
mov dword [ebp - 0x8c8], eax
jmp 0x1002bfd4
mov dword [ebp - 0x8d0], 1
mov dword [ebp - 0xbac], 0xf5af8b51
mov dword [ebp - 0x6cc], 0x9dbea522
mov dword [ebp - 0x2a4], 1
push 3
lea ecx, [ebp - 0xa44]
call fcn.1000e8cf
mov dword [ebp - 4], 3
mov dword [ebp - 0xa18], 3
mov dword [ebp - 0xa14], 3
mov dword [ebp - 0xa10], 3
mov dword [ebp - 0xa0c], 3
lea ecx, [ebp - 0x295]
call fcn.1000e94b
push eax
lea eax, [ebp - 0xa08]
push eax
lea eax, [ebp - 0xa18]
push eax
lea ecx, [ebp - 0xda4]
call fcn.1000e94e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd58]
call fcn.1000e911
mov byte [ebp - 4], 4
mov dword [ebp - 0x354], 0xb7a14055
mov dword [ebp - 0x68], 0
jmp 0x1002c1b4
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1002c1cd
push dword [ebp - 0x68]
lea ecx, [ebp - 0xa44]
call fcn.1000e93c
or dword [eax], 0xffffffff
jmp 0x1002c1ad
mov dword [ebp - 0x68], 0
jmp 0x1002c1dd
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1002c1f3
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x9a4], 0
jmp 0x1002c1d6
mov byte [ebp - 0xbb], 0
movzx eax, byte [ebp - 0xbb]
test eax, eax
je 0x1002c20f
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9a4]
dec eax
mov dword [ebp - 0x6b4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6b4]
mov dword [ebp + eax - 0x9a4], ecx
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x354]
neg eax
je 0x1002c258
mov dword [ebp - 0x6bc], 1
jmp 0x1002c25f
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x6cc]
cmp dword [ebp - 0x2a4], eax
jle 0x1002c279
mov dword [ebp - 0x35c], 1
jmp 0x1002c280
and dword [ebp - 0x35c], 0
mov eax, 0x11accbad
sub eax, dword [ebp - 0x6bc]
sub eax, dword [ebp - 0x35c]
mov dword [ebp - 0x6c4], eax
push 2
lea ecx, [ebp - 0xa44]
call fcn.1000e93c
mov ecx, dword [ebp - 0x6c4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2a4]
add eax, dword [ebp - 0x2a4]
imul eax, dword [ebp - 0x6c4]
cmp eax, dword [ebp - 0x8d0]
jg 0x1002c2d3
mov dword [ebp - 0x364], 1
jmp 0x1002c2da
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x6cc], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xd58]
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa44]
call fcn.1000e937
mov dword [ebp - 0xcb4], 0xd41
mov dword [ebp - 0x8d8], 1
mov dword [ebp - 0xbb4], 0xf5af8b51
mov dword [ebp - 0x384], 0x9dbea522
mov dword [ebp - 0x2dc], 1
push 3
lea ecx, [ebp - 0xa5c]
call fcn.1000e8cf
mov dword [ebp - 4], 5
mov dword [ebp - 0x9dc], 3
mov dword [ebp - 0x9d8], 3
mov dword [ebp - 0x9d4], 3
mov dword [ebp - 0x9d0], 3
lea ecx, [ebp - 0x2f1]
call fcn.1000e94b
push eax
lea eax, [ebp - 0x9cc]
push eax
lea eax, [ebp - 0x9dc]
push eax
lea ecx, [ebp - 0xd9c]
call fcn.1000e94e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd94]
call fcn.1000e911
mov byte [ebp - 4], 6
mov dword [ebp - 0x6d4], 0xb7a14055
mov dword [ebp - 0x88], 0
jmp 0x1002c3ce
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x1002c3ed
push dword [ebp - 0x88]
lea ecx, [ebp - 0xa5c]
call fcn.1000e93c
or dword [eax], 0xffffffff
jmp 0x1002c3c1
mov dword [ebp - 0x88], 0
jmp 0x1002c406
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x1002c422
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x9ac], 0
jmp 0x1002c3f9
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x1002c43e
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9ac]
dec eax
mov dword [ebp - 0x36c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x36c]
mov dword [ebp + eax - 0x9ac], ecx
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
neg eax
je 0x1002c487
mov dword [ebp - 0x374], 1
jmp 0x1002c48e
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x384]
cmp dword [ebp - 0x2dc], eax
jle 0x1002c4a8
mov dword [ebp - 0x6dc], 1
jmp 0x1002c4af
and dword [ebp - 0x6dc], 0
mov eax, 0x11accbad
sub eax, dword [ebp - 0x374]
sub eax, dword [ebp - 0x6dc]
mov dword [ebp - 0x37c], eax
push 2
lea ecx, [ebp - 0xa5c]
call fcn.1000e93c
mov ecx, dword [ebp - 0x37c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2dc]
add eax, dword [ebp - 0x2dc]
imul eax, dword [ebp - 0x37c]
cmp eax, dword [ebp - 0x8d8]
jg 0x1002c502
mov dword [ebp - 0x6e4], 1
jmp 0x1002c509
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0x384], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xd94]
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa5c]
call fcn.1000e937
mov dword [ebp - 0xd30], 0xd41
mov dword [ebp - 0x8f4], 1
mov dword [ebp - 0xbbc], 0xf5af8b51
mov dword [ebp - 0x704], 0x9dbea522
mov dword [ebp - 0x2ac], 1
push 3
lea ecx, [ebp - 0xb10]
call fcn.1000e8cf
mov dword [ebp - 4], 7
mov dword [ebp - 0xa04], 3
mov dword [ebp - 0xa00], 3
mov dword [ebp - 0x9fc], 3
mov dword [ebp - 0x9f8], 3
lea ecx, [ebp - 0x29d]
call fcn.1000e94b
push eax
lea eax, [ebp - 0x9f4]
push eax
lea eax, [ebp - 0xa04]
push eax
lea ecx, [ebp - 0xdac]
call fcn.1000e94e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd70]
call fcn.1000e911
mov byte [ebp - 4], 8
mov dword [ebp - 0x38c], 0xb7a14055
mov dword [ebp - 0x70], 0
jmp 0x1002c5f4
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1002c60d
push dword [ebp - 0x70]
lea ecx, [ebp - 0xb10]
call fcn.1000e93c
or dword [eax], 0xffffffff
jmp 0x1002c5ed
mov dword [ebp - 0x70], 0
jmp 0x1002c61d
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1002c633
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x9b4], 0
jmp 0x1002c616
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1002c64f
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9b4]
dec eax
mov dword [ebp - 0x6ec], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6ec]
mov dword [ebp + eax - 0x9b4], ecx
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x38c]
neg eax
je 0x1002c698
mov dword [ebp - 0x6f4], 1
jmp 0x1002c69f
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x704]
cmp dword [ebp - 0x2ac], eax
jle 0x1002c6b9
mov dword [ebp - 0x394], 1
jmp 0x1002c6c0
and dword [ebp - 0x394], 0
mov eax, 0x11accbad
sub eax, dword [ebp - 0x6f4]
sub eax, dword [ebp - 0x394]
mov dword [ebp - 0x6fc], eax
push 2
lea ecx, [ebp - 0xb10]
call fcn.1000e93c
mov ecx, dword [ebp - 0x6fc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2ac]
add eax, dword [ebp - 0x2ac]
imul eax, dword [ebp - 0x6fc]
cmp eax, dword [ebp - 0x8f4]
jg 0x1002c713
mov dword [ebp - 0x39c], 1
jmp 0x1002c71a
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x704], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd70]
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb10]
call fcn.1000e937
push 2
lea ecx, [ebp - 0x798]
call fcn.1000e8cf
mov dword [ebp - 4], 9
mov dword [ebp - 0x204], 0
jmp 0x1002c771
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 2
jge 0x1002c793
push dword [ebp - 0x204]
lea ecx, [ebp - 0x798]
call fcn.1000e93c
mov dword [eax], 0x1824a8c6
jmp 0x1002c764
push 0
lea ecx, [ebp - 0x798]
call fcn.1000e93c
and dword [eax], 0
jmp 0x1002c7c9
push 0
lea ecx, [ebp - 0x798]
call fcn.1000e93c
mov dword [ebp - 0x3a4], eax
mov eax, dword [ebp - 0x3a4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3a4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x798]
call fcn.1000e93c
cmp dword [eax], 0xffffffe2
jge 0x1002c833
mov byte [ebp - 0xcf], 0
movzx eax, byte [ebp - 0xcf]
test eax, eax
je 0x1002c807
push 0x455
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 0xbf], 0
movzx eax, byte [ebp - 0xbf]
test eax, eax
je 0x1002c82e
push 0x232d
push 0x117d
push 0x153c
call dword [sym.imp.KERNEL32.dll_HeapCreate]
jmp 0x1002c7a5
push 0
lea ecx, [ebp - 0x798]
call fcn.1000e93c
mov esi, eax
push 0
lea ecx, [ebp - 0x798]
call fcn.1000e93c
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x1002c861
mov dword [ebp - 0x70c], 1
jmp 0x1002c868
and dword [ebp - 0x70c], 0
push 1
lea ecx, [ebp - 0x798]
call fcn.1000e93c
mov ecx, dword [ebp - 0x70c]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x798]
call fcn.1000e937
push 2
lea ecx, [ebp - 0x7a8]
call fcn.1000e8cf
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x184], 0
jmp 0x1002c8b9
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jge 0x1002c8db
push dword [ebp - 0x184]
lea ecx, [ebp - 0x7a8]
call fcn.1000e93c
mov dword [eax], 0x1824a8c6
jmp 0x1002c8ac
push 0
lea ecx, [ebp - 0x7a8]
call fcn.1000e93c
and dword [eax], 0
jmp 0x1002c911
push 0
lea ecx, [ebp - 0x7a8]
call fcn.1000e93c
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3ac]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3ac]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x7a8]
call fcn.1000e93c
cmp dword [eax], 0xffffffe2
jge 0x1002c97b
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1002c94f
push 0x455
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x1002c976
push 0x232d
push 0x117d
push 0x153c
call dword [sym.imp.KERNEL32.dll_HeapCreate]
jmp 0x1002c8ed
push 0
lea ecx, [ebp - 0x7a8]
call fcn.1000e93c
mov esi, eax
push 0
lea ecx, [ebp - 0x7a8]
call fcn.1000e93c
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x1002c9a9
mov dword [ebp - 0x714], 1
jmp 0x1002c9b0
and dword [ebp - 0x714], 0
push 1
lea ecx, [ebp - 0x7a8]
call fcn.1000e93c
mov ecx, dword [ebp - 0x714]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7a8]
call fcn.1000e937
push 2
lea ecx, [ebp - 0x7b8]
call fcn.1000e8cf
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x284], 0
jmp 0x1002ca01
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 2
jge 0x1002ca23
push dword [ebp - 0x284]
lea ecx, [ebp - 0x7b8]
call fcn.1000e93c
mov dword [eax], 0x1824a8c6
jmp 0x1002c9f4
push 0
lea ecx, [ebp - 0x7b8]
call fcn.1000e93c
and dword [eax], 0
jmp 0x1002ca59
push 0
lea ecx, [ebp - 0x7b8]
call fcn.1000e93c
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0x3b4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3b4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x7b8]
call fcn.1000e93c
cmp dword [eax], 0xffffffe2
jge 0x1002cac3
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x1002ca97
push 0x455
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 0xc3], 0
movzx eax, byte [ebp - 0xc3]
test eax, eax
je 0x1002cabe
push 0x232d
push 0x117d
push 0x153c
call dword [sym.imp.KERNEL32.dll_HeapCreate]
jmp 0x1002ca35
push 0
lea ecx, [ebp - 0x7b8]
call fcn.1000e93c
mov esi, eax
push 0
lea ecx, [ebp - 0x7b8]
call fcn.1000e93c
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x1002caf1
mov dword [ebp - 0x71c], 1
jmp 0x1002caf8
and dword [ebp - 0x71c], 0
push 1
lea ecx, [ebp - 0x7b8]
call fcn.1000e93c
mov ecx, dword [ebp - 0x71c]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7b8]
call fcn.1000e937
mov dword [ebp - 0xcbc], 0x44696a48
mov dword [ebp - 0x8fc], 0x94543beb
mov dword [ebp - 0x904], 4
mov dword [ebp - 0xcf4], 0xfffffffa
push 1
lea ecx, [ebp - 0xc00]
call fcn.1000e8cf
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xa2c], 5
mov dword [ebp - 0xa28], 5
mov dword [ebp - 0xa24], 5
mov dword [ebp - 0xa20], 5
lea ecx, [ebp - 0x29e]
call fcn.1000e94b
push eax
lea eax, [ebp - 0xa1c]
push eax
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [ebp - 0xdc4]
call fcn.1000e94e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd88]
call fcn.1000e911
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xbf4], 0xe1c2e937
mov dword [ebp - 0xcc4], 0xfffffff8
mov dword [ebp - 0x304], 0
mov dword [ebp - 0x78], 0
jmp 0x1002cbe7
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x1002cbfd
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xe00], 0x67a8
jmp 0x1002cbe0
mov dword [ebp - 0x78], 0
jmp 0x1002cc0d
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1002cc29
push dword [ebp - 0x78]
lea ecx, [ebp - 0xc00]
call fcn.1000e93c
mov dword [eax], 9
jmp 0x1002cc06
mov eax, dword [ebp - 0x304]
sub eax, dword [ebp - 0x8fc]
mov dword [ebp - 0x904], eax
mov eax, dword [ebp - 0x304]
dec eax
mov dword [ebp - 0x304], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xd88]
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc00]
call fcn.1000e937
mov dword [ebp - 0xc04], 0x44696a48
mov dword [ebp - 0x90c], 0x94543beb
mov dword [ebp - 0x914], 4
mov dword [ebp - 0xd40], 0xfffffffa
push 1
lea ecx, [ebp - 0xc10]
call fcn.1000e8cf
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x9f0], 5
mov dword [ebp - 0x9ec], 5
mov dword [ebp - 0x9e8], 5
mov dword [ebp - 0x9e4], 5
lea ecx, [ebp - 0x289]
call fcn.1000e94b
push eax
lea eax, [ebp - 0x9e0]
push eax
lea eax, [ebp - 0x9f0]
push eax
lea ecx, [ebp - 0xdbc]
call fcn.1000e94e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd64]
call fcn.1000e911
mov byte [ebp - 4], 0xf
mov dword [ebp - 0xc14], 0xe1c2e937
mov dword [ebp - 0xccc], 0xfffffff8
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x5c], 0
jmp 0x1002cd31
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x1002cd47
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xdf4], 0x67a8
jmp 0x1002cd2a
mov dword [ebp - 0x5c], 0
jmp 0x1002cd57
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x1002cd73
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xc10]
call fcn.1000e93c
mov dword [eax], 9
jmp 0x1002cd50
mov eax, dword [ebp - 0x2b4]
sub eax, dword [ebp - 0x90c]
mov dword [ebp - 0x914], eax
mov eax, dword [ebp - 0x2b4]
dec eax
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xd64]
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc10]
call fcn.1000e937
mov dword [ebp - 0xc24], 0x27cb3f4f
push 2
lea ecx, [ebp - 0xc30]
call fcn.1000e8cf
mov dword [ebp - 4], 0x10
push 2
lea ecx, [ebp - 0xc20]
call fcn.1000e8cf
mov byte [ebp - 4], 0x11
mov dword [ebp - 0xd08], 0xeb2391cb
mov dword [ebp - 0x10c], 0x23dd972c
push 3
lea ecx, [ebp - 0xad4]
call fcn.1000e8cf
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x24], 0
jmp 0x1002ce14
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002ce30
push dword [ebp - 0x24]
lea ecx, [ebp - 0xc30]
call fcn.1000e93c
mov dword [eax], 0xfffffffe
jmp 0x1002ce0d
mov dword [ebp - 0x24], 0
jmp 0x1002ce40
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002ce5c
push dword [ebp - 0x24]
lea ecx, [ebp - 0xc20]
call fcn.1000e93c
mov dword [eax], 0xe7d214c4
jmp 0x1002ce39
mov dword [ebp - 0x24], 0
jmp 0x1002ce6c
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002ce88
push dword [ebp - 0x24]
lea ecx, [ebp - 0xad4]
call fcn.1000e93c
mov dword [eax], 0xfa5d8720
jmp 0x1002ce65
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x10c], 0
jmp 0x1002ceae
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x1b
jle 0x1002cf41
mov dword [ebp - 0xc34], 3
mov dword [ebp - 0xcd4], 0
mov dword [ebp - 0xc44], 2
mov dword [ebp - 0xd38], 0xd8d955a6
mov dword [ebp - 0x18c], 0
jmp 0x1002cefc
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 1
jge 0x1002cf18
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0xc54], 0xffffffff
jmp 0x1002ceef
push 0
lea ecx, [ebp - 0xad4]
call fcn.1000e93c
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp - 0x3bc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3bc]
mov dword [ecx], eax
jmp 0x1002cea1
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xad4]
call fcn.1000e937
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xc20]
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc30]
call fcn.1000e937
mov dword [ebp - 0xcdc], 0x44696a48
mov dword [ebp - 0x91c], 0x94543beb
mov dword [ebp - 0x924], 4
mov dword [ebp - 0xc64], 0xfffffffa
push 1
lea ecx, [ebp - 0xc40]
call fcn.1000e8cf
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x9c8], 5
mov dword [ebp - 0x9c4], 5
mov dword [ebp - 0x9c0], 5
mov dword [ebp - 0x9bc], 5
lea ecx, [ebp - 0x2d1]
call fcn.1000e94b
push eax
lea eax, [ebp - 0x9b8]
push eax
lea eax, [ebp - 0x9c8]
push eax
lea ecx, [ebp - 0xdb4]
call fcn.1000e94e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd7c]
call fcn.1000e911
mov byte [ebp - 4], 0x14
mov dword [ebp - 0xd1c], 0xe1c2e937
mov dword [ebp - 0xc74], 0xfffffff8
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0x7c], 0
jmp 0x1002d039
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1002d04f
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xdd0], 0x67a8
jmp 0x1002d032
mov dword [ebp - 0x7c], 0
jmp 0x1002d05f
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x1002d07b
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xc40]
call fcn.1000e93c
mov dword [eax], 9
jmp 0x1002d058
mov eax, dword [ebp - 0x2e4]
sub eax, dword [ebp - 0x91c]
mov dword [ebp - 0x924], eax
mov eax, dword [ebp - 0x2e4]
dec eax
mov dword [ebp - 0x2e4], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xd7c]
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc40]
call fcn.1000e937
mov dword [ebp - 0x92c], 1
mov dword [ebp - 0x3c4], 4
mov dword [ebp - 0x2c4], 8
mov dword [ebp - 0x2bc], 0x6b59229a
mov dword [ebp - 0x20c], 0
jmp 0x1002d0f9
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jge 0x1002d115
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0xbc8], 0xffffffff
jmp 0x1002d0ec
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0xc98], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x984], eax
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x984], 0xec541651
jb 0x1002d152
mov dword [ebp - 0x724], 1
jmp 0x1002d159
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0xc84], eax
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0xca0], eax
mov eax, dword [ebp - 0x3c4]
dec eax
dec eax
cmp eax, 0xfffffff9
jle 0x1002d18a
mov dword [ebp - 0x2fc], 1
jmp 0x1002d191
and dword [ebp - 0x2fc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2fc]
mov dword [ebp + eax - 0xbc8], ecx
mov eax, dword [ebp - 0x724]
imul eax, dword [ebp - 0x2fc]
sub eax, 0x1bb05c1
cmp eax, 6
jge 0x1002d1c7
mov dword [ebp - 0x72c], 1
jmp 0x1002d1ce
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x3c4]
add eax, dword [ebp - 0x72c]
mov dword [ebp - 0x2c4], eax
mov byte [ebp - 0xa6], 0
movzx eax, byte [ebp - 0xa6]
test eax, eax
je 0x1002d1fe
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24c], 0x4401d1b9
mov dword [ebp - 0x19c], 1
mov dword [ebp - 0x8c0], 0x19716e28
mov dword [ebp - 0x80], 0xfffffffc
push 2
lea ecx, [ebp - 0xaec]
call fcn.1000e8cf
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x194], 0
jmp 0x1002d257
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 2
jge 0x1002d279
push dword [ebp - 0x194]
lea ecx, [ebp - 0xaec]
call fcn.1000e93c
mov dword [eax], 0xfffffff6
jmp 0x1002d24a
mov dword [ebp - 0x24c], 0xd76c
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x24c], eax
jge 0x1002d29a
mov dword [ebp - 0x73c], 1
jmp 0x1002d2a1
and dword [ebp - 0x73c], 0
cmp dword [ebp - 0x2c], 0x3d5943e2
jne 0x1002d2b6
mov dword [ebp - 0x3cc], 1
jmp 0x1002d2bd
and dword [ebp - 0x3cc], 0
imul eax, dword [ebp - 0x3cc], 0x4c6a
test eax, eax
jg 0x1002d2d7
mov dword [ebp - 0x950], 1
jmp 0x1002d2de
and dword [ebp - 0x950], 0
cmp dword [ebp - 0x2c], 0x9229
jne 0x1002d2f3
mov dword [ebp - 0x734], 1
jmp 0x1002d2fa
and dword [ebp - 0x734], 0
cmp dword [ebp - 0x734], 0x44262821
je 0x1002d30a
cmp dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2c]
jne 0x1002d321
mov dword [ebp - 0x3d4], 1
jmp 0x1002d328
and dword [ebp - 0x3d4], 0
imul eax, dword [ebp - 0x3d4], 0xfffffffb
cmp eax, 0xffffffff
jge 0x1002d340
mov dword [ebp - 0x3dc], 1
jmp 0x1002d347
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x73c]
cmp eax, dword [ebp - 0x3dc]
jl 0x1002d361
mov dword [ebp - 0x744], 1
jmp 0x1002d368
and dword [ebp - 0x744], 0
cmp dword [ebp - 0x744], 0x6337
jle 0x1002d380
mov dword [ebp - 0x3e4], 1
jmp 0x1002d387
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x19c], eax
imul eax, dword [ebp - 0x19c], 0
cmp dword [ebp - 0x2c], eax
jg 0x1002d3b4
cmp dword [ebp - 0x8c0], 0
je 0x1002d3b4
mov dword [ebp - 0x74c], 1
jmp 0x1002d3bb
and dword [ebp - 0x74c], 0
cmp dword [ebp - 0x74c], 2
jge 0x1002d3d0
mov dword [ebp - 0x3ec], 1
jmp 0x1002d3d7
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x3ec], 0xa81d68c2
jae 0x1002d3ef
mov dword [ebp - 0x754], 1
jmp 0x1002d3f6
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x754]
jle 0x1002d410
cmp dword [ebp - 0x2c], 0
jne 0x1002d410
and dword [ebp - 0x3f4], 0
jmp 0x1002d41a
mov dword [ebp - 0x3f4], 1
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x3f4]
neg eax
cmp eax, 0x3222c7e1
jg 0x1002d438
mov dword [ebp - 0x75c], 1
jmp 0x1002d43f
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x80], 0
jmp 0x1002d458
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xa
jne 0x1002d617
mov dword [ebp - 0x79c], 0xfffd
mov dword [ebp - 0xb2c], 0
mov dword [ebp - 0xb28], 0
mov dword [ebp - 0xb24], 0
mov dword [ebp - 0xb20], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x24c], 2
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0x214], eax
jle 0x1002d4cc
mov dword [ebp - 0x764], 1
jmp 0x1002d4d3
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x764], eax
jl 0x1002d4ea
mov dword [ebp - 0x400], 1
jmp 0x1002d4f1
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x400]
cmp eax, 0xb92a
jne 0x1002d50e
mov dword [ebp - 0x898], 1
jmp 0x1002d515
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x824], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x824]
mov dword [ebp + eax - 0xb2c], ecx
mov dword [ebp - 0x19c], 0xfffffff8
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x79c], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x79c], eax
jle 0x1002d562
xor eax, eax
je 0x1002d562
mov dword [ebp - 0x408], 1
jmp 0x1002d569
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0x408], eax
jne 0x1002d583
mov dword [ebp - 0x5e8], 1
jmp 0x1002d58a
and dword [ebp - 0x5e8], 0
cmp dword [ebp - 0x5e8], 0xca51c18c
je 0x1002d5a2
mov dword [ebp - 0x410], 1
jmp 0x1002d5a9
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x410], eax
jg 0x1002d5c0
mov dword [ebp - 0x6d8], 1
jmp 0x1002d5c7
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x6d8]
sub eax, dword [ebp - 0x214]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x418]
sub eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x214]
jne 0x1002d5f6
mov dword [ebp - 0x5f0], 1
jmp 0x1002d5fd
and dword [ebp - 0x5f0], 0
push 1
lea ecx, [ebp - 0xaec]
call fcn.1000e93c
mov ecx, dword [ebp - 0x5f0]
mov dword [eax], ecx
jmp 0x1002d451
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaec]
call fcn.1000e937
mov dword [ebp - 0xc94], 0x27cb3f4f
push 2
lea ecx, [ebp - 0xc60]
call fcn.1000e8cf
mov dword [ebp - 4], 0x16
push 2
lea ecx, [ebp - 0xc50]
call fcn.1000e8cf
mov byte [ebp - 4], 0x17
mov dword [ebp - 0xca8], 0xeb2391cb
mov dword [ebp - 0x128], 0x23dd972c
push 3
lea ecx, [ebp - 0xb04]
call fcn.1000e8cf
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x20], 0
jmp 0x1002d68a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002d6a6
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc60]
call fcn.1000e93c
mov dword [eax], 0xfffffffe
jmp 0x1002d683
mov dword [ebp - 0x20], 0
jmp 0x1002d6b6
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002d6d2
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc50]
call fcn.1000e93c
mov dword [eax], 0xe7d214c4
jmp 0x1002d6af
mov dword [ebp - 0x20], 0
jmp 0x1002d6e2
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002d6fe
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb04]
call fcn.1000e93c
mov dword [eax], 0xfa5d8720
jmp 0x1002d6db
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x128], 0
jmp 0x1002d724
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x1b
jle 0x1002d7b7
mov dword [ebp - 0xcb0], 3
mov dword [ebp - 0xb84], 0
mov dword [ebp - 0xb88], 2
mov dword [ebp - 0xb90], 0xd8d955a6
mov dword [ebp - 0x1a4], 0
jmp 0x1002d772
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 1
jge 0x1002d78e
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0xb98], 0xffffffff
jmp 0x1002d765
push 0
lea ecx, [ebp - 0xb04]
call fcn.1000e93c
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x420]
mov dword [ecx], eax
jmp 0x1002d717
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xb04]
call fcn.1000e937
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xc50]
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc60]
call fcn.1000e937
mov dword [ebp - 0xba0], 0xfffc
mov byte [ebp - 0xa8], 0
movzx eax, byte [ebp - 0xa8]
test eax, eax
je 0x1002d808
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0xaa], 0
movzx eax, byte [ebp - 0xaa]
test eax, eax
je 0x1002d829
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [ebp - 0xba8], 0x27cb3f4f
push 2
lea ecx, [ebp - 0xc80]
call fcn.1000e8cf
mov dword [ebp - 4], 0x19
push 2
lea ecx, [ebp - 0xc70]
call fcn.1000e8cf
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0xbb0], 0xeb2391cb
mov dword [ebp - 0x114], 0x23dd972c
push 3
lea ecx, [ebp - 0xb1c]
call fcn.1000e8cf
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x28], 0
jmp 0x1002d88d
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002d8a9
push dword [ebp - 0x28]
lea ecx, [ebp - 0xc80]
call fcn.1000e93c
mov dword [eax], 0xfffffffe
jmp 0x1002d886
mov dword [ebp - 0x28], 0
jmp 0x1002d8b9
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002d8d5
push dword [ebp - 0x28]
lea ecx, [ebp - 0xc70]
call fcn.1000e93c
mov dword [eax], 0xe7d214c4
jmp 0x1002d8b2
mov dword [ebp - 0x28], 0
jmp 0x1002d8e5
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002d901
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb1c]
call fcn.1000e93c
mov dword [eax], 0xfa5d8720
jmp 0x1002d8de
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x114], 0
jmp 0x1002d927
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x1b
jle 0x1002d9ba
mov dword [ebp - 0xbb8], 3
mov dword [ebp - 0xbc0], 0
mov dword [ebp - 0xbcc], 2
mov dword [ebp - 0xbd8], 0xd8d955a6
mov dword [ebp - 0x26c], 0
jmp 0x1002d975
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 1
jge 0x1002d991
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0xcb8], 0xffffffff
jmp 0x1002d968
push 0
lea ecx, [ebp - 0xb1c]
call fcn.1000e93c
mov dword [ebp - 0x750], eax
mov eax, dword [ebp - 0x750]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x750]
mov dword [ecx], eax
jmp 0x1002d91a
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xb1c]
call fcn.1000e937
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xc70]
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc80]
call fcn.1000e937
push 3
lea ecx, [ebp - 0x7c8]
call fcn.1000e8cf
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x430], 0x1e12aa53
mov dword [ebp - 0xdc], 0x2632c5b6
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x82c], 0x67bb1a88
mov dword [ebp - 0x134], 8
mov dword [ebp - 0x1ac], 0
jmp 0x1002da46
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 3
jge 0x1002da68
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x7c8]
call fcn.1000e93c
mov dword [eax], 0x7a4a
jmp 0x1002da39
push 1
lea ecx, [ebp - 0x7c8]
call fcn.1000e93c
cmp dword [eax], 0
jne 0x1002db37
push 1
lea ecx, [ebp - 0x7c8]
call fcn.1000e93c
mov eax, 0x9c710427
test eax, eax
je 0x1002daa9
cmp dword [ebp - 0x430], 0
je 0x1002daa9
mov dword [ebp - 0x428], 1
jmp 0x1002dab0
and dword [ebp - 0x428], 0
cmp dword [ebp - 0x428], 0xc36fe5ab
je 0x1002dac8
mov dword [ebp - 0x5f8], 1
jmp 0x1002dacf
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x5f8]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xa1f05067
jb 0x1002daf9
mov eax, 0x45dcefb
test eax, eax
jne 0x1002daf9
and dword [ebp - 0x8cc], 0
jmp 0x1002db03
mov dword [ebp - 0x8cc], 1
push 1
lea ecx, [ebp - 0x7c8]
call fcn.1000e93c
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0xcc0], eax
push 1
lea ecx, [ebp - 0x7c8]
call fcn.1000e93c
cmp dword [eax], 0
jne 0x1002db37
and dword [ebp - 0x6e0], 0
jmp 0x1002db41
mov dword [ebp - 0x6e0], 1
push 1
lea ecx, [ebp - 0x7c8]
call fcn.1000e93c
mov ecx, dword [ebp - 0x6e0]
cmp ecx, dword [eax]
jle 0x1002db64
mov dword [ebp - 0x438], 1
jmp 0x1002db6b
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x96a162c9
ja 0x1002db98
mov eax, 0x6e483bbb
test eax, eax
je 0x1002db98
mov dword [ebp - 0x600], 1
jmp 0x1002db9f
and dword [ebp - 0x600], 0
cmp dword [ebp - 0x600], 0xcd1b7e2
jg 0x1002dbc0
cmp dword [ebp - 0x82c], 0
je 0x1002dbc0
mov dword [ebp - 0x440], 1
jmp 0x1002dbc7
and dword [ebp - 0x440], 0
push 1
lea ecx, [ebp - 0x7c8]
call fcn.1000e93c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x440]
jg 0x1002dbea
mov dword [ebp - 0x7dc], 1
jmp 0x1002dbf1
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], 0
jmp 0x1002dc16
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jg 0x1002dc87
mov dword [ebp - 0xdc], 0
jmp 0x1002dc38
cmp dword [ebp - 0xdc], 2
jg 0x1002dc7b
mov dword [ebp - 0x134], 0
jmp 0x1002dc5a
cmp dword [ebp - 0x134], 2
jg 0x1002dc79
mov dword [ebp - 0x920], 0xffffffff
mov dword [ebp - 0x920], 0x62b50098
jmp 0x1002dc4d
jmp 0x1002dc2b
mov dword [ebp - 0xdc], 0xffffffff
jmp 0x1002dc09
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c8]
call fcn.1000e937
mov dword [ebp - 0x4c], 0xebaeef20
mov dword [ebp - 0x608], 0x94bb489f
mov dword [ebp - 0x8d4], 0xfffd
mov dword [ebp - 0x83c], 0xa7bc6c89
mov dword [ebp - 0x468], 1
mov dword [ebp - 0x21c], 0
jmp 0x1002dcde
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 3
jge 0x1002dcfa
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0xa80], 5
jmp 0x1002dcd1
mov dword [ebp - 0x4c], 2
jmp 0x1002dd0a
cmp dword [ebp - 0x4c], 0
jl 0x1002ddbf
mov dword [ebp - 0x1b4], 0xe1e2c0d3
mov dword [ebp - 0x834], 0xffffffff
mov dword [ebp - 0x1b4], 2
jmp 0x1002dd41
cmp dword [ebp - 0x4c], 0
je 0x1002ddd7