Function at 0x1002a832
Capabilities:
Compare security identifiers
Get keyboard layout

Disassembly:
mov eax, 0x1013f635
call fcn.1013e250
sub esp, 0x53c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xb4], edx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x1f0]
mov dword [ebp - 0x38], ebx
movdqa xmm0, xmmword [0x1000ea70]
push edi
push dword [ebp - 0xb4]
mov dword [ebp - 0xa8], ecx
lea ecx, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x200]
mov dword [ebp - 0x1c], 0xdb5cabfc
push eax
mov dword [ebp - 0x20], 0x6f93bd5d
mov dword [ebp - 0x10], 5
push ebx
movdqu xmmword [ebp - 0x200], xmm0
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
call fcn.10014f3b
push 2
lea ecx, [ebp - 0x13c]
mov dword [ebp - 4], 1
call fcn.10013ee8
mov dword [ebp - 0x30], 0xf39281c1
mov dword [ebp - 0x24], 0x1f199e1f
mov dword [ebp - 0x10], ebx
jmp 0x1002a8ea
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x13c]
mov dword [eax + ecx*4], 0xdc0223de
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002a8d7
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
imul ecx, dword [ebp - 0x10], 0x4006
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0xc0]
mov edi, dword [ebp - 0x13c]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x53a3
setle al
xor ecx, ecx
mov dword [esi + 4], eax
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x20]
cmp dword [esi + 4], eax
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0xb0f7
setle al
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
cmp eax, dword [esi + 4]
jle 0x1002a989
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x24], 0x5d1cc0c7
jg 0x1002a989
mov eax, ebx
jmp 0x1002a98c
xor eax, eax
inc eax
mov dword [edi + 4], eax
mov ecx, 0x4043ca31
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x10]
sub ecx, dword [edx + 8]
add eax, ecx
je 0x1002a9b1
cmp dword [esi + 4], ebx
je 0x1002a9b1
xor ecx, ecx
inc ecx
jmp 0x1002a9b3
mov ecx, ebx
xor eax, eax
cmp ecx, dword [edx + 8]
lea ecx, [ebp - 0x13c]
setne al
mov dword [ebp - 0x30], eax
call fcn.100144eb
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], bl
call fcn.100144eb
push dword [ebp + 8]
lea ecx, [ebp - 0x1b4]
call fcn.10013ddc
mov dword [ebp - 4], 2
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x1c], 7
push 1
call fcn.10013ee8
mov dword [ebp - 0x28], 0xc7f05f43
xor edx, edx
mov dword [ebp - 0x20], 0xa2b8ea2c
inc edx
mov dword [ebp - 0x10], 0xfaa23240
push 0xfffffffffffffff7
mov dword [ebp - 0x24], 0xef7e2919
mov dword [ebp - 0x18], ebx
pop esi
jmp 0x1002aa36
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002aa27
push 3
pop ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x30], ecx
jmp 0x1002aa57
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x230], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002aa46
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xcc]
mov dword [eax], edx
xor edx, edx
mov dword [ebp - 0x28], ebx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setge dl
add edx, dword [ebp - 0x20]
je 0x1002aa8e
mov eax, dword [ebp - 0xcc]
cmp dword [eax], ebx
je 0x1002aa8e
xor eax, eax
inc eax
jmp 0x1002aa90
mov eax, ebx
mov ecx, dword [ebp - 0x1c]
xor edx, edx
imul ecx, eax
mov eax, 0xffff0008
sub eax, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xcc]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x20]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne cl
sub eax, ecx
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x10], ebx
jmp 0x1002ab1f
mov dword [ebp - 0x24], 0x82a7
mov dword [ebp - 0x20], 0xb5b0d69b
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002ab1c
push ebx
push 1
push 0x717
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002aaec
lea ecx, [ebp - 0xcc]
call fcn.100144eb
mov dword [ebp - 0x34], 0x5e3edfa8
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x2c], 0x391cb4e7
mov dword [ebp - 0x20], 0x5a9864ba
mov dword [ebp - 0x10], 0xade0980d
mov dword [ebp - 0x24], 0x5c1d1022
push 2
call fcn.10013ee8
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0x1c], 0xca3691f6
mov dword [ebp - 0x28], 0x32e26595
push 1
call fcn.10013ee8
mov byte [ebp - 4], 4
mov dword [ebp - 0x24], 0xcd85
mov dword [ebp - 0x18], ebx
jmp 0x1002aba1
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xd8]
mov dword [eax + ecx*4], 0xaf72b572
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002ab8e
mov dword [ebp - 0x18], ebx
jmp 0x1002abbc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1002abac
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002ac17
push 0x7d0
push 0x1a45
push 0x1f12
push ebx
push 0x144f
push 0xe65
call edi
push eax
call esi
push eax
push 0x370
push 0xdd2
push 0x26f7
push 0x1da5
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax]
lea eax, [ecx + 1]
cmp eax, 1
ja 0x1002ac41
test ecx, ecx
jne 0x1002ac41
mov eax, ebx
jmp 0x1002ac44
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x28]
imul ecx, eax
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x28]
cmp ecx, eax
jge 0x1002ac59
xor ecx, ecx
inc ecx
jmp 0x1002ac5b
mov ecx, ebx
xor eax, eax
cmp ecx, 0x3b91
setg al
xor ecx, ecx
inc ecx
cmp eax, ecx
jbe 0x1002ac75
cmp dword [ebp - 0x10], ebx
je 0x1002ac75
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe4]
cmp dword [eax], ebx
je 0x1002adcb
mov dword [ebp - 0x18], 0xce724d25
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], 0x15
je 0x1002adc0
mov dword [ebp - 0x24], 0xffffffff
lea ecx, [ebp - 0x124]
push 4
call fcn.10013ee8
mov byte [ebp - 4], 5
mov dword [ebp - 0x20], ebx
jmp 0x1002acca
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x124]
mov dword [eax + ecx*4], 0x7874d2d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002acb7
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 0x1c
jne 0x1002ad98
mov esi, dword [ebp - 0x124]
mov dword [ebp - 0x34], esi
push 3
lea ecx, [ebp - 0x130]
call fcn.10013ee8
push 3
mov dword [ebp - 0x1c], ebx
pop edx
jmp 0x1002ad0e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x130]
mov dword [eax + ecx*4], 0xeb613644
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002acfb
cmp dword [ebp - 0x18], ebx
jne 0x1002ad20
mov dword [ebp - 0x1c], ebx
cmp dword [esi + 8], ebx
je 0x1002ad27
mov dword [ebp - 0x1c], 1
mov esi, dword [esi + 8]
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x130]
sub esi, dword [edi + 8]
cmp ecx, eax
setl dl
sub esi, edx
sub esi, dword [ebp - 0x1c]
sub esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
sub esi, 9
neg esi
sbb esi, esi
xor ecx, ecx
neg esi
cmp eax, esi
mov esi, dword [ebp - 0x34]
setg cl
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, dword [esi + 8]
lea ecx, [ebp - 0x130]
setle al
mov dword [edi + 8], eax
call fcn.100144eb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1c
je 0x1002ace6
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 4
call fcn.100144eb
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x15
jne 0x1002ac9a
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
jmp 0x1002ae69
mov dword [ebp - 0x20], 0xfd11e6ac
mov eax, 0x9fb0e7fb
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jl 0x1002ae34
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
push 2
pop ecx
sub ecx, eax
jne 0x1002ae16
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], 4
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
inc ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0x1c]
jns 0x1002adf7
imul eax, dword [ebp - 0x20], 0xc6b9
test eax, eax
je 0x1002ae57
cmp dword [edx + 4], ebx
jne 0x1002ae53
cmp dword [ebp - 0x1c], ebx
jne 0x1002ae53
mov eax, dword [ebp - 0xd8]
cmp dword [eax], ebx
je 0x1002ae57
mov edx, ecx
jmp 0x1002ae59
mov edx, ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x148], ecx
lea ecx, [ebp - 0xe4]
call fcn.100144eb
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 2
call fcn.100144eb
mov dword [ebp - 0x3c], 0x2d015d00
mov edx, ebx
movzx ecx, byte [ebp + edx - 0x3b]
sub ecx, edx
dec ecx
jns 0x1002aea8
or eax, 0xffffffff
sub eax, ecx
add ecx, 0x100
and eax, 0xffffff00
add ecx, eax
movzx eax, byte [ebp + edx - 0x3c]
add edx, 2
mov word [ebp + eax*2 - 0xb0], cx
cmp edx, 4
jb 0x1002ae8c
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x28], 3
push 4
call fcn.10013ee8
push 1
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 6
call fcn.10013ee8
mov byte [ebp - 4], 7
mov dword [ebp - 0x1c], ebx
jmp 0x1002af01
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x174]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002aef2
xor edx, edx
mov dword [ebp - 0x1c], ebx
inc edx
jmp 0x1002af1e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10c]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002af0f
mov eax, dword [ebp - 0x18]
mov ecx, 0xe3cf9575
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add eax, 0x39f7747
cmp ecx, eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
jne 0x1002af51
mov ecx, ebx
cmp dword [ebp - 0x18], ebx
je 0x1002af53
mov ecx, edx
mov eax, dword [ebp - 0x28]
imul eax, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xfffffff0
cmp dword [ebp - 0x28], 0xffffffef
jge 0x1002b130
mov esi, 0xffff
mov dword [ebp - 0x20], 0xfff6
lea ecx, [ebp - 0x168]
push edx
call fcn.10013ee8
mov byte [ebp - 4], 8
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x10], ebx
jmp 0x1002afbc
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x168]
mov dword [eax + ecx*4], 0xe1c2a91
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1002afa9
mov dword [ebp - 0x18], 0xffffffe2
jmp 0x1002b0fb
mov dword [ebp - 0x10], 5
lea ecx, [ebp - 0x118]
push 4
call fcn.10013ee8
mov dword [ebp - 0x1c], ebx
jmp 0x1002affa
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x118]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002afe7
mov eax, dword [ebp - 0x18]
cmp esi, eax
sbb eax, eax
neg eax
cmp eax, esi
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
add edx, dword [ebp - 0x10]
neg edx
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
sub eax, 8
inc edx
cmp eax, edx
je 0x1002b07b
mov dword [ebp - 0x20], ebx
jmp 0x1002b06f
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002b058
push 0x1e31
push 0x5c1
push 0xbfd
push 0xfa1
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002b06c
push 0x206
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1002b035
cmp dword [ebp - 0x10], ebx
je 0x1002b0e5
jmp 0x1002b0ed
mov dword [ebp - 0x1c], 0x20be
xor edx, edx
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x24], 0xc894628a
mov dword [ebp - 0x1c], 0xbf7d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setge dl
add edx, 0x7ba6da08
je 0x1002b0c5
cmp dword [ebp - 0x10], 0xd983a5c2
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x10]
jl 0x1002b0c5
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0xec], ecx
mov eax, dword [ebp - 0x10c]
dec dword [eax]
lea ecx, [ebp - 0x118]
call fcn.100144eb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x11
je 0x1002afce
mov dword [ebp - 0xf4], ebx
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 7
call fcn.100144eb
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffef
push 1
pop edx
jl 0x1002af72
mov esi, dword [sym.imp.USER32.dll_GetDC]
lea ecx, [ebp - 0x10c]
call fcn.100144eb
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 2
call fcn.100144eb
xor eax, eax
xor edx, edx
mov word [ebp - 0xac], ax
inc edx
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x28], 0x5cc7
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], 0xdc4b
mov dword [ebp - 0x10], ebx
jmp 0x1002b188
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x48], 0x8bbca631
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002b17a
mov dword [ebp - 0x18], ebx
jmp 0x1002b2b9
mov dword [ebp - 0x20], 0x94ff5452
mov dword [ebp - 0x1c], 0x3799040c
push 3
mov dword [ebp - 0x24], 0xde90
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x1002b1c4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x224], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002b1b3
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x48], ecx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x20], eax
jge 0x1002b1f1
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x48]
cmp eax, edx
setge cl
neg ecx
je 0x1002b218
mov ecx, edx
cmp dword [ebp - 0x24], ebx
jne 0x1002b21a
mov ecx, ebx
mov eax, dword [ebp - 0x18]
cmp ecx, dword [ebp + eax*4 - 0x48]
je 0x1002b22e
mov eax, dword [ebp - 0x18]
mov ecx, ebx
cmp dword [ebp + eax*4 - 0x48], ebx
je 0x1002b230
mov ecx, edx
xor eax, eax
cmp ecx, 0xd3ed
setge al
cmp eax, 0x5ad058bb
jle 0x1002b249
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x1c], 0xfe64
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jne 0x1002b28d
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002b2b6
push ebx
push 0x1a9b
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
xor edx, edx
inc edx
jmp 0x1002b2b6
mov dword [ebp - 0x1c], ebx
jmp 0x1002b2b1
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002b2a5
push ebx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
xor edx, edx
inc edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x21c], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1002b292
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x1002b196
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0x209f
lea eax, [ebp - 0xb0]
push eax
setl cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x2c8]
call fcn.10013e17
push eax
lea edx, [ebp - 0x1b4]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x19c]
call fcn.1002a022
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0xb
call fcn.10014448
push 2
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xb0], ebx
mov word [ebp - 0xac], bx
call fcn.10013ee8
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x2c], 0x2c40a98c
mov dword [ebp - 0x10], ebx
jmp 0x1002b349
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002b33a
mov eax, dword [ebp - 0x100]
mov dword [eax], ebx
mov dword [ebp - 0x10], 0x18
jmp 0x1002b384
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002b370
push ebx
call dword [sym.imp.USER32.dll_SetCursor]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002b381
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1d
jg 0x1002b360
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0xb
call fcn.100144eb
cmp dword [ebp - 0x188], 8
lea ecx, [ebp - 0x548]
push ecx
lea eax, [ebp - 0x19c]
cmovae eax, dword [ebp - 0x19c]
push eax
push 0xf90b
push 0x12731
call fcn.100290d8
pop ecx
pop ecx
call eax
mov dword [ebp - 0x10], 0xb743d837
mov dword [ebp - 0x24], 0xfa147b80
mov dword [ebp - 0x20], eax
mov eax, 0x643b8a2
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x24], 0xfbe58499
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x15c], 0x6088
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
sub eax, 0x279c
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sets cl
mov dword [ebp - 0x24], ecx
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setg dl
sub dword [ebp - 0x10], edx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002b44e
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 0xcf17
call fcn.10019cfd
pop ecx
movzx eax, ax
lea ecx, [ebp - 0x1b4]
push eax
push 1
call fcn.10015e93
mov dword [ebp - 0x10], 3
mov dword [ebp - 0x24], 0x19ac196a
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x34], 0xfffffff9
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002b4d6
push 0x7d0
push 0x1a45
push 0x1f12
push ebx
push 0x144f
push 0xe65
call edi
push eax
call esi
push eax
push 0x370
push 0xdd2
push 0x26f7
push 0x1da5
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
mov dword [ebp - 0x24], ebx
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov esi, ebx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setg dl
xor eax, eax
add edx, dword [ebp - 0x10]
cmp edx, 0x4ad744d0
setl al
xor ecx, ecx
cmp eax, 0xb9a7
mov eax, dword [ebp - 0x24]
setne cl
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setg dl
mov dword [ebp - 0x60], 0x31053104
xor ecx, ecx
mov dword [ebp - 0x5c], 0x37023301
cmp eax, edx
mov dword [ebp - 0x58], 0x41093703
mov dword [ebp - 0x54], 0x77d8b475
setge cl
mov dword [ebp - 0x50], 0x6a45c67
mov dword [ebp - 0x34], ecx
mov ecx, ebx
mov word [ebp - 0x4c], 0x3b
mov byte [ebp - 0x4a], 0x3d
cmp ecx, 0xa
jne 0x1002b563
push 9
pop esi
push 0x11
pop ecx
jmp 0x1002b590
movzx eax, byte [ebp + ecx - 0x5f]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x1002b583
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x60]
mov word [ebp + eax*2 - 0x184], dx
add ecx, 2
cmp ecx, 0x17
jb 0x1002b556
xor eax, eax
lea ecx, [ebp - 0x298]
mov word [ebp - 0x176], ax
lea eax, [ebp - 0x184]
push eax
call fcn.10013e17
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0xa8]
push eax
call fcn.1002a5ef
xor eax, eax
mov byte [ebp - 4], 0xb
inc eax
lea ecx, [ebp - 0x298]
push ebx
push eax
mov dword [ebp - 0x38], eax
call fcn.10014448
xor eax, eax
lea edi, [ebp - 0x184]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x18], 0x5a136951
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1002b603
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x40], 0x8ec0ae97
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1002b5f5
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1002b688
mov dword [ebp - 0x24], 0xbf0ddd9c
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x40], ebx
jne 0x1002b63e
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x40], ebx
jne 0x1002b63e
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x40], ebx
jne 0x1002b63e
mov esi, ebx
jmp 0x1002b641
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
add eax, 9
add ecx, eax
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp + eax*4 - 0x40], esi
mov eax, dword [ebp - 0x10]
imul eax, ecx
xor ecx, ecx
cmp esi, eax
sete cl
mov dword [ebp - 0x10], ecx
dec dword [ebp - 0x18]
jns 0x1002b611
cmp dword [ebp - 0x20], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
je 0x1002b9dc
push 3
pop edx
mov dword [ebp - 0x7c], 0x72017304
mov ecx, ebx
mov dword [ebp - 0x78], 0x35067502
mov edi, ebx
mov dword [ebp - 0x74], 0xd2087907
mov dword [ebp - 0x70], 0x1daa274d
mov dword [ebp - 0x6c], 0x6c08363a
mov byte [ebp - 0x68], dl
mov dword [ebp - 0x67], 0x57a0972
mov word [ebp - 0x63], 0x72
mov byte [ebp - 0x61], 0x6f
cmp ecx, 0xa
jne 0x1002b6e3
push 8
pop edi
push 0x10
pop ecx
jmp 0x1002b710
movzx eax, byte [ebp + ecx - 0x7b]
lea esi, [edi - 1]
sub eax, ecx
add esi, eax
jns 0x1002b703
or eax, 0xffffffff
sub eax, esi
add esi, 0x100
and eax, 0xffffff00
add esi, eax
movzx eax, byte [ebp + ecx - 0x7c]
mov word [ebp + eax*2 - 0x218], si
add ecx, 2
cmp ecx, 0x1c
jb 0x1002b6d6
xor eax, eax
mov dword [ebp - 0xa4], 0x76097306
mov word [ebp - 0x204], ax
mov ecx, ebx
mov dword [ebp - 0xa0], 0x7c05660c
mov esi, ebx
mov dword [ebp - 0x9c], 0x70087b01
mov dword [ebp - 0x98], 0xc1097c04
mov dword [ebp - 0x94], 0x8d9c9bc6
mov dword [ebp - 0x90], 0xa7efe8f
mov dword [ebp - 0x8c], 0x810b3d
mov dword [ebp - 0x88], 0xd78076f
mov word [ebp - 0x84], 0x282
mov byte [ebp - 0x82], 0x7e
mov byte [ebp - 0x81], dl
mov byte [ebp - 0x80], 0x8e
cmp ecx, 0xe
jne 0x1002b79c
push 9
pop esi
push 0x15
pop ecx
jmp 0x1002b7cf
movzx eax, byte [ebp + ecx - 0xa3]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x1002b7bf
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0xa4]
mov word [ebp + eax*2 - 0x250], dx
add ecx, 2
cmp ecx, 0x25
jb 0x1002b78f
xor eax, eax
mov word [ebp - 0x234], ax
mov eax, dword [ebp - 0xb4]
cmp dword [eax], 2
jne 0x1002b808
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.10013e17
mov ecx, eax
mov dword [ebp - 0x38], 3
jmp 0x1002b825
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x2f8]
call fcn.10013e17
push 5
mov ecx, eax
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], eax
push ecx
lea ecx, [ebp - 0x280]
call fcn.10013e4f
mov dword [ebp - 4], 0xf
mov eax, dword [ebp - 0x30]
test al, 4
je 0x1002b859
and eax, 0xfffffffb
lea ecx, [ebp - 0x2f8]
push ebx
push 1
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], eax
call fcn.10014448
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 0x10
test al, 2
je 0x1002b875
push ebx
and eax, 0xfffffffd
lea ecx, [ebp - 0x2b0]
push 1
mov dword [ebp - 0x38], eax
call fcn.10014448
xor eax, eax
mov esi, dword [ebp - 0x20]
lea edi, [ebp - 0x218]
stosd dword es:[edi], eax
push 7
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [ebp - 0x250]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x51c]
push eax
lea ecx, [ebp - 0x1cc]
call fcn.10013e17
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x1bc], 7
jb 0x1002b985
lea eax, [ebp - 0x1cc]
push eax
lea edx, [ebp - 0x1b4]
lea ecx, [ebp - 0x2e0]
call fcn.100383a6
pop ecx
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0x12
push ecx
mov edx, eax
lea ecx, [ebp - 0x268]
call fcn.10029ffa
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0x14
call fcn.10014448
lea ecx, [ebp - 0x268]
call fcn.1003a0a4
test al, al
je 0x1002b977
lea eax, [ebp - 0x1cc]
push eax
lea ecx, [ebp - 0x1f0]
call fcn.1002a5ef
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x1f0]
mov edi, dword [ebp - 0xa8]
mov ecx, edi
push eax
call fcn.1002a767
test al, al
je 0x1002b95e
lea eax, [ebp - 0x1f0]
mov ecx, edi
push eax
call fcn.100363c6
lea ecx, [edi + 0xc]
lea eax, [ebp - 0x1e4]
cmp ecx, eax
je 0x1002b95e
push 0xffffffffffffffff
push ebx
push eax
call fcn.10014264
push ebx
push 1
lea ecx, [ebp - 0x1e4]
call fcn.10014448
lea ecx, [ebp - 0x1f0]
call fcn.100144eb
push ebx
push 1
lea ecx, [ebp - 0x268]
call fcn.10014448
push ebx
push 1
lea ecx, [ebp - 0x1cc]
mov byte [ebp - 4], 0x10
call fcn.10014448
lea eax, [ebp - 0x548]
push eax
push esi
push 0xf90b
push 0x609d
call fcn.100290d8
pop ecx
pop ecx
call eax
test eax, eax
jne 0x1002b896
push esi
push 0xf90b
push 0x1aaa5
call fcn.100290d8
pop ecx
pop ecx
call eax
push ebx
push 1
lea ecx, [ebp - 0x280]
call fcn.10014448
push ebx
push 1
lea ecx, [ebp - 0x19c]
call fcn.10014448
push ebx
push 1
lea ecx, [ebp - 0x1b4]
call fcn.10014448
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret