Function at 0x1002f433
Capabilities:
Check for time delay via gettickcount
Check os version
Create a process with modified i/o handles and window
Create process on windows
Delete file
Enumerate files on windows
Get common file path
Get disk information
Get file attributes
Identify system language via api
Parse pe header
Query environment variable
Resume thread
Start service
Terminate process

Disassembly:
mov eax, 0x1007f139
call fcn.1007d3a8
mov eax, 0x1724
call fcn.10079b60
movdqa xmm0, xmmword [0x10007ad0]
lea eax, [ebp - 0x1244]
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x1254]
mov dword [ebp - 0x5c], ecx
push eax
lea ecx, [ebp - 0x1520]
mov byte [ebp - 0x7d], dl
movdqu xmmword [ebp - 0x1254], xmm0
call fcn.100167eb
lea ecx, [ebp - 0x228]
mov esi, eax
call fcn.10008a93
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xba0]
push dword [esi]
call fcn.1001679a
xor eax, eax
mov dword [ebp - 4], eax
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x20], 0xcb50bf34
mov dword [ebp - 0x2c], 0x7b051af7
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1002f4bd
push eax
call ebx
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push 3
pop edx
mov dword [ebp - 0x20], edx
push 1
pop ecx
cmp dword [ebp - 0x20], eax
jl 0x1002f59d
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], eax
jl 0x1002f561
push 2
pop ecx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ecx
jge 0x1002f50a
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x320], 0x4caf14c9
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x1002f4f2
xor eax, eax
mov dword [ebp - 0x31c], edx
cmp dword [ebp - 0x31c], eax
jl 0x1002f559
push dword [ebp - 0x31c]
lea ecx, [ebp - 0xba0]
call fcn.100167dc
push dword [ebp - 0x20]
lea ecx, [ebp - 0xba0]
mov esi, eax
call fcn.100167dc
mov ecx, dword [esi]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1002f549
call edi
dec dword [ebp - 0x31c]
jns 0x1002f518
push 3
pop edx
push 2
xor eax, eax
pop ecx
dec dword [ebp - 0x24]
jns 0x1002f4ea
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], eax
jl 0x1002f594
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ecx
jge 0x1002f589
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x3a4], 0xfffffff7
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x1002f571
xor eax, eax
dec dword [ebp - 0x3a4]
dec dword [ebp - 0x24]
jns 0x1002f569
dec dword [ebp - 0x20]
jns 0x1002f4d5
or eax, 0xffffffff
lea ecx, [ebp - 0xba0]
mov dword [ebp - 4], eax
call fcn.100167c0
xor eax, eax
mov dword [ebp - 0x20], 0xd06ce125
xor edx, edx
mov dword [ebp - 0x38], eax
inc edx
cmp dword [ebp - 0x38], edx
jge 0x1002f5da
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x64c], 0xfffffff8
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edx
jl 0x1002f5c2
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jge 0x1002f5fa
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x64c], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002f5e2
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002f615
push eax
push 0x804
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor edx, edx
xor eax, eax
inc edx
push 2
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ecx
jge 0x1002f63e
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x85c], edx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x1002f62a
xor eax, eax
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], eax
jl 0x1002f696
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x85c], 0
je 0x1002f66f
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x85c]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x85c], ecx
test ecx, ecx
je 0x1002f66f
mov ecx, edx
jmp 0x1002f673
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x24]
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1002f68f
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
xor edx, edx
inc edx
dec dword [ebp - 0x24]
jns 0x1002f646
xor eax, eax
mov dword [ebp - 0x20], 0xf
jmp 0x1002f6c4
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002f6c1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
xor edx, edx
xor eax, eax
inc edx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jge 0x1002f69f
movdqa xmm0, xmmword [0x10007ad0]
lea eax, [ebp - 0x12e4]
push eax
lea eax, [ebp - 0x12f4]
push eax
lea ecx, [ebp - 0x1530]
movdqu xmmword [ebp - 0x12f4], xmm0
call fcn.100167eb
lea ecx, [ebp - 0x165]
mov esi, eax
call fcn.10008a93
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xb94]
push dword [esi]
call fcn.1001679a
xor eax, eax
lea ecx, [ebp - 0x3ec]
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0xcb50bf34
push eax
call fcn.1001673e
push 2
pop eax
mov byte [ebp - 4], al
xor esi, esi
xor eax, eax
mov dword [ebp - 0x2c], 0x49d585ed
mov dword [ebp - 0x38], eax
inc esi
cmp dword [ebp - 0x38], esi
jge 0x1002f75e
push dword [ebp - 0x38]
lea ecx, [ebp - 0x3ec]
call fcn.100167dc
and dword [eax], 0
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x1002f743
xor eax, eax
push eax
lea ecx, [ebp - 0x3ec]
call fcn.100167dc
and dword [eax], 0
jmp 0x1002f800
mov dword [ebp - 0x20], 0x57102d14
mov dword [ebp - 0x2c], 0x33843046
mov dword [ebp - 0x2c], 0x9dd952ea
mov dword [ebp - 0x20], 0x15
jmp 0x1002f7ea
push 3
lea ecx, [ebp - 0xf0c]
call fcn.1001673e
push 3
pop ecx
xor eax, eax
mov byte [ebp - 4], cl
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ecx
jge 0x1002f7c8
push dword [ebp - 0x38]
lea ecx, [ebp - 0xf0c]
call fcn.100167dc
mov dword [eax], esi
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jl 0x1002f7ad
xor eax, eax
push eax
lea ecx, [ebp - 0xf0c]
call fcn.100167dc
push 2
lea ecx, [ebp - 0xf0c]
dec dword [eax]
pop eax
mov byte [ebp - 4], al
call fcn.100167c0
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff8
jne 0x1002f790
xor eax, eax
lea ecx, [ebp - 0x3ec]
push eax
call fcn.100167dc
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x3ec]
push eax
call fcn.100167dc
push 2
pop ecx
cmp dword [eax], ecx
jl 0x1002f772
xor eax, eax
lea ecx, [ebp - 0x3ec]
push eax
call fcn.100167dc
lea ecx, [ebp - 0x3ec]
mov dword [eax], 0x9acf2579
xor eax, eax
inc eax
mov byte [ebp - 4], al
call fcn.100167c0
xor eax, eax
mov dword [ebp - 0x2c], 0x7b051af7
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1002f854
push eax
call ebx
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x1002f92e
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x1002f8ec
push 2
pop edx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], edx
jge 0x1002f898
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x3cc], 0x4caf14c9
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edx
jl 0x1002f880
xor eax, eax
mov dword [ebp - 0x3c8], ecx
cmp dword [ebp - 0x3c8], eax
jl 0x1002f8e7
push dword [ebp - 0x3c8]
lea ecx, [ebp - 0xb94]
call fcn.100167dc
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb94]
mov esi, eax
call fcn.100167dc
mov ecx, dword [esi]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1002f8d7
call edi
dec dword [ebp - 0x3c8]
jns 0x1002f8a6
push 3
pop ecx
push 2
xor eax, eax
pop edx
dec dword [ebp - 0x24]
jns 0x1002f878
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x1002f925
xor ecx, ecx
inc ecx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ecx
jge 0x1002f917
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x368], 0xfffffff7
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x1002f8ff
xor eax, eax
dec dword [ebp - 0x368]
dec dword [ebp - 0x24]
jns 0x1002f8f7
push 3
pop ecx
dec dword [ebp - 0x20]
jns 0x1002f863
or edi, 0xffffffff
lea ecx, [ebp - 0xb94]
mov dword [ebp - 4], edi
call fcn.100167c0
mov dword [ebp - 0x44], 0x692beaa3
lea ecx, [ebp - 0x814]
mov dword [ebp - 0x2c], 0x2d149fe
xor ebx, ebx
mov dword [ebp - 0x10], 0xf69f7fd1
inc ebx
push 8
pop eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
push ebx
call fcn.1001673e
mov dword [ebp - 4], 4
xor eax, eax
push 2
mov dword [ebp - 0x54], ebx
pop ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002f9a7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7e0], 0x464f16ef
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002f98f
xor eax, eax
mov dword [ebp - 0x18], eax
push 3
pop esi
cmp dword [ebp - 0x18], ecx
jge 0x1002f9c6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1540], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f9b2
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002f9ef
push dword [ebp - 0x18]
lea ecx, [ebp - 0x814]
call fcn.100167dc
mov dword [eax], 0xa6ff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002f9ce
push 2
xor eax, eax
pop ecx
cmp dword [ebp - 0x44], eax
je 0x1002fa5f
push ecx
mov dword [ebp - 0x2c], 0x579253a3
lea ecx, [ebp - 0x1010]
mov dword [ebp - 0x2c], 0xfffffffc
call fcn.1001673e
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x2c], eax
push 2
mov dword [ebp - 0x38], eax
pop ecx
cmp dword [ebp - 0x38], ecx
jge 0x1002fa41
push ecx
pop ebx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x1010]
call fcn.100167dc
mov dword [eax], edi
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1002fa24
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x814]
call fcn.100167dc
lea ecx, [ebp - 0x1010]
inc dword [eax]
call fcn.100167c0
jmp 0x1002fb6e
push esi
lea ecx, [ebp - 0x894]
call fcn.1001673e
mov byte [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x40], 0x9d0863e8
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x1002fa9e
push dword [ebp - 0x38]
lea ecx, [ebp - 0x894]
call fcn.100167dc
mov dword [eax], 0x32e0c280
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x1002fa80
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002fab4
push 0x1d00
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
lea ecx, [ebp - 0x814]
call fcn.100167dc
cmp dword [eax], 0
jne 0x1002fb5b
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x894]
neg esi
sbb esi, esi
xor eax, eax
push eax
neg esi
call fcn.100167dc
mov ecx, dword [ebp - 0x54]
xor edx, edx
cmp esi, ecx
mov edi, eax
push 8
setle dl
neg edx
pop eax
cmp eax, edx
mov eax, dword [ebp - 0x64]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, ebx
lea ecx, [ebp - 0x814]
setle dl
xor ebx, ebx
sub eax, edx
cmp eax, dword [edi]
setle bl
xor eax, eax
push eax
call fcn.100167dc
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0x894]
mov esi, dword [eax]
setg dl
xor ebx, ebx
sub esi, edx
inc ebx
push ebx
call fcn.100167dc
xor ecx, ecx
cmp esi, dword [eax]
setl cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
neg eax
je 0x1002fb51
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002fb5b
jmp 0x1002fb53
xor eax, eax
cmp dword [ebp - 0x7e0], eax
je 0x1002fb5d
mov eax, ebx
lea ecx, [ebp - 0x894]
mov dword [ebp - 0x10], eax
call fcn.100167c0
or edi, 0xffffffff
lea ecx, [ebp - 0x814]
mov dword [ebp - 4], edi
call fcn.100167c0
mov dword [ebp - 0x24], 0x71d976ff
lea ecx, [ebp - 0xd74]
mov dword [ebp - 0x1c], 0x2961c0f8
mov dword [ebp - 0x10], 0x44142b91
push ebx
call fcn.1001673e
xor eax, eax
mov dword [ebp - 4], 7
mov dword [ebp - 0x38], eax
jmp 0x1002fbbf
push dword [ebp - 0x38]
lea ecx, [ebp - 0xd74]
call fcn.100167dc
and dword [eax], 0
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1002fbab
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x24], eax
jle 0x1002fc25
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002fc0d
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
sub edx, eax
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
imul ecx, dword [ebp - 0x10]
test ecx, ecx
jne 0x1002fc0d
xor eax, eax
mov esi, eax
jmp 0x1002fc11
mov esi, ebx
xor eax, eax
push eax
lea ecx, [ebp - 0xd74]
call fcn.100167dc
cmp esi, dword [eax]
jle 0x1002fc25
xor eax, eax
jmp 0x1002fc27
mov eax, ebx
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002fc3b
mov dword [ebp - 0x24], 0xfffffff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002fc31
lea ecx, [ebp - 0xd74]
mov dword [ebp - 4], edi
call fcn.100167c0
movdqa xmm0, xmmword [0x10007ad0]
lea eax, [ebp - 0x1264]
push eax
lea eax, [ebp - 0x1274]
push eax
lea ecx, [ebp - 0x1550]
movdqu xmmword [ebp - 0x1274], xmm0
call fcn.100167eb
lea ecx, [ebp - 0x163]
mov esi, eax
call fcn.10008a93
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xbdc]
push dword [esi]
call fcn.1001679a
push 8
pop eax
push 3
pop esi
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x9d8]
mov dword [ebp - 0x18], 0xdf37d45d
push esi
call fcn.1001673e
push 9
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0xbac]
mov dword [ebp - 0x10], 0x5d1cb6a7
mov dword [ebp - 0x44], 0xa0a9
push 4
call fcn.1001673e
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002fcfe
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9d8]
call fcn.100167dc
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002fce0
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002fd16
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbac]
call fcn.100167dc
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002fd03
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov esi, dword [ebp - 0x18]
sub eax, 0x36126460
cmp eax, 0x4fc2285f
setne cl
xor edx, edx
sub esi, ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
inc ecx
cmp ecx, eax
setg dl
xor ecx, ecx
cmp edx, 0x45fe
setne cl
xor eax, eax
cmp esi, ecx
setl al
imul eax, eax, 0xc2e7
test eax, eax
je 0x1002fdb1
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002fd78
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002fd75
call dword [sym.imp.USER32.dll_EndMenu]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x17
jle 0x1002fd64
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x18], eax
je 0x1002fd89
mov edi, ebx
cmp dword [ebp - 0x10], eax
jne 0x1002fdf7
cmp dword [ebp - 0x44], 0xa12a
jg 0x1002fd9e
mov ecx, ebx
cmp dword [ebp - 0x10], eax
jne 0x1002fda0
mov ecx, eax
xor eax, eax
cmp ecx, 6
setne al
add eax, dword [ebp - 0x10]
jne 0x1002fdf7
mov esi, eax
jmp 0x1002fdf9
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1002fdc8
push 0x133f
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jg 0x1002fd80
push ecx
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9d8]
call fcn.100167dc
cmp dword [eax], 0
jne 0x1002fdf0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1002fdd5
xor ebx, ebx
xor eax, eax
inc ebx
jmp 0x1002fd80
mov esi, ebx
push ebx
lea ecx, [ebp - 0x9d8]
call fcn.100167dc
lea ecx, [edi + 4]
xor ebx, ebx
add ecx, esi
push 2
cmp dword [eax], ecx
lea ecx, [ebp - 0xbac]
pop eax
push eax
setl bl
call fcn.100167dc
lea ecx, [ebp - 0xbac]
mov dword [eax], ebx
call fcn.100167c0
push 8
pop eax
lea ecx, [ebp - 0x9d8]
mov byte [ebp - 4], al
call fcn.100167c0
mov dword [ebp - 0x34], 0xcb50bf34
lea ecx, [ebp - 0xe64]
mov dword [ebp - 0x2c], 0x7b051af7
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x20], 0x6525
push 4
call fcn.1001673e
mov byte [ebp - 4], 0xb
or edi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x1002fe9b
push dword [ebp - 0x38]
lea ecx, [ebp - 0xe64]
call fcn.100167dc
mov dword [eax], 0xc2f1fcc1
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
jl 0x1002fe7c
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x18], eax
inc ebx
cmp dword [ebp - 0x18], edi
jg 0x1002ffdb
mov dword [ebp - 0x10], 0x5a83d87e
lea ecx, [ebp - 0x8d0]
mov dword [ebp - 0x28], 6
push 3
call fcn.1001673e
mov byte [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x34], 0xffff
push 3
mov dword [ebp - 0x38], eax
pop ecx
cmp dword [ebp - 0x38], ecx
jge 0x1002ff01
push ecx
pop ebx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x8d0]
call fcn.100167dc
mov dword [eax], 0xa73a151c
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1002fedf
xor ebx, ebx
push 3
inc ebx
pop ecx
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002ff3a
cmp dword [ebp - 0x10], eax
je 0x1002ff13
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0xe64]
call fcn.100167dc
mov esi, dword [ebp - 0x20]
xor edx, edx
imul esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp esi, ecx
setge dl
mov dword [eax], edx
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002ff42
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
xor eax, eax
add edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x18]
jle 0x1002ff66
mov edi, ebx
cmp dword [ebp - 0x20], eax
jne 0x1002ff68
mov edi, eax
push eax
lea ecx, [ebp - 0x8d0]
call fcn.100167dc
mov ecx, dword [ebp - 0x18]
mov esi, eax
xor eax, eax
cmp edi, ebx
sete al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp ecx, eax
mov dword [esi], edx
sbb eax, eax
neg eax
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x1002ffbb
mov dword [ebp - 0x44], eax
push ebx
call fcn.100167dc
mov ecx, dword [ebp - 0x28]
push 0
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x34]
pop eax
cmp dword [ebp - 0x34], 6
lea ecx, [ebp - 0x8d0]
je 0x1002ffa1
mov byte [ebp - 4], 0xb
call fcn.100167c0
dec dword [ebp - 0x18]
or edi, 0xffffffff
jmp 0x1002fea1
push 8
pop eax
lea ecx, [ebp - 0xe64]
mov byte [ebp - 4], al
call fcn.100167c0
push ebx
lea ecx, [ebp - 0x4a0]
call fcn.1001673e
mov byte [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x2c], 0x9ea9831
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x1003002b
push dword [ebp - 0x38]
lea ecx, [ebp - 0x4a0]
call fcn.100167dc
mov dword [eax], 0xdb3ae355
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1003000d
xor eax, eax
push eax
lea ecx, [ebp - 0x4a0]
call fcn.100167dc
and dword [eax], 0
jmp 0x10030070
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1003004f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
push eax
lea ecx, [ebp - 0x4a0]
call fcn.100167dc
cmp dword [eax], 0
jne 0x10030083
xor eax, eax
lea ecx, [ebp - 0x4a0]
push eax
call fcn.100167dc
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x4a0]
push eax
call fcn.100167dc
cmp dword [eax], 0xa
jg 0x1003003c
push 8
pop eax
lea ecx, [ebp - 0x4a0]
mov byte [ebp - 4], al
call fcn.100167c0
xor eax, eax
lea ecx, [ebp - 0xbc4]
mov byte [ebp - 0x11], al
mov dword [ebp - 0x40], 0x974b666a
push 4
call fcn.1001673e
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x44], 0x5300ce3d
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x100300e3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x500], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100300cf
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10030107
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbc4]
call fcn.100167dc
mov dword [eax], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100300ec
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1003011e
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x4fc]
mov eax, dword [ebp - 0x10]
cmp eax, 0x4d07ddbf
setl cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
neg eax
je 0x10030144
mov eax, dword [ebp - 0x4fc]
push ebx
lea ecx, [ebp - 0xbc4]
call fcn.100167dc
xor edx, edx
push 2
mov dword [eax], 0xbfb66feb
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x500]
dec dword [ebp - 0x28]
mov ecx, dword [ebp - 0x500]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
pop eax
setg dl
lea ecx, [ebp - 0xbc4]
add edx, eax
push 8
mov dword [ebp - 0x44], edx
pop eax
mov byte [ebp - 4], al
call fcn.100167c0
cmp byte [ebp - 0x11], 0
je 0x1003019d
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 3
pop esi
mov dword [ebp - 0x34], esi
xor eax, eax
cmp dword [ebp - 0x34], eax
jl 0x1003050f
mov dword [ebp - 0x20], 0xcea5d6c0
mov dword [ebp - 0x2c], 0x891c5534
mov dword [ebp - 0x20], 0xffffffed
jmp 0x100301e6
mov dword [ebp - 0x38], 0xeede0b40
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x38], eax
jmp 0x100301dd
dec dword [ebp - 0x40]
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe6
jge 0x100301d7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x18
jge 0x100301c5
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003020b
push eax
push eax
push eax
push eax
push 0x24fb
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 0xd06ce125
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x10030235
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x65c], 0xfffffff8
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1003021d
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10030255
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x65c], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1003023d
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003026d
push eax
push 0x804
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor eax, eax
mov dword [ebp - 0x2c], 4
push 2
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ecx
jge 0x1003029d
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x6bc], ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x10030289
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x100302f2
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x6bc], 0
je 0x100302ce
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x6bc]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6bc], ecx
test ecx, ecx
je 0x100302ce
mov ecx, ebx
jmp 0x100302d2
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x24]
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100302eb
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
dec dword [ebp - 0x24]
jns 0x100302a5
xor eax, eax
mov dword [ebp - 0x20], 0xf
jmp 0x1003031d
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003031a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jge 0x100302fb
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jl 0x100304d3
push ebx
lea ecx, [ebp - 0x4b8]
call fcn.1001673e
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x2c], 0x49d585ed
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x1003036a
push dword [ebp - 0x38]
lea ecx, [ebp - 0x4b8]
call fcn.100167dc
and dword [eax], 0
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1003034f
xor eax, eax
push eax
lea ecx, [ebp - 0x4b8]
call fcn.100167dc
lea ecx, [ebp - 0x4b8]
and dword [eax], 0
xor eax, eax
push eax
call fcn.100167dc
push 2
pop edi
jmp 0x10030425
mov dword [ebp - 0x20], 0x57102d14
mov dword [ebp - 0x2c], 0x33843046
mov dword [ebp - 0x2c], 0x9dd952ea
mov dword [ebp - 0x20], 0x15
jmp 0x10030401
push esi
lea ecx, [ebp - 0xd8c]
call fcn.1001673e
xor eax, eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x100303e1
push dword [ebp - 0x38]
lea ecx, [ebp - 0xd8c]
call fcn.100167dc
mov dword [eax], ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x100303c7
xor eax, eax
push eax
lea ecx, [ebp - 0xd8c]
call fcn.100167dc
lea ecx, [ebp - 0xd8c]
dec dword [eax]
mov byte [ebp - 4], 0xf
call fcn.100167c0
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff8
jne 0x100303ad
xor eax, eax
lea ecx, [ebp - 0x4b8]
push eax
call fcn.100167dc
lea ecx, [ebp - 0x4b8]
inc dword [eax]
xor eax, eax
push eax
call fcn.100167dc
cmp dword [eax], edi
jl 0x1003038f
xor eax, eax
lea ecx, [ebp - 0x4b8]
push eax
call fcn.100167dc
push 8
lea ecx, [ebp - 0x4b8]
mov dword [eax], 0x9acf2579
pop eax
mov byte [ebp - 4], al
call fcn.100167c0
xor eax, eax
push 2
mov dword [ebp - 0x38], eax
pop ecx
cmp dword [ebp - 0x38], ecx
jge 0x10030477
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x33c], 0x4caf14c9
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x1003045f
xor eax, eax
mov dword [ebp - 0x338], esi
cmp dword [ebp - 0x338], eax
jl 0x100304c5
push dword [ebp - 0x338]
lea ecx, [ebp - 0xbdc]
call fcn.100167dc
push dword [ebp - 0x34]
lea ecx, [ebp - 0xbdc]
mov esi, eax
call fcn.100167dc
mov ecx, dword [esi]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100304ba
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec dword [ebp - 0x338]
jns 0x10030485
push 3
pop esi
dec dword [ebp - 0x24]
jns 0x1003032e
xor eax, eax
or edi, 0xffffffff
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jl 0x10030506
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x100304fb
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x3d8], 0xfffffff7
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x100304e3
xor eax, eax
dec dword [ebp - 0x3d8]
dec dword [ebp - 0x24]
jns 0x100304db
dec dword [ebp - 0x34]
jns 0x100301ae
lea ecx, [ebp - 0xbdc]
mov dword [ebp - 4], edi
call fcn.100167c0
mov dword [ebp - 0x44], 0x692beaa3
lea ecx, [ebp - 0x6e8]
mov dword [ebp - 0x2c], 0x2d149fe
mov dword [ebp - 0x10], 0xf69f7fd1
push 8
pop eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
push ebx
call fcn.1001673e
mov dword [ebp - 4], 0x11
xor eax, eax
push 2
mov dword [ebp - 0x54], ebx
pop ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10030582
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x698], 0x464f16ef
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003056a
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1003059e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1560], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003058a
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100305c7
push dword [ebp - 0x18]
lea ecx, [ebp - 0x6e8]
call fcn.100167dc
mov dword [eax], 0xa6ff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100305a6
push 2
xor eax, eax
pop ecx
cmp dword [ebp - 0x44], eax
je 0x10030637
push ecx
mov dword [ebp - 0x2c], 0x579253a3
lea ecx, [ebp - 0x1138]
mov dword [ebp - 0x2c], 0xfffffffc
call fcn.1001673e
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x2c], eax
push 2
mov dword [ebp - 0x38], eax
pop ecx
cmp dword [ebp - 0x38], ecx
jge 0x10030619
push ecx
pop ebx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x1138]
call fcn.100167dc
mov dword [eax], edi
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x100305fc
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x6e8]
call fcn.100167dc
lea ecx, [ebp - 0x1138]
inc dword [eax]
call fcn.100167c0
jmp 0x10030749
push esi
lea ecx, [ebp - 0xa68]
call fcn.1001673e
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x40], 0x9d0863e8
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x10030676
push dword [ebp - 0x38]
lea ecx, [ebp - 0xa68]
call fcn.100167dc
mov dword [eax], 0x32e0c280
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x10030658
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003068c
push 0x1d00
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
lea ecx, [ebp - 0x6e8]
call fcn.100167dc
cmp dword [eax], 0
jne 0x10030733
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0xa68]
neg esi
sbb esi, esi
xor eax, eax
push eax
neg esi
call fcn.100167dc
mov ecx, dword [ebp - 0x54]
xor edx, edx
cmp esi, ecx
mov edi, eax
push 8
setle dl
neg edx
pop eax
cmp eax, edx
mov eax, dword [ebp - 0x64]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, ebx
lea ecx, [ebp - 0x6e8]
setle dl
xor ebx, ebx
sub eax, edx
cmp eax, dword [edi]
setle bl
xor eax, eax
push eax
call fcn.100167dc
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0xa68]
mov esi, dword [eax]
setg dl
xor ebx, ebx
sub esi, edx
inc ebx
push ebx
call fcn.100167dc
xor ecx, ecx
cmp esi, dword [eax]
setl cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
neg eax
je 0x10030729
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10030733
jmp 0x1003072b
xor eax, eax
cmp dword [ebp - 0x698], eax
je 0x10030735
mov eax, ebx
lea ecx, [ebp - 0xa68]
mov dword [ebp - 0x10], eax
call fcn.100167c0
push 3
pop esi
or edi, 0xffffffff
lea ecx, [ebp - 0x6e8]
mov dword [ebp - 4], edi
call fcn.100167c0
mov dword [ebp - 0x44], 0x692beaa3
lea ecx, [ebp - 0x7cc]
mov dword [ebp - 0x2c], 0x2d149fe
mov dword [ebp - 0x10], 0xf69f7fd1
push 8
pop eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
push ebx
call fcn.1001673e
mov dword [ebp - 4], 0x14
xor eax, eax
push 2
mov dword [ebp - 0x54], ebx
pop ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100307bc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x818], 0x464f16ef
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100307a4
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x100307d8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1570], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100307c4
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10030801
push dword [ebp - 0x18]
lea ecx, [ebp - 0x7cc]
call fcn.100167dc
mov dword [eax], 0xa6ff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100307e0
push 2
xor eax, eax
pop ecx
cmp dword [ebp - 0x44], eax
je 0x10030871
push ecx
mov dword [ebp - 0x2c], 0x579253a3
lea ecx, [ebp - 0x1028]
mov dword [ebp - 0x2c], 0xfffffffc
call fcn.1001673e
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x2c], eax
push 2
mov dword [ebp - 0x38], eax
pop ecx
cmp dword [ebp - 0x38], ecx
jge 0x10030853
push ecx
pop ebx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x1028]
call fcn.100167dc
mov dword [eax], edi
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x10030836
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x7cc]
call fcn.100167dc
lea ecx, [ebp - 0x1028]
inc dword [eax]
call fcn.100167c0
jmp 0x10030980
push esi
lea ecx, [ebp - 0x8e8]
call fcn.1001673e
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x40], 0x9d0863e8
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x100308b0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x8e8]
call fcn.100167dc
mov dword [eax], 0x32e0c280
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x10030892
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100308c6
push 0x1d00
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
lea ecx, [ebp - 0x7cc]
call fcn.100167dc
cmp dword [eax], 0
jne 0x1003096d
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x8e8]
neg esi
sbb esi, esi
xor eax, eax
push eax
neg esi
call fcn.100167dc
mov ecx, dword [ebp - 0x54]
xor edx, edx
cmp esi, ecx
mov edi, eax
push 8
setle dl
neg edx
pop eax
cmp eax, edx
mov eax, dword [ebp - 0x64]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, ebx
lea ecx, [ebp - 0x7cc]
setle dl
xor ebx, ebx
sub eax, edx
cmp eax, dword [edi]
setle bl
xor eax, eax
push eax
call fcn.100167dc
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0x8e8]
mov esi, dword [eax]
setg dl
xor ebx, ebx
sub esi, edx
inc ebx
push ebx
call fcn.100167dc
xor ecx, ecx
cmp esi, dword [eax]
setl cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
neg eax
je 0x10030963
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1003096d
jmp 0x10030965
xor eax, eax
cmp dword [ebp - 0x818], eax
je 0x1003096f
mov eax, ebx
lea ecx, [ebp - 0x8e8]
mov dword [ebp - 0x10], eax
call fcn.100167c0
or edi, 0xffffffff
lea ecx, [ebp - 0x7cc]
mov dword [ebp - 4], edi
call fcn.100167c0
push 3
pop esi
mov dword [ebp - 0x18], 0x4b811476
lea ecx, [ebp - 0x844]
push esi
call fcn.1001673e
mov dword [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x10], 0x50d8
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x732adaa2
mov dword [ebp - 0x38], eax
jmp 0x100309d0
push dword [ebp - 0x38]
call fcn.100167dc
mov dword [eax], ebx
inc dword [ebp - 0x38]
lea ecx, [ebp - 0x844]
cmp dword [ebp - 0x38], esi
jl 0x100309c3
mov eax, dword [ebp - 0x18]
push 2
pop eax
push eax
call fcn.100167dc
mov ecx, dword [ebp - 0x18]
push ebx
mov dword [eax], ecx
lea ecx, [ebp - 0x844]
mov eax, dword [ebp - 0x18]
call fcn.100167dc
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x844]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push 2
pop eax
push eax
call fcn.100167dc
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp dword [eax], ecx
mov eax, 0xdb2b058e
setg dl
cmp eax, edx
mov eax, dword [ebp - 0x10]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0xfffffff8
jle 0x10030b13
mov dword [ebp - 0x20], 0x674643a6
mov dword [ebp - 0x40], 0xdf2ffa36
mov dword [ebp - 0x18], eax
jmp 0x10030b07
push 2
pop eax
push eax
lea ecx, [ebp - 0x700]
call fcn.1001673e
xor eax, eax
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
jmp 0x10030a99
push dword [ebp - 0x38]
call fcn.100167dc
mov dword [eax], ebx
inc dword [ebp - 0x38]
push 2
pop eax
lea ecx, [ebp - 0x700]
cmp dword [ebp - 0x38], eax
jl 0x10030a8c
push ebx
call fcn.100167dc
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x700]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
push ebx
call fcn.100167dc
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x28]
imul eax, eax, 0xfff6
test eax, eax
je 0x10030ae5
xor eax, eax
lea ecx, [ebp - 0x700]
push eax
call fcn.100167dc
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
lea ecx, [ebp - 0x700]
setl dl
mov dword [ebp - 0x3c], edx
mov byte [ebp - 4], 0x17
call fcn.100167c0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x2e
jne 0x10030a6f
jmp 0x10030b23
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x90ce61fa
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x844]
mov dword [ebp - 4], edi
call fcn.100167c0
movdqa xmm0, xmmword [0x10007ad0]
lea eax, [ebp - 0x1364]
push eax
lea eax, [ebp - 0x1374]
push eax
lea ecx, [ebp - 0x1580]
movdqu xmmword [ebp - 0x1374], xmm0
call fcn.100167eb
lea ecx, [ebp - 0x196]
mov esi, eax
call fcn.10008a93
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xc54]
push dword [esi]
call fcn.1001679a
mov dword [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x34], 0xfffffff8
push 3
mov dword [ebp - 0x38], eax
pop ecx
cmp dword [ebp - 0x38], ecx
jge 0x10030ba7
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x718], ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x10030b93
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10030bbf
push 0xb01
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10030ce1
push eax
lea ecx, [ebp - 0x2f4]
call fcn.1001673e
xor eax, eax
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x38], eax
push 2
pop eax
cmp dword [ebp - 0x38], eax
jge 0x10030c05
push eax
pop ebx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2f4]
call fcn.100167dc
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x10030be6
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x2f4]
call fcn.100167dc
push ebx
lea ecx, [ebp - 0x2f4]
and dword [eax], 0
call fcn.100167dc
push 2
pop esi
jmp 0x10030cc7
xor eax, eax
mov dword [ebp - 0x40], edi
push eax
call fcn.100167dc
xor ebx, ebx
cmp dword [eax], ebx
je 0x10030c53
mov ecx, dword [ebp - 0x714]
mov eax, dword [ebp - 0x718]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
xor eax, eax
lea ecx, [ebp - 0x2f4]
inc eax
push eax
call fcn.100167dc
xor ecx, ecx
cmp dword [eax], ebx
mov eax, dword [ebp - 0x34]
setg cl
cmp ecx, 5
mov ecx, dword [ebp + eax*4 - 0x718]
sbb edx, edx
mov eax, dword [ebp - 0x34]
neg edx
add ecx, edx
cmp dword [ebp + eax*4 - 0x718], ecx
jle 0x10030ca2
xor eax, eax
lea ecx, [ebp - 0x2f4]
inc eax
push eax
call fcn.100167dc
cmp dword [eax], ebx
jne 0x10030ca2
xor ebx, ebx
xor eax, eax
inc ebx
jmp 0x10030ca7
xor ebx, ebx
inc ebx
mov eax, ebx
push ebx
lea ecx, [ebp - 0x2f4]
mov dword [ebp - 0x718], eax
call fcn.100167dc
push ebx
lea ecx, [ebp - 0x2f4]
inc dword [eax]
call fcn.100167dc
lea ecx, [ebp - 0x2f4]
cmp dword [eax], esi
jle 0x10030c28
mov byte [ebp - 4], 0x19
call fcn.100167c0
inc dword [ebp - 0x34]
push 2
pop eax
cmp dword [ebp - 0x34], eax
jle 0x10030bc7
mov dword [ebp - 0x10], 0xcb50bf34
lea ecx, [ebp - 0xedc]
mov dword [ebp - 0x24], 0x71d976ff
mov dword [ebp - 0x1c], 0x2961c0f8
mov dword [ebp - 0x10], 0x44142b91
push ebx
call fcn.1001673e
xor eax, eax
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x38], eax
jmp 0x10030d34
push dword [ebp - 0x38]
lea ecx, [ebp - 0xedc]
call fcn.100167dc
and dword [eax], 0
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x10030d20
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x24], eax
jle 0x10030d9a
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10030d82
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
sub edx, eax
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
imul ecx, dword [ebp - 0x10]
test ecx, ecx
jne 0x10030d82
xor eax, eax
mov esi, eax
jmp 0x10030d86
mov esi, ebx
xor eax, eax
push eax
lea ecx, [ebp - 0xedc]
call fcn.100167dc
cmp esi, dword [eax]
jle 0x10030d9a
xor eax, eax
jmp 0x10030d9c
mov eax, ebx
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10030db0
mov dword [ebp - 0x24], 0xfffffff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10030da6
lea ecx, [ebp - 0xedc]
mov byte [ebp - 4], 0x19
call fcn.100167c0
push 3
pop esi
mov dword [ebp - 0x2c], 0x7b051af7
lea ecx, [ebp - 0x9f0]
mov dword [ebp - 0x18], 0xdf37d45d
push esi
call fcn.1001673e
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xbf4]
mov dword [ebp - 0x10], 0x5d1cb6a7
mov dword [ebp - 0x44], 0xa0a9
push 4
call fcn.1001673e
xor eax, eax
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10030e2c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9f0]
call fcn.100167dc
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10030e0e
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10030e44
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbf4]
call fcn.100167dc
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10030e31
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov esi, dword [ebp - 0x18]
sub eax, 0x36126460
cmp eax, 0x4fc2285f
setne cl
xor edx, edx
sub esi, ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
inc ecx
cmp ecx, eax
setg dl
xor ecx, ecx
cmp edx, 0x45fe
setne cl
xor eax, eax
cmp esi, ecx
setl al
imul eax, eax, 0xc2e7
test eax, eax
je 0x10030edf
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10030ea6
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10030ea3
call dword [sym.imp.USER32.dll_EndMenu]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x17
jle 0x10030e92
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x18], eax
je 0x10030eb7
mov edi, ebx
cmp dword [ebp - 0x10], eax
jne 0x10030f25
cmp dword [ebp - 0x44], 0xa12a
jg 0x10030ecc
mov ecx, ebx
cmp dword [ebp - 0x10], eax
jne 0x10030ece
mov ecx, eax
xor eax, eax
cmp ecx, 6
setne al
add eax, dword [ebp - 0x10]
jne 0x10030f25
mov esi, eax
jmp 0x10030f27
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10030ef6
push 0x133f
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jg 0x10030eae
push ecx
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9f0]
call fcn.100167dc
cmp dword [eax], 0
jne 0x10030f1e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10030f03
xor ebx, ebx
xor eax, eax
inc ebx
jmp 0x10030eae
mov esi, ebx
push ebx
lea ecx, [ebp - 0x9f0]
call fcn.100167dc
lea ecx, [edi + 4]
xor ebx, ebx
add ecx, esi
push 2
cmp dword [eax], ecx
lea ecx, [ebp - 0xbf4]
pop eax
push eax
setl bl
call fcn.100167dc
lea ecx, [ebp - 0xbf4]
mov dword [eax], ebx
call fcn.100167c0
lea ecx, [ebp - 0x9f0]
mov byte [ebp - 4], 0x19
call fcn.100167c0
mov dword [ebp - 0x18], 0xfffffffd
lea ecx, [ebp - 0xda4]
mov dword [ebp - 0x20], 0x6525
push 4
call fcn.1001673e
mov byte [ebp - 4], 0x1e
or esi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x10030fb9
push dword [ebp - 0x38]
lea ecx, [ebp - 0xda4]
call fcn.100167dc
mov dword [eax], 0xc2f1fcc1
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
jl 0x10030f9a
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x18], eax
inc ebx
cmp dword [ebp - 0x18], esi
jg 0x100310f9
mov dword [ebp - 0x10], 0x5a83d87e
lea ecx, [ebp - 0x900]
mov dword [ebp - 0x28], 6
push 3
call fcn.1001673e
mov byte [ebp - 4], 0x1f
xor eax, eax
mov dword [ebp - 0x34], 0xffff
push 3
mov dword [ebp - 0x38], eax
pop ecx
cmp dword [ebp - 0x38], ecx
jge 0x1003101f
push ecx
pop ebx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x900]
call fcn.100167dc
mov dword [eax], 0xa73a151c
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x10030ffd
xor ebx, ebx
push 3
inc ebx
pop ecx
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10031058
cmp dword [ebp - 0x10], eax
je 0x10031031
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0xda4]
call fcn.100167dc
mov esi, dword [ebp - 0x20]
xor edx, edx
imul esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp esi, ecx
setge dl
mov dword [eax], edx
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10031060
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
xor eax, eax
add edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x18]
jle 0x10031084
mov edi, ebx
cmp dword [ebp - 0x20], eax
jne 0x10031086
mov edi, eax
push eax
lea ecx, [ebp - 0x900]
call fcn.100167dc
mov ecx, dword [ebp - 0x18]
mov esi, eax
xor eax, eax
cmp edi, ebx
sete al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp ecx, eax
mov dword [esi], edx
sbb eax, eax
neg eax
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x100310d9
mov dword [ebp - 0x44], eax
push ebx
call fcn.100167dc
mov ecx, dword [ebp - 0x28]
push 0
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x34]
pop eax
cmp dword [ebp - 0x34], 6
lea ecx, [ebp - 0x900]
je 0x100310bf
mov byte [ebp - 4], 0x1e
call fcn.100167c0
dec dword [ebp - 0x18]
or esi, 0xffffffff
jmp 0x10030fbf
lea ecx, [ebp - 0xda4]
mov byte [ebp - 4], 0x19
call fcn.100167c0
mov dword [ebp - 0x40], 0x974b666a
lea ecx, [ebp - 0xc0c]
push 4
call fcn.1001673e
mov byte [ebp - 4], 0x20
xor eax, eax
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x44], 0x5300ce3d
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10031152
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4d8], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003113e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10031176
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xc0c]
call fcn.100167dc
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1003115b
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003118d
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x4d4]
mov eax, dword [ebp - 0x10]
cmp eax, 0x4d07ddbf
setl cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
neg eax
je 0x100311b3
mov eax, dword [ebp - 0x4d4]
push ebx
lea ecx, [ebp - 0xc0c]
call fcn.100167dc
xor edx, edx
push 2
mov dword [eax], 0xbfb66feb
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4d8]
dec dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4d8]
cmp ecx, eax
pop eax
setg dl
lea ecx, [ebp - 0xc0c]
add edx, eax
mov dword [ebp - 0x44], edx
mov byte [ebp - 4], 0x19
call fcn.100167c0
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10031268
mov dword [ebp - 0x20], 0xcea5d6c0
mov dword [ebp - 0x2c], 0x891c5534
mov dword [ebp - 0x20], 0xffffffed
jmp 0x1003123d
mov dword [ebp - 0x38], 0xeede0b40
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x38], eax
jmp 0x10031234
dec dword [ebp - 0x40]
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe6
jge 0x1003122e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x18
jge 0x1003121c
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10031261
push eax
push eax
push eax
push eax
push 0x24fb
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
lea ecx, [ebp - 0x4d0]
call fcn.1001673e
mov byte [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x2c], 0x9ea9831
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x100312a7
push dword [ebp - 0x38]
lea ecx, [ebp - 0x4d0]
call fcn.100167dc
mov dword [eax], 0xdb3ae355
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x10031289
xor eax, eax
push eax
lea ecx, [ebp - 0x4d0]
call fcn.100167dc
and dword [eax], 0
jmp 0x100312ec
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100312cb
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
push eax
lea ecx, [ebp - 0x4d0]
call fcn.100167dc
cmp dword [eax], 0
jne 0x100312ff
xor eax, eax
lea ecx, [ebp - 0x4d0]
push eax
call fcn.100167dc
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x4d0]
push eax
call fcn.100167dc
cmp dword [eax], 0xa
jg 0x100312b8
lea ecx, [ebp - 0x4d0]
mov byte [ebp - 4], 0x19
call fcn.100167c0
push 3
pop edi
mov dword [ebp - 0x10], edi
xor eax, eax
mov esi, 0xbe1552b9
cmp dword [ebp - 0x10], eax
jl 0x10032bb8
jmp 0x10031328
mov dword [ebp - 0x20], 0xd06ce125
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x1003134f
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x828], 0xfffffff8
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x10031337
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1003136f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x828], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10031357
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031387
push eax
push 0x804
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor eax, eax
mov dword [ebp - 0x34], edi
push 2
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ecx
jge 0x100313b3
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x7bc], ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x1003139f
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x10031408
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x7bc], 0
je 0x100313e4
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x7bc]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x7bc], ecx
test ecx, ecx
je 0x100313e4
mov ecx, ebx
jmp 0x100313e8
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x24]
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10031401
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
dec dword [ebp - 0x24]
jns 0x100313bb
xor eax, eax
mov dword [ebp - 0x20], 0xf
jmp 0x10031433
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031430
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jge 0x10031411
mov dword [ebp - 0x2c], 4
lea ecx, [ebp - 0x404]
push ebx
call fcn.1001673e
mov byte [ebp - 4], 0x22
xor eax, eax
mov dword [ebp - 0x2c], 0x49d585ed
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x1003147b
push dword [ebp - 0x38]
lea ecx, [ebp - 0x404]
call fcn.100167dc
and dword [eax], 0
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x10031460
xor eax, eax
push eax
lea ecx, [ebp - 0x404]
call fcn.100167dc
and dword [eax], 0
jmp 0x10031517
mov dword [ebp - 0x20], 0x57102d14
mov dword [ebp - 0x2c], 0x33843046
mov dword [ebp - 0x2c], 0x9dd952ea
mov dword [ebp - 0x20], 0x15
jmp 0x10031501
xor eax, eax
lea ecx, [ebp - 0x404]
push eax
call fcn.100167dc
push 2
pop ecx
cmp dword [eax], ecx
jl 0x1003148f
xor eax, eax
lea ecx, [ebp - 0x404]
push eax
call fcn.100167dc
lea ecx, [ebp - 0x404]
mov byte [ebp - 4], 0x19
mov dword [eax], 0x9acf2579
call fcn.100167c0
mov dword [ebp - 0x34], edi
xor eax, eax
cmp dword [ebp - 0x34], eax
jl 0x10032806
or esi, 0xffffffff
lea ecx, [ebp - 0xc54]
mov dword [ebp - 4], esi
call fcn.100167c0
mov dword [ebp - 0x44], 0x692beaa3
lea ecx, [ebp - 0x730]
mov dword [ebp - 0x2c], 0x2d149fe
mov dword [ebp - 0x28], 0xf69f7fd1
push 8
pop eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
push ebx
call fcn.1001673e
mov dword [ebp - 4], 0x39
xor eax, eax
push 2
mov dword [ebp - 0x54], ebx
pop ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10032c2e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7b4], 0x464f16ef
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10032c16
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10032c4a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1538], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10032c36
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10032c73
push dword [ebp - 0x18]
lea ecx, [ebp - 0x730]
call fcn.100167dc
mov dword [eax], 0xa6ff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10032c52
push 2
xor eax, eax
pop ecx
cmp dword [ebp - 0x44], eax
je 0x10032ce3
push ecx
mov dword [ebp - 0x2c], 0x579253a3
lea ecx, [ebp - 0x10a0]
mov dword [ebp - 0x2c], 0xfffffffc
call fcn.1001673e
xor eax, eax
mov byte [ebp - 4], 0x3a
mov dword [ebp - 0x2c], eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10032cc5
push ecx
pop ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x10a0]
call fcn.100167dc
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032ca8
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x730]
call fcn.100167dc
lea ecx, [ebp - 0x10a0]
inc dword [eax]
call fcn.100167c0
jmp 0x10032df2
push edi
lea ecx, [ebp - 0xa08]
call fcn.1001673e
mov byte [ebp - 4], 0x3b
xor eax, eax
mov dword [ebp - 0x40], 0x9d0863e8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10032d22
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa08]
call fcn.100167dc
mov dword [eax], 0x32e0c280
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10032d04
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032d38
push 0x1d00
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
lea ecx, [ebp - 0x730]
call fcn.100167dc
cmp dword [eax], 0
jne 0x10032ddf
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0xa08]
neg esi
sbb esi, esi
xor eax, eax
push eax
neg esi
call fcn.100167dc
mov ecx, dword [ebp - 0x54]
xor edx, edx
cmp esi, ecx
mov edi, eax
push 8
setle dl
neg edx
pop eax
cmp eax, edx
mov eax, dword [ebp - 0x64]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, ebx
lea ecx, [ebp - 0x730]
setle dl
xor ebx, ebx
sub eax, edx
cmp eax, dword [edi]
setle bl
xor eax, eax
push eax
call fcn.100167dc
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0xa08]
mov esi, dword [eax]
setg dl
xor ebx, ebx
sub esi, edx
inc ebx
push ebx
call fcn.100167dc
xor ecx, ecx
cmp esi, dword [eax]
setl cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
neg eax
je 0x10032dd5
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10032ddf
jmp 0x10032dd7
xor eax, eax
cmp dword [ebp - 0x7b4], eax
je 0x10032de1
mov eax, ebx
lea ecx, [ebp - 0xa08]
mov dword [ebp - 0x28], eax
call fcn.100167c0
or esi, 0xffffffff
lea ecx, [ebp - 0x730]
mov dword [ebp - 4], esi
call fcn.100167c0
push 4
lea ecx, [ebp - 0x194]
call fcn.1001673e
xor eax, eax
mov dword [ebp - 4], 0x3c
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10032e35
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x824], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10032e21
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10032e60
push dword [ebp - 0x18]
lea ecx, [ebp - 0x194]
call fcn.100167dc
mov dword [eax], 0xe83c773
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10032e3e
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x18], eax
jmp 0x10032e76
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x560], 0xe075257
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10032e65
push ecx
lea ecx, [ebp - 0x194]
call fcn.100167dc
push 3
pop edi
push edi
and dword [eax], 0
lea ecx, [ebp - 0x194]
call fcn.100167dc
push 2
pop ecx
cmp dword [eax], ecx
jg 0x10032f77
mov dword [ebp - 0x10], 0xad86e52d
lea ecx, [ebp - 0x930]
push edi
call fcn.1001673e
xor eax, eax
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0x10], eax
jmp 0x10032ed5
push edi
lea ecx, [ebp - 0x194]
call fcn.100167dc
mov eax, dword [ebp - 0x824]
lea ecx, [ebp - 0x194]
push ebx
call fcn.100167dc
xor edx, edx
and dword [eax], 0
mov eax, dword [ebp - 0x824]
cmp eax, ebx
mov eax, dword [ebp - 0x824]
setle dl
xor ecx, ecx
neg edx
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 0x558]
jge 0x1003300b