Function at 0x10026b16
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008b6e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x65c
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10029bf5
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x78], 0x9e7
mov dword [ebp - 0x148], 0x228d5fea
mov dword [ebp - 0x304], 0xe80c6548
mov dword [ebp - 0xc0], 0
jmp 0x10026b7c
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x10026b98
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x634], 0x237f4a7d
jmp 0x10026b6f
mov byte [ebp - 0x64], 0
movzx eax, byte [ebp - 0x64]
test eax, eax
je 0x10026bac
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], eax
jge 0x10026bc0
mov dword [ebp - 0x310], 1
jmp 0x10026bc7
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], eax
jne 0x10026bdb
mov dword [ebp - 0x44c], 1
jmp 0x10026be2
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x5c], eax
jge 0x10026bf9
cmp dword [ebp - 0x5c], 0
jne 0x10026bf9
and dword [ebp - 0x35c], 0
jmp 0x10026c03
mov dword [ebp - 0x35c], 1
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x35c]
jge 0x10026c1d
cmp dword [ebp - 0x78], 0
jne 0x10026c1d
and dword [ebp - 0x398], 0
jmp 0x10026c27
mov dword [ebp - 0x398], 1
imul eax, dword [ebp - 0x398], 0x50d8
add eax, dword [ebp - 0x78]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x148], eax
jne 0x10026c51
mov dword [ebp - 0x3a0], 1
jmp 0x10026c58
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x3a0], eax
jle 0x10026c6f
mov dword [ebp - 0x3a8], 1
jmp 0x10026c76
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0x56411d7f
je 0x10026c9a
mov dword [ebp - 0x198], 1
jmp 0x10026ca1
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x310]
cmp eax, dword [ebp - 0x198]
jge 0x10026cbb
mov dword [ebp - 0x470], 1
jmp 0x10026cc2
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x78], 0
jne 0x10026ce3
cmp dword [ebp - 0x148], 0
jne 0x10026ce3
and dword [ebp - 0x318], 0
jmp 0x10026ced
mov dword [ebp - 0x318], 1
mov eax, dword [ebp - 0x318]
sub eax, dword [ebp - 0x78]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x634], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x460], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x454], eax
push 2
lea ecx, [ebp - 0x3b8]
call fcn.1001737a
and dword [ebp - 4], 0
mov dword [ebp - 0x54], 0x35d56974
mov dword [ebp - 0x130], 0
jmp 0x10026d45
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x10026d67
push dword [ebp - 0x130]
lea ecx, [ebp - 0x3b8]
call fcn.10017408
mov dword [eax], 4
jmp 0x10026d38
push 0
lea ecx, [ebp - 0x3b8]
call fcn.10017408
and dword [eax], 0
jmp 0x10026d9d
push 0
lea ecx, [ebp - 0x3b8]
call fcn.10017408
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1a0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x3b8]
call fcn.10017408
cmp dword [eax], 7
jg 0x10026fc9
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x338], 0xb2b058ef
mov dword [ebp - 0xc8], 0
jmp 0x10026de0
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x10026dfc
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x5c0], 1
jmp 0x10026dd3
mov dword [ebp - 0x128], 0xffffffe4
jmp 0x10026e15
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xffffffe2
je 0x10026fc4
push 2
lea ecx, [ebp - 0x424]
call fcn.1001737a
mov byte [ebp - 4], 1
mov dword [ebp - 0x480], 0x5b38
mov dword [ebp - 0xd0], 0
jmp 0x10026e56
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x10026e75
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x424]
call fcn.10017408
and dword [eax], 0
jmp 0x10026e49
push 1
lea ecx, [ebp - 0x424]
call fcn.10017408
cmp dword [eax], 0x2a3b3f36
jg 0x10026e96
mov dword [ebp - 0x1b0], 1
jmp 0x10026e9d
and dword [ebp - 0x1b0], 0
push 0
lea ecx, [ebp - 0x3b8]
call fcn.10017408
mov eax, dword [eax]
sub eax, 0xedf6
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x5c0]
jge 0x10026ecc
mov dword [ebp - 0x320], 1
jmp 0x10026ed3
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfffffffb
jae 0x10026eee
mov dword [ebp - 0x1a8], 1
jmp 0x10026ef5
and dword [ebp - 0x1a8], 0
cmp dword [ebp - 0x1a8], 0xfffffff7
je 0x10026f0a
mov dword [ebp - 0x478], 1
jmp 0x10026f11
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x5d4], eax
mov esi, dword [ebp - 0x338]
push 0
lea ecx, [ebp - 0x424]
call fcn.10017408
cmp esi, dword [eax]
jge 0x10026f52
push 1
lea ecx, [ebp - 0x424]
call fcn.10017408
cmp dword [eax], 0
je 0x10026f52
mov dword [ebp - 0x328], 1
jmp 0x10026f59
and dword [ebp - 0x328], 0
push 0
lea ecx, [ebp - 0x424]
call fcn.10017408
mov eax, dword [eax]
cmp eax, dword [ebp - 0x328]
je 0x10026f7c
mov dword [ebp - 0x330], 1
jmp 0x10026f83
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0x330]
jle 0x10026f9d
mov dword [ebp - 0x1b8], 1
jmp 0x10026fa4
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x338], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x424]
call fcn.10017403
jmp 0x10026e08
jmp 0x10026d79
mov dword [ebp - 0x54], 0
jmp 0x10026fd9
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jg 0x1002700a
push dword [ebp - 0x54]
lea ecx, [ebp - 0x3b8]
call fcn.10017408
cmp dword [eax], 0
je 0x10026ff4
jmp 0x1002700a
push dword [ebp - 0x54]
lea ecx, [ebp - 0x3b8]
call fcn.10017408
mov dword [eax], 0x7f4a7d2a
jmp 0x10026fd2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3b8]
call fcn.10017403
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0xd8], 1
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0xa4], 0xfffffffa
mov dword [ebp - 0x11c], 0
jmp 0x10027059
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 3
jge 0x10027075
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x658], 2
jmp 0x1002704c
mov dword [ebp - 0xd8], 0
jmp 0x1002708e
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jg 0x1002728e
mov dword [ebp - 0x9c], 0xfffffff7
xor eax, eax
je 0x100270ca
mov eax, 0x191b4956
test eax, eax
je 0x100270ca
cmp dword [ebp - 0x9c], 0
je 0x100270ca
mov dword [ebp - 0x9c], 0x588c5561
jmp 0x10027289
mov dword [ebp - 0x12c], 0xfffffff2
jmp 0x100270e3
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0xfffffff7
je 0x10027289
mov dword [ebp - 0xa4], 0x1c
jmp 0x10027109
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x15
jg 0x10027284
mov dword [ebp - 0x9c], 5
jmp 0x1002712f
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xf
jg 0x1002727f
push 2
lea ecx, [ebp - 0x43c]
call fcn.1001737a
mov dword [ebp - 4], 2
mov dword [ebp - 0xe0], 0
jmp 0x10027169
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 2
jge 0x10027188
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x43c]
call fcn.10017408
or dword [eax], 0xffffffff
jmp 0x1002715c
push 0
lea ecx, [ebp - 0x43c]
call fcn.10017408
and dword [eax], 0
jmp 0x100271be
push 0
lea ecx, [ebp - 0x43c]
call fcn.10017408
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x43c]
call fcn.10017408
cmp dword [eax], 2
jg 0x10027243
mov dword [ebp - 0x488], 0xffffffff
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x10027202
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0
lea ecx, [ebp - 0x43c]
call fcn.10017408
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x658], 0
je 0x1002722b
xor eax, eax
je 0x1002722b
mov dword [ebp - 0x340], 1
jmp 0x10027232
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x488], eax
jmp 0x1002719a
mov byte [ebp - 0x70], 0
movzx eax, byte [ebp - 0x70]
test eax, eax
je 0x1002726b
push 0x42d
push 0xe24
push 0xcf8
push 0x4c4
push 0
call dword [sym.imp.USER32.dll_SetRect]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x43c]
call fcn.10017403
jmp 0x10027122
jmp 0x100270fc
jmp 0x100270d6
jmp 0x10027081
mov dword [ebp - 0xa4], 0x514faf14
mov eax, dword [ebp - 0x110]
mov eax, dword [eax + 4]
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x124], 0x8a61928c
mov dword [ebp - 0x124], 0xd
jmp 0x100272ca
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0x1c
jl 0x100272f0
mov byte [ebp - 0x61], 0
movzx eax, byte [ebp - 0x61]
test eax, eax
je 0x100272ee
push 0
push 0x15bb
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
jmp 0x100272bd
mov byte [ebp - 0x66], 0
movzx eax, byte [ebp - 0x66]
test eax, eax
je 0x10027315
push 0
push 0xc2f
push 0x25f1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
mov dword [ebp - 0x504], 0xfffffffd
mov dword [ebp - 0x500], 0xfffffffd
mov dword [ebp - 0x4fc], 0xfffffffd
mov dword [ebp - 0x4f8], 0xfffffffd
mov dword [ebp - 0x80], 0xc1ec2db2
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x504]
mov dword [ebp - 0x80], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x504], 0
je 0x10027395
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x10027393
push 0
push 0
push 0
push 0
push 0xcc2
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x100273cb
mov dword [ebp - 0x80], 0
jmp 0x100273a5
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jg 0x100273cb
mov eax, dword [ebp - 0x80]
cmp dword [ebp + eax*4 - 0x504], 0
je 0x100273ba
jmp 0x100273cb
mov eax, dword [ebp - 0x80]
cmp dword [ebp + eax*4 - 0x504], 0
je 0x100273c9
jmp 0x100273cb
jmp 0x1002739e
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x88], 0x9e7
mov dword [ebp - 0xe8], 1
mov dword [ebp - 0x57c], 0x286e871d
mov dword [ebp - 0x578], 0x286e871d
mov dword [ebp - 0x574], 0x286e871d
mov dword [ebp - 0x570], 0x286e871d
mov dword [ebp - 0xe8], 0
jmp 0x10027427
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 8
jle 0x10027472
mov dword [ebp - 0xa8], 2
mov dword [ebp - 0xa8], 0
jmp 0x10027453
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jg 0x10027470
mov eax, dword [ebp - 0xa8]
cmp dword [ebp + eax*4 - 0x57c], 0
je 0x1002746e
jmp 0x10027470
jmp 0x10027446
jmp 0x1002741a
mov dword [ebp - 0x16c], 0x228d5fea
mov dword [ebp - 0x18], 0xbac04ee7
mov dword [ebp - 0xa0], 0x8551b32e
push 2
lea ecx, [ebp - 0x548]
call fcn.1001737a
mov dword [ebp - 4], 3
mov dword [ebp - 0x114], 0
jmp 0x100274ba
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
jge 0x100274dc
push dword [ebp - 0x114]
lea ecx, [ebp - 0x548]
call fcn.10017408
mov dword [eax], 5
jmp 0x100274ad
mov byte [ebp - 0x68], 0
movzx eax, byte [ebp - 0x68]
test eax, eax
je 0x100274fc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x624], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jl 0x10027519
mov dword [ebp - 0x1c8], 1
jmp 0x10027520
and dword [ebp - 0x1c8], 0
imul eax, dword [ebp - 0x1c8], 0xadb8
test eax, eax
je 0x10027540
cmp dword [ebp - 0x18], 0
je 0x10027540
mov dword [ebp - 0x348], 1
jmp 0x10027547
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x348]
lea eax, [ecx + eax + 5]
xor ecx, ecx
inc ecx
sub ecx, eax
cmp ecx, 0x1eb2391c
jle 0x1002756d
mov dword [ebp - 0x1d0], 1
jmp 0x10027574
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1d0], eax
jg 0x1002758b
mov dword [ebp - 0x350], 1
jmp 0x10027592
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x350], eax
jle 0x100275af
cmp dword [ebp - 0x18], 0
je 0x100275af
mov dword [ebp - 0x1d8], 1
jmp 0x100275b6
and dword [ebp - 0x1d8], 0
cmp dword [ebp - 0x1d8], 0xfffffffc
jbe 0x100275cb
mov dword [ebp - 0x358], 1
jmp 0x100275d2
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x358], eax
jl 0x100275e9
mov dword [ebp - 0x1e0], 1
jmp 0x100275f0
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x1e0]
neg eax
cmp eax, dword [ebp - 0x18]
jle 0x10027609
mov dword [ebp - 0x360], 1
jmp 0x10027610
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
neg eax
cmp eax, dword [ebp - 0x18]
je 0x10027635
mov dword [ebp - 0x1e8], 1
jmp 0x1002763c
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1e8]
inc eax
inc eax
imul eax, dword [ebp - 0x18]
test eax, eax
je 0x100276f7
push 2
lea ecx, [ebp - 0x56c]
call fcn.1001737a
mov byte [ebp - 4], 4
mov dword [ebp - 0x490], 0xd8720725
mov dword [ebp - 0xf0], 0
jmp 0x10027688
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jge 0x100276aa
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x56c]
call fcn.10017408
mov dword [eax], 0x55a61940
jmp 0x1002767b
mov byte [ebp - 0x72], 0
movzx eax, byte [ebp - 0x72]
test eax, eax
je 0x100276cd
push 0xcfd
push 0x4bc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 1
lea ecx, [ebp - 0x56c]
call fcn.10017408
mov eax, dword [eax]
inc eax
mov dword [ebp - 0x490], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x56c]
call fcn.10017403
jmp 0x10027796
mov dword [ebp - 0x5dc], 0xffffffff
mov dword [ebp - 0x60c], 0xbdae8940
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x5e4], 0xffffffff
mov dword [ebp - 0xa0], 0
jmp 0x10027738
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xffffffe7
jl 0x1002775a
mov dword [ebp - 0x368], 0xfffffff6
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
jmp 0x1002772b
mov dword [ebp - 0xac], 1
jmp 0x10027773
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x10027796
push dword [ebp - 0xac]
lea ecx, [ebp - 0x548]
call fcn.10017408
cmp dword [eax], 0
je 0x10027794
jmp 0x10027796
jmp 0x10027766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x548]
call fcn.10017403
mov dword [ebp - 0x2ec], 0xe80c6548
mov dword [ebp - 0x10], 5
mov dword [ebp - 0xb4], 7
push 3
lea ecx, [ebp - 0x4e0]
call fcn.1001737a
mov dword [ebp - 4], 5
mov dword [ebp - 0x4a8], 0
mov dword [ebp - 0x44], 0
jmp 0x100277ee
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x10027801
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x1c], 0xf393
jmp 0x100277e7
mov dword [ebp - 0x44], 0
jmp 0x10027811
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x1002782d
push dword [ebp - 0x44]
lea ecx, [ebp - 0x4e0]
call fcn.10017408
mov dword [eax], 0x9f5ab171
jmp 0x1002780a
cmp dword [ebp - 0x10], 0
je 0x100278de
cmp dword [ebp - 0x10], 0
je 0x1002784f
cmp dword [ebp - 0x10], 0
je 0x1002784f
mov dword [ebp - 0x498], 1
jmp 0x10027856
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x584], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x10027873
mov dword [ebp - 0x1f0], 1
jmp 0x1002787a
and dword [ebp - 0x1f0], 0
imul eax, dword [ebp - 0x1f0], 0xfffffff6
test eax, eax
je 0x10027898
push 8
pop eax
test eax, eax
je 0x10027898
mov dword [ebp - 0x370], 1
jmp 0x1002789f
and dword [ebp - 0x370], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
cmp dword [ebp - 0x370], eax
jl 0x100278bd
mov dword [ebp - 0x4a0], 1
jmp 0x100278c4
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x10], 0
jae 0x100278de
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0
mov dword [ebp - 0xb4], 0x467b47e0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xb4], eax
jne 0x100278ff
mov dword [ebp - 0x1f8], 1
jmp 0x10027906
and dword [ebp - 0x1f8], 0
cmp dword [ebp - 0x1f8], 0x66c93ee
jne 0x1002791e
mov dword [ebp - 0x378], 1
jmp 0x10027925
and dword [ebp - 0x378], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
imul eax, dword [ebp - 0x378]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1c]
jge 0x1002794e
mov dword [ebp - 0x200], 1
jmp 0x10027955
and dword [ebp - 0x200], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
cmp dword [ebp - 0x200], eax
jne 0x10027973
mov dword [ebp - 0x380], 1
jmp 0x1002797a
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x380], eax
jle 0x10027991
mov dword [ebp - 0x208], 1
jmp 0x10027998
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x208]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10027a73
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
mov dword [ebp - 0x590], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
cmp dword [ebp - 0xb4], eax
jne 0x100279dd
mov dword [ebp - 0x388], 1
jmp 0x100279e4
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0xb4]
imul eax, dword [ebp - 0x388]
mov ecx, 0xffff
sub ecx, eax
test ecx, ecx
jle 0x10027a08
mov dword [ebp - 0x390], 1
jmp 0x10027a0f
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0xb4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0
je 0x10027a41
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0
je 0x10027a41
mov dword [ebp - 0x214], 1
jmp 0x10027a48
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
push 1
lea ecx, [ebp - 0x4e0]
call fcn.10017408
mov ecx, dword [ebp - 0x214]
add ecx, dword [eax]
cmp esi, ecx
jl 0x10027a73
and dword [ebp - 0x3cc], 0
jmp 0x10027a7d
mov dword [ebp - 0x3cc], 1
push 1
lea ecx, [ebp - 0x4e0]
call fcn.10017408
mov ecx, dword [ebp - 0x3cc]
cmp ecx, dword [eax]
jne 0x10027aa0
mov dword [ebp - 0x21c], 1
jmp 0x10027aa7
and dword [ebp - 0x21c], 0
push 1
lea ecx, [ebp - 0x4e0]
call fcn.10017408
mov ecx, dword [ebp - 0x21c]
cmp ecx, dword [eax]
jne 0x10027aca
mov dword [ebp - 0x30c], 1
jmp 0x10027ad1
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
add eax, 6
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1c]
jle 0x10027af2
mov dword [ebp - 0x224], 1
jmp 0x10027af9
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x4a8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4e0]
call fcn.10017403
mov dword [ebp - 0x53c], 0xfe0a8eac
mov dword [ebp - 0x538], 0xfe0a8eac
mov dword [ebp - 0x534], 0xfe0a8eac
mov dword [ebp - 0x530], 0xfe0a8eac
lea ecx, [ebp - 0x155]
call fcn.10008cd3
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x53c]
push eax
lea ecx, [ebp - 0x660]
call fcn.10017417
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x418]
call fcn.100173d9
mov dword [ebp - 4], 6
mov dword [ebp - 0x3c], 0
jmp 0x10027b88
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x10027b9e
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x3c8], 0
jmp 0x10027b81
mov dword [ebp - 0x3c], 0
jmp 0x10027bae
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x10027bc4
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x64c], 0x1e13
jmp 0x10027ba7
push 0
lea ecx, [ebp - 0x418]
call fcn.10017408
and dword [eax], 0
jmp 0x10027bfa
push 0
lea ecx, [ebp - 0x418]
call fcn.10017408
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x384]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x384]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x418]
call fcn.10017408
cmp dword [eax], 0xffffffeb
jle 0x10027c47
mov dword [ebp - 0x22c], 0x42a1
mov byte [ebp - 0x6a], 0
movzx eax, byte [ebp - 0x6a]
test eax, eax
je 0x10027c38
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
jmp 0x10027bd6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3c8]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x3c8]
push 4
pop edx
shl edx, 0
add ecx, dword [ebp + edx - 0x3c8]
sub eax, ecx
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x3c8]
jl 0x10027c8f
push 5
pop eax
test eax, eax
jne 0x10027c8f
and dword [ebp - 0x314], 0
jmp 0x10027c99
mov dword [ebp - 0x314], 1
cmp dword [ebp - 0x314], 0xd0c1
jle 0x10027cb1
mov dword [ebp - 0x4b0], 1
jmp 0x10027cb8
and dword [ebp - 0x4b0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3c8]
mov dword [ebp - 0x598], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c8]
mov dword [ebp - 0x5a0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3c8], 6
jg 0x10027d03
mov eax, 0x1f0dfbc4
test eax, eax
je 0x10027d03
mov dword [ebp - 0x3f0], 1
jmp 0x10027d0a
and dword [ebp - 0x3f0], 0
push 0
lea ecx, [ebp - 0x418]
call fcn.10017408
mov eax, dword [eax]
add eax, 0x6b471dfd
mov dword [ebp - 0x234], eax
push 2
lea ecx, [ebp - 0x418]
call fcn.10017408
mov ecx, dword [ebp - 0x234]
mov dword [eax], ecx
mov eax, dword [ebp - 0x234]
cmp eax, dword [ebp - 0x3f0]
jg 0x10027d53
mov dword [ebp - 0x23c], 1
jmp 0x10027d5a
and dword [ebp - 0x23c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x64c]
cmp dword [ebp - 0x23c], eax
jg 0x10027d7a
mov dword [ebp - 0x31c], 1
jmp 0x10027d81
and dword [ebp - 0x31c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x31c]
mov dword [ebp + eax - 0x3c8], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x418]
call fcn.10017403
push 1
lea ecx, [ebp - 0x4f0]
call fcn.1001737a
mov dword [ebp - 4], 7
mov dword [ebp - 0x254], 1
mov dword [ebp - 0x4b8], 0xa1fa147b
mov dword [ebp - 0x25c], 8
mov dword [ebp - 0x5a8], 0xffffffff
mov dword [ebp - 0x170], 0xffffffff
mov dword [ebp - 0x118], 0
jmp 0x10027e01
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
jge 0x10027e23
push dword [ebp - 0x118]
lea ecx, [ebp - 0x4f0]
call fcn.10017408
mov dword [eax], 1
jmp 0x10027df4
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x10027e53
push 0
push 0x1aae
push 0x1632
push 0x4fd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
push 0
lea ecx, [ebp - 0x4f0]
call fcn.10017408
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x170]
inc ecx
mov dword [ebp - 0x170], ecx
test eax, eax
jne 0x10027ed5
push 0
lea ecx, [ebp - 0x4f0]
call fcn.10017408
cmp dword [eax], 0x2f38d927
jl 0x10027e98
mov dword [ebp - 0x244], 1
jmp 0x10027e9f
and dword [ebp - 0x244], 0
cmp dword [ebp - 0x244], 0xeb59
jg 0x10027eb7
mov dword [ebp - 0x38c], 1
jmp 0x10027ebe
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x38c], eax
jle 0x10027ed5
and dword [ebp - 0x24c], 0
jmp 0x10027edf
mov dword [ebp - 0x24c], 1
mov eax, dword [ebp - 0x24c]
inc eax
cmp eax, 0xffff
je 0x10027ef9
mov dword [ebp - 0x324], 1
jmp 0x10027f00
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x4b8]
cmp dword [ebp - 0x324], eax
je 0x10027f1a
mov dword [ebp - 0x3dc], 1
jmp 0x10027f21
and dword [ebp - 0x3dc], 0
push 0
lea ecx, [ebp - 0x4f0]
call fcn.10017408
mov eax, dword [eax]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x254]
add eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x25c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4f0]
call fcn.10017403
mov dword [ebp - 0xf8], 0
jmp 0x10027f70
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 3
jge 0x10027f8c
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x640], 0x237f4a7d
jmp 0x10027f63
mov dword [ebp - 0x58], 6
mov dword [ebp - 0x5b0], 0x47a6deec
mov dword [ebp - 0x5b8], 0xd72276b8
mov dword [ebp - 0x5c4], 0xfffffffc
mov dword [ebp - 0x5d0], 0x9a57b5bf
mov dword [ebp - 0x5d8], 0xce4a6f44
mov dword [ebp - 0x5e0], 0xffffffff
mov dword [ebp - 0x32c], 0xa7b445ac
mov dword [ebp - 0x58], 0x18
jmp 0x10027fe9
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xffffffef
je 0x10028020
mov byte [ebp - 0x6c], 0
movzx eax, byte [ebp - 0x6c]
test eax, eax
je 0x1002800c
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x1002801e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x10027fe2
mov dword [ebp - 0x58], 0
jmp 0x10028030
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 8
jg 0x100280b1
mov dword [ebp - 0x5e8], 0xffffffff
mov dword [ebp - 0x5f0], 1
mov dword [ebp - 0x5f8], 0x47c4d145
mov dword [ebp - 0x618], 0xfffffffa
mov dword [ebp - 0x620], 0xa53061ec
mov dword [ebp - 0x580], 0xfffffffe
mov dword [ebp - 0x604], 6
mov dword [ebp - 0x610], 0xe75cb554
mov eax, dword [ebp - 0x32c]
dec eax
mov dword [ebp - 0x32c], eax
mov byte [ebp - 0x6e], 0
movzx eax, byte [ebp - 0x6e]
test eax, eax
je 0x100280ac
push 0
push 0x1f0d
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
jmp 0x10028029
mov byte [ebp - 0x62], 0
movzx eax, byte [ebp - 0x62]
test eax, eax
je 0x10028729
mov dword [ebp - 0x20], 0x1f665683
mov dword [ebp - 0x4c], 0x64ba8b35
mov dword [ebp - 0x294], 0xfffffffe
mov dword [ebp - 0x4d0], 0xf7828e97
mov dword [ebp - 0x120], 0
jmp 0x100280fc
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 3
jge 0x10028118
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x430], 0x16e2c9bf
jmp 0x100280ef
cmp dword [ebp - 0x20], 0
jne 0x10028277
xor eax, eax
inc eax
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jl 0x10028139
mov dword [ebp - 0x264], 1
jmp 0x10028140
and dword [ebp - 0x264], 0
cmp dword [ebp - 0x264], 1
jne 0x10028155
mov dword [ebp - 0x394], 1
jmp 0x1002815c
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x394], eax
jne 0x10028173
mov dword [ebp - 0x26c], 1
jmp 0x1002817a
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x26c]
jle 0x10028197
mov dword [ebp - 0x334], 1
jmp 0x1002819e
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x334], eax
jle 0x100281b5
mov dword [ebp - 0x274], 1
jmp 0x100281bc
and dword [ebp - 0x274], 0
cmp dword [ebp - 0x274], 0
jge 0x100281d1
mov dword [ebp - 0x3f8], 1
jmp 0x100281d8
and dword [ebp - 0x3f8], 0
cmp dword [ebp - 0x3f8], 8
jl 0x100281ed
mov dword [ebp - 0x27c], 1
jmp 0x100281f4
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
sub eax, 0x6e090b64
jne 0x10028210
cmp dword [ebp - 0x4c], 0
jne 0x10028210
and dword [ebp - 0x4c0], 0
jmp 0x1002821a
mov dword [ebp - 0x4c0], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jg 0x1002822b
mov eax, 0x8551b32e
test eax, eax
jne 0x1002823d
mov eax, 0x595a
test eax, eax
jne 0x1002823d
and dword [ebp - 0x33c], 0
jmp 0x10028247
mov dword [ebp - 0x33c], 1
cmp dword [ebp - 0x33c], 1
jge 0x1002825c
mov dword [ebp - 0x284], 1
jmp 0x10028263
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x284], eax
jl 0x10028277
and dword [ebp - 0x39c], 0
jmp 0x10028281
mov dword [ebp - 0x39c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x39c]
sub ecx, dword [ebp + eax - 0x430]
je 0x1002844c
mov dword [ebp - 0x100], 0xd55a
mov dword [ebp - 0x4c], 0
jmp 0x100282b4
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 4
jge 0x100282da
mov byte [ebp - 0x63], 0
movzx eax, byte [ebp - 0x63]
test eax, eax
je 0x100282d8
push 0x1a5d
push 0x12a5
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x100282ad
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x430], 5
jne 0x100282f6
mov dword [ebp - 0x3ec], 1
jmp 0x100282fd
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x100], 0
jne 0x100283b5
cmp dword [ebp - 0x100], 0
jne 0x10028362
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x430]
cmp dword [ebp + eax - 0x430], ecx
jge 0x1002834c
xor eax, eax
jne 0x1002834c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x430], 0
jne 0x1002834c
and dword [ebp - 0x28c], 0
jmp 0x10028356
mov dword [ebp - 0x28c], 1
cmp dword [ebp - 0x28c], 0xa274
jle 0x10028377
mov eax, 0x1363
test eax, eax
je 0x10028377
mov dword [ebp - 0x344], 1
jmp 0x1002837e
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x294], eax
jge 0x100283a1
mov dword [ebp - 0x4c8], 1
jmp 0x100283a8
and dword [ebp - 0x4c8], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x430], 0
xor eax, eax
jne 0x100283cb
cmp dword [ebp - 0x100], 0
jne 0x100283cb
and dword [ebp - 0x29c], 0
jmp 0x100283d5
mov dword [ebp - 0x29c], 1
mov eax, dword [ebp - 0x3ec]
neg eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x29c]
jl 0x100283f7
mov dword [ebp - 0x34c], 1
jmp 0x100283fe
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x34c], eax
jl 0x10028418
mov dword [ebp - 0x2a4], 1
jmp 0x1002841f
and dword [ebp - 0x2a4], 0
cmp dword [ebp - 0x2a4], 0x402a
jle 0x10028437
mov dword [ebp - 0x3a4], 1
jmp 0x1002843e
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x4d0], eax
jmp 0x10028460
mov byte [ebp - 0x65], 0
movzx eax, byte [ebp - 0x65]
test eax, eax
je 0x10028460
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov byte [ebp - 0x67], 0
movzx eax, byte [ebp - 0x67]
test eax, eax
je 0x10028479
push 0x21e9
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
push 0x23f4
push 0x5dd8
push 0x55f8
push 0
call fcn.10026b16
add esp, 0x10
mov dword [ebp - 0x144], 0x4e6d4f28
mov dword [ebp - 0x140], 0x4e6d4f28
mov dword [ebp - 0x13c], 0x4e6d4f28
mov dword [ebp - 0x138], 0x4e6d4f28
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x154], 5
mov dword [ebp - 0x2cc], 0xe2095e04
mov dword [ebp - 0x18c], 0xddbc75b1
mov dword [ebp - 0x3f4], 0x3f0bde8a
mov dword [ebp - 0x508], 0xe17c927d
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x144], 0
jne 0x1002855d
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x144], 0
jle 0x1002852a
mov dword [ebp - 0x2ac], 1
jmp 0x10028531
and dword [ebp - 0x2ac], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x144]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x144]
imul ecx, dword [ebp - 0x2ac]
push 4
pop edx
shl edx, 1
imul ecx, dword [ebp + edx - 0x144]
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x144]
push 4
pop edx
shl edx, 1
sub ecx, dword [ebp + edx - 0x144]
cmp dword [ebp + eax - 0x144], ecx
jg 0x1002858f
mov dword [ebp - 0x354], 1
jmp 0x10028596
and dword [ebp - 0x354], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x144]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x354]
je 0x100285c2
mov dword [ebp - 0x2b4], 1
jmp 0x100285c9
and dword [ebp - 0x2b4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x144]
cmp dword [ebp - 0x2b4], eax
jl 0x100285e9
mov dword [ebp - 0x400], 1
jmp 0x100285f0
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
push 4
pop eax
shl eax, 1
imul eax, dword [ebp + eax - 0x144], 0
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x61c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x144], 0x705e8c87
jg 0x10028640
mov dword [ebp - 0x2bc], 1
jmp 0x10028647
and dword [ebp - 0x2bc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x144]
add eax, dword [ebp - 0x2bc]
jne 0x10028664
cmp dword [ebp - 0x18c], 0
je 0x10028679
cmp dword [ebp - 0x18c], 0
je 0x10028679
mov dword [ebp - 0x2c4], 1
jmp 0x10028680
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x2c4]
dec eax
cmp eax, 0xfffffffd
jge 0x10028698
mov dword [ebp - 0x3ac], 1
jmp 0x1002869f
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x3ac], eax
jg 0x100286b9
mov dword [ebp - 0x364], 1
jmp 0x100286c0
and dword [ebp - 0x364], 0
mov dword [ebp - 0xb8], 0xa012
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
cmp eax, dword [ebp - 0x364]
jle 0x100286f0
mov dword [ebp - 0x2d4], 1
jmp 0x100286f7
and dword [ebp - 0x2d4], 0
mov dword [ebp - 0x154], 0xffffffff
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0xb0]
imul ecx, dword [ebp - 0x2d4]
imul eax, ecx
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x60], eax
jge 0x1002873d
mov dword [ebp - 0x374], 1
jmp 0x10028744
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x60], eax
jne 0x10028758
mov dword [ebp - 0x450], 1
jmp 0x1002875f
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x60], eax
jge 0x10028779
cmp dword [ebp - 0x60], 0
jne 0x10028779
and dword [ebp - 0x2dc], 0
jmp 0x10028783
mov dword [ebp - 0x2dc], 1
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x2dc]
jge 0x100287a0
cmp dword [ebp - 0x88], 0
jne 0x100287a0
and dword [ebp - 0x36c], 0
jmp 0x100287aa
mov dword [ebp - 0x36c], 1
imul eax, dword [ebp - 0x36c], 0x50d8
add eax, dword [ebp - 0x88]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x16c], eax
jne 0x100287da
mov dword [ebp - 0x2e4], 1
jmp 0x100287e1
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x2e4], eax
jle 0x100287fb
mov dword [ebp - 0x3bc], 1
jmp 0x10028802
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0x56411d7f
je 0x10028826
mov dword [ebp - 0x2f4], 1
jmp 0x1002882d
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x374]
cmp eax, dword [ebp - 0x2f4]
jge 0x10028847
mov dword [ebp - 0x468], 1
jmp 0x1002884e
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x88], 0
jne 0x10028872
cmp dword [ebp - 0x16c], 0
jne 0x10028872
and dword [ebp - 0x3fc], 0
jmp 0x1002887c
mov dword [ebp - 0x3fc], 1
mov eax, dword [ebp - 0x3fc]
sub eax, dword [ebp - 0x88]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x640], eax
mov dword [ebp - 0x45c], 0x2b29949d
mov dword [ebp - 0x108], 0
jmp 0x100288b7
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jge 0x100288d3
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x560], 0
jmp 0x100288aa
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x560], 0
je 0x10028945
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x24], 0
jmp 0x100288fa
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffea
jle 0x1002890b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x45c], eax
jmp 0x100288f3
mov dword [ebp - 0x24], 2
jmp 0x1002891b
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x10028943
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x560], 0
je 0x10028930
jmp 0x10028943
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x560], 0
je 0x10028941
jmp 0x10028943
jmp 0x10028914
jmp 0x1002895e
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x1002895e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x110]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x40], eax
push 1
lea ecx, [ebp - 0x518]
call fcn.1001737a
mov dword [ebp - 4], 8
mov dword [ebp - 0x134], 0x71c7bf0b
mov dword [ebp - 0x30], 0
jmp 0x100289a7
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x100289c3
push dword [ebp - 0x30]
lea ecx, [ebp - 0x518]
call fcn.10017408
mov dword [eax], 0xfffffffa
jmp 0x100289a0
mov dword [ebp - 0x30], 0
jmp 0x100289d3
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x100289e9
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x668], 1
jmp 0x100289cc
push 0
lea ecx, [ebp - 0x518]
call fcn.10017408
mov dword [eax], 8
mov dword [ebp - 0x134], 0
jmp 0x10028a15
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x14
jle 0x10028b04
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x464], 0x112def90
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0x13
jmp 0x10028a4a
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x25
je 0x10028aff
mov dword [ebp - 0x4ac], 0xa13b2885
cmp dword [ebp - 0x48], 0
jne 0x10028a6d
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x4ac]
push 0
lea ecx, [ebp - 0x518]
call fcn.10017408
cmp dword [eax], 9
je 0x10028a8b
mov dword [ebp - 0x2fc], 1
jmp 0x10028a92
and dword [ebp - 0x2fc], 0
cmp dword [ebp - 0x2fc], 0x4204
jne 0x10028aaa
mov dword [ebp - 0x37c], 1
jmp 0x10028ab1
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x37c], eax
jge 0x10028ac8
mov dword [ebp - 0x20c], 1
jmp 0x10028acf
and dword [ebp - 0x20c], 0
cmp dword [ebp - 0x20c], 0xffff
jbe 0x10028ae7
mov dword [ebp - 0x210], 1
jmp 0x10028aee
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x464], eax
jmp 0x10028a43
jmp 0x10028a08
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10017403
and dword [ebp - 0x15c], 0
jmp 0x10028b32
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x15c], eax
jge 0x10029bf3
mov dword [ebp - 0x2c], 0xd4e7937
mov dword [ebp - 0x90], 0xbc588e1b
push 1
lea ecx, [ebp - 0x3d8]
call fcn.1001737a
mov dword [ebp - 4], 9
mov dword [ebp - 0x4f4], 0xa4ec
mov dword [ebp - 0x5ec], 8
mov dword [ebp - 0xbc], 0
jmp 0x10028b9c
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x10028bbe
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x3d8]
call fcn.10017408
mov dword [eax], 3
jmp 0x10028b8f
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x594], eax
push 0
lea ecx, [ebp - 0x3d8]
call fcn.10017408
cmp dword [eax], 0x8dc2a82a
jb 0x10028beb
mov dword [ebp - 0x4d4], 1
jmp 0x10028bf2
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x614], eax
push 0
lea ecx, [ebp - 0x3d8]
call fcn.10017408
push 0
lea ecx, [ebp - 0x3d8]
call fcn.10017408
mov esi, eax
push 0
lea ecx, [ebp - 0x3d8]
call fcn.10017408
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x10028c45
mov dword [ebp - 0x218], 1
jmp 0x10028c4c
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x218]
cmp eax, 1
jl 0x10028eeb
push 3
lea ecx, [ebp - 0x17c]
call fcn.1001737a
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xc4], 0
jmp 0x10028c8f
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x10028cb1
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x17c]
call fcn.10017408
mov dword [eax], 1
jmp 0x10028c82
mov dword [ebp - 0x2c], 0x14
jmp 0x10028cc1
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x3b
jg 0x10028e7c
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x46c], 0xf0ed6937
mov dword [ebp - 0x4b4], 0x1300d3b5
mov byte [ebp - 0x6b], 0
movzx eax, byte [ebp - 0x6b]
test eax, eax
je 0x10028d00
push 0x2507
call dword [sym.imp.USER32.dll_MessageBeep]
cmp dword [ebp - 0x2c], 0
jne 0x10028d6f
push 1
lea ecx, [ebp - 0x17c]
call fcn.10017408
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x59c], eax
push 1
lea ecx, [ebp - 0x17c]
call fcn.10017408
cmp dword [eax], 0
jne 0x10028d45
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x220]
jne 0x10028d45
and dword [ebp - 0x228], 0
jmp 0x10028d4f
mov dword [ebp - 0x228], 1
push 1
lea ecx, [ebp - 0x17c]
call fcn.10017408
mov ecx, dword [ebp - 0x228]
cmp ecx, dword [eax]
jne 0x10028d6f
and dword [ebp - 0x230], 0
jmp 0x10028d79
mov dword [ebp - 0x230], 1
push 0
lea ecx, [ebp - 0x3d8]
call fcn.10017408
mov ecx, dword [ebp - 0x230]
cmp ecx, dword [eax]
jle 0x10028da2
mov eax, 0xd47030fc
test eax, eax
jne 0x10028da2
and dword [ebp - 0x238], 0
jmp 0x10028dac
mov dword [ebp - 0x238], 1
push 1
lea ecx, [ebp - 0x17c]
call fcn.10017408
mov ecx, dword [ebp - 0x238]
cmp ecx, dword [eax]
jl 0x10028dcf
mov dword [ebp - 0x240], 1
jmp 0x10028dd6
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x46c], eax
push 1
lea ecx, [ebp - 0x17c]
call fcn.10017408
mov esi, eax
push 2
lea ecx, [ebp - 0x17c]
call fcn.10017408
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x10028e10
mov dword [ebp - 0x248], 1
jmp 0x10028e17
and dword [ebp - 0x248], 0
push 0
lea ecx, [ebp - 0x17c]
call fcn.10017408
mov ecx, dword [ebp - 0x248]
cmp ecx, dword [eax]
jle 0x10028e3a
mov dword [ebp - 0x250], 1
jmp 0x10028e41
and dword [ebp - 0x250], 0
push 1
lea ecx, [ebp - 0x17c]
call fcn.10017408
mov ecx, dword [ebp - 0x250]
cmp ecx, dword [eax]
je 0x10028e64
mov dword [ebp - 0x258], 1
jmp 0x10028e6b
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x4b4], eax
jmp 0x10028cba
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x10028ed7
push 0x1730
push 0x1f9f
push 0x1fa1
push 0x1539
push 0xec1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x791
push 0xcdc
push 0xe83
push 0x174f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x17c]
call fcn.10017403
jmp 0x10028fb3
mov dword [ebp - 0xcc], 0
jmp 0x10028f04
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jge 0x10028f20
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0xd4], 0xfffffff6
jmp 0x10028ef7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
mov dword [ebp - 0x5f4], eax
push 0
lea ecx, [ebp - 0x3d8]
call fcn.10017408
cmp dword [eax], 0
jne 0x10028f79
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
add eax, dword [ebp - 0x90]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x2c], 0
jne 0x10028f79
and dword [ebp - 0x474], 0
jmp 0x10028f83
mov dword [ebp - 0x474], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
mov dword [ebp - 0x600], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
mov dword [ebp - 0x5ac], eax
mov dword [ebp - 0x4f4], 0xfffffffe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3d8]
call fcn.10017403
push 2
lea ecx, [ebp - 0x3e8]
call fcn.1001737a
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x50], 0x35d56974
mov dword [ebp - 0xdc], 0
jmp 0x10028ff6
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 2
jge 0x10029018
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x3e8]
call fcn.10017408
mov dword [eax], 4
jmp 0x10028fe9
push 0
lea ecx, [ebp - 0x3e8]
call fcn.10017408
and dword [eax], 0
jmp 0x1002904e
push 0
lea ecx, [ebp - 0x3e8]
call fcn.10017408
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x260]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x3e8]
call fcn.10017408
cmp dword [eax], 7
jg 0x1002927a
mov dword [ebp - 0xec], 0
mov dword [ebp - 0x298], 0xb2b058ef
mov dword [ebp - 0xe4], 0
jmp 0x10029091
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 2
jge 0x100290ad
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0x5cc], 1
jmp 0x10029084
mov dword [ebp - 0xec], 0xffffffe4
jmp 0x100290c6
cmp dword [ebp - 0xec], 0xffffffe2
je 0x10029275
push 2
lea ecx, [ebp - 0x448]
call fcn.1001737a
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x4bc], 0x5b38
mov dword [ebp - 0xf4], 0
jmp 0x10029107
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jge 0x10029126
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x448]
call fcn.10017408
and dword [eax], 0
jmp 0x100290fa
push 1
lea ecx, [ebp - 0x448]
call fcn.10017408
cmp dword [eax], 0x2a3b3f36
jg 0x10029147
mov dword [ebp - 0x280], 1
jmp 0x1002914e
and dword [ebp - 0x280], 0
push 0
lea ecx, [ebp - 0x3e8]
call fcn.10017408
mov eax, dword [eax]
sub eax, 0xedf6
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x5cc]
jge 0x1002917d
mov dword [ebp - 0x268], 1
jmp 0x10029184
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xfffffffb
jae 0x1002919f
mov dword [ebp - 0x270], 1
jmp 0x100291a6
and dword [ebp - 0x270], 0
cmp dword [ebp - 0x270], 0xfffffff7
je 0x100291bb
jmp 0x1002902a
mov dword [ebp - 0x50], 0
jmp 0x1002928a
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jg 0x100292bb
push dword [ebp - 0x50]
lea ecx, [ebp - 0x3e8]
call fcn.10017408
cmp dword [eax], 0
je 0x100292a5
jmp 0x100292bb
push dword [ebp - 0x50]
lea ecx, [ebp - 0x3e8]
call fcn.10017408
mov dword [eax], 0x7f4a7d2a
jmp 0x10029283
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3e8]
call fcn.10017403
mov dword [ebp - 0x14], 0x94b2ab76
mov dword [ebp - 0x14c], 0x6128f3b8
push 3
lea ecx, [ebp - 0x188]
call fcn.1001737a
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x38], 0xa928
push 3
lea ecx, [ebp - 0x40c]
call fcn.1001737a
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x494], 0xd571f7fc
mov dword [ebp - 0x50c], 0xffff
mov dword [ebp - 0x1d4], 0x6dea2805
mov dword [ebp - 0x4a4], 0x48cb009
mov dword [ebp - 0x34], 0
jmp 0x10029349
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x10029362
push dword [ebp - 0x34]
lea ecx, [ebp - 0x188]
call fcn.10017408
or dword [eax], 0xffffffff
jmp 0x10029342
mov dword [ebp - 0x34], 0
jmp 0x10029372
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1002938e
push dword [ebp - 0x34]
lea ecx, [ebp - 0x40c]
call fcn.10017408
mov dword [eax], 0x6902
jmp 0x1002936b
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2f64
jge 0x100294e3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x4e4], eax
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x484]
cmp eax, dword [ebp - 0x4e4]
jl 0x100293de
mov dword [ebp - 0x2a0], 1
jmp 0x100293e5
and dword [ebp - 0x2a0], 0
push 2
lea ecx, [ebp - 0x188]
call fcn.10017408
mov ecx, dword [ebp - 0x2a0]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0x188]
call fcn.10017408
or dword [eax], 0xffffffff
or eax, 0xffffffff
sub eax, dword [ebp - 0x98]
jne 0x10029425
push 2
pop eax
test eax, eax
jne 0x10029425
mov dword [ebp - 0x2a8], 1
mov eax, dword [ebp - 0x2a8]
sub eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x14]
je 0x1002944c
mov dword [ebp - 0x2d0], 1
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x2d0], eax
je 0x10029504
mov dword [ebp - 0x2d8], 1
jmp 0x1002950b
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x2d8], eax
jne 0x10029522
mov dword [ebp - 0x2e0], 1
jmp 0x10029529
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x2e0], eax
jge 0x10029540
jmp 0x10029bfd
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret