Function at 0x1002b0d7
Capabilities:
Encrypt data using speck
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a161
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1450
call fcn.10065d20
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002b15d
mov eax, dword [ebp + 8]
mov dword [ebp - 0xcac], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xcb4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xdd4], eax
push 0x767a
push 0x38d0
push 0x1edd
push 0x36d0
push dword [ebp - 0xdd4]
push 1
push 0x7067
push dword [ebp - 0xcac]
push dword [ebp - 0xcb4]
call fcn.10034db0
add esp, 0x24
jmp 0x10034d9f
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xdec], eax
mov dword [ebp - 0x568], 0x3350
mov dword [ebp - 0xdcc], 0x1000a010
cmp dword [ebp - 0x568], 0x34e3
jle 0x1002b233
and dword [ebp - 0x334], 0
jmp 0x1002b1a0
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0x6c91
jge 0x1002b233
and dword [ebp - 0x298], 0
jmp 0x1002b1c6
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0x46ae
jge 0x1002b22e
and dword [ebp - 0x214], 0
jmp 0x1002b1e8
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x449c
jge 0x1002b22c
mov eax, dword [ebp - 0x298]
imul eax, dword [ebp - 0x214]
xor eax, dword [ebp - 0x334]
cdq
mov dword [ebp - 0xcc0], eax
mov dword [ebp - 0xcbc], edx
push dword [ebp - 0xcbc]
push dword [ebp - 0xcc0]
mov ecx, 0x10613338
call fcn.1001050c
jmp 0x1002b1db
jmp 0x1002b1b9
jmp 0x1002b193
lea eax, [ebp + 0x18]
mov dword [ebp - 0xb68], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x568], 0x32b2
jge 0x1002b25c
mov edx, dword [ebp - 0xdcc]
mov ecx, 0x10613338
call fcn.10011fb6
jmp 0x1002b278
or dword [ebp - 4], 0xffffffff
jmp 0x1002b282
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xdf4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xde4], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xddc], eax
mov eax, dword [ebp - 0xb68]
movzx eax, byte [eax]
test eax, eax
je 0x1002b2c4
push 0x1105
push 0x2523
push 0x22d8
call dword [sym.imp.GDI32.dll_LineTo]
jmp 0x10034d9f
mov eax, dword [ebp - 0xddc]
mov dword [ebp - 0xea0], eax
mov eax, dword [ebp - 0xde4]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0xdec]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0xdf4]
mov dword [ebp - 0x4b0], eax
push 4
lea ecx, [ebp - 0xb0c]
call fcn.10010621
mov dword [ebp - 4], 2
push 1
lea ecx, [ebp - 0x1f4]
call fcn.10010621
mov byte [ebp - 4], 3
push 0
push 0x5860
push 0x1ee
push 0x1a0
push 0
lea eax, [ebp - 0xb0c]
push eax
lea eax, [ebp - 0xdfc]
push eax
call fcn.100243b1
add esp, 0x1c
lea eax, [ebp - 0x1f4]
push eax
lea eax, [ebp - 0xdfc]
push eax
push 0xdd1
push 0x5403
push 0x3011
push 0
call fcn.1003c542
add esp, 0x18
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100106bf
and dword [eax], 0
jmp 0x1002b39f
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100106bf
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0xaa0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xaa0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100106bf
cmp dword [eax], 3
jg 0x1002b58c
mov dword [ebp - 0xe0c], 0xfffffffb
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0xb0c]
call fcn.100106bf
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100106bf
cmp dword [eax], 0
jne 0x1002b44f
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100106bf
imul esi, dword [eax], 0xffffffff
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0xb0c]
call fcn.100106bf
sub esi, dword [eax]
cmp esi, 0xfffffff9
jl 0x1002b428
mov dword [ebp - 0xaa8], 1
jmp 0x1002b42f
and dword [ebp - 0xaa8], 0
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100106bf
mov ecx, dword [ebp - 0xaa8]
cmp ecx, dword [eax]
jl 0x1002b44f
and dword [ebp - 0xab0], 0
jmp 0x1002b459
mov dword [ebp - 0xab0], 1
mov eax, dword [ebp - 0xab0]
add eax, 6
jne 0x1002b48c
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0xb0c]
call fcn.100106bf
cmp dword [eax], 0
jne 0x1002b48c
and dword [ebp - 0xab8], 0
jmp 0x1002b496
mov dword [ebp - 0xab8], 1
cmp dword [ebp - 0xab8], 0x6ec7
jl 0x1002b4ae
mov dword [ebp - 0xe04], 1
jmp 0x1002b4b5
and dword [ebp - 0xe04], 0
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100106bf
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0xb0c]
call fcn.100106bf
mov esi, dword [eax]
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100106bf
mov eax, dword [eax]
lea eax, [esi + eax - 0xffff]
imul eax, eax, 0xfffffffe
mov dword [ebp - 0xac0], eax
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0xb0c]
call fcn.100106bf
mov ecx, dword [ebp - 0xac0]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100106bf
mov ecx, dword [ebp - 0xac0]
cmp ecx, dword [eax]
jne 0x1002b542
mov dword [ebp - 0xac8], 1
jmp 0x1002b549
and dword [ebp - 0xac8], 0
push 0
lea ecx, [ebp - 0x1f4]
call fcn.100106bf
mov ecx, dword [ebp - 0xac8]
cmp ecx, dword [eax]
jle 0x1002b56c
mov dword [ebp - 0xad0], 1
jmp 0x1002b573
and dword [ebp - 0xad0], 0
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0xe0c], eax
push 0
call fcn.1003baad
pop ecx
jmp 0x1002b37b
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1f4]
call fcn.100106a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0c]
call fcn.100106a3
or dword [ebp - 0xf68], 0xffffffff
or dword [ebp - 0xf64], 0xffffffff
or dword [ebp - 0xf60], 0xffffffff
or dword [ebp - 0xf5c], 0xffffffff
lea ecx, [ebp - 0x4bd]
call fcn.100106ce
push eax
lea eax, [ebp - 0xf58]
push eax
lea eax, [ebp - 0xf68]
push eax
lea ecx, [ebp - 0x1328]
call fcn.100106d1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb24]
call fcn.1001067d
mov dword [ebp - 4], 4
mov dword [ebp - 0xec], 3
mov dword [ebp - 0x21c], 0
jmp 0x1002b625
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 4
jge 0x1002b641
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0x1234], 0x3f36fc75
jmp 0x1002b618
mov dword [ebp - 0x564], 0x176b
mov dword [ebp - 0xe3c], 0x1000a0a8
cmp dword [ebp - 0x564], 0x17c5
jle 0x1002b70b
and dword [ebp - 0x3c8], 0
jmp 0x1002b67b
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0x3517
jge 0x1002b70b
and dword [ebp - 0x224], 0
jmp 0x1002b6a1
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x6f59
jge 0x1002b706
mov eax, dword [ebp - 0x3c8]
mov ecx, dword [ebp - 0x224]
shl eax, cl
cdq
mov dword [ebp - 0xccc], eax
mov dword [ebp - 0xcc8], edx
push dword [ebp - 0xcc8]
push dword [ebp - 0xccc]
lea ecx, [ebp - 0x1388]
call fcn.1000da20
pop ecx
pop ecx
mov dword [ebp - 0xe14], eax
mov ecx, dword [ebp - 0xe14]
call fcn.100104ec
push eax
call fcn.100540b6
pop ecx
lea ecx, [ebp - 0x1388]
call fcn.100104e2
jmp 0x1002b694
jmp 0x1002b66e
mov dword [ebp - 0xec], 0
jmp 0x1002b724
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jg 0x1002bb65
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x474], 0x2625aa9c
mov dword [ebp - 0x3c], 0
jmp 0x1002b752
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jg 0x1002bb60
mov dword [ebp - 0x52c], 0xffffffff
mov dword [ebp - 0x110], 0xee85ec41
mov dword [ebp - 0x46c], 0x89ced66e
mov dword [ebp - 0xe24], 0xfffffff8
mov dword [ebp - 0xe34], 0
mov dword [ebp - 0x340], 0
jmp 0x1002b7a7
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 3
jge 0x1002b7c3
mov eax, dword [ebp - 0x340]
mov dword [ebp + eax*4 - 0x12d8], 0
jmp 0x1002b79a
cmp dword [ebp - 0x3c], 0x30467731
je 0x1002b7d8
mov dword [ebp - 0xad8], 1
jmp 0x1002b7df
and dword [ebp - 0xad8], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0xad8], eax
jl 0x1002b7f9
mov dword [ebp - 0x96c], 1
jmp 0x1002b800
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x96c], eax
jle 0x1002b81a
mov dword [ebp - 0xa98], 1
jmp 0x1002b821
and dword [ebp - 0xa98], 0
mov eax, dword [ebp - 0xa98]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 4
jl 0x1002b842
mov dword [ebp - 0x520], 1
jmp 0x1002b849
and dword [ebp - 0x520], 0
cmp dword [ebp - 0x520], 1
jg 0x1002b85e
mov dword [ebp - 0x548], 1
jmp 0x1002b865
and dword [ebp - 0x548], 0
push 0xfffffffffffffff7
pop eax
sub eax, dword [ebp - 0x548]
je 0x1002b881
or eax, 0xffffffff
je 0x1002b881
mov dword [ebp - 0xe1c], 1
jmp 0x1002b888
and dword [ebp - 0xe1c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x106c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0xfffb
je 0x1002b8b5
mov dword [ebp - 0x804], 1
jmp 0x1002b8bc
and dword [ebp - 0x804], 0
cmp dword [ebp - 0x804], 0xcfcb8f1f
jne 0x1002b8d4
mov dword [ebp - 0x534], 1
jmp 0x1002b8db
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x46c]
cmp dword [ebp - 0x534], eax
jne 0x1002b8f5
mov dword [ebp - 0xa24], 1
jmp 0x1002b8fc
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0xec]
add eax, dword [ebp - 0xa24]
add eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x53c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x53c]
mov dword [ebp + eax - 0x12d8], ecx
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x53c], eax
jg 0x1002b93c
mov dword [ebp - 0x544], 1
jmp 0x1002b943
and dword [ebp - 0x544], 0
push dword [ebp - 0xec]
lea ecx, [ebp - 0xb24]
call fcn.100106bf
mov dword [ebp - 0x80c], eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xb24]
call fcn.100106bf
mov ecx, dword [ebp - 0x80c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x80c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x544]
jle 0x1002b98e
mov dword [ebp - 0x4b4], 1
jmp 0x1002b995
and dword [ebp - 0x4b4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4b4]
mov dword [ebp + eax - 0x1234], ecx
mov eax, dword [ebp - 0x46c]
cmp dword [ebp - 0x4b4], eax
jl 0x1002b9db
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x474], eax
mov byte [ebp - 0xbf], 0
lea eax, [ebp - 0xbf]
push eax
push 0
call fcn.100256c9
pop ecx
pop ecx
jmp 0x1002ba10
lea eax, [ebp - 0xec]
push eax
push 0x1fdf
lea eax, [ebp - 0x110]
push eax
push 0x1c5f
push 0x3db8
lea eax, [ebp - 0xb24]
push eax
push 0x4eaf
push 0
push 0
call fcn.100227b8
add esp, 0x24
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1234], 0
je 0x1002bad7
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xb24]
call fcn.100106bf
cmp dword [eax], 9
jge 0x1002ba43
mov dword [ebp - 0x974], 1
jmp 0x1002ba4a
and dword [ebp - 0x974], 0
cmp dword [ebp - 0x974], 0xdb1ae9c7
jae 0x1002ba62
mov dword [ebp - 0x54c], 1
jmp 0x1002ba69
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0xe24]
imul eax, dword [ebp - 0x54c]
cmp eax, 0xffffffff
je 0x1002ba87
mov dword [ebp - 0x814], 1
jmp 0x1002ba8e
and dword [ebp - 0x814], 0
cmp dword [ebp - 0x814], 0xd970979b
jbe 0x1002baa6
mov dword [ebp - 0xe2c], 1
jmp 0x1002baad
and dword [ebp - 0xe2c], 0
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x10a0], eax
push 0
lea ecx, [ebp - 0xb24]
call fcn.100106bf
cmp dword [eax], 0
je 0x1002bad7
mov dword [ebp - 0x554], 1
jmp 0x1002bade
and dword [ebp - 0x554], 0
cmp dword [ebp - 0x554], 0xe255
jle 0x1002baf6
mov dword [ebp - 0xaac], 1
jmp 0x1002bafd
and dword [ebp - 0xaac], 0
mov eax, dword [ebp - 0x474]
cmp eax, dword [ebp - 0xaac]
jne 0x1002bb17
mov dword [ebp - 0x55c], 1
jmp 0x1002bb1e
and dword [ebp - 0x55c], 0
imul eax, dword [ebp - 0x55c], 0x27fd
test eax, eax
jne 0x1002bb3e
cmp dword [ebp - 0xe34], 0
jne 0x1002bb3e
and dword [ebp - 0x81c], 0
jmp 0x1002bb48
mov dword [ebp - 0x81c], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x81c]
mov dword [ebp + eax - 0x1234], ecx
jmp 0x1002b74b
jmp 0x1002b717
mov byte [ebp - 4], 5
cmp dword [ebp - 0x564], 0x13c2
jge 0x1002bb81
push dword [ebp - 0xe3c]
call fcn.100540b6
pop ecx
jmp 0x1002bb9d
mov dword [ebp - 4], 4
jmp 0x1002bbad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb24]
call fcn.100106a3
push 4
lea ecx, [ebp - 0xaf4]
call fcn.10010621
mov dword [ebp - 4], 7
push 1
lea ecx, [ebp - 0x1e8]
call fcn.10010621
mov byte [ebp - 4], 8
lea eax, [ebp - 0xaf4]
push eax
push 0xb89
push 0x75e8
push 1
push 1
lea eax, [ebp - 0x180]
push eax
push 0x4e8b
push 0x472b
push 0
push 0x213d
call fcn.10021ed9
add esp, 0x28
mov dword [ebp - 0x22c], 0x3ae35568
mov dword [ebp - 0x22c], 0
jmp 0x1002bc39
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0xe
jl 0x1002bcfd
mov dword [ebp - 0x6c], 0xa9831117
mov dword [ebp - 0x410], 0
jmp 0x1002bc66
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 2
jge 0x1002bc82
mov eax, dword [ebp - 0x410]
mov dword [ebp + eax*4 - 0x1204], 0xfffffffc
jmp 0x1002bc59
mov dword [ebp - 0x6c], 0
jmp 0x1002bc92
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jg 0x1002bcd2
mov byte [ebp - 0xc7], 0
push 0x766f
push 0x1d8e
push 0x72b2
push 0
push 0x45b0
push 0
push 0x5cb7
lea eax, [ebp - 0xc7]
push eax
push 0x7dfd
call fcn.1002582f
add esp, 0x24
jmp 0x1002bc8b
mov dword [ebp - 0x6c], 0
jmp 0x1002bce2
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x1002bcf8
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x1204], 0xd2e8588d
jmp 0x1002bcdb
jmp 0x1002bc2c
mov dword [ebp - 0x180], 0
jmp 0x1002bd16
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 1
jge 0x1002bd38
push dword [ebp - 0x180]
lea ecx, [ebp - 0x1e8]
call fcn.100106bf
mov dword [eax], 0xa32b1cec
jmp 0x1002bd09
mov dword [ebp - 0x11d0], 0
mov dword [ebp - 0x844], 0xffffffff
push 4
lea ecx, [ebp - 0x1160]
call fcn.10010621
mov byte [ebp - 4], 9
mov dword [ebp - 0xbcc], 1
mov dword [ebp - 0x97c], 0x6e3
mov dword [ebp - 0xe90], 0x1000a140
cmp dword [ebp - 0x97c], 0x974
jle 0x1002bea1
and dword [ebp - 0x23c], 0
jmp 0x1002bda1
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0x466
jge 0x1002be94
and dword [ebp - 0x3d0], 0
jmp 0x1002bdc7
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x1e5d
jge 0x1002be8f
and dword [ebp - 0x234], 0
jmp 0x1002bded
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0x27a7
jge 0x1002be8a
and dword [ebp - 0x348], 0
jmp 0x1002be13
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0x6fec
jge 0x1002be85
mov eax, dword [ebp - 0x234]
cdq
idiv dword [ebp - 0x348]
mov eax, dword [ebp - 0x23c]
xor eax, dword [ebp - 0x3d0]
or eax, edx
cdq
mov dword [ebp - 0xcd8], eax
mov dword [ebp - 0xcd4], edx
push dword [ebp - 0xcd4]
push dword [ebp - 0xcd8]
lea ecx, [ebp - 0x13b8]
call fcn.1000da20
pop ecx
pop ecx
mov dword [ebp - 0xe44], eax
mov ecx, dword [ebp - 0xe44]
call fcn.100104ec
push eax
call fcn.100540b6
pop ecx
lea ecx, [ebp - 0x13b8]
call fcn.100104e2
jmp 0x1002be06
jmp 0x1002bde0
jmp 0x1002bdba
jmp 0x1002bd94
push 0x20ae
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0x47c], 1
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x97c], 0x3ce
jge 0x1002bec7
push dword [ebp - 0xe90]
call fcn.100540b6
pop ecx
jmp 0x1002bee3
mov dword [ebp - 4], 9
jmp 0x1002bef3
mov dword [ebp - 0x5c], 0
jmp 0x1002bf03
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x1002bf19
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xae8], 0x40d7f825
jmp 0x1002befc
mov dword [ebp - 0x5c], 0
jmp 0x1002bf29
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x1002bf45
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x1160]
call fcn.100106bf
mov dword [eax], 0x8792891f
jmp 0x1002bf22
mov byte [ebp - 0xdd], 0
push 0x745c
push 0x5369
push 0x1661
push 0x5b2c
push 0x590c
push 0x7422
push 0x724e
push 0
push 0
lea eax, [ebp - 0xdd]
push eax
push 0x456
call fcn.100221f3
add esp, 0x2c
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xae8], 0
jmp 0x1002bfb2
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xae8]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xae8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xae8], 8
jl 0x1002c5c6
mov dword [ebp - 0x98], 0x3d4e677b
mov dword [ebp - 0x198], 0xd018d30
mov dword [ebp - 0x834], 0xfffffff8
mov dword [ebp - 0x10a8], 0x9ef57a55
mov dword [ebp - 0x128c], 1
mov dword [ebp - 0x10b0], 0xfffffffd
mov dword [ebp - 0xcf8], 0
mov dword [ebp - 0x11d8], 0x9f81a770
mov dword [ebp - 0xb78], 0xc46158e9
mov dword [ebp - 0x56c], 0x58ae
mov dword [ebp - 0xea4], 0x1000a16c
cmp dword [ebp - 0x56c], 0x5b05
jle 0x1002c0be
and dword [ebp - 0x244], 0
jmp 0x1002c055
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0x52ee
jge 0x1002c0b6
and dword [ebp - 0x350], 0
jmp 0x1002c077
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0x6b22
jge 0x1002c0b4
mov eax, dword [ebp - 0x244]
sub eax, dword [ebp - 0x350]
cdq
mov dword [ebp - 0xce4], eax
mov dword [ebp - 0xce0], edx
push dword [ebp - 0xce0]
push dword [ebp - 0xce4]
mov ecx, 0x10613338
call fcn.1001050c
jmp 0x1002c06a
jmp 0x1002c048
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov dword [ebp - 0x10b8], 7
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x56c], 0x5805
jge 0x1002c0e8
mov edx, dword [ebp - 0xea4]
mov ecx, 0x10613338
call fcn.10011fb6
jmp 0x1002c104
mov dword [ebp - 4], 9
jmp 0x1002c114
mov dword [ebp - 0x1238], 0xffffffff
mov dword [ebp - 0x10c0], 0xffffffff
mov dword [ebp - 0x11e0], 0xfffffff6
mov dword [ebp - 0xb88], 0xb1ed3090
push 3
lea ecx, [ebp - 0xf88]
call fcn.10010621
mov byte [ebp - 4], 0xe
push 0x2f98
push 0x7128
push 0x42ea
lea eax, [ebp - 0x10c8]
push eax
push 0x3da0
push 0x1245
push 0x756e
push 1
lea eax, [ebp - 0xf88]
push eax
push 0x7c24
push 0x4236
push 0
push 0
push 0x6434
call fcn.10022f71
add esp, 0x38
mov dword [ebp - 0x198], 0x594d0357
cmp dword [ebp - 0x198], 0
jne 0x1002c1e3
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xae8]
imul ecx, dword [ebp + eax - 0xae8]
mov dword [ebp - 0x198], ecx
imul eax, dword [ebp - 0x198], 0xaf12
cmp eax, 0xf0f
jle 0x1002c1e3
and dword [ebp - 0x824], 0
jmp 0x1002c1ed
mov dword [ebp - 0x824], 1
imul eax, dword [ebp - 0x824], 0xec62
cmp eax, dword [ebp - 0x98]
jle 0x1002c20b
mov dword [ebp - 0x574], 1
jmp 0x1002c212
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x574], eax
jg 0x1002c22c
mov dword [ebp - 0xa2c], 1
jmp 0x1002c233
and dword [ebp - 0xa2c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xae8]
cmp dword [ebp - 0xa2c], eax
jge 0x1002c253
mov dword [ebp - 0x57c], 1
jmp 0x1002c25a
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0x57c]
cmp eax, dword [ebp - 0x98]
jne 0x1002c27a
mov dword [ebp - 0x82c], 1
jmp 0x1002c281
and dword [ebp - 0x82c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xae8]
cmp dword [ebp - 0x82c], eax
jne 0x1002c2a1
mov dword [ebp - 0x584], 1
jmp 0x1002c2a8
and dword [ebp - 0x584], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xae8]
cmp dword [ebp - 0x584], eax
jg 0x1002c2c8
mov dword [ebp - 0x984], 1
jmp 0x1002c2cf
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x984]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jne 0x1002c2f0
mov dword [ebp - 0x58c], 1
jmp 0x1002c2f7
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x58c]
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0
je 0x1002c32b
mov byte [ebp - 0xc9], 0
lea eax, [ebp - 0xc9]
push eax
push 0
push 0
call fcn.10034faf
add esp, 0xc
jmp 0x1002c5b2
mov dword [ebp - 0x1294], 5
push 1
lea ecx, [ebp - 0xeec]
call fcn.10010621
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x10d0], 0xfffffffc
mov dword [ebp - 0x11e8], 0xfeac
push 3
lea ecx, [ebp - 0xeb0]
call fcn.10010621
mov byte [ebp - 4], 0x10
push 0x4c76
push 0x4414
push 0xe6a
push 0x27d8
lea eax, [ebp - 0xeec]
push eax
push 0x5c64
push 0x3c1c
push 0
lea eax, [ebp - 0xca4]
push eax
push 0
push 0x4994
call fcn.1003d8e5
add esp, 0x2c
push 0x56e3
lea eax, [ebp - 0xeb0]
push eax
push 0
push 0x7f19
push 1
lea eax, [ebp - 0xca4]
push eax
call fcn.1002209a
add esp, 0x18
mov esi, dword [ebp - 0xbcc]
push 1
lea ecx, [ebp - 0xeb0]
call fcn.100106bf
add esi, dword [eax]
cmp esi, 0x7358
jge 0x1002c3f5
mov dword [ebp - 0x4e0], 1
jmp 0x1002c3fc
and dword [ebp - 0x4e0], 0
push 1
lea ecx, [ebp - 0xeb0]
call fcn.100106bf
mov ecx, dword [ebp - 0x4e0]
mov dword [eax], ecx
cmp dword [ebp - 0x4e0], 0
je 0x1002c42f
cmp dword [ebp - 0xb78], 0
je 0x1002c42f
mov dword [ebp - 0x594], 1
jmp 0x1002c436
and dword [ebp - 0x594], 0
mov esi, dword [ebp - 0x594]
sub esi, 0xa74b
push 0
lea ecx, [ebp - 0xeec]
call fcn.100106bf
cmp esi, dword [eax]
jne 0x1002c45f
mov dword [ebp - 0xa84], 1
jmp 0x1002c466
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0xcf8]
cmp dword [ebp - 0xa84], eax
je 0x1002c480
mov dword [ebp - 0x59c], 1
jmp 0x1002c487
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x47c]
imul eax, dword [ebp - 0x59c]
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xcfc], eax
mov eax, dword [ebp - 0x47c]
inc eax
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0xb80]
cmp eax, dword [ebp - 0xcfc]
jne 0x1002c4cd
mov dword [ebp - 0x83c], 1
jmp 0x1002c4d4
and dword [ebp - 0x83c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xae8]
imul eax, dword [ebp - 0x83c]
cmp eax, 0x315
je 0x1002c4fa
mov dword [ebp - 0x5a4], 1
jmp 0x1002c501
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x5a4], eax
jg 0x1002c51b
mov dword [ebp - 0x98c], 1
jmp 0x1002c522
and dword [ebp - 0x98c], 0
cmp dword [ebp - 0x98c], 0x37bb
jl 0x1002c540
mov eax, 0xf78c
test eax, eax
jne 0x1002c540
and dword [ebp - 0x5ac], 0
jmp 0x1002c54a
mov dword [ebp - 0x5ac], 1
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x844], eax
lea eax, [ebp - 0x198]
push eax
push 0x1b88
push 0x64de
push 0
lea eax, [ebp - 0xf88]
push eax
lea eax, [ebp - 0x844]
push eax
push 0
lea eax, [ebp - 0xeec]
push eax
push 0x6773
lea eax, [ebp - 0xb88]
push eax
call fcn.1003efd2
add esp, 0x28
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xeb0]
call fcn.100106a3
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xeec]
call fcn.100106a3
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xf88]
call fcn.100106a3
jmp 0x1002bf99
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1160]
call fcn.100106a3
push 0
lea ecx, [ebp - 0x1e8]
call fcn.100106bf
and dword [eax], 0
jmp 0x1002c60b
push 0
lea ecx, [ebp - 0x1e8]
call fcn.100106bf
mov dword [ebp - 0x5b4], eax
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5b4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1e8]
call fcn.100106bf
cmp dword [eax], 3
jg 0x1002d326
mov dword [ebp - 0xb90], 0x6a53d06c
push 3
lea ecx, [ebp - 0xec8]
call fcn.10010621
mov byte [ebp - 4], 0x11
mov dword [ebp - 0xa8], 0xb283066c
mov dword [ebp - 0xdf0], 0x6968
mov dword [ebp - 0x5cc], 0x26f39384
push 0x3fc7
lea eax, [ebp - 0x10d8]
push eax
push 1
push 0x66e5
push 0x32a5
push 0
lea eax, [ebp - 0xec8]
push eax
call fcn.100239ca
add esp, 0x1c
push 0
lea eax, [ebp - 0xa8]
push eax
call fcn.10037649
pop ecx
pop ecx
mov dword [ebp - 0xa8], 0
jmp 0x1002c6ac
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jg 0x1002c821
mov dword [ebp - 0xd08], 0xbe9fb1c0
mov dword [ebp - 0x24c], 0
jmp 0x1002c6dc
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 4
jge 0x1002c6f8
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x1348], 0xfffffffa
jmp 0x1002c6cf
push 0x7d28
push 0x28a3
push 0x1d0f
push 0
push 0x5204
lea eax, [ebp - 0xdf0]
push eax
push 1
push 0x15c4
push 1
call fcn.10023f18
add esp, 0x24
cmp dword [ebp - 0xa8], 0
jne 0x1002c741
cmp dword [ebp - 0xa8], 0
jne 0x1002c741
and dword [ebp - 0xa34], 0
jmp 0x1002c74b
mov dword [ebp - 0xa34], 1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1348], 0
je 0x1002c76f
cmp dword [ebp - 0xb90], 0
je 0x1002c76f
mov dword [ebp - 0x5bc], 1
jmp 0x1002c776
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0xa34]
cmp eax, dword [ebp - 0x5bc]
jge 0x1002c790
mov dword [ebp - 0x5c4], 1
jmp 0x1002c797
and dword [ebp - 0x5c4], 0
push 0
lea ecx, [ebp - 0xec8]
call fcn.100106bf
mov dword [ebp - 0x84c], eax
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xec8]
call fcn.100106bf
mov ecx, dword [ebp - 0x84c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x84c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5c4]
jge 0x1002c7e1
mov dword [ebp - 0x994], 1
jmp 0x1002c7e8
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 1
jne 0x1002c809
mov dword [ebp - 0x854], 1
jmp 0x1002c810
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0xd08], eax
jmp 0x1002c69f
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xec8]
call fcn.100106a3
mov dword [ebp - 0xd14], 0xfffffffb
mov dword [ebp - 0x150], 0x3fcb50bf
mov dword [ebp - 0x204], 0
jmp 0x1002c85d
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 1
jge 0x1002c879
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0xb98], 0x8eac8b13
jmp 0x1002c850
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1002c8a6
push 0
push 0x2480
push 0
push 0x2286
push 0
push 0x944
call dword [sym.imp.USER32.dll_DrawTextExW]
mov dword [ebp - 0x150], 0
jmp 0x1002c8bf
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jl 0x1002c8ff
mov byte [ebp - 0xcb], 0
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x1002c8eb
push 0
push 0x1258
push 0
call fcn.10036b26
add esp, 0xc
mov eax, dword [ebp - 0x150]
cmp dword [ebp + eax*4 - 0xb98], 0
je 0x1002c8fd
jmp 0x1002c8ff
jmp 0x1002c8b2
mov dword [ebp - 0x254], 1
mov dword [ebp - 0x124c], 0
mov dword [ebp - 0x450], 0
jmp 0x1002c92c
mov eax, dword [ebp - 0x450]
inc eax
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 2
jge 0x1002c948
mov eax, dword [ebp - 0x450]
mov dword [ebp + eax*4 - 0x110c], 1
jmp 0x1002c91f
mov dword [ebp - 0x254], 0
jmp 0x1002c961
mov eax, dword [ebp - 0x254]
dec eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffe9
jg 0x1002cb8a
mov dword [ebp - 0x84], 7
mov dword [ebp - 0x84], 0
jmp 0x1002c991
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jg 0x1002ca64
mov dword [ebp - 0x358], 0x2937a3a1
mov dword [ebp - 0x358], 1
jmp 0x1002c9c1
mov eax, dword [ebp - 0x358]
dec eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0
jl 0x1002ca5f
mov dword [ebp - 0x158], 0x5f0ed1ad
mov dword [ebp - 0x158], 0
jmp 0x1002c9f1
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jg 0x1002ca4c
mov dword [ebp - 0x1c0], 0x98e64e6d
push 0
push 0x5608
push 1
call fcn.10022e0c
add esp, 0xc
mov dword [ebp - 0x1c0], 0
jmp 0x1002ca2e
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 2
jge 0x1002ca4a
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x110c], 0x60f7e730
jmp 0x1002ca21
jmp 0x1002c9e4
cmp dword [ebp - 0x158], 0
je 0x1002ca5a
jmp 0x1002c9b4
jmp 0x1002c9b4
jmp 0x1002c984
mov dword [ebp - 0x84], 0xffffffe3
jmp 0x1002ca7d
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xd
jl 0x1002cb85
push 2
lea ecx, [ebp - 0xf94]
call fcn.10010621
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x7c], 0
jmp 0x1002caab
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 4
jge 0x1002cac1
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x1034], 0x23dcdf5
jmp 0x1002caa4
mov dword [ebp - 0x7c], 0
jmp 0x1002cad1
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1002caed
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xf94]
call fcn.100106bf
mov dword [eax], 0xc12a7b09
jmp 0x1002caca
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1034], 0
jmp 0x1002cb1b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1034]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1034], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1034], 0xffffffe4
jg 0x1002cb71
mov dword [ebp - 0xe48], 0xfffffffc
push 0
push 0
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0xf94]
push eax
call fcn.10022014
add esp, 0x10
mov byte [ebp - 0xdf], 0
movzx eax, byte [ebp - 0xdf]
test eax, eax
je 0x1002cb6f
push 0x1dc8
push 0
call fcn.1003ea79
pop ecx
pop ecx
jmp 0x1002cb00
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xf94]
call fcn.100106a3
jmp 0x1002ca70
jmp 0x1002c954
push 0
lea ecx, [ebp - 0x1e8]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0xaf4]
call fcn.100106bf
push 0
lea ecx, [ebp - 0x1e8]
call fcn.100106bf
cmp dword [eax], 0
jne 0x1002cc1a
push 0
lea ecx, [ebp - 0x1e8]
call fcn.100106bf
imul esi, dword [eax], 0xffffffff
push 0
lea ecx, [ebp - 0x1e8]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0xaf4]
call fcn.100106bf
sub esi, dword [eax]
cmp esi, 0xfffffff9
jl 0x1002cbf3
mov dword [ebp - 0x5d4], 1
jmp 0x1002cbfa
and dword [ebp - 0x5d4], 0
push 0
lea ecx, [ebp - 0x1e8]
call fcn.100106bf
mov ecx, dword [ebp - 0x5d4]
cmp ecx, dword [eax]
jl 0x1002cc1a
and dword [ebp - 0xac4], 0
jmp 0x1002cc24
mov dword [ebp - 0xac4], 1
mov eax, dword [ebp - 0xac4]
add eax, 6
jne 0x1002cc57
push 0
lea ecx, [ebp - 0x1e8]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0xaf4]
call fcn.100106bf
cmp dword [eax], 0
jne 0x1002cc57
and dword [ebp - 0x5dc], 0
jmp 0x1002cc61
mov dword [ebp - 0x5dc], 1
cmp dword [ebp - 0x5dc], 0x6ec7
jl 0x1002cc79
mov dword [ebp - 0xba0], 1
jmp 0x1002cc80
and dword [ebp - 0xba0], 0
push 0
lea ecx, [ebp - 0x1e8]
call fcn.100106bf
push 0
lea ecx, [ebp - 0x1e8]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0xaf4]
call fcn.100106bf
mov esi, dword [eax]
push 0
lea ecx, [ebp - 0x1e8]
call fcn.100106bf
mov eax, dword [eax]
lea eax, [esi + eax - 0xffff]
imul eax, eax, 0xfffffffe
mov dword [ebp - 0x85c], eax
push 0
lea ecx, [ebp - 0x1e8]
call fcn.100106bf
push dword [eax]
lea ecx, [ebp - 0xaf4]
call fcn.100106bf
mov ecx, dword [ebp - 0x85c]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x1e8]
call fcn.100106bf
mov ecx, dword [ebp - 0x85c]
cmp ecx, dword [eax]
jne 0x1002cd0d
mov dword [ebp - 0x5e4], 1
jmp 0x1002cd14
and dword [ebp - 0x5e4], 0
push 0
lea ecx, [ebp - 0x1e8]
call fcn.100106bf
mov ecx, dword [ebp - 0x5e4]
cmp ecx, dword [eax]
jle 0x1002cd37
mov dword [ebp - 0x99c], 1
jmp 0x1002cd3e
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0xd14], eax
mov byte [ebp - 0xcf], 0
mov dword [ebp - 0x2c], 0x17571177
mov dword [ebp - 0x874], 0xc935cb51
mov dword [ebp - 0x2c], 0
jmp 0x1002cd72
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 6
jge 0x1002d2fd
mov dword [ebp - 0x90], 0xfffffffd
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0xf4], 0x9ca3eaa3
mov dword [ebp - 0x614], 2
mov dword [ebp - 0x60c], 1
mov dword [ebp - 0x25c], 0
jmp 0x1002cdc4
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 1
jge 0x1002cde0
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0xbb0], 0x6ab81d4
jmp 0x1002cdb7
cmp dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10e0], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x11f0], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x64]
jge 0x1002ce0a
mov dword [ebp - 0x5ec], 1
jmp 0x1002ce11
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x5ec]
cmp eax, 0x27f08e22
jne 0x1002ce2d
mov dword [ebp - 0xba8], 1
jmp 0x1002ce34
and dword [ebp - 0xba8], 0
mov dword [ebp - 0x90], 0x9120
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x10e8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x12a0], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x10f0], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x11f8], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x10f8], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x1260], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x1100], eax
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x2c]
jle 0x1002ce94
mov dword [ebp - 0x864], 1
jmp 0x1002ce9b
and dword [ebp - 0x864], 0
cmp dword [ebp - 0x864], 0xffff
jne 0x1002ceb3
mov dword [ebp - 0x5f4], 1
jmp 0x1002ceba
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x8877
jne 0x1002cede
mov dword [ebp - 0xa3c], 1
jmp 0x1002cee5
and dword [ebp - 0xa3c], 0
cmp dword [ebp - 0xa3c], 7
je 0x1002cefa
mov dword [ebp - 0x5fc], 1
jmp 0x1002cf01
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x5fc], eax
jle 0x1002cf18
mov dword [ebp - 0x86c], 1
jmp 0x1002cf1f
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x86c], eax
jge 0x1002d108
mov dword [ebp - 0x61c], 0x38ff
mov dword [ebp - 0xf4], 0x11
jmp 0x1002cf51
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xd
je 0x1002d0f5
mov dword [ebp - 0xdf8], 1
mov dword [ebp - 0x624], 0x3d4f39ab
mov dword [ebp - 0x90], 0x16
jmp 0x1002cf8b
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xfffffff6
jle 0x1002d00e
push 1
lea ecx, [ebp - 0xfac]
call fcn.10010621
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x3d8], 0
jmp 0x1002cfbe
mov eax, dword [ebp - 0x3d8]
inc eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 1
jge 0x1002cfe0
push dword [ebp - 0x3d8]
lea ecx, [ebp - 0xfac]
call fcn.100106bf
mov dword [eax], 0xfffffff9
jmp 0x1002cfb1
push 0
lea ecx, [ebp - 0xfac]
call fcn.100106bf
or dword [eax], 0xffffffff
mov dword [ebp - 0x874], 0xffffffff
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xfac]
call fcn.100106a3
jmp 0x1002cf7e
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x61c]
jle 0x1002d025
mov dword [ebp - 0x604], 1
jmp 0x1002d02c
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x604]
cmp eax, dword [ebp - 0x64]
jl 0x1002d049
mov dword [ebp - 0x9a4], 1
jmp 0x1002d050
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp - 0x60c]
sub eax, 0x24374969
cmp dword [ebp - 0xdf8], eax
je 0x1002d07b
mov dword [ebp - 0xa8c], 1
jmp 0x1002d082
and dword [ebp - 0xa8c], 0
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x614], eax
mov eax, dword [ebp - 0x614]
cmp eax, dword [ebp - 0xa8c]
je 0x1002d0a8
mov dword [ebp - 0x87c], 1
jmp 0x1002d0af
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x61c]
imul eax, dword [ebp - 0x87c]
sub eax, dword [ebp - 0xf4]
mov dword [ebp - 0x624], eax
je 0x1002d0d6
mov dword [ebp - 0x9ac], 1
jmp 0x1002d0dd
and dword [ebp - 0x9ac], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9ac]
mov dword [ebp + eax - 0xbb0], ecx
jmp 0x1002cf44
cmp dword [ebp - 0x90], 0
je 0x1002d103
jmp 0x1002cd6b
jmp 0x1002d2da
mov dword [ebp - 0x62c], 0x17c5
mov dword [ebp - 0xbb8], 0x1000a1d0
cmp dword [ebp - 0x62c], 0x1823
jle 0x1002d21c
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
and dword [ebp - 0x26c], 0
jmp 0x1002d14e
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0x7aa2
jge 0x1002d212
and dword [ebp - 0x264], 0
jmp 0x1002d174
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0x1d92
jge 0x1002d20d
and dword [ebp - 0x360], 0
jmp 0x1002d19a
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0x65d6
jge 0x1002d208
mov eax, dword [ebp - 0x264]
cdq
idiv dword [ebp - 0x360]
mov eax, dword [ebp - 0x26c]
mov ecx, edx
sar eax, cl
cdq
mov dword [ebp - 0xcf0], eax
mov dword [ebp - 0xcec], edx
push dword [ebp - 0xcec]
push dword [ebp - 0xcf0]
lea ecx, [ebp - 0x1418]
call fcn.1000da20
pop ecx
pop ecx
mov dword [ebp - 0xd20], eax
mov ecx, dword [ebp - 0xd20]
call fcn.100104ec
push eax
call fcn.100540b6
pop ecx
lea ecx, [ebp - 0x1418]
call fcn.100104e2
jmp 0x1002d18d
jmp 0x1002d167
jmp 0x1002d141
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x62c], 0x1420
jge 0x1002d238
push dword [ebp - 0xbb8]
call fcn.100540b6
pop ecx
jmp 0x1002d254
mov dword [ebp - 4], 8
jmp 0x1002d264
mov dword [ebp - 0x418], 0
jmp 0x1002d27d
mov eax, dword [ebp - 0x418]
inc eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 2
jge 0x1002d299
mov eax, dword [ebp - 0x418]
mov dword [ebp + eax*4 - 0xf04], 0x9ee52129
jmp 0x1002d270
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf04]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xf04], eax
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1002d2da
push 0x3063
push 0x5ebc
push 0
call fcn.1003f9cf
add esp, 0xc
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1002d2f8
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
jmp 0x1002cd6b
push 0
push 0
push 1
push 0x1928
push 0x281a
lea eax, [ebp - 0xcf]
push eax
push 0x4a42
call fcn.1003b461
add esp, 0x1c
jmp 0x1002c5e7
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1e8]
call fcn.100106a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf4]
call fcn.100106a3
mov dword [ebp - 0x1298], 0xea7
push 0x3fc8
push 0
push 0x1dff
push 0x6b65
push 0x7005
push 0x144d
push 0x69ce
push 0x2b2f
push 0xc6d
push 0
call fcn.1002499f
add esp, 0x28
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1002d3a8
push 0
push 0
push 0x1b68
push 0x67e
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 0xea0]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x94], 0xffffffff
mov dword [ebp - 0x4bc], 1
mov dword [ebp - 0x370], 6
mov dword [ebp - 0x67c], 0x56eff52
mov dword [ebp - 0x284], 0
mov dword [ebp - 0xa94], 0
cmp dword [ebp - 0x1c], 0
je 0x1002d44d
mov eax, dword [ebp - 0x1c]
neg eax
jne 0x1002d429
cmp dword [ebp - 0x1c], 0
je 0x1002d420
mov eax, 0x8fb0
test eax, eax
jne 0x1002d429
and dword [ebp - 0x884], 0
jmp 0x1002d433
mov dword [ebp - 0x884], 1
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x884]
test eax, eax
je 0x1002d44d
mov dword [ebp - 0x634], 1
jmp 0x1002d454
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0x1c]
jne 0x1002d47d
cmp dword [ebp - 0x1c], 0
je 0x1002d47d
mov dword [ebp - 0xbc0], 1
jmp 0x1002d484
and dword [ebp - 0xbc0], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1140], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x120c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x114c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1274], eax
cmp dword [ebp - 0xfc], 0
jne 0x1002d4bd
mov dword [ebp - 0xa44], 1
jmp 0x1002d4c4
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xa44], eax
jge 0x1002d4db
mov dword [ebp - 0x63c], 1
jmp 0x1002d4e2
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x63c], eax
jg 0x1002d4f9
mov dword [ebp - 0xd2c], 1
jmp 0x1002d500
and dword [ebp - 0xd2c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1154], eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jne 0x1002d536
mov byte [ebp - 0xd1], 0
push 0
lea eax, [ebp - 0xd1]
push eax
call fcn.100373eb
pop ecx
pop ecx
jmp 0x1002d6f3
mov dword [ebp - 0xd38], 0xffff
mov dword [ebp - 0xe00], 0x5296947a
mov dword [ebp - 0xbc8], 0xffffffff
mov dword [ebp - 0xbd0], 0xda9fc5c2
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x7dc3
lea eax, [ebp - 0xbc8]
push eax
lea eax, [ebp - 0xe00]
push eax
lea eax, [ebp - 0xbd0]
push eax
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0xd38]
push eax
push 1
call fcn.1002499f
add esp, 0x28
mov dword [ebp - 0x88c], 0x7a4f
mov dword [ebp - 0xbd8], 0x1000a220
cmp dword [ebp - 0x88c], 0x7aae
jle 0x1002d6aa
push 0x2405
call dword [sym.imp.KERNEL32.dll_Sleep]
and dword [ebp - 0x27c], 0
jmp 0x1002d5e2
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0xbe2
jge 0x1002d6aa
and dword [ebp - 0x3e0], 0
jmp 0x1002d608
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0x5b5c
jge 0x1002d6a5
and dword [ebp - 0x274], 0
jmp 0x1002d62e
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0x5ddb
jge 0x1002d6a0
and dword [ebp - 0x368], 0
jmp 0x1002d650
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0xf0a
jge 0x1002d69e
mov eax, dword [ebp - 0x274]
cdq
idiv dword [ebp - 0x368]
mov eax, dword [ebp - 0x27c]
add eax, dword [ebp - 0x3e0]
mov ecx, edx
shl eax, cl
cdq
mov dword [ebp - 0xd04], eax
mov dword [ebp - 0xd00], edx
push dword [ebp - 0xd00]
push dword [ebp - 0xd04]
mov ecx, 0x10613338
call fcn.1001050c
jmp 0x1002d643
jmp 0x1002d621
jmp 0x1002d5fb
jmp 0x1002d5d5
mov dword [ebp - 4], 0x16
cmp dword [ebp - 0x88c], 0x7981
jge 0x1002d6cd
mov edx, dword [ebp - 0xbd8]
mov ecx, 0x10613338
call fcn.10011fb6
jmp 0x1002d6e9
or dword [ebp - 4], 0xffffffff
jmp 0x1002d6f3
cmp dword [ebp - 0x1c], 0x1863
jle 0x1002d708
mov dword [ebp - 0x66c], 1
jmp 0x1002d70f
and dword [ebp - 0x66c], 0
cmp dword [ebp - 0x94], 0x97010273
jne 0x1002d727
mov dword [ebp - 0x644], 1
jmp 0x1002d72e
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x644], eax
jne 0x1002d745
mov dword [ebp - 0x9b4], 1
jmp 0x1002d74c
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x9b4], eax
jle 0x1002d766
mov dword [ebp - 0x64c], 1
jmp 0x1002d76d
and dword [ebp - 0x64c], 0
cmp dword [ebp - 0x64c], 0x205a4aac
jge 0x1002d785
mov dword [ebp - 0x894], 1
jmp 0x1002d78c
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x894], eax
jge 0x1002d7a6
mov dword [ebp - 0x654], 1
jmp 0x1002d7ad
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x654], eax
jge 0x1002d7c7
mov dword [ebp - 0xab4], 1
jmp 0x1002d7ce
and dword [ebp - 0xab4], 0
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 0
jle 0x1002d7ef
mov dword [ebp - 0x65c], 1
jmp 0x1002d7f6
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x65c], eax
je 0x1002d810
mov dword [ebp - 0x89c], 1
jmp 0x1002d817
and dword [ebp - 0x89c], 0
cmp dword [ebp - 0x89c], 0xffffffff
jbe 0x1002d824
cmp dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x4bc]
cmp eax, dword [ebp - 0x370]
jne 0x1002d843
or eax, 0xffffffff
je 0x1002d843
mov dword [ebp - 0x664], 1
jmp 0x1002d84a
and dword [ebp - 0x664], 0
mov dword [ebp - 0xfc], 0x3e35
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0x664]
je 0x1002d86e
mov dword [ebp - 0x9bc], 1
jmp 0x1002d875
and dword [ebp - 0x9bc], 0
cmp dword [ebp - 0x9bc], 0
jne 0x1002d88a
mov dword [ebp - 0x8a4], 1
jmp 0x1002d891
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x66c]
add eax, dword [ebp - 0x8a4]
add eax, dword [ebp - 0x370]
jne 0x1002d8b1
mov dword [ebp - 0x674], 1
jmp 0x1002d8b8
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x370]
cmp dword [ebp - 0x674], eax
jg 0x1002d8d2
mov dword [ebp - 0xe58], 1
jmp 0x1002d8d9
and dword [ebp - 0xe58], 0
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x94]
jg 0x1002d8f3
mov dword [ebp - 0xa4c], 1
jmp 0x1002d8fa
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 0xae93
jle 0x1002d91e
mov dword [ebp - 0x8ac], 1
jmp 0x1002d925
and dword [ebp - 0x8ac], 0
imul eax, dword [ebp - 0x8ac], 0x95d3
add eax, 0xf0b5
cmp eax, dword [ebp - 0x284]
jne 0x1002d948
mov dword [ebp - 0x684], 1
jmp 0x1002d94f
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x684], eax
je 0x1002d966
mov dword [ebp - 0x9c4], 1
jmp 0x1002d96d
and dword [ebp - 0x9c4], 0
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0x9c4], eax
jge 0x1002d987
mov dword [ebp - 0x68c], 1
jmp 0x1002d98e
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0x68c], eax
jle 0x1002d9b1
cmp dword [ebp - 0x284], 0
je 0x1002d9b1
mov dword [ebp - 0x8b4], 1
jmp 0x1002d9b8
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x8b4]
sub eax, dword [ebp - 0x370]
je 0x1002d9d2
mov dword [ebp - 0x694], 1
jmp 0x1002d9d9
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0xa94], eax
cmp dword [ebp - 0xa94], 0
je 0x1002da0a
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x1002da08
push 0
call fcn.1003d794
pop ecx
jmp 0x1002da34
mov byte [ebp - 0xd3], 0
movzx eax, byte [ebp - 0xd3]
test eax, eax
je 0x1002da34
push 0x189f
push 0
push 0
push 0
push 0x1349
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [ebp - 0x1214], 0xea7
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0x28c], 0
jmp 0x1002da61
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 8
jg 0x1002dae3
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x438], 0xffffffe9
jmp 0x1002da8d
mov eax, dword [ebp - 0x438]
inc eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0x17
je 0x1002dade
mov dword [ebp - 0x294], 0xfffffff7
mov dword [ebp - 0x294], 0
jmp 0x1002dab9
mov eax, dword [ebp - 0x294]
dec eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0xfffffff5
jl 0x1002dadc
push 0x4936
push 1
push 0
push 0
push 0x5265
call fcn.10036c7a
add esp, 0x14
jmp 0x1002daac
jmp 0x1002da80
jmp 0x1002da54
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x484], 0xf839
mov dword [ebp - 0x8cc], 0x49744027
mov dword [ebp - 0x1a0], 0xffffffff
mov dword [ebp - 0x378], 0
jmp 0x1002db21
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 2
jge 0x1002db3d
mov eax, dword [ebp - 0x378]
mov dword [ebp + eax*4 - 0x508], 1
jmp 0x1002db14
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x508], 0
jle 0x1002db59
mov dword [ebp - 0x69c], 1
jmp 0x1002db60
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x484]
cmp dword [ebp - 0x69c], eax
jg 0x1002db7a
mov dword [ebp - 0x8bc], 1
jmp 0x1002db81
and dword [ebp - 0x8bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x508]
cmp dword [ebp - 0x8bc], eax
je 0x1002dba2
mov dword [ebp - 0x6a4], 1
jmp 0x1002dba9
and dword [ebp - 0x6a4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x508]
cmp dword [ebp - 0x6a4], eax
jne 0x1002dbd0
cmp dword [ebp - 0x74], 0
je 0x1002dbd0
mov dword [ebp - 0x9cc], 1
jmp 0x1002dbd7
and dword [ebp - 0x9cc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x508]
add eax, dword [ebp - 0x9cc]
cmp eax, dword [ebp - 0x74]
jge 0x1002dc01
cmp dword [ebp - 0x484], 0
jne 0x1002dc01
and dword [ebp - 0x6ac], 0
jmp 0x1002dc0b
mov dword [ebp - 0x6ac], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x508]
cmp dword [ebp - 0x6ac], eax
jg 0x1002dc2c
mov dword [ebp - 0x8c4], 1
jmp 0x1002dc33
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x8c4]
inc eax
cmp dword [ebp - 0x74], eax
jg 0x1002dc4b
mov dword [ebp - 0x6b4], 1
jmp 0x1002dc52
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x6b4], eax
jl 0x1002dc69
mov dword [ebp - 0xa54], 1
jmp 0x1002dc70
and dword [ebp - 0xa54], 0
xor eax, eax
sub eax, dword [ebp - 0xa54]
cmp eax, dword [ebp - 0x484]
jl 0x1002dc8c
mov dword [ebp - 0x6bc], 1
jmp 0x1002dc93
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x6bc]
jne 0x1002dcaa
mov dword [ebp - 0xbe0], 1
jmp 0x1002dcb1
and dword [ebp - 0xbe0], 0
mov dword [ebp - 0x8cc], 0xff15cc7c
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x1a0], 0
jmp 0x1002dce0
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 1
jg 0x1002dd93
mov dword [ebp - 0x74], 0
jmp 0x1002dcfd
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jg 0x1002dd8e
mov dword [ebp - 0x12c], 0xffffffff
lea eax, [ebp - 0x12c]
push eax
push 0x7746
push 0x22aa
push 0
push 0x2007
push 1
push 0x5f98
push 0x616b
push 0
push 0x42e4
push 0x606d
push 0x638
push 0x7710
call fcn.100252be
add esp, 0x34
mov dword [ebp - 0x12c], 0
jmp 0x1002dd6c
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 1
jg 0x1002dd89
mov eax, dword [ebp - 0x12c]
cmp dword [ebp + eax*4 - 0x508], 0
je 0x1002dd87
jmp 0x1002dd89
jmp 0x1002dd5f
jmp 0x1002dcf6
jmp 0x1002dcd3
mov byte [ebp - 0xe3], 0
movzx eax, byte [ebp - 0xe3]
test eax, eax
je 0x1002e2f1
or dword [ebp - 0xf2c], 0xffffffff
or dword [ebp - 0xf28], 0xffffffff
or dword [ebp - 0xf24], 0xffffffff
or dword [ebp - 0xf20], 0xffffffff
lea ecx, [ebp - 0x4e1]
call fcn.100106ce
push eax
lea eax, [ebp - 0xf1c]
push eax
lea eax, [ebp - 0xf2c]
push eax
lea ecx, [ebp - 0x1370]
call fcn.100106d1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb48]
call fcn.1001067d
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x104], 3
mov dword [ebp - 0x29c], 0
jmp 0x1002de24
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 4
jge 0x1002de40
mov eax, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0x1248], 0x3f36fc75
jmp 0x1002de17
mov dword [ebp - 0x104], 0
jmp 0x1002de59
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jg 0x1002e2d7
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0x4c4], 0x2625aa9c
mov dword [ebp - 0x40], 0
jmp 0x1002de87
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jg 0x1002e2d2
mov dword [ebp - 0xad4], 0xffffffff
mov dword [ebp - 0x11c], 0xee85ec41
mov dword [ebp - 0x4f0], 0x89ced66e
mov dword [ebp - 0xbe8], 0xfffffff8
mov dword [ebp - 0xbf0], 0
mov dword [ebp - 0x3e8], 0
jmp 0x1002dedc
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 3
jge 0x1002def8
mov eax, dword [ebp - 0x3e8]
mov dword [ebp + eax*4 - 0x1320], 0
jmp 0x1002decf
cmp dword [ebp - 0x40], 0x30467731
je 0x1002df0d
mov dword [ebp - 0x6c4], 1
jmp 0x1002df14
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x6c4], eax
jl 0x1002df2e
mov dword [ebp - 0x9d4], 1
jmp 0x1002df35
and dword [ebp - 0x9d4], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x9d4], eax
jle 0x1002df4f
mov dword [ebp - 0x6cc], 1
jmp 0x1002df56
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x6cc]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 4
jl 0x1002df77
mov dword [ebp - 0x8d4], 1
jmp 0x1002df7e
and dword [ebp - 0x8d4], 0
cmp dword [ebp - 0x8d4], 1
jg 0x1002df93
mov dword [ebp - 0x6d4], 1
jmp 0x1002df9a
and dword [ebp - 0x6d4], 0
push 0xfffffffffffffff7
pop eax
sub eax, dword [ebp - 0x6d4]
je 0x1002dfb6
or eax, 0xffffffff
je 0x1002dfb6
mov dword [ebp - 0xd44], 1
jmp 0x1002dfbd
and dword [ebp - 0xd44], 0
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x1164], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xad4], eax
cmp dword [ebp - 0xad4], 0xfffb
je 0x1002dfea
mov dword [ebp - 0x6dc], 1
jmp 0x1002dff1
and dword [ebp - 0x6dc], 0
cmp dword [ebp - 0x6dc], 0xcfcb8f1f
jne 0x1002e009
mov dword [ebp - 0x8dc], 1
jmp 0x1002e010
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x4f0]
cmp dword [ebp - 0x8dc], eax
jne 0x1002e02a
mov dword [ebp - 0x6e4], 1
jmp 0x1002e031
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x104]
add eax, dword [ebp - 0x6e4]
add eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x9dc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x9dc]
mov dword [ebp + eax - 0x1320], ecx
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x9dc], eax
jg 0x1002e071
mov dword [ebp - 0x8e4], 1
jmp 0x1002e078
and dword [ebp - 0x8e4], 0
push dword [ebp - 0x104]
lea ecx, [ebp - 0xb48]
call fcn.100106bf
mov dword [ebp - 0x6ec], eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0xb48]
call fcn.100106bf
mov ecx, dword [ebp - 0x6ec]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x6ec]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x8e4]
jle 0x1002e0c3
mov dword [ebp - 0x48c], 1
jmp 0x1002e0ca
and dword [ebp - 0x48c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x48c]
mov dword [ebp + eax - 0x1248], ecx
mov eax, dword [ebp - 0x4f0]
cmp dword [ebp - 0x48c], eax
jl 0x1002e14d
push 0x231
push 0x2383
lea eax, [ebp - 0x4c4]
push eax
push 0x1731
lea eax, [ebp - 0x11c]
push eax
push 0x4dec
push 0x57f3
push 1
push 0
push 0x68e1
push 0x24aa
call fcn.100221f3
add esp, 0x2c
mov byte [ebp - 0xd4], 0
movzx eax, byte [ebp - 0xd4]
test eax, eax
je 0x1002e14b
push 0
push 0x18d9
push 0
call fcn.1002273e
add esp, 0xc
jmp 0x1002e182
push 0x64fb
push 0x6600
push 0x7232
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x54cf
lea eax, [ebp - 0xb48]
push eax
push 0
push 1
call fcn.100227b8
add esp, 0x24
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1248], 0
je 0x1002e249
push dword [ebp - 0x40]
lea ecx, [ebp - 0xb48]
call fcn.100106bf
cmp dword [eax], 9
jge 0x1002e1b5
mov dword [ebp - 0x6f4], 1
jmp 0x1002e1bc
and dword [ebp - 0x6f4], 0
cmp dword [ebp - 0x6f4], 0xdb1ae9c7
jae 0x1002e1d4
mov dword [ebp - 0xa5c], 1
jmp 0x1002e1db
and dword [ebp - 0xa5c], 0
mov eax, dword [ebp - 0xbe8]
imul eax, dword [ebp - 0xa5c]
cmp eax, 0xffffffff
je 0x1002e1f9
mov dword [ebp - 0x6fc], 1
jmp 0x1002e200
and dword [ebp - 0x6fc], 0
cmp dword [ebp - 0x6fc], 0xd970979b
jbe 0x1002e218
mov dword [ebp - 0xe08], 1
jmp 0x1002e21f
and dword [ebp - 0xe08], 0
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x12a8], eax
push 0
lea ecx, [ebp - 0xb48]
call fcn.100106bf
cmp dword [eax], 0
je 0x1002e249
mov dword [ebp - 0x8ec], 1
jmp 0x1002e250
and dword [ebp - 0x8ec], 0
cmp dword [ebp - 0x8ec], 0xe255
jle 0x1002e268
mov dword [ebp - 0x704], 1
jmp 0x1002e26f
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x4c4]
cmp eax, dword [ebp - 0x704]
jne 0x1002e289
mov dword [ebp - 0x9e4], 1
jmp 0x1002e290
and dword [ebp - 0x9e4], 0
imul eax, dword [ebp - 0x9e4], 0x27fd
test eax, eax
jne 0x1002e2b0
cmp dword [ebp - 0xbf0], 0
jne 0x1002e2b0
and dword [ebp - 0x70c], 0
jmp 0x1002e2ba
mov dword [ebp - 0x70c], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x70c]
mov dword [ebp + eax - 0x1248], ecx
jmp 0x1002de80
jmp 0x1002de4c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb48]
call fcn.100106a3
push 0x1f88
call dword [sym.imp.GDI32.dll_GetStockObject]
push 4
lea ecx, [ebp - 0x1000]
call fcn.10010621
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x2a4], 0
jmp 0x1002e31e
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 4
jge 0x1002e340
push dword [ebp - 0x2a4]
lea ecx, [ebp - 0x1000]
call fcn.100106bf
mov dword [eax], 0xffff
jmp 0x1002e311
push 3
lea ecx, [ebp - 0x1000]
call fcn.100106bf
cmp dword [eax], 0
je 0x1002e374
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1002e372
push 0x7b15
push 0
call fcn.1003e09b
pop ecx
pop ecx
jmp 0x1002e3ea
mov byte [ebp - 0xfd], 0
push 0
lea eax, [ebp - 0xfd]
push eax
call fcn.1003f243
pop ecx
pop ecx
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x1002e3ea
push 0x5964
push 0x1cbc
push 0x3110
push 0x301e
push 0xf8d
push 0x1a13
push 0x35b9
push 0xd84
push 0x7941
push 0x3f46
push 0
push 0
push 0x42ed
push 0x3751
push 0x7558
call fcn.1003bc4d
add esp, 0x3c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1000]
call fcn.100106a3
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1002e4ec
mov dword [ebp - 0x380], 0x3ae35568
mov dword [ebp - 0x380], 0
jmp 0x1002e432
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xe
jl 0x1002e4d8
mov dword [ebp - 0x50], 0xa9831117
mov dword [ebp - 0x2ac], 0
jmp 0x1002e45f
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 2
jge 0x1002e47b
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0x1130], 0xfffffffc
jmp 0x1002e452
mov dword [ebp - 0x50], 0
jmp 0x1002e48b
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jg 0x1002e4ad
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x1002e4ab
push 0
call fcn.10035802
pop ecx
jmp 0x1002e484
mov dword [ebp - 0x50], 0
jmp 0x1002e4bd
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x1002e4d3
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x1130], 0xd2e8588d
jmp 0x1002e4b6
jmp 0x1002e425
push 0
push 0
push 0x1b68
push 0x67e
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0xbf8], 0x64caf14c
mov dword [ebp - 0xf54], 0x6a3735b2
mov dword [ebp - 0xf50], 0x6a3735b2
mov dword [ebp - 0xf4c], 0x6a3735b2
mov dword [ebp - 0xf48], 0x6a3735b2
lea ecx, [ebp - 0x4e9]
call fcn.100106ce
push eax
lea eax, [ebp - 0xf44]
push eax
lea eax, [ebp - 0xf54]
push eax
lea ecx, [ebp - 0x1350]
call fcn.100106d1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1170]
call fcn.1001067d
mov dword [ebp - 4], 0x1a
push 4
lea ecx, [ebp - 0xe54]
call fcn.10010621
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0xd50], 0
mov dword [ebp - 0x8f4], 0x2668451f
mov dword [ebp - 0xe98], 0xd1f0dfbc
mov dword [ebp - 0xc00], 0xffffffff
push 0x5ba0
push 0x363e
lea eax, [ebp - 0x1174]
push eax
push 0
push 0
push 0x3b4
push 0x5fdd
push 0x643d
lea eax, [ebp - 0xe54]
push eax
call fcn.10023a81
add esp, 0x24
lea eax, [ebp - 0xe54]
push eax
lea eax, [ebp - 0x8f4]
push eax
push 0x3311
lea eax, [ebp - 0xd50]
push eax
push 0x31
lea eax, [ebp - 0x1170]
push eax
push 0
lea eax, [ebp - 0xbf8]
push eax
push 0x33b4
lea eax, [ebp - 0xe98]
push eax
call fcn.10025e58
add esp, 0x28
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0x121c], eax
push 2
lea ecx, [ebp - 0xe54]
call fcn.100106bf
imul eax, dword [eax], 0x78ed
test eax, eax
je 0x1002e63e
cmp dword [ebp - 0xc00], 0
je 0x1002e63e
mov dword [ebp - 0x714], 1
jmp 0x1002e645
and dword [ebp - 0x714], 0
push 1
lea ecx, [ebp - 0xe54]
call fcn.100106bf
mov ecx, dword [ebp - 0x714]
mov dword [eax], ecx
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xe54]
call fcn.100106a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1170]
call fcn.100106a3
cmp dword [ebp - 0x4a8], 0
jle 0x10034d9f
push 1
lea ecx, [ebp - 0xe64]
call fcn.10010621
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x420], 0xfffffff6
mov dword [ebp - 0x1d4], 0x6f1f
push 3
lea ecx, [ebp - 0xfdc]
call fcn.10010621
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x160], 0
jmp 0x1002e6d7
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x1002e6f9
push dword [ebp - 0x160]
lea ecx, [ebp - 0xe64]
call fcn.100106bf
mov dword [eax], 0xfffffffa
jmp 0x1002e6ca
lea eax, [ebp - 0x160]
push eax
push 0x1e76
push 0
push 1
push 0x7f1a
lea eax, [ebp - 0xfdc]
push eax
push 0x5eaf
call fcn.10023cdf
add esp, 0x1c
push 0x2ff6
push 0x6c5e
push 0x2262
push 1
lea eax, [ebp - 0xe64]
push eax
push 0x470f
push 0
push 0x63bd
push 0
call fcn.10023f18
add esp, 0x24
mov dword [ebp - 0x420], 0
jmp 0x1002e769
mov eax, dword [ebp - 0x420]
dec eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jl 0x1002ea8f
push 4
lea ecx, [ebp - 0xb30]
call fcn.10010621
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x13c], 0xffffffff
mov dword [ebp - 0xe10], 0x69cd17cd
mov dword [ebp - 0xd5c], 0x4ce10b49
lea eax, [ebp - 0x1184]
push eax
push 0
push 1
push 0x5e8a
push 0x4838
push 0x7602
push 1
push 0x29e2
lea eax, [ebp - 0xb30]
push eax
call fcn.10021cf3
add esp, 0x24
push 2
lea ecx, [ebp - 0xb30]
call fcn.100106bf
and dword [eax], 0
jmp 0x1002e80b
push 2
lea ecx, [ebp - 0xb30]
call fcn.100106bf
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0xa9c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa9c]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xb30]
call fcn.100106bf
cmp dword [eax], 0
jg 0x1002e9c9
mov dword [ebp - 0xc08], 0x4b3f4b14
push 0xd88
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0xd5c]
push eax
push 0
lea eax, [ebp - 0xc08]
push eax
push 1
push 0x6f0a
lea eax, [ebp - 0xb30]
push eax
push 1
lea eax, [ebp - 0xe10]
push eax
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0xfdc]
push eax
lea eax, [ebp - 0xe64]
push eax
call fcn.100252be
add esp, 0x34
mov dword [ebp - 0x71c], 0x6884
mov dword [ebp - 0xc10], 0x1000a2b0
cmp dword [ebp - 0x71c], 0x6c27
jle 0x1002e978
and dword [ebp - 0x2b4], 0
jmp 0x1002e8b5
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x3589
jge 0x1002e978
and dword [ebp - 0x388], 0
jmp 0x1002e8db
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0x52b1
jge 0x1002e973
and dword [ebp - 0x2bc], 0
jmp 0x1002e901
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0x5292
jge 0x1002e96e
and dword [ebp - 0x3f0], 0
jmp 0x1002e923
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0x3a12
jge 0x1002e96c
mov eax, dword [ebp - 0x2b4]
sub eax, dword [ebp - 0x388]
sub eax, dword [ebp - 0x2bc]
and eax, dword [ebp - 0x3f0]
cdq
mov dword [ebp - 0xd10], eax
mov dword [ebp - 0xd0c], edx
push dword [ebp - 0xd0c]
push dword [ebp - 0xd10]
mov ecx, 0x10613338
call fcn.1001050c
jmp 0x1002e916
jmp 0x1002e8f4
jmp 0x1002e8ce
jmp 0x1002e8a8
mov byte [ebp - 4], 0x1f
cmp dword [ebp - 0x71c], 0x64a2
jge 0x1002e998
mov edx, dword [ebp - 0xc10]
mov ecx, 0x10613338
call fcn.10011fb6
jmp 0x1002e9b4
mov dword [ebp - 4], 0x1e
jmp 0x1002e9c4
jmp 0x1002e7e7
mov dword [ebp - 0x1d4], 0
jmp 0x1002e9e2
mov eax, dword [ebp - 0x1d4]
dec eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jl 0x1002ea7b
mov dword [ebp - 0x13c], 0
jmp 0x1002ea08
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 1
jge 0x1002ea35
push 0
lea eax, [ebp - 0x13c]
push eax
push 0x3c9c
push 0x690b
lea eax, [ebp - 0xe64]
push eax
call fcn.1003b0a3
add esp, 0x14
jmp 0x1002e9fb
mov byte [ebp - 0xc0], 0
movzx eax, byte [ebp - 0xc0]
test eax, eax
je 0x1002ea76
push 0x6f54
push 0
push 0x1307
push 0x618b
push 0
push 0x1cb5
push 0x10ff
push 0x7a3e
push 0x2f7f
call fcn.1003c7c3
add esp, 0x24
jmp 0x1002e9d5
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xb30]
call fcn.100106a3
jmp 0x1002e75c
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xfdc]
call fcn.100106a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe64]
call fcn.100106a3
push 1
lea ecx, [ebp - 0x4d8]
call fcn.10010621
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x124], 0xbf34fda
lea eax, [ebp - 0x1288]
push eax
push 0
push 0xc98
push 0
push 0x6847
push 0x1ed5
lea eax, [ebp - 0x4d8]
push eax
call fcn.1003cfa3
add esp, 0x1c
mov byte [ebp - 0xc2], 0
push 0
push 0x5ac5
push 0x192c
lea eax, [ebp - 0xc2]
push eax
push 0x3b8b
push 0
call fcn.10022523
add esp, 0x18
mov dword [ebp - 0x124], 0
jmp 0x1002eb36
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jl 0x1002ed26
mov dword [ebp - 0x48], 0
push dword [ebp - 0x124]
lea ecx, [ebp - 0x4d8]
call fcn.100106bf
cmp dword [eax], 0
je 0x1002eb65
jmp 0x1002ed26
mov dword [ebp - 0x48], 0
jmp 0x1002eb75
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x1002ed21
mov dword [ebp - 0x2c4], 0x53589fe5
push dword [ebp - 0x48]
lea ecx, [ebp - 0x4d8]
call fcn.100106bf
cmp dword [eax], 0xfffffffc
jge 0x1002ebf9
push dword [ebp - 0x48]
lea ecx, [ebp - 0x4d8]
call fcn.100106bf
mov esi, dword [ebp - 0x124]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x4d8]
call fcn.100106bf
cmp esi, dword [eax]
jge 0x1002ebce
mov dword [ebp - 0x8fc], 1
jmp 0x1002ebd5
and dword [ebp - 0x8fc], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x4d8]
call fcn.100106bf
mov ecx, dword [ebp - 0x8fc]
sub ecx, dword [eax]
je 0x1002ebf9
mov dword [ebp - 0x724], 1
jmp 0x1002ec00
and dword [ebp - 0x724], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x4d8]
call fcn.100106bf
mov eax, dword [eax]
sub eax, dword [ebp - 0x724]
imul esi, eax, 0xcaf1
push 0
lea ecx, [ebp - 0x4d8]
call fcn.100106bf
mov dword [eax], esi
mov dword [ebp - 0x2c4], 0
jmp 0x1002ec44
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0
jg 0x1002ed1c
mov dword [ebp - 0x168], 0xf0415773
push 0x5cce
push 0
lea eax, [ebp - 0x4d8]
push eax
push 0x3550
push 0x69d8
push 0
push 0x7a05
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.1003e62a
add esp, 0x24
mov dword [ebp - 0x168], 0
jmp 0x1002eca6
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jg 0x1002ed17
mov dword [ebp - 0x1a8], 0xffffffff
mov dword [ebp - 0x1a8], 0
jmp 0x1002ecd2
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
jl 0x1002ed15
mov byte [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
test eax, eax
je 0x1002ecfb
push 0
push 0x3d82
call fcn.10036c5e
pop ecx
pop ecx
push dword [ebp - 0x1a8]
lea ecx, [ebp - 0x4d8]
call fcn.100106bf
cmp dword [eax], 0
je 0x1002ed13
jmp 0x1002ed15
jmp 0x1002ecc5
jmp 0x1002ec99
jmp 0x1002ec37
jmp 0x1002eb6e
jmp 0x1002eb29
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d8]
call fcn.100106a3
mov dword [ebp - 0x390], 0x62d5e48d
push 0x4845
push 0
push 1
call fcn.10022178
add esp, 0xc
mov dword [ebp - 0x390], 0xfffffff0
jmp 0x1002ed69
mov eax, dword [ebp - 0x390]
dec eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 0xffffffe9
jge 0x1002ed8b
mov byte [ebp - 0xc6], 0
push 0
lea eax, [ebp - 0xc6]
push eax
call fcn.100259dc
pop ecx
pop ecx
jmp 0x1002ed5c
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x134], 1
mov dword [ebp - 0xd68], 0
mov dword [ebp - 0x58], 0x7ee3
mov dword [ebp - 0x2cc], 0xfffffffd
mov dword [ebp - 0x494], 0xfffffffe
cmp dword [ebp - 0x134], 0
jne 0x1002eeb4
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x1194], eax
cmp dword [ebp - 0x134], 0
jne 0x1002edfd
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0xd68], eax
xor eax, eax
inc eax
jne 0x1002edfd
and dword [ebp - 0x9ec], 0
jmp 0x1002ee07
mov dword [ebp - 0x9ec], 1
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x9ec], eax
je 0x1002ee1e
mov dword [ebp - 0x72c], 1
jmp 0x1002ee25
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
cmp eax, dword [ebp - 0x58]
jl 0x1002ee48
mov dword [ebp - 0x904], 1
jmp 0x1002ee4f
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x904], eax
jle 0x1002ee6f
cmp dword [ebp - 0x2cc], 0
je 0x1002ee6f
mov dword [ebp - 0x734], 1
jmp 0x1002ee76
and dword [ebp - 0x734], 0
cmp dword [ebp - 0x734], 0x4f23
jl 0x1002ee8e
mov dword [ebp - 0xa64], 1
jmp 0x1002ee95
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0xa64]
sub eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x134]
cmp eax, 0x624c
jl 0x1002eeb4
and dword [ebp - 0x73c], 0
jmp 0x1002eebe
mov dword [ebp - 0x73c], 1
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x73c], eax
jg 0x1002eed8
mov dword [ebp - 0x90c], 1
jmp 0x1002eedf
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x90c], eax
jle 0x1002ef34
mov dword [ebp - 0x11c8], 0xfffffffb
push 0x474d
push 1
push 0
lea eax, [ebp - 0x2cc]
push eax
push 0x7e44
push 0x6433
push 0
push 0xd10
push 0x32dd
call fcn.10021cf3
add esp, 0x24
mov eax, dword [ebp - 0x494]
inc eax
mov dword [ebp - 0x494], eax
jmp 0x1002f2ad
mov dword [ebp - 0x3f8], 1
mov dword [ebp - 0x58], 0x10
jmp 0x1002ef4e
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0x16
jle 0x1002f2ad
mov dword [ebp - 0x76c], 0x121f
mov dword [ebp - 0xd74], 0xa1ec8f94
mov dword [ebp - 0x744], 0x7619
mov dword [ebp - 0xe68], 0x1000a308
cmp dword [ebp - 0x744], 0x7790
jle 0x1002f080
push 0
push 0
push 0x10cd
push 0x2287
push 0x2502
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
and dword [ebp - 0x398], 0
jmp 0x1002efbf
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0xbdc
jge 0x1002f080
and dword [ebp - 0x448], 0
jmp 0x1002efe5
mov eax, dword [ebp - 0x448]
inc eax
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0x7b2a
jge 0x1002f07b
and dword [ebp - 0x2d4], 0
jmp 0x1002f00b
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0x5ae3
jge 0x1002f076
mov eax, dword [ebp - 0x448]
mov ecx, dword [ebp - 0x2d4]
sar eax, cl
xor eax, dword [ebp - 0x398]
cdq
mov dword [ebp - 0xd1c], eax
mov dword [ebp - 0xd18], edx
push dword [ebp - 0xd18]
push dword [ebp - 0xd1c]
lea ecx, [ebp - 0x13e8]
call fcn.1000da20
pop ecx
pop ecx
mov dword [ebp - 0xc18], eax
mov ecx, dword [ebp - 0xc18]
call fcn.100104ec
push eax
call fcn.100540b6
pop ecx
lea ecx, [ebp - 0x13e8]
call fcn.100104e2
jmp 0x1002effe
jmp 0x1002efd8
jmp 0x1002efb2
mov dword [ebp - 4], 0x22
cmp dword [ebp - 0x744], 0x73ad
jge 0x1002f09f
push dword [ebp - 0xe68]
call fcn.100540b6
pop ecx
jmp 0x1002f0bb
or dword [ebp - 4], 0xffffffff
jmp 0x1002f0c5
mov dword [ebp - 0x2dc], 0
jmp 0x1002f0de
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 1
jge 0x1002f0fa
mov eax, dword [ebp - 0x2dc]
mov dword [ebp + eax*4 - 0x4c8], 0xbf81
jmp 0x1002f0d1
mov byte [ebp - 0xc8], 0
movzx eax, byte [ebp - 0xc8]
test eax, eax
je 0x1002f12e
push 1
push 0
push 1
push 0x162d
push 0x2f09
push 0x18f8
push 0x50df
call fcn.1003b461
add esp, 0x1c
xor eax, eax
inc eax
je 0x1002f28e
cmp dword [ebp - 0x3f8], 2
jne 0x1002f14c
mov dword [ebp - 0x914], 1
jmp 0x1002f153
and dword [ebp - 0x914], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c8], 0
jne 0x1002f16f
mov dword [ebp - 0x9f4], 1
jmp 0x1002f176
and dword [ebp - 0x9f4], 0
cmp dword [ebp - 0x494], 0xffffffff
jne 0x1002f18b
mov dword [ebp - 0x74c], 1
jmp 0x1002f192
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x9f4]
cmp eax, dword [ebp - 0x74c]
jg 0x1002f1ac
mov dword [ebp - 0x754], 1
jmp 0x1002f1b3
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x914]
cmp eax, dword [ebp - 0x754]
jne 0x1002f1cd
mov dword [ebp - 0xabc], 1
jmp 0x1002f1d4
and dword [ebp - 0xabc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c8]
cmp dword [ebp - 0xabc], eax
jl 0x1002f1fe
mov eax, 0x699ff93f
test eax, eax
je 0x1002f1fe
mov dword [ebp - 0x75c], 1
jmp 0x1002f205
and dword [ebp - 0x75c], 0
cmp dword [ebp - 0x75c], 0x5f4d
jg 0x1002f21d
mov dword [ebp - 0x91c], 1
jmp 0x1002f224
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x3f8]
cmp dword [ebp - 0x91c], eax
jg 0x1002f23e
mov dword [ebp - 0x764], 1
jmp 0x1002f245
and dword [ebp - 0x764], 0
cmp dword [ebp - 0x764], 0xfffffff8
je 0x1002f25a
mov dword [ebp - 0x9fc], 1
jmp 0x1002f261
and dword [ebp - 0x9fc], 0
mov eax, dword [ebp - 0x9fc]
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x76c], eax
cmp dword [ebp - 0x76c], 0
je 0x1002f28e
mov dword [ebp - 0xc20], 1
jmp 0x1002f295
and dword [ebp - 0xc20], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c8]
mov dword [ebp - 0xd74], eax
jmp 0x1002ef47
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x3a0], 0x2c03342e
mov dword [ebp - 0x2e4], 0
jmp 0x1002f2de
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 1
jge 0x1002f2fa
mov eax, dword [ebp - 0x2e4]
mov dword [ebp + eax*4 - 0xc28], 0
jmp 0x1002f2d1
mov dword [ebp - 0x3a0], 0xfffffff3
jmp 0x1002f313
mov eax, dword [ebp - 0x3a0]
dec eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0xffffffee
je 0x1002f399
mov dword [ebp - 0x1c8], 0xfffffffd
mov dword [ebp - 0x1c8], 0
jmp 0x1002f33f
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
jl 0x1002f389
mov dword [ebp - 0x170], 5
mov dword [ebp - 0x170], 0
jmp 0x1002f36b
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x1002f387
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0xc28], 1
jmp 0x1002f35e
jmp 0x1002f332
cmp dword [ebp - 0x1c8], 0
je 0x1002f394
jmp 0x1002f399
jmp 0x1002f306
mov byte [ebp - 0xca], 0
movzx eax, byte [ebp - 0xca]
test eax, eax
je 0x1002f3ce
push 0x4ce6
push 0x7979
push 0
push 0x123c
push 0x2874
push 0x397e
call fcn.1003b7c2
add esp, 0x18
mov dword [ebp - 0x4e8], 1
mov dword [ebp - 0x924], 0x3dfa
mov dword [ebp - 0xe18], 0x1000a340
cmp dword [ebp - 0x924], 0x4004
jle 0x1002f4a4
and dword [ebp - 0x2ec], 0
jmp 0x1002f412
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0x2078
jge 0x1002f4a4
and dword [ebp - 0x428], 0
jmp 0x1002f438
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0x3e8e
jge 0x1002f49f
and dword [ebp - 0x2f4], 0
jmp 0x1002f45a
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0x7cd9
jge 0x1002f49d
mov eax, dword [ebp - 0x2ec]
sub eax, dword [ebp - 0x428]
and eax, dword [ebp - 0x2f4]
cdq
mov dword [ebp - 0xd28], eax
mov dword [ebp - 0xd24], edx
push dword [ebp - 0xd24]
push dword [ebp - 0xd28]
mov ecx, 0x10613338
call fcn.1001050c
jmp 0x1002f44d
jmp 0x1002f42b
jmp 0x1002f405
mov dword [ebp - 4], 0x24
cmp dword [ebp - 0x924], 0x3bed
jge 0x1002f4c7
mov edx, dword [ebp - 0xe18]
mov ecx, 0x10613338
call fcn.10011fb6
jmp 0x1002f4e3
or dword [ebp - 4], 0xffffffff
jmp 0x1002f4ed
mov dword [ebp - 0x114], 1
mov dword [ebp - 0xc30], 0
mov dword [ebp - 0x60], 0x7ee3
mov dword [ebp - 0x3a8], 0xfffffffd
mov dword [ebp - 0x934], 0xfffffffe
cmp dword [ebp - 0x114], 0
jne 0x1002f60f
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x11a4], eax
cmp dword [ebp - 0x114], 0
jne 0x1002f558
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xc30], eax
xor eax, eax
inc eax
jne 0x1002f558
and dword [ebp - 0x774], 0
jmp 0x1002f562
mov dword [ebp - 0x774], 1
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x774], eax
je 0x1002f579
mov dword [ebp - 0xa6c], 1
jmp 0x1002f580
and dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0xa6c]
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp - 0x3a8]
cmp eax, dword [ebp - 0x60]
jl 0x1002f5a3
mov dword [ebp - 0x77c], 1
jmp 0x1002f5aa
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x77c], eax
jle 0x1002f5ca
cmp dword [ebp - 0x3a8], 0
je 0x1002f5ca
mov dword [ebp - 0x92c], 1
jmp 0x1002f5d1
and dword [ebp - 0x92c], 0
cmp dword [ebp - 0x92c], 0x4f23
jl 0x1002f5e9
mov dword [ebp - 0x784], 1
jmp 0x1002f5f0
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x784]
sub eax, dword [ebp - 0x60]
sub eax, dword [ebp - 0x114]
cmp eax, 0x624c
jl 0x1002f60f
and dword [ebp - 0xa04], 0
jmp 0x1002f619
mov dword [ebp - 0xa04], 1
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0xa04], eax
jg 0x1002f633
mov dword [ebp - 0x78c], 1
jmp 0x1002f63a
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x78c], eax
jle 0x1002f691
mov dword [ebp - 0x1068], 0xfffffffb
mov dword [ebp - 0x3a8], 0xfffffffd
push 0x1a7a
push 0x1679
push 0x429e
push 0
push 0
push 0x3487
push 0x285e
push 0x5933
push 1
lea eax, [ebp - 0x934]
push eax
call fcn.10021ed9
add esp, 0x28
jmp 0x1002f89f
mov dword [ebp - 0x400], 1
mov dword [ebp - 0x60], 0x10
jmp 0x1002f6ab
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x16
jle 0x1002f89f
mov dword [ebp - 0xa74], 0x121f
mov dword [ebp - 0xc38], 0xa1ec8f94
mov dword [ebp - 0x2fc], 0
jmp 0x1002f6e2
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 1
jge 0x1002f6fe
mov eax, dword [ebp - 0x2fc]
mov dword [ebp + eax*4 - 0x49c], 0xbf81
jmp 0x1002f6d5
mov byte [ebp - 0xcc], 0
push 0x49da
push 0
lea eax, [ebp - 0xcc]
push eax
push 0x24f2
call fcn.1003e36e
add esp, 0x10
xor eax, eax
inc eax
je 0x1002f880
cmp dword [ebp - 0x400], 2
jne 0x1002f73e
mov dword [ebp - 0x79c], 1
jmp 0x1002f745
and dword [ebp - 0x79c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x49c], 0
jne 0x1002f761
mov dword [ebp - 0x794], 1
jmp 0x1002f768
and dword [ebp - 0x794], 0
cmp dword [ebp - 0x934], 0xffffffff
jne 0x1002f77d
mov dword [ebp - 0xaa4], 1
jmp 0x1002f784
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0x794]
cmp eax, dword [ebp - 0xaa4]
jg 0x1002f79e
mov dword [ebp - 0x93c], 1
jmp 0x1002f7a5
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x79c]
cmp eax, dword [ebp - 0x93c]
jne 0x1002f7bf
mov dword [ebp - 0x7a4], 1
jmp 0x1002f7c6
and dword [ebp - 0x7a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x49c]
cmp dword [ebp - 0x7a4], eax
jl 0x1002f7f0
mov eax, 0x699ff93f
test eax, eax
je 0x1002f7f0
mov dword [ebp - 0xa0c], 1
jmp 0x1002f7f7
and dword [ebp - 0xa0c], 0
cmp dword [ebp - 0xa0c], 0x5f4d
jg 0x1002f80f
mov dword [ebp - 0x7ac], 1
jmp 0x1002f816
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x400]
cmp dword [ebp - 0x7ac], eax
jg 0x1002f830
and dword [ebp - 0xd80], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x49c]
mov dword [ebp - 0xc38], eax
jmp 0x1002f6a4
mov dword [ebp - 0x2a8], 6
mov dword [ebp - 0x304], 0
jmp 0x1002f8c2
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 1
jge 0x1002f8de
mov eax, dword [ebp - 0x304]
mov dword [ebp + eax*4 - 0x3b0], 0xfffffffb
jmp 0x1002f8b5
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3b0], 0xffffffec
jmp 0x1002f90c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3b0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3b0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3b0], 9
jle 0x1002f93a
mov byte [ebp - 0xce], 0
movzx eax, byte [ebp - 0xce]
test eax, eax
je 0x1002f938
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
jmp 0x1002f8f1
mov dword [ebp - 0x728], 0x56eff52
mov dword [ebp - 0xd8c], 0x98311173
mov dword [ebp - 0xc48], 0x43eb6069
mov dword [ebp - 0x94c], 6
mov dword [ebp - 0x7c4], 0xfffffffe
mov dword [ebp - 0x7cc], 0xffffffff
mov dword [ebp - 0x68], 0
jmp 0x1002f986
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1002f99c
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x1118], 0x9d568d52
jmp 0x1002f97f
mov dword [ebp - 0x68], 0
jmp 0x1002f9ac
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1002f9c2
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x1314], 0x563ffaf0
jmp 0x1002f9a5
mov dword [ebp - 0x7bc], 0x298a
mov dword [ebp - 0xc40], 0x1000a3a0
cmp dword [ebp - 0x7bc], 0x2cec
jle 0x1002fafe
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
and dword [ebp - 0x30c], 0
jmp 0x1002fa06
cmp dword [ebp - 0x30c], 0x585f
jge 0x1002fafe
mov byte [ebp - 0xe2], 0
mov dword [ebp - 4], 0x26
cmp dword [ebp - 0x7bc], 0x288c
jge 0x1002fb24
push dword [ebp - 0xc40]
call fcn.100540b6
pop ecx
jmp 0x1002fb40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret