Function at 0x1002efe3
Capabilities:
Accept command line arguments
Check os version
Compare security identifiers
Create directory
Enumerate gui resources
Extract resource via kernel32 functions
Get disk information
Get disk size
Get graphical window text
Get keyboard layout
Get session user name
Identify system language via api
Parse pe header
Query or enumerate registry key
Read .ini file
Start service

Disassembly:
mov eax, 0x10088f46
call fcn.100877a0
mov eax, 0x13b4
call fcn.10085030
push ebx
push esi
push edi
push 3
pop ebx
mov dword [ebp - 0x70], ecx
or edi, 0xffffffff
mov dword [ebp - 0x3c], 8
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x50], edi
push ebx
mov byte [ebp - 0x65], dl
call fcn.10017f97
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x24], 0x34ea
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002f055
push dword [ebp - 0x28]
lea ecx, [ebp - 0x12c]
call fcn.10018004
mov dword [eax], 0x452a
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002f037
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002f073
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x7dc], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1002f05e
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x28], eax
inc ebx
cmp dword [ebp - 0x28], ebx
jge 0x1002f096
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5c4], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002f07e
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x1002f0b4
push 2
lea ecx, [ebp - 0x12c]
call fcn.10018004
push ebx
lea ecx, [ebp - 0x12c]
call fcn.10018004
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x12c]
push ebx
call fcn.10018004
push 2
lea ecx, [ebp - 0x12c]
call fcn.10018004
push ebx
lea ecx, [ebp - 0x12c]
mov esi, eax
call fcn.10018004
mov ecx, dword [esi]
push ebx
sub ecx, dword [eax]
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x12c]
mov eax, dword [ebp - 0x2c]
neg eax
mov dword [ebp - 0x7d8], eax
call fcn.10018004
push 2
lea ecx, [ebp - 0x12c]
call fcn.10018004
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x12c]
neg esi
push ebx
sbb esi, esi
neg esi
mov dword [ebp - 0x5c4], esi
call fcn.10018004
xor ebx, ebx
lea ecx, [ebp - 0x12c]
cmp esi, dword [eax]
setle bl
xor eax, eax
push eax
call fcn.10018004
xor ecx, ecx
cmp ebx, dword [eax]
setg cl
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
inc ebx
push ebx
lea ecx, [ebp - 0x12c]
call fcn.10018004
lea ecx, [ebp - 0x12c]
mov esi, dword [eax]
xor eax, eax
add esi, dword [ebp - 0x1c]
push eax
call fcn.10018004
push 4
pop ecx
mov eax, dword [eax]
add eax, esi
neg eax
je 0x1002f184
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1002f1b4
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1002f1b2
mov dword [ebp - 0x1c], 0x5950cfdf
xor eax, eax
mov dword [ebp - 0x1c], 0xb6bd0d42
mov dword [ebp - 0x18], eax
jmp 0x1002f1aa
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1350], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f199
dec dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002f1d3
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x7dc], 0xd36fbc6a
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x24]
push 0xfffffffffffffffa
pop eax
cmp dword [ebp - 0x24], ebx
jle 0x1002f1b9
lea ecx, [ebp - 0x12c]
mov dword [ebp - 4], edi
call fcn.10017fff
push 3
pop esi
mov dword [ebp - 0x24], edi
lea ecx, [ebp - 0x3d4]
push esi
call fcn.10017f97
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xde661fbc
mov dword [ebp - 0x14], 0x1213072c
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
jmp 0x1002f22d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x188], 0xb659d568
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002f21c
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg eax
push 0xfffffffffffffff6
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xbc07c207
pop ecx
sbb eax, eax
add eax, 0xe4262eb2
cmp eax, ecx
jne 0x1002f262
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x1002f264
mov ecx, ebx
xor eax, eax
mov dword [ebp - 0x184], 0x9831
cmp ecx, 0x693009c
push 0xfffffffffffffff7
setl al
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0x9831
mov eax, dword [ebp - 0x28]
cmp ecx, eax
pop eax
setge dl
sub edx, eax
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x28]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
jg 0x1002f426
mov dword [ebp - 0x34], 0x29b4ccc4
lea ecx, [ebp - 0x890]
push 2
call fcn.10017f97
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002f302
push dword [ebp - 0x18]
lea ecx, [ebp - 0x890]
call fcn.10018004
xor ecx, ecx
inc ecx
mov dword [eax], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002f2e2
xor eax, eax
jmp 0x1002f305
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], eax
jmp 0x1002f342
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
jl 0x1002f33f
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1002f325
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x188], 0
jne 0x1002f33a
dec dword [ebp - 0x28]
push 0
pop eax
jns 0x1002f312
xor ecx, ecx
xor eax, eax
inc ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x1002f30a
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x188]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x188]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x188], 0
jne 0x1002f377
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002f37e
jmp 0x1002f379
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x1002f388
mov edx, eax
cmp dword [ebp - 0x184], eax
je 0x1002f38a
mov edx, ecx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
imul ecx, dword [ebp - 0x34]
push eax
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x890]
call fcn.10018004
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x184]
setge dl
sub edx, eax
mov eax, dword [ebp - 0x14]
add eax, edx
jne 0x1002f3cb
cmp dword [ebp - 0x1c], eax
jne 0x1002f3cb
mov edx, eax
jmp 0x1002f3d0
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x14]
push 0xfffffffffffffff6
mov ecx, dword [ebp + eax*4 - 0x188]
pop eax
cmp eax, edx
mov edx, 0x807c1f4b
sbb eax, eax
inc eax
cmp edx, eax
sbb eax, eax
xor edx, edx
neg eax
cmp ecx, eax
mov eax, dword [ebp - 0x34]
sete dl
xor ecx, ecx
shl edx, 2
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
inc eax
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], al
call fcn.10017fff
inc dword [ebp - 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jle 0x1002f2bc
jmp 0x1002f429
xor eax, eax
inc eax
mov dword [ebp - 0x24], 0xd6c05baf
lea ecx, [ebp - 0xac4]
push eax
call fcn.10017f97
push 3
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002f460
push dword [ebp - 0x18]
lea ecx, [ebp - 0xac4]
call fcn.10018004
mov dword [eax], 6
inc dword [ebp - 0x18]
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jl 0x1002f449
mov dword [ebp - 0x24], 0xfffffffd
cmp dword [ebp - 0x24], 0xfffffff9
je 0x1002f617
jmp 0x1002f47e
xor eax, eax
inc eax
push eax
lea ecx, [ebp - 0x4e0]
call fcn.10017f97
push 4
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x6f8]
xor eax, eax
inc eax
push eax
call fcn.10017f97
push 5
pop eax
mov byte [ebp - 4], al
xor esi, esi
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x1c], eax
inc esi
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002f4dc
push dword [ebp - 0x14]
lea ecx, [ebp - 0x4e0]
call fcn.10018004
mov dword [eax], 0xeede0b40
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002f4b8
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002f501
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6f8]
call fcn.10018004
mov dword [eax], edi
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002f4e4
xor eax, eax
push eax
lea ecx, [ebp - 0x4e0]
call fcn.10018004
and dword [eax], 0
jmp 0x1002f5d7
mov dword [ebp - 0x2c], 0xdfad5bef
xor eax, eax
mov dword [ebp - 0x20], 0x4039ee49
cmp dword [ebp - 0x24], eax
je 0x1002f5c2
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jl 0x1002f553
push dword [ebp - 0x34]
lea ecx, [ebp - 0x6f8]
call fcn.10018004
cmp dword [eax], 0
jne 0x1002f551
dec dword [ebp - 0x34]
jns 0x1002f539
xor eax, eax
push eax
lea ecx, [ebp - 0x6f8]
call fcn.10018004
mov esi, eax
lea ecx, [ebp - 0xac4]
xor eax, eax
push eax
call fcn.10018004
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
sub edx, 0xcf1c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setle cl
xor edx, edx
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
neg edx
add eax, edx
imul eax, eax, 0x53b1
mov dword [ebp - 0x1c], eax
xor eax, eax
jmp 0x1002f5c9
mov dword [ebp - 0x2c], 0x67120dd9
push eax
lea ecx, [ebp - 0x4e0]
call fcn.10018004
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x4e0]
push eax
call fcn.10018004
cmp dword [eax], 9
je 0x1002f515
lea ecx, [ebp - 0x6f8]
call fcn.10017fff
push 3
pop eax
lea ecx, [ebp - 0x4e0]
mov byte [ebp - 4], al
call fcn.10017fff
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff9
jne 0x1002f47b
xor eax, eax
lea ecx, [ebp - 0xac4]
inc eax
mov byte [ebp - 4], al
call fcn.10017fff
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002f645
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3d4]
call fcn.10018004
push 0xfffffffffffffff7
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x18]
push 3
pop eax
cmp dword [ebp - 0x18], eax
jl 0x1002f62f
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setge dl
xor eax, eax
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], eax
jne 0x1002f66b
mov edi, eax
jmp 0x1002f670
xor eax, eax
lea edi, [eax + 1]
push 2
lea ecx, [ebp - 0x3d4]
call fcn.10018004
mov ecx, dword [ebp - 0x3c]
mov esi, eax
xor eax, eax
cmp edi, ecx
mov ecx, dword [ebp - 0x3c]
sete al
xor edx, edx
cmp eax, ecx
mov ecx, dword [ebp - 0x3c]
setge dl
sub ecx, edx
cmp ecx, 0xc54c9751
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x18d
setle cl
xor eax, eax
imul ecx, dword [ebp - 0x3c]
or edi, 0xffffffff
cmp ecx, edi
setl al
inc eax
mov dword [esi], eax
mov dword [ebp - 0x24], 0xffffffeb
jmp 0x1002f8bc
mov dword [ebp - 0x50], 0xfffffffc
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
xor eax, eax
push 5
mov dword [ebp - 0x2c], eax
pop ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x1c], 0xfffffffc
push 3
mov dword [ebp - 0x1c], 0xc5674fa7
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x1002f707
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x114], 0x97ee
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f6f6
mov eax, dword [ebp - 0x10c]
xor edx, edx
mov ecx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
cmp ecx, eax
setle dl
mov dword [ebp - 0x50], edx
xor edx, edx
mov ecx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
mov eax, dword [ebp - 0x10c]
setge dl
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, edi
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x10c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x114]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10c]
setg dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 9
setge al
xor ecx, ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x110]
sub eax, dword [ebp - 0x50]
cmp eax, 0xf3b0
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10c]
setne dl
sub edx, eax
xor eax, eax
cmp dword [ebp - 0x2c], edx
jge 0x1002f7d3
cmp dword [ebp - 0x2c], eax
je 0x1002f7d3
xor edx, edx
inc edx
mov ecx, edx
jmp 0x1002f7d8
xor edx, edx
mov ecx, eax
inc edx
push 0xfffffffffffffff9
pop eax
sub eax, ecx
mov ecx, dword [ebp - 0x10c]
sub ecx, eax
neg ecx
push 2
sbb ecx, ecx
inc ecx
cmp ecx, esi
pop ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x1c], 0x4e785c2f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002f81d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x608], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002f809
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002f833
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x660], 0x796a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002f822
push ecx
lea ecx, [ebp - 0x3d4]
call fcn.10018004
cmp dword [eax], 0
jne 0x1002f886
push 2
lea ecx, [ebp - 0x3d4]
call fcn.10018004
push 2
lea ecx, [ebp - 0x3d4]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x608], eax
call fcn.10018004
mov eax, dword [ebp - 0x608]
xor eax, eax
inc eax
mov dword [ebp - 0x608], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x65c]
lea ecx, [ebp - 0x3d4]
neg esi
push 2
sbb esi, esi
neg esi
call fcn.10018004
mov ecx, dword [ebp - 0x65c]
xor edx, edx
sub esi, ecx
mov ecx, dword [ebp - 0x65c]
cmp esi, ecx
setge dl
add edx, dword [eax]
mov dword [ebp - 0x1c], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x10
mov esi, 0xffff
jge 0x1002f6c8
lea ecx, [ebp - 0x3d4]
mov dword [ebp - 4], edi
call fcn.10017fff
mov dword [ebp - 0x24], 0x3342eb9
lea ecx, [ebp - 0x8b4]
mov dword [ebp - 0x50], 0xc42ff18c
push 2
call fcn.10017f97
mov dword [ebp - 4], 6
xor ecx, ecx
inc ecx
xor eax, eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x50], 0x95a52772
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002f93b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x8b4]
call fcn.10018004
mov dword [eax], 0x2268f62c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002f919
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x24], eax
jmp 0x1002fa11
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], 0xe
cmp dword [ebp - 0x14], 0xfffffffe
jl 0x1002f9ef
push 5
pop ecx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x24], eax
jne 0x1002f965
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x8b4]
mov eax, dword [ebp - 0x50]
xor eax, eax
push eax
call fcn.10018004
mov eax, dword [ebp - 0x24]
add eax, 0x7b831966
imul eax, dword [ebp - 0x14]
cmp eax, 0xd44f4cc5
jb 0x1002f9ad
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002f9af
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x1002f9b2
xor eax, eax
xor ecx, ecx
inc ecx
cmp ecx, eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x50], eax
jne 0x1002f9c7
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffe
push 0
pop eax
jge 0x1002f957
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1002fa0b
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor eax, eax
dec dword [ebp - 0x24]
push 1
pop ecx
cmp dword [ebp - 0x24], edi
je 0x1002f943
lea ecx, [ebp - 0x8b4]
mov dword [ebp - 4], edi
call fcn.10017fff
push 8
pop esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0xe60]
mov dword [ebp - 0x1c], 0x272a7275
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x1c], 0xe704f3d
push 2
call fcn.10017f97
mov dword [ebp - 4], 7
mov eax, 0xffff
mov dword [ebp - 0x50], eax
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002fa84
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbbc], 0x40d7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002fa6c
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002faac
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe60]
call fcn.10018004
mov dword [eax], 0xe1f6f084
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002fa8d
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x1002fb40
movdqa xmm0, xmmword [0x10007f90]
lea eax, [ebp - 0xfc0]
push eax
lea eax, [ebp - 0xfd0]
mov dword [ebp - 0x1c], 0x4b25
push eax
lea ecx, [ebp - 0x120c]
movdqu xmmword [ebp - 0xfd0], xmm0
call fcn.10018013
lea ecx, [ebp - 0x1ba]
mov esi, eax
call fcn.100090d3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x102c]
push dword [esi]
call fcn.10017fd9
xor eax, eax
mov dword [ebp - 0x1c], 0xa4d91f06
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1002fb21
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
dec dword [ebp - 0x50]
lea ecx, [ebp - 0x102c]
call fcn.10017fff
inc dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jle 0x1002fab8
push 8
pop esi
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1002fb50
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [ebp - 0xe60]
mov dword [ebp - 4], edi
call fcn.10017fff
push 3
pop ebx
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x50], edi
push ebx
call fcn.10017f97
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x24], 0x34ea
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002fbac
push dword [ebp - 0x28]
lea ecx, [ebp - 0x144]
call fcn.10018004
mov dword [eax], 0x452a
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002fb8e
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002fbca
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x7cc], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1002fbb5
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x28], eax
inc ebx
cmp dword [ebp - 0x28], ebx
jge 0x1002fbed
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x658], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002fbd5
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x1002fc0b
push 2
lea ecx, [ebp - 0x144]
call fcn.10018004
push ebx
lea ecx, [ebp - 0x144]
call fcn.10018004
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x144]
push ebx
call fcn.10018004
push 2
lea ecx, [ebp - 0x144]
call fcn.10018004
push ebx
lea ecx, [ebp - 0x144]
mov esi, eax
call fcn.10018004
mov ecx, dword [esi]
push ebx
sub ecx, dword [eax]
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x144]
mov eax, dword [ebp - 0x2c]
neg eax
mov dword [ebp - 0x7c8], eax
call fcn.10018004
push 2
lea ecx, [ebp - 0x144]
call fcn.10018004
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x144]
neg esi
push ebx
sbb esi, esi
neg esi
mov dword [ebp - 0x658], esi
call fcn.10018004
xor ebx, ebx
lea ecx, [ebp - 0x144]
cmp esi, dword [eax]
setle bl
xor eax, eax
push eax
call fcn.10018004
xor ecx, ecx
cmp ebx, dword [eax]
setg cl
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
inc ebx
push ebx
lea ecx, [ebp - 0x144]
call fcn.10018004
lea ecx, [ebp - 0x144]
mov esi, dword [eax]
xor eax, eax
add esi, dword [ebp - 0x1c]
push eax
call fcn.10018004
mov eax, dword [eax]
add eax, esi
neg eax
je 0x1002fcd8
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1002fd0b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1002fd09
mov dword [ebp - 0x1c], 0x5950cfdf
xor eax, eax
push 4
mov dword [ebp - 0x1c], 0xb6bd0d42
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x1002fd01
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1370], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002fcf0
dec dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002fd2d
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x7cc], 0xd36fbc6a
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1002fd10
lea ecx, [ebp - 0x144]
mov dword [ebp - 4], edi
call fcn.10017fff
mov dword [ebp - 0x3c], edi
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xde661fbc
mov dword [ebp - 0x14], 0x1213072c
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
jmp 0x1002fd72
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1a8], 0xb659d568
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002fd61
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg eax
push 0xfffffffffffffff6
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xbc07c207
pop esi
sbb eax, eax
add eax, 0xe4262eb2
cmp eax, esi
jne 0x1002fda7
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x1002fda9
mov ecx, ebx
xor eax, eax
mov dword [ebp - 0x1a4], 0x9831
cmp ecx, 0x693009c
push 0xfffffffffffffff7
setl al
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0x9831
mov eax, dword [ebp - 0x28]
cmp ecx, eax
pop eax
setge dl
sub edx, eax
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x28]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002ff47
mov dword [ebp - 0x34], 0x29b4ccc4
lea ecx, [ebp - 0xa1c]
push 2
call fcn.10017f97
push 3
mov dword [ebp - 4], 9
pop eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002fe3e
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa1c]
call fcn.10018004
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002fe23
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002fe7c
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x1002fe79
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1002fe62
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x1a8], 0
jne 0x1002fe77
dec dword [ebp - 0x28]
push 0
pop eax
jns 0x1002fe4b
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1002fe43
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1a8]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1a8]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x1a8], 0
jne 0x1002feb1
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002feb8
jmp 0x1002feb3
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x1002fec2
mov edx, eax
cmp dword [ebp - 0x1a4], eax
je 0x1002fec4
mov edx, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
imul ecx, dword [ebp - 0x34]
push eax
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0xa1c]
call fcn.10018004
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x1a4]
setge dl
sub edx, eax
mov eax, dword [ebp - 0x14]
add eax, edx
jne 0x1002ff03
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x1002ff05
mov edx, ebx
mov eax, dword [ebp - 0x14]
cmp esi, edx
mov edx, 0x807c1f4b
mov ecx, dword [ebp + eax*4 - 0x1a8]
sbb eax, eax
inc eax
cmp edx, eax
sbb eax, eax
xor edx, edx
neg eax
cmp ecx, eax
mov eax, dword [ebp - 0x34]
sete dl
xor ecx, ecx
shl edx, 2
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xa1c]
mov dword [ebp - 4], edi
call fcn.10017fff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1002fdf7
push 3
pop eax
push eax
lea ecx, [ebp - 0x3ec]
call fcn.10017f97
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x8cc]
mov dword [ebp - 0x24], 0xd6c05baf
push ebx
call fcn.10017f97
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x18], eax
jmp 0x1002ff9b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x8cc]
call fcn.10018004
mov dword [eax], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002ff84
mov dword [ebp - 0x24], 0xfffffffd
jmp 0x10030126
push ebx
lea ecx, [ebp - 0x540]
call fcn.10017f97
push ebx
lea ecx, [ebp - 0x74c]
mov byte [ebp - 4], 0xc
call fcn.10017f97
push 0xfffffffffffffffa
mov byte [ebp - 4], 0xd
pop eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002fffa
push dword [ebp - 0x14]
lea ecx, [ebp - 0x540]
call fcn.10018004
mov dword [eax], 0xeede0b40
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002ffdc
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1003001c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x74c]
call fcn.10018004
mov dword [eax], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030002
xor eax, eax
push eax
lea ecx, [ebp - 0x540]
call fcn.10018004
and dword [eax], 0
jmp 0x100300f2
mov dword [ebp - 0x2c], 0xdfad5bef
xor eax, eax
mov dword [ebp - 0x20], 0x4039ee49
cmp dword [ebp - 0x24], eax
je 0x100300dd
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jl 0x1003006e
push dword [ebp - 0x34]
lea ecx, [ebp - 0x74c]
call fcn.10018004
cmp dword [eax], 0
jne 0x1003006c
dec dword [ebp - 0x34]
jns 0x10030054
xor eax, eax
push eax
lea ecx, [ebp - 0x74c]
call fcn.10018004
mov esi, eax
lea ecx, [ebp - 0x8cc]
xor eax, eax
push eax
call fcn.10018004
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
sub edx, 0xcf1c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setle cl
xor edx, edx
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
neg edx
add eax, edx
imul eax, eax, 0x53b1
mov dword [ebp - 0x1c], eax
xor eax, eax
jmp 0x100300e4
mov dword [ebp - 0x2c], 0x67120dd9
push eax
lea ecx, [ebp - 0x540]
call fcn.10018004
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x540]
push eax
call fcn.10018004
cmp dword [eax], 9
je 0x10030030
lea ecx, [ebp - 0x74c]
call fcn.10017fff
lea ecx, [ebp - 0x540]
mov byte [ebp - 4], 0xb
call fcn.10017fff
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff9
jne 0x1002ffac
lea ecx, [ebp - 0x8cc]
mov byte [ebp - 4], 0xa
call fcn.10017fff
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x50], ecx
xor eax, eax
mov dword [ebp - 0x20], ebx
push 5
mov dword [ebp - 0x2c], eax
pop esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x1c], ecx
push 3
mov dword [ebp - 0x1c], 0xc5674fa7
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10030176
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xfc], 0x97ee
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10030165
mov eax, dword [ebp - 0xf4]
xor edx, edx
mov ecx, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
cmp ecx, eax
setle dl
mov dword [ebp - 0x50], edx
xor edx, edx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0xf4]
cmp ecx, eax
mov eax, dword [ebp - 0xf4]
setge dl
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, edi
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xf4]
cmp ecx, eax
mov eax, dword [ebp - 0xf4]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xfc]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xf4]
setg dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 9
setge al
xor edx, edx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0xf8]
sub ecx, eax
mov eax, dword [ebp - 0x20]
cmp ecx, 0xf3b0
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xf4]
setne cl
sub ecx, eax
xor eax, eax
cmp dword [ebp - 0x2c], ecx
jge 0x10030240
mov ecx, ebx
cmp dword [ebp - 0x2c], eax
jne 0x10030242
mov ecx, eax
push 0xfffffffffffffff9
pop eax
sub eax, ecx
mov ecx, dword [ebp - 0xf4]
sub ecx, eax
mov eax, 0xffff
neg ecx
push 3
sbb ecx, ecx
inc ecx
cmp ecx, eax
pop esi
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10030290
push esi
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3ec]
call fcn.10018004
push 0xfffffffffffffff7
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10030270
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x4b283066
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x14], 0xffffffec
cmp dword [ebp - 0x14], 0xfffffffe
jne 0x10030330
jmp 0x100302bc
xor eax, eax
mov dword [ebp - 0x2c], 0x9f4288a1
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100302d4
call dword [sym.imp.USER32.dll_CreatePopupMenu]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10030306
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100302f2
push 0x13a4
push 0x23b2
call dword [sym.imp.USER32.dll_SetCaretPos]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10030301
mov eax, ebx
mov dword [ebp - 0x18], eax
jmp 0x10030327
mov dword [ebp - 0x1c], 0xe9fb
xor ecx, ecx
mov dword [ebp - 0x44], 0x8a062b00
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp eax, 0x3809d01
setne cl
mov dword [ebp - 0x44], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffe
je 0x100302ba
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x34]
je 0x10030347
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
imul eax, dword [ebp - 0x14], 0xffff
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
sub eax, 0xfdb6
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x14]
je 0x10030377
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10030379
mov edx, ebx
jmp 0x1003037b
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setge dl
xor eax, eax
mov dword [ebp - 0x3c], edx
mov edi, eax
cmp dword [ebp - 0x3c], eax
je 0x100303a6
mov edi, ebx
push 2
lea ecx, [ebp - 0x3ec]
call fcn.10018004
mov ecx, dword [ebp - 0x38]
mov esi, eax
xor eax, eax
cmp edi, ecx
mov ecx, dword [ebp - 0x38]
sete al
xor edx, edx
cmp eax, ecx
mov ecx, dword [ebp - 0x38]
push 5
setge dl
sub ecx, edx
cmp ecx, 0xc54c9751
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x18d
setle cl
xor eax, eax
imul ecx, dword [ebp - 0x38]
or edx, 0xffffffff
cmp ecx, edx
lea ecx, [ebp - 0xb24]
setl al
inc eax
mov dword [esi], eax
pop eax
mov dword [ebp - 0x28], 0xca4f833f
mov dword [ebp - 0x20], 0xd4a1cf04
mov dword [ebp - 0x1c], eax
push 2
call fcn.10017f97
push 3
xor eax, eax
mov byte [ebp - 4], 0xe
pop ecx
mov dword [ebp - 0x14], eax
push 0xfffffffffffffff6
pop esi
cmp dword [ebp - 0x14], ecx
jge 0x1003043b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x304], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10030427
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1003045f
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb24]
call fcn.10018004
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10030444
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x100304b4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x100304b1
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x2c], 2
cmp dword [ebp - 0x2c], eax
jl 0x1003049b
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10030496
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x10030483
mov eax, dword [ebp - 0x28]
push 0
mov eax, dword [ebp + eax*4 - 0x304]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
pop eax
jle 0x10030470
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x10030464
cmp dword [ebp - 0x28], eax
jne 0x1003053b
mov eax, dword [ebp - 0x2fc]
xor eax, eax
cmp dword [ebp - 0x304], eax
je 0x100304d9
mov edx, ebx
cmp dword [ebp - 0x300], eax
jne 0x100304db
mov edx, eax
mov eax, dword [ebp - 0x2fc]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x300]
mov eax, dword [ebp - 0x2fc]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
setg dl
sub ecx, edx
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x304]
jne 0x10030520
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x28]
je 0x1003052b
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2fc]
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10030577
mov dword [ebp - 0x2c], 0x8842b4cf
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x1c], 0xfffffff9
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100305bf
push 3
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10030590
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1050], 0x1401cea0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003057f
push ebx
lea ecx, [ebp - 0xb24]
call fcn.10018004
mov ecx, dword [ebp - 0x1048]
inc ecx
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100305bf
push 0x73d
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
lea ecx, [ebp - 0xb24]
mov byte [ebp - 4], 0xa
call fcn.10017fff
mov dword [ebp - 0x3c], 0xffffffeb
cmp dword [ebp - 0x3c], 0x10
jl 0x10030ead
mov edi, dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [ebp - 0x1c], 0xd546
or ecx, 0xffffffff
mov dword [ebp - 0x1c], 0x184c506d
xor eax, eax
mov dword [ebp - 0x1c], 0xd7b1c2a2
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], 0xa955a63a
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x1c], 0x9ae65c34
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x50], 0x2e5769e8
mov dword [ebp - 0x18], eax
jmp 0x10030641
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x116c], 0x9949dfcf
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10030630
inc dword [ebp - 0x50]
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x8e4]
push 2
call fcn.10017f97
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x18], 0xdf2f4a8b
push 2
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x10030690
push dword [ebp - 0x18]
lea ecx, [ebp - 0x8e4]
call fcn.10018004
mov dword [eax], 0x75c9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10030672
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x100306b0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x8e4]
call fcn.10018004
cmp dword [eax], 0
jne 0x100306b0
dec dword [ebp - 0x18]
jns 0x10030698
lea ecx, [ebp - 0x8e4]
mov byte [ebp - 4], 0xa
call fcn.10017fff
mov dword [ebp - 0x14], 8
lea ecx, [ebp - 0xc64]
push ebx
call fcn.10017f97
xor eax, eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100306fe
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc64]
call fcn.10018004
mov dword [eax], 0xaa9ac70c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100306e0
xor eax, eax
mov dword [ebp - 0x14], 0x61928c17
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x100307d7
mov dword [ebp - 0x24], 0x49f845d8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x100307ce
or ecx, 0xffffffff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jg 0x100307c2
push ebx
lea ecx, [ebp - 0xa34]
call fcn.10017f97
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003076e
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa34]
call fcn.10018004
mov dword [eax], 0xe8b0d193
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10030750
xor eax, eax
push eax
lea ecx, [ebp - 0xa34]
call fcn.10018004
mov dword [eax], 0xd3740063
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100307a2
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push eax
call edi
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xa34]
mov byte [ebp - 4], 0x10
call fcn.10017fff
inc dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
jle 0x10030736
or ecx, 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x10030727
dec dword [ebp - 0x14]
jns 0x10030711
lea ecx, [ebp - 0xc64]
mov byte [ebp - 4], 0xa
call fcn.10017fff
mov dword [ebp - 0x24], 0xfffffffd
lea ecx, [ebp - 0xe78]
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x1c], 0xf050678e
push ebx
call fcn.10017f97
push 3
mov byte [ebp - 4], 0x12
pop eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10030840
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe78]
call fcn.10018004
mov dword [eax], 0xde283bc1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10030822
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff0
je 0x100308d7
mov dword [ebp - 0x50], eax
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], 0x72ba75a5
mov dword [ebp - 0x1c], 0xfffffffd
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x50], 0x55b7cefa
mov eax, dword [ebp - 0x18]
cmp eax, ebx
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
push 0
setne cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setg dl
xor ecx, ecx
imul edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, edx
setle cl
xor ebx, ebx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
setle bl
xor edx, edx
cmp ecx, eax
pop eax
setge dl
sub edx, ebx
neg edx
push 1
sbb edx, edx
inc edx
mov dword [ebp - 0x1c], edx
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff0
pop ebx
jne 0x1003084d
inc dword [ebp - 0x48]
lea ecx, [ebp - 0xe78]
mov byte [ebp - 4], 0xa
call fcn.10017fff
mov dword [ebp - 0x1c], 0x4e785c2f
lea ecx, [ebp - 0x634]
mov dword [ebp - 0x14], 0x4a8b108f
mov dword [ebp - 0x24], ebx
push esi
call fcn.10017f97
push 0xfffffffffffffff7
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xe90]
pop eax
mov dword [ebp - 0x1c], 0x7374fd52
mov dword [ebp - 0x1c], 0x881dda8d
mov dword [ebp - 0x1c], eax
push 3
pop eax
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x1c], 0xe3d4
push eax
call fcn.10017f97
mov byte [ebp - 4], 0x14
or eax, 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 0xb38e5161
mov dword [ebp - 0x1c], 0xf1fa6f6
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1003097e
push dword [ebp - 0x28]
lea ecx, [ebp - 0x634]
call fcn.10018004
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10030960
xor eax, eax
push 3
mov dword [ebp - 0x28], eax
pop esi
cmp dword [ebp - 0x28], esi
jge 0x100309ac
push esi
pop ebx
push dword [ebp - 0x28]
lea ecx, [ebp - 0xe90]
call fcn.10018004
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1003098b
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x100309cd
push 0xfffffffffffffffa
pop ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x11f4], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x100309b8
xor eax, eax
mov dword [ebp - 0x28], eax
or esi, 0xffffffff
cmp dword [ebp - 0x28], 2
jge 0x100309e8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x117c], esi
inc dword [ebp - 0x28]
jmp 0x100309d3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10030aab
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10030a20
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1194], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10030a0b
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jg 0x10030aa5
mov dword [ebp - 0x18], 0x13281d21
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x10030a57
inc dword [ebp - 0x50]
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10030a52
push eax
push 0x187c
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x10030a37
push dword [ebp - 0x14]
lea ecx, [ebp - 0x634]
call fcn.10018004
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10030a7f
push dword [ebp - 0x14]
lea ecx, [ebp - 0x634]
call fcn.10018004
cmp dword [eax], 0
jne 0x10030a82
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x634]
call fcn.10018004
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], 0xfffffffd
inc dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], ebx
jle 0x10030a28
inc dword [ebp - 0x48]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x100309f8
lea ecx, [ebp - 0xe90]
call fcn.10017fff
lea ecx, [ebp - 0x634]
mov byte [ebp - 4], 0xa
call fcn.10017fff
mov dword [ebp - 0x38], 0x3efc
xor edx, edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0xc66883ce
mov dword [ebp - 0x50], ebx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setl dl
xor eax, eax
cmp edx, 0x628405ce
setge al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x38]
jg 0x10030b38
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10030b68
push 0x1043
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x10030b68
mov dword [ebp - 0x1c], 8
xor eax, eax
mov dword [ebp - 0x1c], 0x26529694
mov dword [ebp - 0x1c], 7
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10030b65
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x50]
push 5
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10030ba0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x61c], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10030b93
mov dword [ebp - 0x14], 8
lea ecx, [ebp - 0xc88]
push ebx
call fcn.10017f97
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10030be5
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc88]
call fcn.10018004
mov dword [eax], 0xaa9ac70c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10030bc7
xor eax, eax
mov dword [ebp - 0x14], 0x61928c17
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x10030cb3
mov dword [ebp - 0x24], 0x49f845d8
mov dword [ebp - 0x24], eax
jmp 0x10030ca1
cmp dword [ebp - 0x24], eax
jle 0x10030c07
lea ecx, [ebp - 0xc88]
mov byte [ebp - 4], 0xa
call fcn.10017fff
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10030cda
cmp dword [ebp - 0x14], 2
jl 0x10030cc9
or esi, 0xffffffff
lea ecx, [ebp - 0x3ec]
mov dword [ebp - 4], esi
call fcn.10017fff
mov dword [ebp - 0x38], ebx
xor eax, eax
mov dword [ebp - 0x20], 0x8bc8977b
mov dword [ebp - 0x4c], 0xfffffffd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10030eee
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6c], 0x4ec2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030ed9
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10030f10
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x178], 0x8f381c4e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10030ef7
xor eax, eax
mov dword [ebp - 0x38], eax
mov edi, 0xa909f00f
cmp dword [ebp - 0x38], eax
jg 0x100311f2
mov dword [ebp - 0x24], 0xc9ebf495
lea ecx, [ebp - 0x764]
push ebx
call fcn.10017f97
mov dword [ebp - 4], 0x19
lea ecx, [ebp - 0x914]
mov dword [ebp - 0x34], 0x7a140552
mov dword [ebp - 0x50], 0x925b974d
mov dword [ebp - 0x50], 0x736fa7ab
push ebx
call fcn.10017f97
xor eax, eax
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10030f88
push dword [ebp - 0x14]
lea ecx, [ebp - 0x764]
call fcn.10018004
mov dword [eax], 0x9a56718e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030f6a
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10030fa4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x914]
call fcn.10018004
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030f8d
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x6c], 0
je 0x10030fca
mov eax, dword [ebp - 0x38]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setl dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x6c], eax
jne 0x10030fee
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x6c], 0
jne 0x10030fee
xor eax, eax
mov edx, eax
jmp 0x10030ff0
mov edx, ebx
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x6c]
jne 0x10031008
mov esi, eax
cmp dword [ebp - 0x38], eax
je 0x1003100a
mov esi, ebx
push eax
lea ecx, [ebp - 0x764]
call fcn.10018004
xor ecx, ecx
cmp esi, dword [eax]
setle cl
xor eax, eax
add ecx, 2
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x100311a5
or ecx, 0xffffffff
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x48], 8
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jg 0x10031199
push 3
pop ecx
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10031077
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10e0], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003105f
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jl 0x10031187
xor esi, esi
inc esi
mov dword [ebp - 0x2c], 7
lea ecx, [ebp - 0x764]
mov dword [ebp - 0x40], 0x8a746c20
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
inc eax
sub eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
cmp eax, 6
setl bl
xor eax, eax
mov dword [ebp - 0x10dc], ebx
push eax
call fcn.10018004
mov ecx, dword [ebp - 0x48]
xor edx, edx
push 0xfffffffffffffff6
imul ecx, dword [eax]
cmp ecx, ebx
pop ecx
setne dl
xor eax, eax
cmp edx, ecx
push 4
setg al
cmp eax, esi
mov eax, dword [ebp - 0x3c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
imul ecx, dword [ebp - 0x48]
cmp ecx, 0x5d487c75
setge al
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
cmp edi, eax
mov eax, dword [ebp - 0x40]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
add edx, 0x747eab1a
cmp edx, eax
pop eax
setle cl
cmp ecx, eax
mov eax, dword [ebp - 0x14]
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp ecx, eax
lea ecx, [ebp - 0x914]
setl bl
xor eax, eax
push eax
call fcn.10018004
xor edx, edx
mov dword [eax], ebx
mov eax, dword [ebp - 0x2c]
cmp ebx, eax
setg dl
mov eax, dword [ebp - 0x174]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x174], ecx
dec dword [ebp - 0x3c]
jns 0x10031086
xor ebx, ebx
xor eax, eax
push 3
inc ebx
pop ecx
dec dword [ebp - 0x28]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jle 0x1003104d
or ecx, 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x10031034
lea ecx, [ebp - 0x914]
call fcn.10017fff
or esi, 0xffffffff
lea ecx, [ebp - 0x764]
mov dword [ebp - 4], esi
call fcn.10017fff
inc dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x38], eax
jle 0x10030f21
cmp dword [ebp - 0x38], eax
jne 0x100311f2
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x174]
xor ecx, ecx
cmp eax, ebx
setl cl
cmp ecx, dword [ebp - 0x178]
jne 0x10031235
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100312aa
push 0x2389
push 0x11c3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
jmp 0x100312a8
mov dword [ebp - 0x24], 0x8cb2cc2
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
cmp eax, ecx
setl dl
xor ecx, ecx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setl cl
xor eax, eax
add ecx, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x174], ecx
xor eax, eax
mov dword [ebp - 0x34], 0x6af1124f
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0xfb37b048
mov dword [ebp - 0x18], 0xcc58a012
mov dword [ebp - 0x18], 0x3d783989
mov dword [ebp - 0x2c], 0x2fbb6bc3
mov dword [ebp - 0x1c], 0x8d383303
push 3
pop ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], 0x4e665969
mov dword [ebp - 0x18], eax
jmp 0x100312f9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1068], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100312ec
push 0xfffffffffffffff7
pop edi
mov dword [ebp - 0x34], edi
jmp 0x10031371
mov dword [ebp - 0x1c], esi
lea ecx, [ebp - 0xd88]
call fcn.10017f97
mov dword [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x4c], 9
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1003134c
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd88]
call fcn.10018004
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1003132d
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003135d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
inc dword [ebp - 0x4c]
lea ecx, [ebp - 0xd88]
mov dword [ebp - 4], esi
call fcn.10017fff
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xa
push 2
jg 0x10031306
xor eax, eax
mov dword [ebp - 0x34], eax
pop ecx
jmp 0x100313fa
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jl 0x100313ae
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100313a6
push eax
push eax
push eax
push eax
push eax
push eax
push 0x11e7
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x10031389
push 2
pop ecx
mov dword [ebp - 0x24], eax
jmp 0x100313d3
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100313c8
push eax
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x100313b3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], eax
jle 0x100313cb
cmp dword [ebp - 0x18], ecx
jg 0x100313f7
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x1068], 0
jne 0x100313f5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x100313e0
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jle 0x10031381
push 3
pop eax
mov dword [ebp - 0x3c], 8
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x24], esi
push eax
call fcn.10017f97
xor eax, eax
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x18], eax
push 3
pop eax
cmp dword [ebp - 0x18], eax
jge 0x10031449
push eax
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x44c]
call fcn.10018004
mov dword [eax], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003142e
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setge dl
xor eax, eax
mov dword [ebp - 0x24], edx
mov edi, eax
cmp dword [ebp - 0x24], eax
je 0x10031467
mov edi, ebx
push 2
lea ecx, [ebp - 0x44c]
call fcn.10018004
mov ecx, dword [ebp - 0x3c]
mov esi, eax
xor eax, eax
mov ebx, 0xc54c9751
cmp edi, ecx
mov ecx, dword [ebp - 0x3c]
sete al
xor edx, edx
cmp eax, ecx
mov ecx, dword [ebp - 0x3c]
setge dl
sub ecx, edx
cmp ecx, ebx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x18d
setle cl
xor eax, eax
imul ecx, dword [ebp - 0x3c]
or edi, 0xffffffff
cmp ecx, edi
setl al
inc eax
mov dword [esi], eax
mov dword [ebp - 0x24], 0xffffffeb
jmp 0x1003158d
cmp dword [ebp - 0x24], 0x10
jge 0x100314c0