Function at 0x100281c8
Capabilities:
Delete directory
Get common file path
Get disk information
Get system information on windows
Parse pe header
Set environment variable
Set registry value
Terminate process

Disassembly:
mov eax, 0x1007941f
call fcn.10077d60
mov eax, 0x167c
call fcn.10074510
push ebx
push esi
push edi
push 7
mov byte [ebp - 0x71], dl
pop edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x5c], ecx
mov ecx, 0x70bb743d
push 0xfffffffffffffff9
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x38]
pop ebx
mov dword [ebp - 0x10], eax
xor eax, eax
push 0xfffffffffffffffd
mov dword [ebp - 0x10], eax
pop esi
jmp 0x10028211
mov dword [ebp - 0x44], esi
inc dword [ebp - 0x44]
jne 0x10028216
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jg 0x10028206
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10028234
mov dword [ebp - 0x44], esi
inc dword [ebp - 0x44]
jne 0x10028239
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jg 0x10028229
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x4e0]
call fcn.1001377b
xor eax, eax
mov dword [ebp - 4], eax
push 9
pop ecx
mov dword [ebp - 0xa08], ecx
mov dword [ebp - 0xa04], ecx
mov dword [ebp - 0xa00], ecx
mov dword [ebp - 0x9fc], ecx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], eax
jmp 0x10028281
push dword [ebp - 0x10]
call fcn.10013807
mov dword [eax], 8
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x4e0]
cmp dword [ebp - 0x10], ebx
jl 0x10028270
xor esi, esi
inc esi
push esi
call fcn.10013807
xor ebx, ebx
lea ecx, [ebp - 0x4e0]
push ebx
mov dword [eax], ebx
call fcn.10013807
mov edi, dword [sym.imp.GDI32.dll_Polygon]
xor ecx, ecx
cmp dword [eax], ebx
mov ebx, dword [sym.imp.USER32.dll_GetClassNameW]
sete cl
xor eax, eax
cmp ecx, 0x9ed9
setne al
cmp eax, 0x7e4
jg 0x10028383
mov dword [ebp - 0x34], 0xa5b7d8cf
xor edx, edx
mov dword [ebp - 0x10], 0x3ccd2466
mov dword [ebp - 0x9fc], 0x8d963785
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xa04]
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0x9ba
setl al
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x1002839c
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4e0]
call fcn.10013807
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4e0]
mov esi, eax
call fcn.10013807
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x20], 0xfffffff2
cmp dword [ebp - 0x20], 0x12
jge 0x10028379
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10028370
push 0x14d8
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x12
jl 0x1002834f
dec dword [ebp - 0x10]
jns 0x1002831e
xor esi, esi
inc esi
jmp 0x1002839c
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002839c
push 0xbe0
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
or eax, 0xffffffff
lea ecx, [ebp - 0x4e0]
mov dword [ebp - 4], eax
call fcn.10013802
push 7
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x10], 0x70bb743d
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100283d6
mov dword [ebp - 0x44], 0xfffffffd
inc dword [ebp - 0x44]
jne 0x100283dc
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff9
jg 0x100283c7
mov dword [ebp - 0x10], ecx
push 2
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x10028402
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa68], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100283ea
xor eax, eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x10028423
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0xa68]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa68], ecx
dec dword [ebp - 0x10]
jns 0x1002840a
push edx
lea ecx, [ebp - 0x4f8]
call fcn.1001377b
mov dword [ebp - 4], esi
push 9
pop eax
mov dword [ebp - 0x970], eax
mov dword [ebp - 0x96c], eax
mov dword [ebp - 0x968], eax
mov dword [ebp - 0x964], eax
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002846b
push dword [ebp - 0x10]
call fcn.10013807
mov dword [eax], 8
inc dword [ebp - 0x10]
push 2
pop eax
lea ecx, [ebp - 0x4f8]
cmp dword [ebp - 0x10], eax
jl 0x1002845a
push esi
call fcn.10013807
xor ecx, ecx
push ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x4f8]
call fcn.10013807
xor ecx, ecx
cmp dword [eax], ecx
sete cl
xor eax, eax
cmp ecx, 0x9ed9
setne al
cmp eax, 0x7e4
jg 0x10028561
mov dword [ebp - 0x34], 0xa5b7d8cf
xor edx, edx
mov dword [ebp - 0x10], 0x3ccd2466
mov dword [ebp - 0x964], 0x8d963785
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x96c]
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0x9ba
setl al
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x1002857a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4f8]
call fcn.10013807
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4f8]
mov esi, eax
call fcn.10013807
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x20], 0xfffffff2
cmp dword [ebp - 0x20], 0x12
jge 0x10028557
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002854e
push 0x14d8
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x12
jl 0x1002852d
dec dword [ebp - 0x10]
jns 0x100284fc
xor esi, esi
inc esi
jmp 0x1002857a
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002857a
push 0xbe0
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
or eax, 0xffffffff
lea ecx, [ebp - 0x4f8]
mov dword [ebp - 4], eax
call fcn.10013802
push 3
lea ecx, [ebp - 0x370]
call fcn.1001377b
push 2
pop edi
xor eax, eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], eax
push 0xfffffffffffffff7
pop ecx
cmp dword [ebp - 0x18], esi
jge 0x100285bf
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7a4], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100285ab
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100285e7
push dword [ebp - 0x18]
lea ecx, [ebp - 0x370]
call fcn.10013807
mov dword [eax], 0xf5c184c5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100285c8
xor eax, eax
push eax
lea ecx, [ebp - 0x370]
call fcn.10013807
xor ebx, ebx
mov dword [eax], ebx
jmp 0x1002861a
push ebx
call fcn.10013807
push ebx
lea ecx, [ebp - 0x370]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x7a4], 0x82bd7b1c
call fcn.10013807
inc dword [eax]
push ebx
lea ecx, [ebp - 0x370]
call fcn.10013807
lea ecx, [ebp - 0x370]
cmp dword [eax], esi
jl 0x100285f9
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10013802
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0xb8c]
push esi
call fcn.1001377b
push 3
pop ebx
xor eax, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], eax
jmp 0x1002866b
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb8c]
call fcn.10013807
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10028657
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, esi
setle cl
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], 0xf
cmp dword [ebp - 0x20], 5
jg 0x100286e0
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100286ab
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10028697
xor eax, eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], eax
jl 0x100286d7
push eax
lea ecx, [ebp - 0xb8c]
call fcn.10013807
cmp dword [eax], 0
jne 0x100286d5
dec dword [ebp - 0xd4]
push 0
pop eax
jns 0x100286b9
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 5
jle 0x1002868f
or eax, 0xffffffff
lea ecx, [ebp - 0xb8c]
mov dword [ebp - 4], eax
call fcn.10013802
mov dword [ebp - 0x38], 7
lea ecx, [ebp - 0xea4]
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], 0xea2a3b3f
mov dword [ebp - 0x2c], esi
push esi
call fcn.1001377b
push 4
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10028742
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe7c], 0xffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002872a
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10028762
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x105c], 0x55cc25bf
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002874a
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10028784
push dword [ebp - 0x24]
lea ecx, [ebp - 0xea4]
call fcn.10013807
mov dword [eax], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002876a
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x100287c4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
jmp 0x100287bc
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100287b9
push eax
push 0x1cea
push 0x2339
push eax
push 0xd84
push 0x20bc
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x10028791
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x10028789
inc dword [ebp - 0x44]
lea ecx, [ebp - 0xea4]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10013802
mov dword [ebp - 0x20], 0x70bb743d
lea ecx, [ebp - 0xcb8]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
push esi
call fcn.1001377b
xor eax, eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10028821
push dword [ebp - 0x18]
lea ecx, [ebp - 0xcb8]
call fcn.10013807
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10028807
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10028841
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x13e0], 0xbf34fda0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10028829
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10028859
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
xor eax, eax
push eax
lea ecx, [ebp - 0xcb8]
call fcn.10013807
lea ecx, [ebp - 0xcb8]
mov eax, dword [eax]
mov dword [ebp - 0x13d8], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10013802
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff9
jle 0x10028a65
push 4
pop edx
jmp 0x10028894
xor eax, eax
mov dword [ebp - 0x10], 0x33efc07e
mov dword [ebp - 0x1c], 0x1adb2bc4
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x18], eax
jmp 0x100288bf
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe88], 0xa1650187
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100288ae
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0x3a6c
mov eax, dword [ebp - 0x10]
dec eax
je 0x100288e8
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100288ea
mov eax, esi
jmp 0x100288ea
xor eax, eax
cmp eax, esi
sbb eax, eax
neg eax
mov dword [ebp - 0xe88], eax
xor eax, eax
mov dword [ebp - 0x18], 0xffffffea
cmp dword [ebp - 0x18], eax
je 0x1002892b
mov dword [ebp - 0x10], eax
jmp 0x1002891d
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002891a
call dword [sym.imp.USER32.dll_EndMenu]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1a
jg 0x10028909
inc dword [ebp - 0x18]
jne 0x10028904
push 4
pop edx
mov dword [ebp - 0x1c], 0xfffffffd
or ecx, 0xffffffff
inc dword [ebp - 0x1c]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0xa5d732ad
mov dword [ebp - 0x34], 0x1943ec3e
mov dword [ebp - 0x44], 0xdf1563cf
mov dword [ebp - 0x10], 0xd5376e30
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x10028977
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1154], 0xd50c8576
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002895f
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002898d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10e0], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002897c
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
push 4
setle cl
xor ebx, ebx
cmp ecx, eax
setg bl
sub ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, edx
setne cl
mov dword [ebp - 0x114c], ecx
mov dword [ebp - 0x10e0], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10d8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
sub edx, 0x70af9c1
cmp edx, eax
pop edx
setg cl
xor eax, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x10028a50
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1154], 0x2ffa36fe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10028a38
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10028a65
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff9
push 3
pop ebx
jg 0x10028892
movdqa xmm0, xmmword [0x10007e90]
lea eax, [ebp - 0x1274]
push eax
lea eax, [ebp - 0x1284]
push eax
lea ecx, [ebp - 0x14e4]
movdqu xmmword [ebp - 0x1284], xmm0
call fcn.10013816
lea ecx, [ebp - 0x135]
mov esi, eax
call fcn.10008fb3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1410]
push dword [esi]
call fcn.100137dc
mov ebx, dword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10028acf
push eax
push 0xfb
push eax
push 0xa1b
call ebx
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x10028af4
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10028aef
push eax
call edi
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10028ae1
lea ecx, [ebp - 0x1410]
call fcn.10013802
xor eax, eax
mov dword [ebp - 0x10], 7
push 2
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x10028b2b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9b8], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10028b13
xor eax, eax
xor esi, esi
inc esi
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x10028b4f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x9b8]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9b8], ecx
dec dword [ebp - 0x10]
jns 0x10028b36
push edx
lea ecx, [ebp - 0x510]
call fcn.1001377b
mov dword [ebp - 4], 6
push 9
pop eax
mov dword [ebp - 0x980], eax
mov dword [ebp - 0x97c], eax
mov dword [ebp - 0x978], eax
mov dword [ebp - 0x974], eax
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10028b9b
push dword [ebp - 0x10]
call fcn.10013807
mov dword [eax], 8
inc dword [ebp - 0x10]
push 2
pop eax
lea ecx, [ebp - 0x510]
cmp dword [ebp - 0x10], eax
jl 0x10028b8a
push esi
call fcn.10013807
xor ecx, ecx
push ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x510]
call fcn.10013807
xor ecx, ecx
cmp dword [eax], ecx
sete cl
xor eax, eax
cmp ecx, 0x9ed9
setne al
cmp eax, 0x7e4
jg 0x10028c99
mov dword [ebp - 0x34], 0xa5b7d8cf
xor edx, edx
mov dword [ebp - 0x10], 0x3ccd2466
mov dword [ebp - 0x974], 0x8d963785
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x97c]
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0x9ba
setl al
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x10028cb6
push dword [ebp - 0x10]
lea ecx, [ebp - 0x510]
call fcn.10013807
push dword [ebp - 0x10]
lea ecx, [ebp - 0x510]
mov esi, eax
call fcn.10013807
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x20], 0xfffffff2
cmp dword [ebp - 0x20], 0x12
jge 0x10028c8f
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10028c86
push 0x14d8
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x12
jl 0x10028c61
dec dword [ebp - 0x10]
jns 0x10028c30
xor esi, esi
inc esi
jmp 0x10028cb6
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10028cb6
push 0xbe0
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
or eax, 0xffffffff
lea ecx, [ebp - 0x510]
mov dword [ebp - 4], eax
call fcn.10013802
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x34], 0x935cb514
mov dword [ebp - 0x30], 0x324c99ff
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffe7
jg 0x10028e78
jmp 0x10028cf1
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x10], 0x7f3c88fe
mov dword [ebp - 0x10], eax
jmp 0x10028d18
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1e0], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10028d07
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1e0]
dec eax
je 0x10028d36
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10028d40
jmp 0x10028d38
xor eax, eax
cmp dword [ebp - 0x1dc], eax
je 0x10028d43
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
je 0x10028d73
xor eax, eax
cmp dword [ebp - 0x1d8], eax
je 0x10028d75
mov eax, esi
jmp 0x10028d75
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], 0x1a
cmp dword [ebp - 0x10], 0x16
je 0x10028e6b
xor eax, eax
mov dword [ebp - 0x30], 0x19c36c1
push 2
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x10028ddf
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x73c], 0xfb65
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10028dc7
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10028dfd
push 0xf1f
push 0x10fd
push 0xa4f
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov eax, dword [ebp - 0x73c]
mov eax, dword [ebp - 0x73c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x1dc], 0xfffe
test eax, eax
jne 0x10028e20
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x73c]
cmp eax, esi
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
sub ecx, eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x16
jne 0x10028db3
or ecx, 0xffffffff
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe7
jle 0x10028cef
movdqa xmm0, xmmword [0x10007e90]
lea eax, [ebp - 0x1194]
push eax
lea eax, [ebp - 0x11a4]
push eax
lea ecx, [ebp - 0x14f4]
movdqu xmmword [ebp - 0x11a4], xmm0
call fcn.10013816
lea ecx, [ebp - 0x1a5]
mov esi, eax
call fcn.10008fb3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x13c8]
push dword [esi]
call fcn.100137dc
xor eax, eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10028edc
push eax
push 0xfb
push eax
push 0xa1b
call ebx
xor eax, eax
push 3
pop esi
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x10028efa
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10028ef5
push eax
call edi
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10028ee7
lea ecx, [ebp - 0x13c8]
call fcn.10013802
mov dword [ebp - 0x10], 0x72a7
lea ecx, [ebp - 0x908]
mov dword [ebp - 0x44], 0x9141a9c2
xor ebx, ebx
mov dword [ebp - 0x38], 0xcbeb969
inc ebx
mov dword [ebp - 0x2c], ebx
or eax, 0xffffffff
mov dword [ebp - 0x2c], 0x57ea0d01
mov dword [ebp - 0x48], eax
push 4
mov dword [ebp - 0x2c], 0x88039d6b
pop edi
mov dword [ebp - 0x2c], 0xaf12
mov dword [ebp - 0x38], 0x5a8ccedb
mov dword [ebp - 0x1c], 0xc44d4e2b
push edi
call fcn.1001377b
mov dword [ebp - 4], 7
lea ecx, [ebp - 0xeb4]
mov dword [ebp - 0x2c], 0x891f433c
push esi
call fcn.1001377b
mov byte [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x34], 0x6cefc6e2
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10028fa5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x188], 7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10028f8d
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10028fc8
push dword [ebp - 0x24]
lea ecx, [ebp - 0x908]
call fcn.10013807
and dword [eax], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10028fad
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10028fee
push dword [ebp - 0x24]
lea ecx, [ebp - 0xeb4]
call fcn.10013807
mov dword [eax], 0xee6ee3e4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10028fd0
xor eax, eax
mov edi, ebx
cmp dword [ebp - 0x10], eax
jne 0x10028ff7
mov edi, eax
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x908]
push 2
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x1c]
pop eax
push eax
call fcn.10013807
mov edx, dword [ebp - 0x48]
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp edx, ecx
setg al
xor edx, edx
cmp eax, dword [esi]
mov eax, dword [ebp - 0x1c]
setle dl
add eax, dword [ebp - 0x44]
xor ecx, ecx
neg eax
cmp eax, edx
mov eax, dword [ebp - 0x10]
setl cl
xor edx, edx
test ecx, ecx
setg dl
xor ecx, ecx
cmp eax, edi
setle cl
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x38]
jne 0x1002905a
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x1c], eax
je 0x1002905c
mov esi, ebx
push ebx
lea ecx, [ebp - 0x908]
call fcn.10013807
mov ecx, dword [ebp - 0x188]
push 2
add ecx, esi
pop edi
push edi
cmp ecx, dword [eax]
jge 0x10029140
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0xaf0]
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x2c], ebx
call fcn.1001377b
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x1c], 0x280dda25
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100290ca
push dword [ebp - 0x18]
lea ecx, [ebp - 0xaf0]
call fcn.10013807
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100290b0
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100290ea
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x718], 0x35a6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100290d2
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x1c], eax
je 0x100290f7
cmp dword [ebp - 0x34], eax
jne 0x100290fc
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
lea ecx, [ebp - 0xaf0]
call fcn.10013807
mov ecx, dword [ebp - 0x1c]
xor edx, edx
neg ecx
and dword [eax], 0
mov eax, dword [ebp - 0x188]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x718]
setge cl
sub ecx, eax
mov eax, dword [ebp - 0x1c]
imul eax, ecx
lea ecx, [ebp - 0xaf0]
mov dword [ebp - 0x38], eax
jmp 0x100291b7
lea ecx, [ebp - 0xc28]
call fcn.1001377b
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x10], eax
jmp 0x10029167
push dword [ebp - 0x10]
call fcn.10013807
mov dword [eax], 0x1a65
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xc28]
cmp dword [ebp - 0x10], edi
jl 0x10029156
mov eax, dword [ebp - 0x188]
push ebx
call fcn.10013807
mov ecx, dword [ebp - 0x48]
cmp dword [eax], ecx
jge 0x10029193
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x20]
jge 0x10029193
xor eax, eax
mov ecx, eax
jmp 0x10029195
mov ecx, ebx
xor eax, eax
cmp ecx, 5
setg al
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x100291b1
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea ecx, [ebp - 0xc28]
call fcn.10013802
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x100291cc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [ebp - 0xeb4]
call fcn.10013802
or esi, 0xffffffff
lea ecx, [ebp - 0x908]
mov dword [ebp - 4], esi
call fcn.10013802
xor eax, eax
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10029211
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa38], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100291f9
xor eax, eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x10029234
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0xa38]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa38], ecx
dec dword [ebp - 0x10]
jns 0x10029219
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x2c], 0xfe1ca29
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10029261
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x66c], 0xd837bc75
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10029249
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10029278
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0xb08]
mov dword [ebp - 0x66c], eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x20], eax
push ebx
call fcn.1001377b
xor eax, eax
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x10], eax
jmp 0x100292b7
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb08]
call fcn.10013807
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100292a3
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, ebx
setle cl
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], 0xf
cmp dword [ebp - 0x20], 5
jg 0x1002932c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100292f7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdc], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100292e3
xor eax, eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], eax
jl 0x10029323
push eax
lea ecx, [ebp - 0xb08]
call fcn.10013807
cmp dword [eax], 0
jne 0x10029321
dec dword [ebp - 0xdc]
push 0
pop eax
jns 0x10029305
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 5
jle 0x100292db
lea ecx, [ebp - 0xb08]
mov dword [ebp - 4], esi
call fcn.10013802
push 0xfffffffffffffffa
xor eax, eax
pop ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0xb167
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10029385
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x15c4], 0xff12f3cc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002936c
xor eax, eax
mov dword [ebp - 0x18], ecx
mov edx, 0xd5493e62
jmp 0x100294ad
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100293bd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x15e8], 0xc345fe46
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100293a4
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe3
je 0x1002941d
push 4
pop ecx
mov dword [ebp - 0x2c], 0xf2887cf2
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], 0xc97412df
mov dword [ebp - 0x998], edx
mov dword [ebp - 0x994], edx
mov dword [ebp - 0x990], edx
mov dword [ebp - 0x98c], edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002940e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xfe0], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x100293fa
xor eax, eax
dec dword [ebp - 0x990]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe3
jne 0x100293c9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 9
jg 0x100294aa
movdqa xmm0, xmmword [0x10007ed0]
lea eax, [ebp - 0x12f4]
push eax
lea eax, [ebp - 0x1304]
push eax
lea ecx, [ebp - 0x1514]
movdqu xmmword [ebp - 0x1304], xmm0
call fcn.10013816
lea ecx, [ebp - 0x145]
mov esi, eax
call fcn.10008fb3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1088]
push dword [esi]
call fcn.100137dc
push edi
lea ecx, [ebp - 0x1088]
mov dword [ebp - 4], 0xc
call fcn.10013807
mov ecx, dword [ebp - 0x10]
or esi, 0xffffffff
mov dword [ebp - 4], esi
mov dword [eax], ecx
lea ecx, [ebp - 0x1088]
call fcn.10013802
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jle 0x1002942a
xor eax, eax
mov edx, 0xd5493e62
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x12
je 0x10029392
mov dword [ebp - 0x18], esi
jmp 0x10029517
push 4
pop eax
mov dword [ebp - 0x2c], 0xa972737a
lea ecx, [ebp - 0xec4]
mov dword [ebp - 0x2c], eax
push ebx
call fcn.1001377b
mov dword [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x44], 9
mov dword [ebp - 0x10], eax
jmp 0x100294fe
push dword [ebp - 0x10]
call fcn.10013807
mov dword [eax], 0x800f4d4e
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xec4]
cmp dword [ebp - 0x10], ebx
jl 0x100294ed
inc dword [ebp - 0x44]
mov dword [ebp - 4], esi
call fcn.10013802
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffed
jge 0x100294bc
push edi
lea ecx, [ebp - 0x540]
call fcn.1001377b
push edi
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 4], 0xe
call fcn.1001377b
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x1c], 0xeaa32b1c
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10029576
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5e8]
call fcn.10013807
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10029558
xor eax, eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x10029608
mov dword [ebp - 0x20], 0xbb6748f6
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x100295fa
mov dword [ebp - 0x44], ebx
lea ecx, [ebp - 0x5e8]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x20]
call fcn.10013807
push dword [ebp - 0x20]
xor ebx, ebx
lea ecx, [ebp - 0x5e8]
cmp dword [eax], 0xbf9acf25
sete bl
call fcn.10013807
lea ecx, [ebp - 0x5e8]
sub ebx, dword [eax]
mov eax, dword [ebp - 0x44]
sub ebx, eax
neg ebx
sbb ebx, ebx
xor eax, eax
inc eax
neg ebx
push eax
call fcn.10013807
xor ecx, ecx
cmp ebx, dword [eax]
setne cl
xor ebx, ebx
mov dword [ebp - 0x38], ecx
inc ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10029597
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10029608
dec dword [ebp - 0x1c]
jns 0x10029582
lea ecx, [ebp - 0x5e8]
mov byte [ebp - 4], 0xe
call fcn.10013802
push 9
pop ecx
mov dword [ebp - 0x9b0], ecx
xor eax, eax
mov dword [ebp - 0x9ac], ecx
mov dword [ebp - 0x9a8], ecx
mov dword [ebp - 0x9a4], ecx
mov dword [ebp - 0x24], 0x987f
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x34], 0x7c4e7ccc
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x50], 0x369029ef
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, 0x6b58
setne cl
xor eax, eax
add ecx, 0xc443
je 0x10029689
mov ecx, ebx
cmp dword [ebp - 0x24], eax
jne 0x1002968b
mov ecx, eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp eax, ecx
mov eax, dword [ebp - 0x24]
push 0xfffffffffffffffd
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
sub edx, 0x40f8278b
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop eax
setg cl
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
je 0x1002975f
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10029754
push 0x1412
push eax
push 0xa03
push 0x1cae
push 0x25f7
push eax
push 0x860
push 0x7b6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
jmp 0x10029831
mov dword [ebp - 0x10], 0x4b58
mov dword [ebp - 0x44], 0x99040c3f
mov dword [ebp - 0x20], eax
jmp 0x10029783
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x110c], 0xa7c6dd3
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10029772
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
push 4
pop ecx
add eax, ecx
xor ecx, ecx
cmp eax, esi
setg cl
imul ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
sub eax, 0x5452fa81
jne 0x100297c1
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x100297c3
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setne cl
xor edx, edx
cmp eax, ecx
setle dl
sub edx, 0xe07ea4c5
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x10]
jl 0x100297f6
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x100297f8
mov ecx, ebx
mov eax, dword [ebp - 0x10]
xor edx, edx
add eax, 0xd9964974
add ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, 0x8cff26af
setl dl
cmp eax, edx
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x110c], ecx
mov dword [ebp - 0x18], 0xa8eac8b
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], 0x14f4e797
mov dword [ebp - 0x44], 0xfffffffe
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x18], 0x15
jmp 0x10029868
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x10], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffec
je 0x10029857
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x44], ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
setne dl
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100298ca
push dword [ebp - 0x10]
lea ecx, [ebp - 0x540]
call fcn.10013807
mov dword [eax], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100298b3
push edi
lea ecx, [ebp - 0xc0]
call fcn.1001377b
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], ebx
push 4
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x30], 0x4f32b7b8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002991a
push dword [ebp - 0x24]
lea ecx, [ebp - 0xc0]
call fcn.10013807
mov dword [eax], 0xd5816210
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x100298fc
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002993a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb4], 0x23e93d0b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10029922
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10029950
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x308], 0xe9d60a22
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002993f
push ebx
lea ecx, [ebp - 0xc0]
call fcn.10013807
xor ebx, ebx
lea ecx, [ebp - 0xc0]
push ebx
call fcn.10013807
xor ecx, ecx
push ebx
cmp dword [eax], ebx
sete cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xc0]
call fcn.10013807
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [eax]
lea ecx, [ebp - 0xc0]
setne bl
xor esi, esi
inc esi
push esi
call fcn.10013807
cmp ebx, dword [eax]
je 0x100299b5
push esi
lea ecx, [ebp - 0xc0]
call fcn.10013807
cmp dword [eax], 0
je 0x100299b5
mov edi, esi
jmp 0x100299b9
xor eax, eax
mov edi, eax
push esi
lea ecx, [ebp - 0xc0]
call fcn.10013807
lea ecx, [ebp - 0xc0]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0x308], esi
mov dword [ebp - 0x1c], edi
xor edi, edi
push edi
call fcn.10013807
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
sub esi, ecx
lea ecx, [ebp - 0xc0]
cmp esi, dword [eax]
setge bl
xor eax, eax
inc eax
push eax
call fcn.10013807
xor ecx, ecx
push edi
cmp dword [eax], ebx
setle cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xc0]
call fcn.10013807
inc edi
lea ecx, [ebp - 0xc0]
push edi
mov esi, dword [eax]
imul esi, dword [ebp - 0x38]
call fcn.10013807
cmp esi, dword [eax]
je 0x10029a3e
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x308], eax
je 0x10029a40
mov esi, edi
push edi
lea ecx, [ebp - 0xc0]
call fcn.10013807
xor ebx, ebx
lea ecx, [ebp - 0xc0]
push edi
cmp esi, dword [eax]
setge bl
call fcn.10013807
mov ecx, dword [ebp - 0x44]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0xc0]
setne dl
xor ebx, ebx
imul edx, dword [eax]
inc ebx
push ebx
mov dword [ebp - 0x38], edx
call fcn.10013807
mov eax, dword [eax]
imul eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x308]
neg eax
jne 0x10029acd
xor eax, eax
cmp dword [ebp - 0xb4], eax
jne 0x10029aa0
cmp dword [ebp - 0x44], eax
je 0x10029aa2
mov eax, ebx
cmp ebx, eax
mov dword [ebp - 0x1c], 0xe5a8
push ebx
sbb eax, eax
lea ecx, [ebp - 0xc0]
neg eax
mov dword [ebp - 0x308], eax
call fcn.10013807
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb4]
lea ecx, [ebp - 0xc0]
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 4], 0xe
call fcn.10013802
push ebx
lea ecx, [ebp - 0x540]
call fcn.10013807
and dword [eax], 0
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x10], 0x70bb743d
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10029b2d
mov dword [ebp - 0x44], 0xfffffffd
inc dword [ebp - 0x44]
jne 0x10029b33
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff9
jg 0x10029b1e
push eax
lea ecx, [ebp - 0x540]
call fcn.10013807
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadLocale]
xor ecx, ecx
cmp dword [eax], ecx
sete cl
xor eax, eax
cmp ecx, 0x9ed9
setne al
cmp eax, 0x7e4
jg 0x1002a9a4
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x50], 0x7806aa1c
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0x8ebdb88d
mov dword [ebp - 0x20], 0xa3888ad
push 2
mov dword [ebp - 0x50], 0xde5c4896
mov dword [ebp - 0x10], eax
pop esi
jmp 0x10029b9e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9d0], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10029b91
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x28]
jl 0x10029bbd
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov edx, ebx
sub edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x20]
je 0x10029cce
mov dword [ebp - 0x10], 0xe85c
xor edx, edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setl dl
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x10], eax
je 0x10029cbd
movdqa xmm0, xmmword [0x10007f10]
lea eax, [ebp - 0x11b4]
push eax
lea eax, [ebp - 0x11c4]
push eax
lea ecx, [ebp - 0x1434]
movdqu xmmword [ebp - 0x11c4], xmm0
call fcn.10013816
lea ecx, [ebp - 0x1b5]
mov esi, eax
call fcn.10008fb3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1138]
push dword [esi]
call fcn.100137dc
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x28], eax
jmp 0x10029ca4
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x9d0]
xor eax, eax
push eax
call fcn.10013807
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov esi, eax
mov ecx, dword [ebp + ecx*4 - 0x9d0]
test ecx, ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
setg dl
xor ebx, ebx
cmp edx, ecx
setge bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor ebx, ebx
mov dword [esi], ecx
inc dword [ebp - 0x28]
inc ebx
lea ecx, [ebp - 0x1138]
cmp dword [ebp - 0x28], ebx
jle 0x10029c63
mov byte [ebp - 4], 0xe
call fcn.10013802
push 2
pop esi
jmp 0x10029d34
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10029d36
push eax
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
jmp 0x10029d34
push 4
pop eax
push eax
lea ecx, [ebp - 0xd30]
call fcn.1001377b
xor eax, eax
mov byte [ebp - 4], 0x12
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10029d0f
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd30]
call fcn.10013807
push 4
mov dword [eax], 0x2a30
inc dword [ebp - 0x10]
pop eax
cmp dword [ebp - 0x10], eax
jl 0x10029cee
xor eax, eax
push eax
lea ecx, [ebp - 0xd30]
call fcn.10013807
xor ecx, ecx
cmp dword [eax], ecx
sete cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0xd30]
mov byte [ebp - 4], 0xe
call fcn.10013802
xor eax, eax
mov dword [ebp - 0x1c], 0xa5b7d8cf
mov dword [ebp - 0x20], 0x4fd3df75
mov dword [ebp - 0x20], eax
jmp 0x10029d88
mov dword [ebp - 0x10], 0xa35f394
mov dword [ebp - 0x10], eax
jmp 0x10029d7f
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10029d68
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10029d7c
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x10
je 0x10029d55
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe2
jg 0x10029d49
mov dword [ebp - 0x28], 0x3ccd2466
lea ecx, [ebp - 0x22c]
push 3
call fcn.1001377b
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x18], 0xaed23b61
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10029dd4
push dword [ebp - 0x18]
lea ecx, [ebp - 0x22c]
call fcn.10013807
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10029db8
mov dword [ebp - 0x18], eax
jmp 0x10029dea
xor eax, eax
mov dword [ebp - 0x2c], 0x24039b64
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002a9c8
push 0x1a20
push 0x1205
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002a9d8
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 2
pop esi
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x8b4]
push esi
call fcn.1001377b
xor eax, eax
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002aa16
push dword [ebp - 0x18]
lea ecx, [ebp - 0x8b4]
call fcn.10013807
mov dword [eax], 0x7a7bc6c8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002a9f8
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002aa35
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x780], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002aa21
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffffb
jl 0x1002ab50
mov dword [ebp - 0x44], 0x81ced8f6
mov dword [ebp - 0x294], ebx
mov dword [ebp - 0x290], ebx
mov dword [ebp - 0x28c], ebx
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x44], 7
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x18], eax
jle 0x1002aa88
xor eax, eax
cmp dword [ebp - 0x28c], eax
je 0x1002aa8a
mov eax, ebx
jmp 0x1002aa8a
xor eax, eax
cmp eax, dword [ebp - 0x290]
jne 0x1002aa9b
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x18], eax
je 0x1002aa9d
mov esi, ebx
push ebx
lea ecx, [ebp - 0x8b4]
call fcn.10013807
push 6
pop ecx
mov dword [eax], ecx
mov eax, ecx
sub eax, esi
imul eax, eax, 0xd6c3
add eax, dword [ebp - 0x294]
jne 0x1002aac7
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1002aac9
mov ecx, ebx
mov eax, dword [ebp - 0x18]
imul eax, ecx
sub eax, dword [ebp - 0x294]
je 0x1002aae5
xor eax, eax
cmp dword [ebp - 0x28c], eax
je 0x1002aae7
mov eax, ebx
jmp 0x1002aae7
xor eax, eax
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x8b4]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x290]
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x44], 0x147909b7
mov eax, dword [ebp - 0x44]
push ebx
call fcn.10013807
xor eax, eax
cmp dword [ebp - 0x28c], eax
je 0x1002ab1e
mov eax, ebx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x780], eax
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002ab40
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffb
jge 0x1002aa42
push 2
pop esi
lea ecx, [ebp - 0x8b4]
mov byte [ebp - 4], 0xe
call fcn.10013802
xor eax, eax
or ecx, 0xffffffff
mov byte [ebp - 0x11], al
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x3c], eax
jne 0x1002abb4
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
cmp edx, 0xd085
setl cl
sub eax, ecx
jne 0x1002abb4
mov ecx, eax
jmp 0x1002abb6
mov ecx, ebx
mov eax, dword [ebp - 0x28]
add eax, ecx
mov dword [ebp - 0x240], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x1e
jg 0x1002ae8b
push 4
pop ecx
mov dword [ebp - 0x18], 0x452a
mov dword [ebp - 0x1c], 0xb1aa435c
mov dword [ebp - 0x38], 0x31d611cf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002ac08
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x152c], 0x6760
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002abf0
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002ae8b
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], 0x7a6bae6a
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x2d
je 0x1002ae7b
mov dword [ebp - 0x20], 0xeae3254
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002ac59
push eax
push 0x55a
push 0x26b2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002ae5b
cmp dword [ebp - 0x10], eax
jne 0x1002ac7b
mov eax, dword [ebp - 0x240]
neg eax
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x2d
push 0
pop eax
jne 0x1002ac28
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1e
push 2
pop esi
jle 0x1002abd3
cmp byte [ebp - 0x11], 0
je 0x1002afa0
mov dword [ebp - 0x3c], 0x5540d7f8
mov dword [ebp - 0x3c], 7
cmp dword [ebp - 0x3c], 0xfffffffc
jl 0x1002aedb
push 0xfffffffffffffffd
pop esi
mov dword [ebp - 0x10], 0xdce9d05b
mov dword [ebp - 0x10], eax
jmp 0x1002aecd
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002aeca
push eax
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jge 0x1002aeb8
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffffc
jge 0x1002aeac
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x15
je 0x1002af8d
mov dword [ebp - 0x10], 0x704f3d4e
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002af5f
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, 0x593c8699
setne dl
xor ecx, ecx
add edx, 0xffff
test edx, edx
setle cl
xor eax, eax
cmp ecx, 0x45a8cced
setle al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x3c]
jne 0x1002af34
cmp eax, dword [ebp - 0x3c]
je 0x1002af46
mov eax, ebx
cmp eax, dword [ebp - 0x3c]
je 0x1002af46
mov ecx, 0x91f06e85
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x3c]
jle 0x1002af71
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
neg eax
push 0
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x15
pop eax
jne 0x1002aee8
push 0xbe0
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
or esi, 0xffffffff
lea ecx, [ebp - 0x540]
mov dword [ebp - 4], esi
call fcn.10013802
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffc
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002afcb
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
xor eax, eax
mov dword [ebp - 0x20], 7
cmp dword [ebp - 0x20], eax
jle 0x1002b07a
push ebx
lea ecx, [ebp - 0x558]
call fcn.1001377b
xor eax, eax
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002b016
push dword [ebp - 0x10]
lea ecx, [ebp - 0x558]
call fcn.10013807
mov dword [eax], 0xaa9ac70c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002aff8
xor eax, eax
push eax
lea ecx, [ebp - 0x558]
call fcn.10013807
xor ecx, ecx
push ecx
mov dword [eax], ecx
jmp 0x1002b04e
lea ecx, [ebp - 0x558]
call fcn.10013807
cmp dword [eax], 0x19
jl 0x1002b029
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x34], 0x935cb514
mov dword [ebp - 0x30], 0x324c99ff
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffe7
jg 0x1002b225
push 0xfffffffffffffff7
pop ecx
jmp 0x1002b0a2
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x10], 0x7f3c88fe
mov dword [ebp - 0x10], eax
jmp 0x1002b0c5
push ebx
lea ecx, [ebp - 0x638]
call fcn.1001377b
mov dword [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x34], 0xdab551fa
mov dword [ebp - 0x44], 0xc5051dd2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002b274
push dword [ebp - 0x10]
lea ecx, [ebp - 0x638]
call fcn.10013807
mov dword [eax], 0x5d6c05ba
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002b256
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x1002b2b2