Function at 0x1002fb43
Capabilities:
Check os version
Connect pipe
Create pipe
Create process on windows
Delete registry key
Delete registry value
Enumerate files on windows
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk information
Get memory capacity
Identify system language via api
Parse pe header
Query or enumerate registry key
Query service status
Resume thread
Set registry value
Set thread local storage value

Disassembly:
mov eax, 0x1007c196
call fcn.1007ac40
mov eax, 0x13b4
call fcn.100773f0
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x5c], ecx
inc esi
mov byte [ebp - 0x71], dl
push edi
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x9a8]
mov dword [ebp - 0x1c], 0xcb13638e
mov dword [ebp - 0x4c], 0x3423637b
push esi
call fcn.10016a6e
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], 0x137d3709
push 2
mov dword [ebp - 0x28], eax
pop ebx
cmp dword [ebp - 0x28], ebx
jge 0x1002fbaf
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xdc0], 6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002fb97
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002fbcf
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x374], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002fbb7
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002fbe8
push dword [ebp - 0x28]
lea ecx, [ebp - 0x9a8]
call fcn.10016adb
and dword [eax], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002fbd4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002fc71
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xdbc], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp - 0x374]
mov ecx, dword [ebp - 0x4c]
sub ecx, eax
je 0x1002fc20
mov edx, esi
jmp 0x1002fc24
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x374]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne cl
neg eax
sub eax, ecx
lea ecx, [ebp - 0x9a8]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push eax
call fcn.10016adb
mov edx, dword [ebp - 0x374]
mov esi, eax
mov ecx, dword [ebp - 0x1c]
xor eax, eax
cmp ecx, edx
setne al
mov dword [esi], eax
xor esi, esi
mov eax, dword [ebp - 0x370]
inc esi
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x38], 0xe41b0ce7
lea ecx, [ebp - 0x9a8]
or dword [ebp - 4], 0xffffffff
call fcn.10016ad6
xor eax, eax
mov dword [ebp - 0x918], eax
mov dword [ebp - 0x914], eax
mov dword [ebp - 0x910], eax
mov dword [ebp - 0x90c], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x44], 0xfffffff8
push 3
mov dword [ebp - 0x34], 0xc8d3c891
pop edi
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x1002fd2d
mov dword [ebp - 0x4c], 4
dec dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
jg 0x1002fd28
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x918]
mov eax, dword [ebp - 0x1c]
sub ecx, dword [ebp + eax*4 - 0x918]
je 0x1002fd0e
mov dword [ebp - 0x38], 0x15d7249a
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002fd1e
push eax
push eax
push 0x1155
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x1002fd1e
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002fd1e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jle 0x1002fccf
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002fcbd
mov ecx, 0xdd1e1e87
mov dword [ebp - 0x534], ecx
mov dword [ebp - 0x530], ecx
mov dword [ebp - 0x52c], ecx
mov dword [ebp - 0x528], ecx
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], edi
jge 0x1002fd66
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x1160], esi
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], edi
jl 0x1002fd52
xor eax, eax
mov dword [ebp - 0x52c], eax
jmp 0x1002fdb8
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jg 0x1002fdb2
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002fd93
push eax
push esi
push 0x17bd
push eax
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
push 0
mov eax, dword [ebp + eax*4 - 0x1160]
cmp eax, ebx
pop eax
setle cl
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x1002fd79
inc dword [ebp - 0x52c]
cmp dword [ebp - 0x52c], ebx
jle 0x1002fd6e
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002fde5
push 0x973
push 0xebe
push eax
push eax
push 0xb27
push 0x2267
call dword [sym.imp.USER32.dll_ToUnicode]
mov dword [ebp - 0x2c], 0x8bbca631
lea ecx, [ebp - 0x5f0]
mov dword [ebp - 0x4c], 9
mov dword [ebp - 0x44], 0x5dae5a60
push 4
call fcn.10016a6e
mov dword [ebp - 4], esi
lea ecx, [ebp - 0xbd0]
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x10], 0x7278fa8f
push esi
call fcn.10016a6e
mov byte [ebp - 4], bl
xor eax, eax
mov dword [ebp - 0x38], 0xe291920b
mov dword [ebp - 0x3c], 0x6fd8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002fe5c
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5f0]
call fcn.10016adb
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002fe40
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002fe78
push dword [ebp - 0x18]
lea ecx, [ebp - 0xbd0]
call fcn.10016adb
mov dword [eax], 0x720348f4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002fe61
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x5f0]
mov eax, dword [ebp - 0x4c]
xor eax, eax
push eax
call fcn.10016adb
xor eax, eax
lea ecx, [ebp - 0x5f0]
push eax
call fcn.10016adb
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xbd0]
xor eax, eax
push eax
call fcn.10016adb
push esi
lea ecx, [ebp - 0x5f0]
dec dword [eax]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.10016adb
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002fee1
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea ecx, [ebp - 0xbd0]
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5f0]
call fcn.10016ad6
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov dword [ebp - 0x2c], edi
mov edi, dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x100304a0
mov dword [ebp - 0x38], 0x971c
lea ecx, [ebp - 0x9c0]
mov dword [ebp - 0x44], 0x4768c0aa
mov dword [ebp - 0x4c], 3
push 4
call fcn.10016a6e
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x764]
mov dword [ebp - 0x34], 0x3859
xor eax, eax
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 0x44], 0xa97f51ef
mov dword [ebp - 0x44], eax
push esi
call fcn.10016a6e
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x1c], 0x8f49235
mov dword [ebp - 0x24], 0x4643a64e
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1002ff94
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1354], 0x978f3c34
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x1002ff7b
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1002ffbc
push dword [ebp - 0x30]
lea ecx, [ebp - 0x9c0]
call fcn.10016adb
mov dword [eax], 0x5cc2
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x1002ff9d
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jge 0x1002ffe2
push dword [ebp - 0x30]
lea ecx, [ebp - 0x764]
call fcn.10016adb
mov dword [eax], 0x3eb61943
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x1002ffc4
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x10030004
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x11f0], 5
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x1002ffeb
xor eax, eax
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x764]
push eax
call fcn.10016adb
mov dword [eax], esi
inc dword [ebp - 0x1c]
test esi, esi
jne 0x10030068
mov eax, dword [ebp - 0x34]
neg eax
cmp eax, dword [ebp - 0x4c]
jle 0x1003004f
xor eax, eax
lea ecx, [ebp - 0x764]
push eax
call fcn.10016adb
mov edx, dword [ebp - 0x11f0]
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x5438
setg cl
mov dword [eax], ecx
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
setge dl
add edx, 4
cmp dword [ebp - 0x24], edx
jle 0x10030068
xor eax, eax
jmp 0x1003006b
xor eax, eax
inc eax
cmp dword [ebp - 0x38], eax
jl 0x100300a4
mov dword [ebp - 0x34], 3
xor eax, eax
cmp dword [ebp - 0x34], eax
jl 0x10030139
xor ebx, ebx
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x9c0]
push dword [ebp - 0x34]
call fcn.10016adb
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x34]
jns 0x10030084
jmp 0x10030131
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x100300be
push eax
push 0xca8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x10030137
xor ebx, ebx
mov byte [ebp - 0x3d], bl
cmp byte [ebp - 0x3d], bl
je 0x100300d8
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov byte [ebp - 0x3d], bl
cmp byte [ebp - 0x3d], bl
je 0x10030128
push 0x1a95
push 0xbb4
push ebx
push ebx
push 0x26d0
push 0x208f
push 0x22ac
push 0x119b
push 0x144b
push 0x1abe
push 0x1933
push 0x17d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x100300c9
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor eax, eax
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x764]
neg esi
push eax
sbb esi, esi
neg esi
call fcn.10016adb
lea ecx, [ebp - 0x764]
mov dword [eax], esi
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c0]
call fcn.10016ad6
mov dword [ebp - 0x34], 0xfffffffd
xor eax, eax
mov dword [ebp - 0x44], 0xfa147b80
xor esi, esi
mov dword [ebp - 0x44], 0xfffffff9
inc esi
mov dword [ebp - 0x44], 4
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], esi
jge 0x100301ab
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0xe88], 0x624039b
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], esi
jl 0x10030193
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10030235
mov dword [ebp - 0x58], 0x976ff55e
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x44], 0xd1f2e966
mov dword [ebp - 0x58], eax
jmp 0x1003022d
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], esi
jge 0x100301f4
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0xd50], 5
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], esi
jl 0x100301dc
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030213
push 0x2432
push eax
push eax
push eax
push 0x213
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x10030225
mov dword [ebp - 0x4c], 0x27f7b6fe
dec dword [ebp - 0x4c]
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], eax
jle 0x10030218
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], eax
jle 0x100301cd
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jle 0x100301b3
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003025d
push eax
push eax
push eax
push eax
push 0x1e5f
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003026b
push eax
call edi
xor eax, eax
mov dword [ebp - 0x4c], 0xb0b0
mov dword [ebp - 0x4c], 0xffffffff
cmp dword [ebp - 0x4c], eax
mov byte [ebp - 0x3d], al
je 0x10030296
cmp byte [ebp - 0x3d], 0
je 0x100302a5
push eax
push 0x8d9
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100302a3
cmp byte [ebp - 0x3d], 0
je 0x100302a5
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor eax, eax
mov dword [ebp - 0x1c], 0xdb3ae355
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x100302ce
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x608], 0x38ab659d
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 3
jl 0x100302b5
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x16
je 0x10030492
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x1003046c
mov dword [ebp - 0x20], 0x2e8588d0
mov dword [ebp - 0x28], 0x1fbc9fa8
mov dword [ebp - 0x4c], 2
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], eax
jl 0x1003044c
xor ebx, ebx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfaf07207
mov ecx, dword [ebp - 0x18]
sbb edx, edx
inc edx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp edx, ecx
setle al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x608]
imul eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x20]
je 0x100303af
mov dword [ebp - 0x38], 0x77d6446b
mov dword [ebp - 0x28], 0x18
jmp 0x100303a7
mov dword [ebp - 0x4c], 0xe7504ed0
mov eax, dword [ebp - 0x600]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x608], ebx
je 0x10030381
mov edx, esi
cmp dword [ebp - 0x4c], ebx
jne 0x10030383
mov edx, ebx
mov eax, dword [ebp - 0x604]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
test ecx, ecx
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x4c], ecx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff2
jle 0x1003035b
jmp 0x100303d0
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], ebx
jl 0x100303d0
mov byte [ebp - 0x3d], bl
cmp byte [ebp - 0x3d], bl
je 0x100303cb
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
dec dword [ebp - 0x28]
jns 0x100303bb
mov dword [ebp - 0x28], 0xfffffff5
jmp 0x1003043b
mov dword [ebp - 0x38], 0xffff
mov dword [ebp - 0x4c], 0xaecaa70
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
sub ecx, 0xfff9
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
mov ecx, 0x461d0ee3
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul eax, eax, 0xfffb
sub ecx, eax
add ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setl dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
add edx, 0xffffb8d1
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp + eax*4 - 0x608]
mov dword [ebp - 0x24], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xa
jl 0x100303d9
dec dword [ebp - 0x20]
jns 0x10030318
xor eax, eax
mov dword [ebp - 0x20], 0x10
jmp 0x10030463
cmp dword [ebp - 0x24], eax
jne 0x10030469
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], 0xffffffe7
jle 0x10030455
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe5
jl 0x100302f1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x16
push 0
pop eax
jne 0x100302db
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003049d
call ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x14
jge 0x1002ff0f
mov dword [ebp - 0x2c], 0x8bbca631
mov dword [ebp - 0x2c], 3
cmp dword [ebp - 0x2c], 0x14
jl 0x100304e4
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100304ce
push eax
call edi
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100304db
call ebx
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x14
jge 0x100304c0
mov dword [ebp - 0x2c], 0x8bbca631
mov dword [ebp - 0x2c], 3
cmp dword [ebp - 0x2c], 0x14
jl 0x1003051e
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030508
push eax
call edi
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030515
call ebx
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x14
jge 0x100304fa
mov dword [ebp - 0x20], 0x76b0f738
lea ecx, [ebp - 0x9d8]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0xd30], esi
mov dword [ebp - 0xd2c], esi
mov dword [ebp - 0xd28], esi
mov dword [ebp - 0xd24], esi
push 4
call fcn.10016a6e
xor eax, eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1003057a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x100], 0x70f9e3d3
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10030562
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10030598
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x968], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x10030583
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x100305b4
push dword [ebp - 0x28]
lea ecx, [ebp - 0x9d8]
call fcn.10016adb
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1003059d
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
cmp dword [ebp - 0x20], 0xffffffff
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setg cl
xor edx, edx
cmp ecx, 0x213e
mov dword [ebp - 0x100], ecx
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0x7ad53a38
jl 0x10030611
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0x100]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100306ba
mov dword [ebp - 0x20], eax
jmp 0x100306af
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x18], 0xfffffff7
jmp 0x10030669
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x2c], eax
jmp 0x10030660
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x34], eax
jne 0x10030666
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 8
jl 0x10030655
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
je 0x10030642
mov dword [ebp - 0x34], eax
jmp 0x100306a7
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1003068c
push eax
push 0xcb6
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100306a4
push eax
push 0xcb6
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jle 0x10030674
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x36
jle 0x10030636
jmp 0x1003079f
mov dword [ebp - 0x48], 0x523e
lea ecx, [ebp - 0xc6c]
push 3
call fcn.10016a6e
xor eax, eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x2c], eax
jmp 0x100306ed
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc6c]
call fcn.10016adb
and dword [eax], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x100306d9
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
cmp eax, esi
setle cl
xor eax, eax
cmp ecx, 0x76dcb0c7
setge al
cmp eax, dword [ebp - 0x48]
jle 0x10030717
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10030719
mov eax, esi
xor ebx, ebx
lea ecx, [ebp - 0xc6c]
cmp eax, 0x56eb3e19
push esi
setg bl
call fcn.10016adb
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x48]
cmp ebx, eax
mov eax, dword [ebp - 0x48]
setg cl
xor edx, edx
cmp eax, ecx
setge dl
xor ecx, ecx
mov dword [ebp - 0x100], edx
mov eax, dword [ebp - 0x968]
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x968]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setne dl
cmp edx, dword [ebp - 0x20]
jg 0x1003077c
xor eax, eax
cmp dword [ebp - 0xd30], eax
jne 0x1003077c
mov esi, eax
push 2
lea ecx, [ebp - 0x9d8]
call fcn.10016adb
lea ecx, [ebp - 0xc6c]
mov dword [eax], esi
call fcn.10016ad6
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor esi, esi
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9d8]
call fcn.10016ad6
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0xb7c]
mov dword [ebp - 0x1c], 0xcb13638e
mov dword [ebp - 0x4c], 0x3423637b
push esi
call fcn.10016a6e
mov dword [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x38], 0x137d3709
push 2
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x100307fe
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xdd4], 6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x100307e6
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1003081e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x388], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10030806
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10030837
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb7c]
call fcn.10016adb
and dword [eax], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10030823
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100308c0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xdd0], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp - 0x388]
mov ecx, dword [ebp - 0x4c]
sub ecx, eax
je 0x1003086f
mov edx, esi
jmp 0x10030873
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x388]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne cl
neg eax
sub eax, ecx
lea ecx, [ebp - 0xb7c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push eax
call fcn.10016adb
mov edx, dword [ebp - 0x388]
mov esi, eax
mov ecx, dword [ebp - 0x1c]
xor eax, eax
cmp ecx, edx
setne al
mov dword [esi], eax
xor esi, esi
mov eax, dword [ebp - 0x384]
inc esi
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x38], 0xe41b0ce7
lea ecx, [ebp - 0xb7c]
or dword [ebp - 4], 0xffffffff
call fcn.10016ad6
mov dword [ebp - 0x10], 0x8bbca631
xor eax, eax
mov dword [ebp - 0x950], eax
mov dword [ebp - 0x94c], eax
mov dword [ebp - 0x948], eax
mov dword [ebp - 0x944], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x44], 0xfffffff8
push 3
mov dword [ebp - 0x34], 0xc8d3c891
pop ecx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x1003098a
mov dword [ebp - 0x4c], 4
dec dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ecx
jg 0x1003097f
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x950]
mov eax, dword [ebp - 0x1c]
sub ecx, dword [ebp + eax*4 - 0x950]
je 0x10030964
mov dword [ebp - 0x38], 0x15d7249a
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x3d], bl
cmp byte [ebp - 0x3d], bl
je 0x10030972
push ebx
push ebx
push 0x1155
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x10030972
mov byte [ebp - 0x3d], bl
cmp byte [ebp - 0x3d], bl
je 0x10030972
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
inc dword [ebp - 0x34]
push 3
pop ecx
cmp dword [ebp - 0x34], ecx
jle 0x10030927
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10030913
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x14
jl 0x10031239
jmp 0x1003099e
push 3
xor eax, eax
pop ecx
mov edx, 0xdd1e1e87
mov dword [ebp - 0x554], edx
mov dword [ebp - 0x550], edx
mov dword [ebp - 0x54c], edx
mov dword [ebp - 0x548], edx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jge 0x100309d7
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x11a8], esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x100309c3
xor eax, eax
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 2
jg 0x10030a3e
xor ebx, ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], ebx
jmp 0x10030a21
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x3d], bl
cmp byte [ebp - 0x3d], bl
je 0x10030a09
push ebx
push esi
push 0x17bd
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x11a8]
cmp eax, 2
setle cl
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jle 0x100309f0
inc dword [ebp - 0x54c]
cmp dword [ebp - 0x54c], 2
jle 0x100309e8
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030a63
push 0x973
push 0xebe
push eax
push eax
push 0xb27
push 0x2267
call dword [sym.imp.USER32.dll_ToUnicode]
mov dword [ebp - 0x38], 0x971c
lea ecx, [ebp - 0x9f0]
mov dword [ebp - 0x44], 0x4768c0aa
mov dword [ebp - 0x4c], 3
push 4
call fcn.10016a6e
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x6d4]
mov dword [ebp - 0x34], 0x3859
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x44], 0xa97f51ef
mov dword [ebp - 0x44], eax
push esi
call fcn.10016a6e
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x1c], 0x8f49235
mov dword [ebp - 0x24], 0x4643a64e
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x10030ae8
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x136c], 0x978f3c34
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x10030acf
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x10030b10
push dword [ebp - 0x30]
lea ecx, [ebp - 0x9f0]
call fcn.10016adb
mov dword [eax], 0x5cc2
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x10030af1
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jge 0x10030b36
push dword [ebp - 0x30]
lea ecx, [ebp - 0x6d4]
call fcn.10016adb
mov dword [eax], 0x3eb61943
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x10030b18
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x10030b58
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1208], 5
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x10030b3f
xor eax, eax
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x6d4]
push eax
call fcn.10016adb
mov dword [eax], esi
inc dword [ebp - 0x1c]
test esi, esi
jne 0x10030bbc
mov eax, dword [ebp - 0x34]
neg eax
cmp eax, dword [ebp - 0x4c]
jle 0x10030ba3
xor eax, eax
lea ecx, [ebp - 0x6d4]
push eax
call fcn.10016adb
mov edx, dword [ebp - 0x1208]
sub edx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x5438
setg cl
mov dword [eax], ecx
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
setge dl
add edx, 4
cmp dword [ebp - 0x24], edx
jle 0x10030bbc
xor eax, eax
jmp 0x10030bbf
xor eax, eax
inc eax
cmp dword [ebp - 0x38], eax
jl 0x10030bf8
mov dword [ebp - 0x34], 3
xor eax, eax
cmp dword [ebp - 0x34], eax
jl 0x10030c8d
xor ebx, ebx
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x9f0]
push dword [ebp - 0x34]
call fcn.10016adb
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x34]
jns 0x10030bd8
jmp 0x10030c85
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10030c12
push eax
push 0xca8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x10030c8b
xor ebx, ebx
mov byte [ebp - 0x3d], bl
cmp byte [ebp - 0x3d], bl
je 0x10030c2c
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov byte [ebp - 0x3d], bl
cmp byte [ebp - 0x3d], bl
je 0x10030c7c
push 0x1a95
push 0xbb4
push ebx
push ebx
push 0x26d0
push 0x208f
push 0x22ac
push 0x119b
push 0x144b
push 0x1abe
push 0x1933
push 0x17d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x10030c1d
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor eax, eax
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x6d4]
neg esi
push eax
sbb esi, esi
neg esi
call fcn.10016adb
lea ecx, [ebp - 0x6d4]
mov dword [eax], esi
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9f0]
call fcn.10016ad6
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10030d03
mov dword [ebp - 0x4c], 0xb0b0
mov dword [ebp - 0x4c], 0xffffffff
cmp dword [ebp - 0x4c], eax
mov byte [ebp - 0x3d], al
je 0x10030cf2
cmp byte [ebp - 0x3d], al
je 0x10030d00
push eax
push 0x8d9
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10030cfe
cmp byte [ebp - 0x3d], al
je 0x10030d00
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor eax, eax
push eax
call edi
mov dword [ebp - 0x4c], 9
lea ecx, [ebp - 0x620]
mov dword [ebp - 0x44], 0x5dae5a60
push 4
call fcn.10016a6e
xor esi, esi
mov dword [ebp - 4], 0xa
inc esi
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x2c], 0x7278fa8f
lea ecx, [ebp - 0xc0c]
push esi
call fcn.10016a6e
mov byte [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x38], 0xe291920b
mov dword [ebp - 0x3c], 0x6fd8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10030d7b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x620]
call fcn.10016adb
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10030d5f
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10030d97
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc0c]
call fcn.10016adb
mov dword [eax], 0x720348f4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10030d80
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x620]
mov eax, dword [ebp - 0x4c]
xor eax, eax
push eax
call fcn.10016adb
xor eax, eax
lea ecx, [ebp - 0x620]
push eax
call fcn.10016adb
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xc0c]
xor eax, eax
push eax
call fcn.10016adb
push esi
lea ecx, [ebp - 0x620]
dec dword [eax]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
call fcn.10016adb
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10030e00
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea ecx, [ebp - 0xc0c]
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x620]
call fcn.10016ad6
mov dword [ebp - 0x58], 0xfffffffd
xor eax, eax
mov dword [ebp - 0x44], 0xfa147b80
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x44], 4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x10030e58
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xd54], 0x624039b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x10030e40
xor eax, eax
mov dword [ebp - 0x58], eax
jmp 0x10030ee2
mov dword [ebp - 0x48], 0x976ff55e
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x44], 0xd1f2e966
mov dword [ebp - 0x48], eax
jmp 0x10030eda
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x10030ea1
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xd5c], 5
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x10030e89
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030ec0
push 0x2432
push eax
push eax
push eax
push 0x213
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10030ed2
mov dword [ebp - 0x4c], 0x27f7b6fe
dec dword [ebp - 0x4c]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x10030ec5
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], eax
jle 0x10030e7a
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], eax
jle 0x10030e60
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030f0a
push eax
push eax
push eax
push eax
push 0x1e5f
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
mov byte [ebp - 0x11], al
mov dword [ebp - 0x1c], 0xdb3ae355
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10030f36
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x72c], 0x38ab659d
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x10030f1d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x16
je 0x100310fa
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x100310d4
mov dword [ebp - 0x20], 0x2e8588d0
mov dword [ebp - 0x28], 0x1fbc9fa8
mov dword [ebp - 0x4c], 2
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], eax
jl 0x100310b4
xor ebx, ebx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfaf07207
mov ecx, dword [ebp - 0x18]
sbb edx, edx
inc edx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp edx, ecx
setle al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x72c]
imul eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x20]
je 0x10031017
mov dword [ebp - 0x38], 0x77d6446b
mov dword [ebp - 0x28], 0x18
jmp 0x1003100f
mov dword [ebp - 0x4c], 0xe7504ed0
mov eax, dword [ebp - 0x724]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x72c], ebx
je 0x10030fe9
mov edx, esi
cmp dword [ebp - 0x4c], ebx
jne 0x10030feb
mov edx, ebx
mov eax, dword [ebp - 0x728]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
test ecx, ecx
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x4c], ecx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff2
jle 0x10030fc3
jmp 0x10031038
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], ebx
jl 0x10031038
mov byte [ebp - 0x3d], bl
cmp byte [ebp - 0x3d], bl
je 0x10031033
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
dec dword [ebp - 0x28]
jns 0x10031023
mov dword [ebp - 0x28], 0xfffffff5
jmp 0x100310a3
mov dword [ebp - 0x38], 0xffff
mov dword [ebp - 0x4c], 0xaecaa70
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
sub ecx, 0xfff9
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
mov ecx, 0x461d0ee3
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul eax, eax, 0xfffb
sub ecx, eax
add ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setl dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
add edx, 0xffffb8d1
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp + eax*4 - 0x72c]
mov dword [ebp - 0x24], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xa
jl 0x10031041
dec dword [ebp - 0x20]
jns 0x10030f80
xor eax, eax
mov dword [ebp - 0x20], 0x10
jmp 0x100310cb
cmp dword [ebp - 0x24], eax
jne 0x100310d1
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], 0xffffffe7
jle 0x100310bd
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe5
jl 0x10030f59
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x16
push 0
pop eax
jne 0x10030f43
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
cmp byte [ebp - 0x11], 0
je 0x1003122c
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0xa08]
mov dword [ebp - 0x1c], 0xcb13638e
mov dword [ebp - 0x4c], 0x3423637b
push esi
call fcn.10016a6e
mov dword [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x38], 0x137d3709
push 2
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x10031154
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xde8], 6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1003113c
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x10031174
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x368], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1003115c
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1003118d
push dword [ebp - 0x28]
lea ecx, [ebp - 0xa08]
call fcn.10016adb
and dword [eax], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10031179
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10031214
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xde4], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x368]
je 0x100311c3
mov edx, esi
jmp 0x100311c7
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x368]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne cl
neg eax
sub eax, ecx
lea ecx, [ebp - 0xa08]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push eax
call fcn.10016adb
mov edx, dword [ebp - 0x1c]
mov esi, eax
mov ecx, dword [ebp - 0x368]
xor eax, eax
cmp edx, ecx
setne al
mov dword [esi], eax
xor esi, esi
mov eax, dword [ebp - 0x364]
inc esi
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x38], 0xe41b0ce7
lea ecx, [ebp - 0xa08]
or dword [ebp - 4], 0xffffffff
call fcn.10016ad6
call ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x14
jge 0x10030999
movdqa xmm0, xmmword [0x10007a40]
lea eax, [ebp - 0xf84]
push eax
lea eax, [ebp - 0xf94]
push eax
lea ecx, [ebp - 0x12ac]
movdqu xmmword [ebp - 0xf94], xmm0
call fcn.10016aea
lea ecx, [ebp - 0x1dc]
mov esi, eax
call fcn.10008943
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1a4]
push dword [esi]
call fcn.10016ab0
xor edi, edi
mov dword [ebp - 4], 0xd
inc edi
lea ecx, [ebp - 0x638]
push edi
call fcn.10016a6e
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100312c5
push dword [ebp - 0x18]
lea ecx, [ebp - 0x638]
call fcn.10016adb
mov dword [eax], 0x99333c7d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100312a7
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100312e3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdfc], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100312ce
xor eax, eax
push eax
lea ecx, [ebp - 0x1a4]
call fcn.10016adb
mov esi, eax
lea ecx, [ebp - 0x1a4]
xor eax, eax
push eax
call fcn.10016adb
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x1a4]
setg bl
xor eax, eax
push eax
call fcn.10016adb
xor ecx, ecx
cmp ebx, dword [eax]
setl cl
xor eax, eax
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x1a4]
push eax
call fcn.10016adb
mov ecx, dword [ebp - 0x38]
xor ebx, ebx
push 3
cmp dword [eax], ecx
lea ecx, [ebp - 0x1a4]
setl bl
dec ebx
call fcn.10016adb
lea ecx, [ebp - 0x1a4]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, ebx
call fcn.10016adb
xor ebx, ebx
lea ecx, [ebp - 0x638]
cmp dword [eax], esi
setne bl
xor eax, eax
push eax
mov dword [ebp - 0x38], ebx
call fcn.10016adb
lea ecx, [ebp - 0x1a4]
mov dword [eax], ebx
xor eax, eax
push eax
call fcn.10016adb
mov ecx, dword [ebp - 0x38]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x1a4]
setg bl
xor eax, eax
push eax
call fcn.10016adb
cmp ebx, dword [eax]
jne 0x100313b5
xor eax, eax
lea ecx, [ebp - 0x638]
push eax
call fcn.10016adb
cmp dword [eax], 0
je 0x100313b5
mov esi, edi
xor eax, eax
jmp 0x100313b9
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x1a4]
call fcn.10016adb
lea ecx, [ebp - 0x1a4]
mov eax, dword [eax]
imul eax, esi
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
xor eax, eax
push eax
call fcn.10016adb
xor eax, eax
lea ecx, [ebp - 0x638]
push eax
call fcn.10016adb
xor ebx, ebx
lea ecx, [ebp - 0x1a4]
cmp dword [eax], ebx
setne bl
xor eax, eax
push eax
call fcn.10016adb
xor ecx, ecx
push 3
cmp ebx, dword [eax]
setg cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x1a4]
call fcn.10016adb
lea ecx, [ebp - 0x638]
mov eax, dword [eax]
imul eax, dword [ebp - 0x38]
mov dword [ebp - 0xdf8], eax
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a4]
call fcn.10016ad6
movdqa xmm0, xmmword [0x10007a40]
lea eax, [ebp - 0x1114]
push eax
lea eax, [ebp - 0x1124]
push eax
lea ecx, [ebp - 0x12dc]
movdqu xmmword [ebp - 0x1124], xmm0
call fcn.10016aea
lea ecx, [ebp - 0x1fa]
mov esi, eax
call fcn.10008943
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x174]
push dword [esi]
call fcn.10016ab0
push edi
lea ecx, [ebp - 0x6e4]
mov dword [ebp - 4], 0xf
call fcn.10016a6e
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100314c7
push dword [ebp - 0x18]
lea ecx, [ebp - 0x6e4]
call fcn.10016adb
mov dword [eax], 0x99333c7d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100314a9
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100314e5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe10], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100314d0
xor eax, eax
push eax
lea ecx, [ebp - 0x174]
call fcn.10016adb
mov esi, eax
lea ecx, [ebp - 0x174]
xor eax, eax
push eax
call fcn.10016adb
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x174]
setg bl
xor eax, eax
push eax
call fcn.10016adb
xor ecx, ecx
cmp ebx, dword [eax]
setl cl
xor eax, eax
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x174]
push eax
call fcn.10016adb
mov ecx, dword [ebp - 0x38]
xor ebx, ebx
push 3
cmp dword [eax], ecx
lea ecx, [ebp - 0x174]
setl bl
dec ebx
call fcn.10016adb
lea ecx, [ebp - 0x174]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, ebx
call fcn.10016adb
xor ebx, ebx
lea ecx, [ebp - 0x6e4]
cmp dword [eax], esi
setne bl
xor eax, eax
push eax
mov dword [ebp - 0x38], ebx
call fcn.10016adb
lea ecx, [ebp - 0x174]
mov dword [eax], ebx
xor eax, eax
push eax
call fcn.10016adb
mov ecx, dword [ebp - 0x38]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x174]
setg bl
xor eax, eax
push eax
call fcn.10016adb
cmp ebx, dword [eax]
jne 0x100315b7
xor eax, eax
lea ecx, [ebp - 0x6e4]
push eax
call fcn.10016adb
cmp dword [eax], 0
je 0x100315b7
mov esi, edi
xor eax, eax
jmp 0x100315bb
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x174]
call fcn.10016adb
lea ecx, [ebp - 0x174]
mov eax, dword [eax]
imul eax, esi
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
xor eax, eax
push eax
call fcn.10016adb
xor eax, eax
lea ecx, [ebp - 0x6e4]
push eax
call fcn.10016adb
xor ebx, ebx
lea ecx, [ebp - 0x174]
cmp dword [eax], ebx
setne bl
xor eax, eax
push eax
call fcn.10016adb
xor ecx, ecx
push 3
cmp ebx, dword [eax]
setg cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x174]
call fcn.10016adb
lea ecx, [ebp - 0x6e4]
mov eax, dword [eax]
imul eax, dword [ebp - 0x38]
mov dword [ebp - 0xe0c], eax
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.10016ad6
push edi
lea ecx, [ebp - 0xcc]
call fcn.10016a6e
push edi
lea ecx, [ebp - 0xb94]
mov dword [ebp - 4], 0x11
call fcn.10016a6e
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x4c], 0x635290ce
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x24], 0xcd3624b6
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x100316a3
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x340], 0x1b3c692b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1003168a
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x100316c9
push dword [ebp - 0x28]
lea ecx, [ebp - 0xcc]
call fcn.10016adb
mov dword [eax], 0xb457102d
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x100316ab
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x100316ec
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb94]
call fcn.10016adb
or dword [eax], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x100316d1
xor eax, eax
push eax
lea ecx, [ebp - 0xcc]
call fcn.10016adb
and dword [eax], 0
jmp 0x10031872
xor eax, eax
lea ecx, [ebp - 0xcc]
push eax
call fcn.10016adb
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x340], 0
jne 0x10031889
xor eax, eax
lea ecx, [ebp - 0xcc]
push eax
call fcn.10016adb
mov esi, eax
lea ecx, [ebp - 0xcc]
xor eax, eax
push eax
call fcn.10016adb
xor ebx, ebx
mov ecx, dword [eax]
mov ecx, dword [ebp + ecx*4 - 0x340]
mov eax, dword [esi]
mov eax, dword [ebp + eax*4 - 0x340]
cmp eax, ecx
lea ecx, [ebp - 0xcc]
setg bl
xor eax, eax
push eax
call fcn.10016adb
push 0
lea ecx, [ebp - 0xb94]
cmp ebx, dword [eax]
pop ebx
setge bl
xor eax, eax
push eax
call fcn.10016adb
lea ecx, [ebp - 0xcc]
mov dword [eax], ebx
xor eax, eax
push eax
call fcn.10016adb
neg ebx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x340]
cmp ebx, eax
jg 0x100317b6
xor eax, eax
lea ecx, [ebp - 0xcc]
push eax
call fcn.10016adb
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x340], 0
jne 0x100317b6
xor eax, eax
jmp 0x100317b8
mov eax, edi
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0xcc]
xor eax, eax
push eax
call fcn.10016adb
mov esi, eax
lea ecx, [ebp - 0xcc]
xor eax, eax
push eax
call fcn.10016adb
mov ecx, dword [esi]
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0x340]
cmp dword [eax], ecx
lea ecx, [ebp - 0xcc]
setg bl
xor eax, eax
push eax
call fcn.10016adb
mov ecx, dword [ebp - 0x4c]
imul ecx, dword [eax]
add ecx, ebx
xor ebx, ebx
cmp ecx, 0x89ec
lea ecx, [ebp - 0xcc]
setge bl
xor eax, eax
push eax
call fcn.10016adb
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x340]
cmp ebx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xcc]
push eax
call fcn.10016adb
xor ebx, ebx
lea ecx, [ebp - 0xcc]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x340]
cmp dword [ebp - 0x38], eax
setl bl
xor eax, eax
push eax
call fcn.10016adb
xor ecx, ecx
cmp ebx, dword [eax]
setg cl
xor eax, eax
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xcc]
push eax
call fcn.10016adb
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0xcc]
push eax
call fcn.10016adb
cmp dword [eax], 2
jle 0x10031700
inc dword [ebp - 0x24]
lea ecx, [ebp - 0xb94]
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc]
call fcn.10016ad6
movdqa xmm0, xmmword [0x10007a40]
lea eax, [ebp - 0xfd4]
push eax
lea eax, [ebp - 0xfe4]
push eax
lea ecx, [ebp - 0x126c]
movdqu xmmword [ebp - 0xfe4], xmm0
call fcn.10016aea
lea ecx, [ebp - 0x1f6]
mov esi, eax
call fcn.10008943
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x150]
push dword [esi]
call fcn.10016ab0
push edi
lea ecx, [ebp - 0x650]
mov dword [ebp - 4], 0x13
call fcn.10016a6e
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1003192f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x650]
call fcn.10016adb
mov dword [eax], 0x99333c7d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10031911
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1003194d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe24], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10031938
xor eax, eax
push eax
lea ecx, [ebp - 0x150]
call fcn.10016adb
mov esi, eax
lea ecx, [ebp - 0x150]
xor eax, eax
push eax
call fcn.10016adb
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x150]
setg bl
xor eax, eax
push eax
call fcn.10016adb
xor ecx, ecx
cmp ebx, dword [eax]
setl cl
xor eax, eax
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x150]
push eax
call fcn.10016adb
mov ecx, dword [ebp - 0x38]
xor ebx, ebx
push 3
cmp dword [eax], ecx
lea ecx, [ebp - 0x150]
setl bl
dec ebx
call fcn.10016adb
lea ecx, [ebp - 0x150]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, ebx
call fcn.10016adb
xor ebx, ebx
lea ecx, [ebp - 0x650]
cmp dword [eax], esi
setne bl
xor eax, eax
push eax
mov dword [ebp - 0x38], ebx
call fcn.10016adb
lea ecx, [ebp - 0x150]
mov dword [eax], ebx
xor eax, eax
push eax
call fcn.10016adb
mov ecx, dword [ebp - 0x38]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x150]
setg bl
xor eax, eax
push eax
call fcn.10016adb
cmp ebx, dword [eax]
jne 0x10031a1f
xor eax, eax
lea ecx, [ebp - 0x650]
push eax
call fcn.10016adb
cmp dword [eax], 0
je 0x10031a1f
mov esi, edi
xor eax, eax
jmp 0x10031a23
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x150]
call fcn.10016adb
lea ecx, [ebp - 0x150]
mov eax, dword [eax]
imul eax, esi
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
xor eax, eax
push eax
call fcn.10016adb
xor eax, eax
lea ecx, [ebp - 0x650]
push eax
call fcn.10016adb
xor ebx, ebx
lea ecx, [ebp - 0x150]
cmp dword [eax], ebx
setne bl
xor eax, eax
push eax
call fcn.10016adb
xor ecx, ecx
push 3
cmp ebx, dword [eax]
setg cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x150]
call fcn.10016adb
lea ecx, [ebp - 0x650]
mov eax, dword [eax]
imul eax, dword [ebp - 0x38]
mov dword [ebp - 0xe20], eax
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.10016ad6
movdqa xmm0, xmmword [0x10007a20]
lea eax, [ebp - 0x1094]
push eax
lea eax, [ebp - 0x10a4]
push eax
lea ecx, [ebp - 0x128c]
movdqu xmmword [ebp - 0x10a4], xmm0
call fcn.10016aea
lea ecx, [ebp - 0x20f]
mov esi, eax
call fcn.10008943
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x134]
push dword [esi]
call fcn.10016ab0
push edi
lea ecx, [ebp - 0x7dc]
mov dword [ebp - 4], 0x15
call fcn.10016a6e
mov byte [ebp - 4], 0x16
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x4c], 0x55d58009
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], eax
jmp 0x10031b30
push dword [ebp - 0x10]
lea ecx, [ebp - 0x7dc]
call fcn.10016adb
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10031b1d
push 3
lea ecx, [ebp - 0x134]
call fcn.10016adb
xor eax, eax
lea ecx, [ebp - 0x7dc]
push eax
call fcn.10016adb
lea ecx, [ebp - 0x134]
mov dword [eax], edi
xor eax, eax
mov dword [ebp - 0x24], 4
push eax
call fcn.10016adb
mov ecx, dword [ebp - 0x24]
xor ebx, ebx
push esi
cmp ecx, dword [eax]
lea ecx, [ebp - 0x134]
setle bl
sub ebx, 0x2c87
neg ebx
sbb ebx, ebx
inc ebx
call fcn.10016adb
push 3
lea ecx, [ebp - 0x134]
sub ebx, dword [eax]
mov dword [ebp - 0x38], ebx
call fcn.10016adb
mov ecx, dword [ebp - 0x38]
xor ebx, ebx
push 3
cmp ecx, dword [eax]
lea ecx, [ebp - 0x134]
setg bl
call fcn.10016adb
xor ecx, ecx
push 3
cmp ebx, dword [eax]
setne cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x134]
call fcn.10016adb
mov esi, eax
lea ecx, [ebp - 0x134]
xor eax, eax
push eax
call fcn.10016adb
mov ecx, dword [ebp - 0x4c]
xor edx, edx
cmp dword [ebp - 0x38], ecx
push 3
mov ecx, dword [eax]
setle dl
add ecx, dword [esi]
xor ebx, ebx
cmp ecx, edx
lea ecx, [ebp - 0x134]
pop esi
push esi
setne bl
call fcn.10016adb
xor ecx, ecx
push esi
cmp ebx, dword [eax]
setle cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x134]
call fcn.10016adb
mov ecx, dword [ebp - 0x38]
xor ebx, ebx
push esi
cmp dword [eax], ecx
lea ecx, [ebp - 0x134]
setge bl
call fcn.10016adb
xor ecx, ecx
cmp ebx, dword [eax]
sete cl
xor ebx, ebx
cmp ecx, 0xdbc2a41b
push edi
lea ecx, [ebp - 0x134]
setne bl
call fcn.10016adb
cmp ebx, dword [eax]
jne 0x10031d47
push 4
lea ecx, [ebp - 0x4d0]
call fcn.10016a6e
xor eax, eax
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], eax
jmp 0x10031c81
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4d0]
call fcn.10016adb
mov dword [eax], 0xffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10031c6a
push esi
lea ecx, [ebp - 0x134]
call fcn.10016adb
xor eax, eax
lea ecx, [ebp - 0x4d0]
push eax
call fcn.10016adb
mov esi, eax
lea ecx, [ebp - 0x4d0]
xor eax, eax
push eax
call fcn.10016adb
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x4d0]
setge bl
xor eax, eax
push eax
call fcn.10016adb
lea ecx, [ebp - 0x7dc]
mov esi, dword [eax]
imul esi, ebx
sub esi, 0x25cf
neg esi
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.10016adb
mov edx, dword [ebp - 0x24]
dec edx
mov eax, dword [eax]
add eax, esi
add edx, eax
mov eax, dword [ebp - 0x4c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
neg ecx
jne 0x10031d1c
push 3
lea ecx, [ebp - 0x4d0]
call fcn.10016adb
cmp dword [eax], 0
jne 0x10031d1c
xor eax, eax
mov esi, eax
jmp 0x10031d1e
mov esi, edi
push 3
lea ecx, [ebp - 0x134]
call fcn.10016adb
xor edx, edx
cmp dword [eax], esi
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x4d0]
jmp 0x10031d9f
push esi
lea ecx, [ebp - 0xa20]
call fcn.10016a6e
mov byte [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x38], 0x1847726b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10031d86
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa20]
call fcn.10016adb
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10031d68
xor eax, eax
push eax
lea ecx, [ebp - 0xa20]
call fcn.10016adb
mov dword [ebp - 0x38], 0x9e478dfc
lea ecx, [ebp - 0xa20]
call fcn.10016ad6
lea ecx, [ebp - 0x7dc]
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x134]
call fcn.10016ad6
mov dword [ebp - 0x18], 0xce57bf5c
xor eax, eax
mov dword [ebp - 0x1c], 0xeea53061
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x4c], edi
mov edi, dword [sym.imp.USER32.dll_DrawMenuBar]
mov dword [ebp - 0x4c], 9
mov dword [ebp - 0x3c], 0x718bc698
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10031dfb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10031e03
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x18]
test eax, eax
je 0x10031e28
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10031e2a
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x10031e2f
xor eax, eax
xor ebx, ebx
mov edx, eax
inc ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 0xcd76
setg al
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
jne 0x10031e58
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10031e58
cmp dword [ebp - 0x1c], eax
je 0x10031e5a
mov eax, ebx
mov ecx, dword [ebp - 0x18]
sub ecx, eax
movdqa xmm0, xmmword [0x10007a40]
sub ecx, dword [ebp - 0x1c]
neg ecx
push 0xfffffffffffffffe
sbb ecx, ecx
pop eax
inc ecx
sub eax, ecx
lea ecx, [ebp - 0x12a4]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0xff4]
push eax
lea eax, [ebp - 0x1004]
push eax
movdqu xmmword [ebp - 0x1004], xmm0
call fcn.10016aea
lea ecx, [ebp - 0x1f8]
mov esi, eax
call fcn.10008943
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x180]
push dword [esi]
call fcn.10016ab0
xor esi, esi
mov dword [ebp - 4], 0x19
inc esi
xor eax, eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031ef9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x394], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031ee0
xor eax, eax
mov dword [ebp - 0x390], eax
jmp 0x10031fb3
mov dword [ebp - 0x1c], 0xeede0b40
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffea
jg 0x10031fad
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10031f3d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1e8], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10031f28
xor eax, eax
cmp dword [ebp - 0x394], eax
jne 0x10031f48
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1e8]
xor ecx, ecx
mov eax, dword [ebp - 0x390]
mov eax, dword [ebp - 0x1e8]
mov eax, dword [ebp - 0x1e8]
mov eax, dword [ebp - 0x1e8]
mov eax, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x1e4]
cmp eax, esi
push 0
setge cl
mov dword [ebp - 0x4c], ecx
mov ecx, 0xe0f758fc
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
pop eax
setg dl
add edx, dword [ebp - 0x1e4]
mov dword [ebp - 0x38], edx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffea
jle 0x10031f1f
inc dword [ebp - 0x390]
cmp dword [ebp - 0x390], 0x1c
jne 0x10031f04
push esi
lea ecx, [ebp - 0x668]
call fcn.10016a6e
mov byte [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x1c], 0x1e87df2f
mov dword [ebp - 0x4c], 0x77d7
push 2
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jge 0x10032003
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x334], 0xf0ea
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10031feb
xor eax, eax
push 4
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10032022
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1104], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003200e
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032041
push esi
push eax
push 0x2202
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
xor eax, eax
mov dword [ebp - 0x1c], esi
mov ecx, 0x227d373e
cmp dword [ebp - 0x1c], eax
jl 0x100321ae
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x8d8], ecx
mov dword [ebp - 0x8d4], ecx
mov dword [ebp - 0x8d0], ecx
mov dword [ebp - 0x8cc], ecx
mov dword [ebp - 0x24], 0xffff
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x34], eax
jl 0x1003210e
mov dword [ebp - 0x44], esi
lea ecx, [ebp - 0xd68]
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x44], 0xe96b779c
push esi
call fcn.10016a6e
xor eax, eax
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100320d7
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd68]
call fcn.10016adb
mov dword [eax], 0x858f9c25
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100320b9
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100320ed
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1330], 0xc5440874
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100320dc
dec dword [ebp - 0x24]
lea ecx, [ebp - 0xd68]
mov byte [ebp - 4], 0x1a
call fcn.10016ad6
dec dword [ebp - 0x34]
jns 0x10032087
mov eax, dword [ebp - 0x1104]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x334]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x1104], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x334]
mov eax, dword [ebp - 0x334]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + eax*4 - 0x334]
mov ecx, dword [ebp - 0x334]
sub ecx, 0x2a6a
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
setle al
mov dword [ebp - 0x8d8], eax
test eax, eax
je 0x10032180
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x10032182
mov ecx, esi
jmp 0x10032184
xor eax, eax
mov ecx, eax
add ecx, 0x4518072
neg ecx
push 0
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x395c
mov ecx, 0x227d373e
setge al
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x1c]
pop eax
jns 0x10032052
mov dword [ebp - 0x4c], esi
lea ecx, [ebp - 0xc54]
mov dword [ebp - 0x30], 0x6dee
mov dword [ebp - 0x18], 0x7a88ff76
mov dword [ebp - 0x4c], eax
push 4
call fcn.10016a6e
mov byte [ebp - 4], 0x1c
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0x3c], 0x7f559297
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10032200
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x70], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x100321eb
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10032222
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1024], 0xfffffffc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10032209
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1003224a
push dword [ebp - 0x28]
lea ecx, [ebp - 0xc54]
call fcn.10016adb
mov dword [eax], 0xbb84a8a6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1003222b
xor eax, eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xffffffec
jne 0x1003233b
mov dword [ebp - 0x10], 0xadacd7d3
mov dword [ebp - 0x24], 0x869b7d6b
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x38], esi
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x10], 0x75cb
jle 0x10032281
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x30]
cmp eax, 0x12a72b3d
setge cl
cmp ecx, 0xf81320f2
sbb eax, eax
neg eax
inc eax
neg eax
sbb eax, eax
inc eax
cmp eax, 0xf7c629c4
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x4c6a
setg cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x30], 8
jmp 0x10032326
xor eax, eax
mov dword [ebp - 0x24], 0xfffffffd
cmp dword [ebp - 0x10], eax
jne 0x10032306
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setle dl
mov dword [ebp - 0x18], edx
xor edx, edx
mov eax, dword [ebp - 0x10]
test eax, eax
sets dl
xor ecx, ecx
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x4c], ecx
mov edx, eax
cmp dword [ebp - 0x4c], eax
je 0x10032308
mov edx, esi
mov dword [ebp - 0x24], 0xffffffff
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, edx
setle cl
xor eax, eax
test ecx, ecx
setle al
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x32
jg 0x100322c5
dec dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0xffffffec
je 0x10032257
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffec
jg 0x1003241e
jmp 0x1003234c
xor eax, eax
mov dword [ebp - 0x1c], 0xec499e98
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x30], 3
jmp 0x1003238d
mov dword [ebp - 0x10], 0xf3bec767
mov dword [ebp - 0x10], eax
jmp 0x10032384
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032381
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x19
jle 0x1003236f
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x2c
jl 0x10032363
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x1c], esi
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100323dc
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x30]
jg 0x100323b7
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xc54]
mov eax, dword [ebp - 0x1018]
push esi
call fcn.10016adb
push 0xfffffffffffffff9
pop ecx
mov dword [eax], ecx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x4c]
jl 0x100323df
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
test eax, eax
setns cl
sub ecx, 0x3ee28c35
jne 0x100323fb
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x100323fb
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1018]
mov dword [ebp - 0x24], 0xd465c301
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffec
jle 0x1003234a
lea ecx, [ebp - 0xc54]
mov byte [ebp - 4], 0x1a
call fcn.10016ad6
push ebx
lea ecx, [ebp - 0xb0]
call fcn.10016a6e
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xa38]
mov dword [ebp - 0x18], 0x12f3ccd2
push 3
call fcn.10016a6e
mov byte [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x38], 0xa889
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jge 0x1003247b
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x78], 0x261f
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x10032466
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x100324a1
push dword [ebp - 0x30]
lea ecx, [ebp - 0xb0]
call fcn.10016adb
mov dword [eax], 7
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x10032483
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x100324c5
push dword [ebp - 0x30]
lea ecx, [ebp - 0xa38]
call fcn.10016adb
mov dword [eax], esi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x100324aa
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x100324d7
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xe38], esi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x100324ca
push esi
lea ecx, [ebp - 0xb0]
call fcn.10016adb
xor ebx, ebx
lea ecx, [ebp - 0xb0]
push esi
mov dword [eax], ebx
call fcn.10016adb
cmp dword [eax], ebx
jl 0x100326ee
mov dword [ebp - 0x1c], 2
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x2c], 0xa0122d80
push esi
call fcn.10016adb
push esi
lea ecx, [ebp - 0xb0]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x78]
call fcn.10016adb
push esi
lea ecx, [ebp - 0xb0]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x78]
call fcn.10016adb
push esi
lea ecx, [ebp - 0xb0]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x18]
call fcn.10016adb
mov esi, eax
lea ecx, [ebp - 0xb0]
xor eax, eax
inc eax
push eax
call fcn.10016adb
mov ecx, dword [esi]
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0x78]
cmp ecx, dword [eax]
lea ecx, [ebp - 0xb0]
setl bl
xor esi, esi
inc esi
push esi
call fcn.10016adb
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x78]
cmp ebx, eax
setl cl
neg ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0xffffffe2
cmp dword [ebp - 0x18], 0xffffffed
jne 0x100326cb
xor eax, eax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x100326be
push esi
lea ecx, [ebp - 0xb0]
call fcn.10016adb
push esi
lea ecx, [ebp - 0xb0]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x78]
mov dword [ebp - 0x2c], eax
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x78]
cmp dword [ebp - 0x2c], eax
jl 0x10032626
push esi
lea ecx, [ebp - 0xa38]
call fcn.10016adb
mov dword [eax], esi
cmp dword [ebp - 0x10], esi
jg 0x10032610
push esi
lea ecx, [ebp - 0xb0]
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x10], 0xa4ef
test eax, eax
jne 0x10032626
mov esi, eax
xor eax, eax
lea ecx, [ebp - 0xb0]
inc eax
push eax
call fcn.10016adb
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp esi, ecx
lea ecx, [ebp - 0xb0]
setge dl
xor ebx, ebx
cmp edx, dword [eax]
setle bl
xor esi, esi
inc esi
mov dword [ebp - 0xe38], ebx
push esi
call fcn.10016adb
push esi
mov eax, dword [eax]
mov ecx, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x10]
sub ebx, eax
mov dword [ebp - 0x38], ebx
xor ebx, ebx
cmp dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xb0]
setne bl
call fcn.10016adb
mov ecx, dword [ebp - 0x10]
xor edx, edx
sub ebx, ecx
imul ecx, ebx, 9
sub ecx, 0x3ed6125f
cmp ecx, 0x3d5ab883
mov ecx, dword [ebp - 0x1c]
mov eax, dword [eax]
setg dl
xor ebx, ebx
cmp edx, ecx
mov eax, dword [ebp + eax*4 - 0x78]
setge bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x100325bf
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffed
je 0x100325a5
push esi
lea ecx, [ebp - 0xb0]
call fcn.10016adb
push esi
lea ecx, [ebp - 0xb0]
dec dword [eax]
call fcn.10016adb
cmp dword [eax], 0
jge 0x10032500
xor eax, eax
lea ecx, [ebp - 0xb0]
push eax
call fcn.10016adb
xor ebx, ebx
lea ecx, [ebp - 0xb0]
inc ebx
push ebx
imul esi, dword [eax], 7
call fcn.10016adb
lea ecx, [ebp - 0xa38]
mov dword [eax], esi
mov dword [ebp - 0x38], esi
call fcn.10016ad6
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x1a
call fcn.10016ad6
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10032755
push dword [ebp - 0x18]
lea ecx, [ebp - 0x668]
call fcn.10016adb
mov dword [eax], 0x99333c7d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10032737
xor eax, eax
mov dword [ebp - 0x18], 0xeb0647dc
mov dword [ebp - 0x4c], 0x526954eb
cmp dword [ebp - 0x18], 0xfffffffa
jge 0x100329ef
movdqa xmm0, xmmword [0x10007a00]
lea eax, [ebp - 0x10b4]
push eax
lea eax, [ebp - 0x10c4]
push eax
lea ecx, [ebp - 0x12b4]
movdqu xmmword [ebp - 0x10c4], xmm0
call fcn.10016aea
lea ecx, [ebp - 0x1da]
mov esi, eax
call fcn.10008943
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x7a0]
push dword [esi]
call fcn.10016ab0
xor eax, eax
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100327da
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2b4], 2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100327c2
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xc
jg 0x100329de
mov dword [ebp - 0x2c], 0x4a90
lea ecx, [ebp - 0x3c4]
push 4
call fcn.10016a6e
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x10], eax
jmp 0x1003281d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x3c4]
call fcn.10016adb
mov dword [eax], 0x5fff839e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10032806
push 3
pop esi
push esi
lea ecx, [ebp - 0x7a0]
call fcn.10016adb
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x3c4]
dec dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
xor eax, eax
push eax
call fcn.10016adb
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x3c4]
xor eax, eax
push eax
call fcn.10016adb
push esi
lea ecx, [ebp - 0x7a0]
call fcn.10016adb
xor ebx, ebx
lea ecx, [ebp - 0x3c4]
push esi
cmp dword [eax], 0xca77
setl bl
call fcn.10016adb
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
cmp ecx, esi
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x18]
setg cl
sub ecx, eax
je 0x100328f3
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100329bf
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x2565
push 0x13f5
push 0x51b
push 0x1862
push 0x61
call ebx
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x1918
push 0x1e6a
push 0xa47
push 0xac9
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x100329bf
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x4c], esi
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003290a
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
push 2
lea ecx, [ebp - 0x3c4]
call fcn.10016adb
mov ecx, dword [ebp - 0x10]
cmp dword [eax], ecx
jl 0x1003294c
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x3c4]
xor eax, eax
push eax
call fcn.10016adb
mov ecx, dword [ebp - 0x10]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x4c], 0x4d0c
jg 0x1003294c
xor eax, eax
lea esi, [eax + 1]
jmp 0x10032950
xor eax, eax
mov esi, eax
push 3
lea ecx, [ebp - 0x7a0]
call fcn.10016adb
xor ecx, ecx
push 3
sub esi, dword [eax]
mov eax, dword [ebp - 0x18]
cmp eax, esi
mov eax, dword [ebp - 0x10]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 0x595
lea ecx, [ebp - 0x7a0]
setg al
imul eax, eax, 0x5a1e
sub eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
call fcn.10016adb
mov eax, dword [ebp - 0x2b4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2b4], eax
lea ecx, [ebp - 0x3c4]
mov byte [ebp - 4], 0x1f
call fcn.10016ad6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xc
jle 0x100327e7
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x7a0]
mov byte [ebp - 4], 0x1a
call fcn.10016ad6
jmp 0x10032a1e
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032a20
push eax
push 0x25c8
push 0xaf7
push 0x1305
push 0x56c
push 0xff1
push 0x195e
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10032a3e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe4c], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10032a29
xor eax, eax
mov dword [ebp - 0x30], 0x6dee
lea ecx, [ebp - 0xbac]
mov dword [ebp - 0x18], 0x7a88ff76
mov dword [ebp - 0x4c], eax
push 4
call fcn.10016a6e
mov byte [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0x3c], 0x7f559297
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10032a8d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x6c], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10032a78
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10032aaf
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1044], 0xfffffffc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10032a96
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10032ad7
push dword [ebp - 0x28]
lea ecx, [ebp - 0xbac]
call fcn.10016adb
mov dword [eax], 0xbb84a8a6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10032ab8
xor eax, eax
push 0xffffffffffffffec
pop esi
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], esi
jne 0x10032bc9
mov dword [ebp - 0x10], 0xadacd7d3
mov dword [ebp - 0x24], 0x869b7d6b
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x10], 0x75cb
jle 0x10032b10
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x30]
cmp eax, 0x12a72b3d
setge cl
cmp ecx, 0xf81320f2
sbb eax, eax
neg eax
inc eax
neg eax
sbb eax, eax
inc eax
cmp eax, 0xf7c629c4
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x4c6a
setg cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x30], 8
jmp 0x10032bb5
xor eax, eax
mov dword [ebp - 0x24], 0xfffffffd
cmp dword [ebp - 0x10], eax
jne 0x10032b95
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setle dl
mov dword [ebp - 0x18], edx
xor edx, edx
mov eax, dword [ebp - 0x10]
test eax, eax
sets dl
xor ecx, ecx
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x4c], ecx
mov edx, eax
cmp dword [ebp - 0x4c], eax
je 0x10032b97
mov edx, ebx
mov dword [ebp - 0x24], 0xffffffff
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, edx
setle cl
xor eax, eax
test ecx, ecx
setle al
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x32
jg 0x10032b54
dec dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], esi
je 0x10032ae6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jg 0x10032caa
jmp 0x10032bd9
mov dword [ebp - 0x1c], 0xec499e98
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x30], 3
jmp 0x10032c1a
mov dword [ebp - 0x10], 0xf3bec767
mov dword [ebp - 0x10], eax
jmp 0x10032c11
cmp dword [ebp - 0x10], 0x19
jle 0x10032bfc
cmp dword [ebp - 0x30], 0x2c
jl 0x10032bf0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1c], ebx
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10032c69
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x30]
jg 0x10032c44
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
test eax, eax
setns cl
sub ecx, 0x3ee28c35
jne 0x10032c88
lea ecx, [ebp - 0xbac]
mov byte [ebp - 4], 0x1a
call fcn.10016ad6
xor eax, eax
lea ecx, [ebp - 0x180]
push eax
call fcn.10016adb
mov esi, eax
lea ecx, [ebp - 0x180]
xor eax, eax
push eax
call fcn.10016adb
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x180]
setg bl
xor eax, eax
push eax
call fcn.10016adb
xor ecx, ecx
cmp ebx, dword [eax]
setl cl
xor eax, eax
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x180]
push eax
call fcn.10016adb
mov ecx, dword [ebp - 0x38]
xor ebx, ebx
push 3
cmp dword [eax], ecx
lea ecx, [ebp - 0x180]
setl bl
dec ebx
call fcn.10016adb
lea ecx, [ebp - 0x180]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, ebx
call fcn.10016adb
xor ebx, ebx
lea ecx, [ebp - 0x668]
cmp dword [eax], esi
setne bl
xor eax, eax
push eax
mov dword [ebp - 0x38], ebx
call fcn.10016adb
lea ecx, [ebp - 0x180]
mov dword [eax], ebx
xor eax, eax
push eax
call fcn.10016adb
mov ecx, dword [ebp - 0x38]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x180]
setg bl
xor eax, eax
push eax
call fcn.10016adb
cmp ebx, dword [eax]
jne 0x10032d8e
xor eax, eax
lea ecx, [ebp - 0x668]
push eax
call fcn.10016adb
cmp dword [eax], 0
je 0x10032d8e
xor eax, eax
lea esi, [eax + 1]
jmp 0x10032d92
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x180]
call fcn.10016adb
lea ecx, [ebp - 0x180]
mov eax, dword [eax]
imul eax, esi
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
xor eax, eax
push eax
call fcn.10016adb
xor eax, eax
lea ecx, [ebp - 0x668]
push eax
call fcn.10016adb
xor ebx, ebx
lea ecx, [ebp - 0x180]
cmp dword [eax], ebx
setne bl
xor eax, eax
push eax
call fcn.10016adb
xor ecx, ecx
push 3
cmp ebx, dword [eax]
setg cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x180]
call fcn.10016adb
lea ecx, [ebp - 0x668]
mov eax, dword [eax]
imul eax, dword [ebp - 0x38]
mov dword [ebp - 0xe48], eax
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x180]
call fcn.10016ad6
xor ebx, ebx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x10], 0xd
inc ebx
cmp dword [ebp - 0x10], 0xffffffff
jg 0x10032e56
mov dword [ebp - 0x38], 0xfffffffb
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10032e4b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x10]
jmp 0x10032e28
push ebx
lea ecx, [ebp - 0xd8]
call fcn.10016a6e
push ebx
lea ecx, [ebp - 0xa50]
mov dword [ebp - 4], 0x22
call fcn.10016a6e
mov byte [ebp - 4], 0x23
xor eax, eax
mov dword [ebp - 0x4c], 0x635290ce
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x24], 0xcd3624b6
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10032eb9
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x2e0], 0x1b3c692b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10032ea0
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10032edf
push dword [ebp - 0x28]
lea ecx, [ebp - 0xd8]
call fcn.10016adb
mov dword [eax], 0xb457102d
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10032ec1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10032f02