Function at 0x1002d23a
Capabilities:
Check for time delay via gettickcount
Check os version
Create directory
Create process on windows
Delete file
Delete registry key
Get common file path
Get disk information
Get disk size
Get file attributes
Get file system object information
Get graphical window text
Identify system language via api
Log keystrokes
Parse pe header
Query environment variable
Read .ini file
Resume thread
Set environment variable
Set thread local storage value
Suspend thread

Disassembly:
mov eax, 0x1007ca7c
call fcn.1007b3d0
mov eax, 0x1424
call fcn.10077b80
mov dword [ebp - 0x14], 0x2c70bb74
xor eax, eax
push ebx
mov ebx, 0x961c0f80
mov byte [ebp - 0x71], dl
mov dword [ebp - 0xb50], ebx
mov dword [ebp - 0xb4c], ebx
push esi
mov dword [ebp - 0xb48], ebx
xor esi, esi
mov dword [ebp - 0xb44], ebx
inc esi
mov dword [ebp - 0x18], eax
push edi
mov dword [ebp - 0x78], ecx
cmp dword [ebp - 0x18], esi
jge 0x1002d2a0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc6c], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002d288
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1002d2bb
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xb4c], eax
dec dword [ebp - 0x14]
jns 0x1002d2a8
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002d2d5
push 0x418
push eax
push eax
call edi
xor eax, eax
mov dword [ebp - 0x14], 0x2c70bb74
mov dword [ebp - 0xbf0], ebx
mov dword [ebp - 0xbec], ebx
mov dword [ebp - 0xbe8], ebx
mov dword [ebp - 0xbe4], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002d314
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xeb0], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002d2fc
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1002d32f
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xbec], eax
dec dword [ebp - 0x14]
jns 0x1002d31c
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002d343
push 0x418
push eax
push eax
call edi
xor eax, eax
mov dword [ebp - 0x2c], 0x367f5ed9
mov dword [ebp - 0x40], 0x9f6d4a0d
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x40], eax
je 0x1002d37c
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], eax
je 0x1002d37a
mov eax, esi
jmp 0x1002d37c
xor eax, eax
mov dword [ebp - 0x1c], eax
xor edx, edx
mov dword [ebp - 0x2c], 0x8974b66
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
setge dl
imul eax, edx, 0x4d07
mov edx, dword [ebp - 0x2c]
sub edx, eax
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x30]
jne 0x1002d3fd
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x1002d3fd
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002d3d8
push 0x735
call ebx
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
mov dword [ebp - 0x2c], 0x1b
jmp 0x1002d3f2
mov dword [ebp - 0x24], 0xfff7
mov dword [ebp - 0x24], 0xddc4ea3c
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xf
jne 0x1002d3e1
jmp 0x1002d47f
mov dword [ebp - 0x20], 0xffffffff
xor edx, edx
mov dword [ebp - 0x50], 0xfffffffa
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
dec edx
jne 0x1002d448
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002d44a
mov eax, esi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1c], 0xffffffec
jmp 0x1002d479
xor eax, eax
xor edx, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x54], 0x6014efc7
imul ecx, dword [ebp - 0x24], 0xffff000a
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
mov dword [ebp - 0x54], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 5
jl 0x1002d456
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x16
jle 0x1002d4aa
mov dword [ebp - 0x24], 0x3620
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
setle cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x16
jg 0x1002d48a
xor eax, eax
mov dword [ebp - 0x14], 0x2c70bb74
mov ecx, 0x961c0f80
mov dword [ebp - 0xb90], ecx
mov dword [ebp - 0xb8c], ecx
mov dword [ebp - 0xb88], ecx
mov dword [ebp - 0xb84], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002d4ee
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc7c], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002d4d6
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1002d509
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xb8c], eax
dec dword [ebp - 0x14]
jns 0x1002d4f6
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002d51b
push 0x418
push eax
push eax
call edi
mov dword [ebp - 0x2c], 2
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x48], 0xd0e75d
mov dword [ebp - 0x1c], 0xa2b82c44
mov dword [ebp - 0x30], 0x5248
push esi
call fcn.10015fe6
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x18], eax
jmp 0x1002d56e
push dword [ebp - 0x18]
call fcn.10016087
mov dword [eax], esi
inc dword [ebp - 0x18]
lea ecx, [ebp - 0xb8]
cmp dword [ebp - 0x18], esi
jl 0x1002d561
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x30], 0x8e503485
push eax
call fcn.10016087
mov ecx, dword [ebp - 0x30]
push 0xfffffffffffffff6
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], eax
pop eax
jg 0x1002d97c
xor edi, edi
inc edi
mov dword [ebp - 0x4c], 0xf12afbca
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x50], eax
push dword [ebp - 0x48]
call fcn.10016087
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0xb8]
push dword [ebp - 0x48]
call fcn.10016087
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
lea ecx, [ebp - 0xb8]
setge dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
imul eax, edx, 0x6cad
sub eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x48]
call fcn.10016087
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0xb8]
neg eax
mov dword [ebp - 0x28], eax
xor eax, eax
push eax
call fcn.10016087
cmp dword [eax], 0xe0c80d67
je 0x1002d650
mov eax, dword [ebp - 0x4c]
push dword [ebp - 0x48]
lea ecx, [ebp - 0xb8]
call fcn.10016087
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x40]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x4c], ecx
imul eax, dword [ebp - 0x4c], 0x906e
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], eax
jg 0x1002d95e
mov dword [ebp - 0x5c], 0xfffffffe
mov dword [ebp - 0x14], 0x8eb26348
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x5c], eax
xor eax, eax
cmp dword [ebp - 0x5c], eax
je 0x1002d6bf
push eax
lea ecx, [ebp - 0xb8]
call fcn.10016087
cmp dword [eax], 0
je 0x1002d6bd
mov esi, edi
jmp 0x1002d6c1
xor eax, eax
mov esi, eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xb8]
call fcn.10016087
push dword [ebp - 0x48]
xor ebx, ebx
lea ecx, [ebp - 0xb8]
cmp dword [eax], ebx
setle bl
call fcn.10016087
xor ecx, ecx
cmp dword [eax], esi
mov eax, dword [ebp - 0x50]
setne cl
xor edx, edx
cmp ebx, ecx
setg dl
sub eax, edx
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x1002d950
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x54], 0xb75e0bd0
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1002d738
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002d733
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x1002d721
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x1002d947
mov dword [ebp - 0x3c], 0x16fbb122
lea ecx, [ebp - 0xb8]
push dword [ebp - 0x4c]
call fcn.10016087
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x28], eax
jl 0x1002d764
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x4c], eax
je 0x1002d777
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002d779
mov esi, edi
jmp 0x1002d77b
xor eax, eax
mov esi, eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xb8]
call fcn.10016087
push dword [ebp - 0x48]
xor ebx, ebx
lea ecx, [ebp - 0xb8]
cmp dword [eax], esi
setg bl
call fcn.10016087
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp ebx, ecx
setl dl
cmp dword [eax], edx
jle 0x1002d7c3
push dword [ebp - 0x48]
lea ecx, [ebp - 0xb8]
call fcn.10016087
cmp dword [eax], 0
je 0x1002d7c3
mov esi, edi
jmp 0x1002d7c7
xor eax, eax
mov esi, eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0xb8]
call fcn.10016087
xor ebx, ebx
lea ecx, [ebp - 0xb8]
cmp esi, dword [eax]
setge bl
xor eax, eax
push eax
call fcn.10016087
mov ecx, dword [ebp - 0x38]
sub ebx, ecx
push dword [ebp - 0x28]
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
xor ebx, ebx
cmp ecx, 0xffffffff
lea ecx, [ebp - 0xb8]
setle bl
call fcn.10016087
mov ecx, dword [ebp - 0x1c]
mov esi, eax
xor eax, eax
cmp ebx, ecx
mov ecx, dword [ebp - 0x5c]
setl al
xor edx, edx
cmp eax, ecx
setg dl
xor eax, eax
mov dword [esi], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002d939
mov dword [ebp - 0x24], 0xab487867
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], eax
jl 0x1002d930
push dword [ebp - 0x48]
lea ecx, [ebp - 0xb8]
call fcn.10016087
xor ecx, ecx
cmp dword [eax], 2
sete cl
add ecx, 0x439e
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0xb8]
push dword [ebp - 0x28]
call fcn.10016087
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor ebx, ebx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb8]
setle bl
call fcn.10016087
push dword [ebp - 0x48]
xor ecx, ecx
cmp dword [eax], ebx
setl cl
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0xb8]
call fcn.10016087
mov edx, dword [ebp - 0x54]
xor ecx, ecx
cmp dword [eax], edx
setge cl
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0xb8]
push dword [ebp - 0x28]
call fcn.10016087
mov ecx, dword [ebp - 0x14]
xor edx, edx
push dword [ebp - 0x48]
cmp ecx, dword [eax]
lea ecx, [ebp - 0xb8]
setg dl
sub edx, 0x691f75fc
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x54], edx
call fcn.10016087
mov ecx, dword [ebp - 0x54]
xor ebx, ebx
push dword [ebp - 0x28]
cmp ecx, dword [eax]
lea ecx, [ebp - 0xb8]
sete bl
call fcn.10016087
xor ecx, ecx
cmp dword [eax], ebx
setge cl
mov dword [ebp - 0x54], ecx
dec dword [ebp - 0x40]
jns 0x1002d845
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002d832
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x1002d744
xor eax, eax
dec dword [ebp - 0x28]
jns 0x1002d70b
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
jle 0x1002d68d
xor eax, eax
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], eax
push 0xfffffffffffffff6
pop eax
jle 0x1002d5c9
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor esi, esi
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb8]
call fcn.1001606b
mov dword [ebp - 0x2c], 0x367f5ed9
xor eax, eax
mov dword [ebp - 0x28], 0x9f6d4a0d
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x28], eax
je 0x1002d9c6
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
je 0x1002d9c4
mov eax, esi
jmp 0x1002d9c6
xor eax, eax
mov dword [ebp - 0x1c], eax
xor edx, edx
mov dword [ebp - 0x2c], 0x8974b66
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setge dl
imul eax, edx, 0x4d07
mov edx, dword [ebp - 0x2c]
sub edx, eax
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x30]
jne 0x1002da41
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002da41
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002da1c
push 0x735
call ebx
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
mov dword [ebp - 0x2c], 0x1b
jmp 0x1002da36
mov dword [ebp - 0x24], 0xfff7
mov dword [ebp - 0x24], 0xddc4ea3c
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xf
jne 0x1002da25
jmp 0x1002dac3
mov dword [ebp - 0x20], 0xffffffff
xor edx, edx
mov dword [ebp - 0x50], 0xfffffffa
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
dec edx
jne 0x1002da8c
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002da8e
mov eax, esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0xffffffec
jmp 0x1002dabd
xor eax, eax
xor edx, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x54], 0x6014efc7
imul ecx, dword [ebp - 0x24], 0xffff000a
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
mov dword [ebp - 0x54], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 5
jl 0x1002da9a
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x16
jle 0x1002daee
mov dword [ebp - 0x24], 0x3620
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
setle cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x16
jg 0x1002dace
xor eax, eax
mov dword [ebp - 0x30], 0xfe0a8eac
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x58], 0x2d4ad446
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002db2c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5dc], 0xd79339b8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002db14
xor eax, eax
mov dword [ebp - 0x30], 0xd
cmp dword [ebp - 0x30], 0xf
je 0x1002dcd2
jmp 0x1002db41
xor eax, eax
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x3c], 0x56979f9f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002db71
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcb0], 0xf51b4373
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002db58
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x20], eax
jne 0x1002db7e
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002dbd9
mov eax, dword [ebp - 0x2c]
mov ecx, 0xffff1a79
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x2c]
sub ecx, eax
sub ecx, dword [ebp - 0x50]
add ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp eax, edx
setne cl
cmp ecx, 0xffff
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x20]
jne 0x1002dbcd
cmp dword [ebp - 0x20], eax
je 0x1002dbcf
mov eax, esi
neg eax
je 0x1002dbd7
mov ecx, esi
jmp 0x1002dbdb
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x5dc], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
sub eax, 3
je 0x1002dc2c
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0xbde6b786
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xffffffff
dec dword [ebp - 0x3c]
jmp 0x1002dcb4
push 3
lea ecx, [ebp - 0x60c]
call fcn.10015fe6
xor eax, eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002dc63
push dword [ebp - 0x18]
lea ecx, [ebp - 0x60c]
call fcn.10016087
or dword [eax], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002dc47
xor eax, eax
push eax
lea ecx, [ebp - 0x60c]
call fcn.10016087
cmp dword [eax], 0
je 0x1002dc9b
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002dca5
push eax
push 0x8b3
push 0x3b7
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
jmp 0x1002dca5
xor eax, eax
cmp dword [ebp - 0xcb0], eax
jne 0x1002dcc3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60c]
call fcn.1001606b
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xf
jne 0x1002db3f
jmp 0x1002dcd2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60c]
call fcn.1001606b
dec dword [ebp - 0x58]
lea ecx, [ebp - 0x8ac]
mov dword [ebp - 0x20], 0x5a136951
mov dword [ebp - 0x24], 9
push esi
call fcn.10015fe6
xor eax, eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002dd1e
push dword [ebp - 0x18]
lea ecx, [ebp - 0x8ac]
call fcn.10016087
mov dword [eax], 0x6513
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002dd00
xor eax, eax
mov dword [ebp - 0x20], 0x8ec0ae97
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1002dd81
jmp 0x1002dd32
xor eax, eax
mov dword [ebp - 0x14], 0xfffffff8
lea ecx, [ebp - 0x8ac]
mov dword [ebp - 0x50], 0x75cb5542
mov dword [ebp - 0x54], 0xfffffff8
push eax
call fcn.10016087
dec dword [eax]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002dd5f
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x54], 0x7c869b7d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002dd30
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8ac]
call fcn.1001606b
mov dword [ebp - 0x14], 0xfffd
mov dword [ebp - 0x18], 0xd022
mov dword [ebp - 0x20], 0xae2718b9
mov dword [ebp - 0x38], 0x77201043
mov dword [ebp - 0x3c], 0xe01a
mov dword [ebp - 0x5c], 0xfffffff9
mov dword [ebp - 0x24], 0x9a97a8d1
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], 0xfffffff8
mov ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
test ecx, ecx
setle al
cmp dword [ebp - 0x18], eax
jne 0x1002dde2
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002ddec
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x38]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x18]
sub ecx, 0x151ee88f
cmp ecx, eax
setne dl
sub edx, 0x553a
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x24]
je 0x1002de33
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xe2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x50], esi
imul eax, dword [ebp - 0x50], 0xffff
push 3
pop esi
push esi
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
call fcn.10015fe6
lea eax, [ebp - 0x1138]
mov dword [ebp - 4], esi
movdqa xmm0, xmmword [0x10007ae0]
lea ecx, [ebp - 0x12a0]
push eax
lea eax, [ebp - 0x1148]
mov dword [ebp - 0x34], 0x13dce9d
push eax
movdqu xmmword [ebp - 0x1148], xmm0
call fcn.10016096
lea ecx, [ebp - 0x1a6]
mov esi, eax
call fcn.10008ab3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1170]
push dword [esi]
call fcn.10016045
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x50], 0x272a
push 3
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x1002dedf
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe2c]
call fcn.10016087
or dword [eax], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002dec4
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002deff
push eax
push 0x182c
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
dec dword [ebp - 0x50]
lea ecx, [ebp - 0x1170]
call fcn.1001606b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe2c]
call fcn.1001606b
mov dword [ebp - 0x14], 0x2c70bb74
lea ecx, [ebp - 0x378]
push esi
call fcn.10015fe6
push 5
pop ecx
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x18], eax
jmp 0x1002df53
push dword [ebp - 0x18]
call fcn.10016087
mov dword [eax], 0xa61928c1
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x378]
cmp dword [ebp - 0x18], esi
jl 0x1002df42
push 2
pop esi
push esi
call fcn.10016087
mov dword [eax], 5
jmp 0x1002dfa4
mov dword [ebp - 0x24], 0xb5cabfc3
push esi
call fcn.10016087
xor ecx, ecx
push esi
cmp dword [eax], 0x822b1658
setne cl
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x378]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
call fcn.10016087
inc dword [eax]
push esi
lea ecx, [ebp - 0x378]
call fcn.10016087
lea ecx, [ebp - 0x378]
cmp dword [eax], 0x1a
jge 0x1002df6f
or dword [ebp - 4], 0xffffffff
call fcn.1001606b
mov eax, 0x961c0f80
lea ecx, [ebp - 0x648]
mov dword [ebp - 0xbd0], eax
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbc4], eax
push esi
call fcn.10015fe6
push 6
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], 0xa66fe7d8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002e01f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x648]
call fcn.10016087
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002e004
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002e069
mov dword [ebp - 0x24], 0xffffffff
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002e03e
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x648]
call fcn.10016087
push dword [ebp - 0x20]
lea ecx, [ebp - 0x648]
mov esi, eax
call fcn.10016087
push 0
mov ecx, dword [eax]
mov dword [esi], ecx
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x20]
pop eax
xor esi, esi
inc esi
cmp dword [ebp - 0x20], esi
jle 0x1002e024
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1001606b
mov dword [ebp - 0x30], 0x834504cd
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002e0a0
mov dword [ebp - 0x50], 7
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
jmp 0x1002e1d3
push 2
lea ecx, [ebp - 0xa44]
call fcn.10015fe6
xor eax, eax
mov dword [ebp - 4], 7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002e0de
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa44]
call fcn.10016087
mov dword [eax], 0x11738ab6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002e0bf
xor eax, eax
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x30], eax
jl 0x1002e1c4
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x1002e1bb
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x1002e1ac
mov dword [ebp - 0x20], 0x1c71bc7d
mov dword [ebp - 0x20], eax
jmp 0x1002e18c
mov dword [ebp - 0x1c], 0x7182b474
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1002e154
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002e13b
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa44]
call fcn.10016087
inc dword [ebp - 0x1c]
push 0
pop eax
cmp dword [ebp - 0x1c], esi
jle 0x1002e12b
mov dword [ebp - 0x1c], eax
jmp 0x1002e184
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002e181
push eax
push 0x851
push eax
push 0x223a
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002e159
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x1002e11c
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002e1a3
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002e110
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x14]
push 0
pop eax
jns 0x1002e0fd
dec dword [ebp - 0x30]
jns 0x1002e0ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa44]
call fcn.1001606b
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x18], eax
inc ebx
cmp dword [ebp - 0x18], ebx
jge 0x1002e1f8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xde8], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002e1e0
xor eax, eax
mov dword [ebp - 0x34], 0xffff
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002e215
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002e226
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor eax, eax
mov dword [ebp - 0x14], eax
mov ecx, 0xa5d6c05b
push 3
pop esi
cmp dword [ebp - 0x14], eax
jl 0x1002e3f9
mov dword [ebp - 0x5ec], ecx
mov dword [ebp - 0x5e8], ecx
mov dword [ebp - 0x5e4], ecx
mov dword [ebp - 0x5e0], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002e274
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3ec], 0x8da8e97e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002e25b
xor eax, eax
mov dword [ebp - 0x3e8], esi
cmp dword [ebp - 0x3e8], eax
jl 0x1002e2a1
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002e299
push 0x18f0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
dec dword [ebp - 0x3e8]
jns 0x1002e282
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002e2b2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
xor eax, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], 0x3ae35568
mov dword [ebp - 0x18], eax
jmp 0x1002e3bf
push 4
lea ecx, [ebp - 0x528]
call fcn.10015fe6
push ebx
lea ecx, [ebp - 0x2f4]
mov dword [ebp - 4], 8
call fcn.10015fe6
xor eax, eax
mov byte [ebp - 4], 9
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1002e30e
push dword [ebp - 0x28]
lea ecx, [ebp - 0x528]
call fcn.10016087
mov dword [eax], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002e2f3
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002e331
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2f4]
call fcn.10016087
and dword [eax], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002e316
xor eax, eax
push eax
lea ecx, [ebp - 0x2f4]
call fcn.10016087
and dword [eax], 0
jmp 0x1002e37e
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1002e355
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
push eax
lea ecx, [ebp - 0x2f4]
call fcn.10016087
lea ecx, [ebp - 0x528]
push dword [eax]
call fcn.10016087
xor eax, eax
lea ecx, [ebp - 0x2f4]
push eax
call fcn.10016087
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x2f4]
push eax
call fcn.10016087
cmp dword [eax], esi
jle 0x1002e342
push 2
lea ecx, [ebp - 0x528]
call fcn.10016087
lea ecx, [ebp - 0x2f4]
cmp dword [eax], 0
jne 0x1002e3cb
call fcn.1001606b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x528]
call fcn.1001606b
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff2
jge 0x1002e2c4
jmp 0x1002e3df
call fcn.1001606b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x528]
call fcn.1001606b
mov eax, dword [ebp - 0x24]
mov ecx, 0xa5d6c05b
mov dword [ebp - 0xbcc], eax
dec dword [ebp - 0x14]
push 0
pop eax
jns 0x1002e23a
mov dword [ebp - 0x4c], 0xfffffff8
mov dword [ebp - 0x38], 0x607d19fa
mov dword [ebp - 0x50], 0x36c8609
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002e41f
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1002e593
push 4
lea ecx, [ebp - 0x8c4]
call fcn.10015fe6
xor eax, eax
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002e466
push dword [ebp - 0x18]
lea ecx, [ebp - 0x8c4]
call fcn.10016087
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002e447
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x22
jge 0x1002e588
jmp 0x1002e477
xor eax, eax
mov dword [ebp - 0x20], 0x5912
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x50], 0xfffffff6
mov dword [ebp - 0x18], eax
jmp 0x1002e49e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1164], 0x42bb1e5d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002e48d
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
cmp eax, 0x3ee67684
setge cl
xor eax, eax
cmp ecx, 0x6a08
setne al
cmp eax, 9
jb 0x1002e4d2
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x4c], eax
je 0x1002e4d4
mov edi, ebx
push esi
lea ecx, [ebp - 0x8c4]
call fcn.10016087
mov ecx, dword [ebp - 0x4c]
xor edx, edx
cmp edi, 0x9200
mov esi, eax
setge dl
xor eax, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x20]
setne al
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x4c]
setl dl
imul eax, edx, 0x26d5
xor edx, edx
cmp eax, dword [esi]
mov eax, dword [ebp - 0x20]
setge dl
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
imul eax, ecx, 0x4d4b
mov ecx, dword [ebp - 0x20]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002e56c
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002e55d
push eax
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x115c], eax
inc dword [ebp - 0x30]
push 0
pop eax
cmp dword [ebp - 0x30], 0x12
jne 0x1002e54d
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0x22
push 3
pop esi
jl 0x1002e475
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x8c4]
jmp 0x1002e6c9
movdqa xmm0, xmmword [0x10007b40]
lea eax, [ebp - 0xf58]
push eax
lea eax, [ebp - 0xf68]
push eax
lea ecx, [ebp - 0x13a0]
movdqu xmmword [ebp - 0xf68], xmm0
call fcn.10016096
lea ecx, [ebp - 0x1d9]
mov esi, eax
call fcn.10008ab3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x538]
push dword [esi]
call fcn.10016045
push 0xb
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0x3e821d2a
mov dword [ebp - 0x4c], 0xfffffff0
cmp dword [ebp - 0x4c], eax
jle 0x1002e6c3
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002e61b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2a4], 0xfffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002e602
xor eax, eax
cmp eax, dword [ebp - 0x2a4]
je 0x1002e65e
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x538]
xor eax, eax
push eax
call fcn.10016087
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2a4]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x2a4]
sub eax, 0xc6a0
je 0x1002e654
mov eax, ebx
jmp 0x1002e656
xor eax, eax
cmp eax, dword [ebp - 0x2a4]
jne 0x1002e676
push 3
lea ecx, [ebp - 0x538]
call fcn.10016087
cmp dword [eax], 0
jne 0x1002e676
xor eax, eax
mov esi, eax
jmp 0x1002e67a
mov esi, ebx
xor eax, eax
push eax
lea ecx, [ebp - 0x538]
call fcn.10016087
xor ebx, ebx
lea ecx, [ebp - 0x538]
cmp esi, dword [eax]
setne bl
xor eax, eax
push eax
call fcn.10016087
cmp ebx, dword [eax]
je 0x1002e6ae
xor eax, eax
cmp dword [ebp - 0x2a4], eax
jne 0x1002e6ae
xor ebx, ebx
inc ebx
jmp 0x1002e6b3
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xb
jg 0x1002e5f7
lea ecx, [ebp - 0x538]
or dword [ebp - 4], 0xffffffff
call fcn.1001606b
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x20], 0xa2ae
mov dword [ebp - 0x30], 0x7d0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002e7e6
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002e71f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1b8], 0x4859bb7a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002e707
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002e774
mov dword [ebp - 0x14], 0x86e52d8c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002e74d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x12b0], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002e734
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x1002e771
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002e76c
push 0x1df
push eax
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1002e755
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffed
jne 0x1002e724
cmp dword [ebp - 0x20], eax
jne 0x1002e7a0
mov eax, dword [ebp - 0x1b8]
mov ecx, 0xa0c0e075
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
sub ecx, eax
add ecx, dword [ebp - 0x2c]
cmp ecx, 0xffffffff
je 0x1002e7a0
xor eax, eax
mov edx, eax
jmp 0x1002e7a2
mov edx, ebx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setge cl
xor ebx, ebx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1b8]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x1b8]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor ebx, ebx
mov dword [ebp - 0x24], ecx
inc ebx
jmp 0x1002e88b
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x50], 0x1b460d54
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002e817
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x514], 0xd38e20b4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002e7ff
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002e832
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002e82f
push 7
call dword [sym.imp.KERNEL32.dll_TlsFree]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xa
jl 0x1002e81c
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
test ecx, ecx
sets dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x514], ecx
mov dword [ebp - 0x50], ebx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x24], eax
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0x28], 0x7e2799ac
push 2
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x1002e8ba
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf18], 0xd19ac196
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002e8a2
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffea
jl 0x1002e93a
mov dword [ebp - 0x20], 0x8b72fd49
mov dword [ebp - 0x20], eax
jmp 0x1002e922
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x1002e919
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002e8ec
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1002e914
push eax
push 0x84e
push eax
push 0x1f45
push 0x13d9
push eax
push 0x15ac
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1002e8da
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], 0xe
jge 0x1002e8cf
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffea
push 0
pop eax
jge 0x1002e8c3
mov dword [ebp - 0x28], 0xfffffff8
jmp 0x1002e971
mov dword [ebp - 0x18], eax
jmp 0x1002e959
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1194], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002e948
mov eax, dword [ebp - 0xf18]
mov dword [ebp - 0x1190], eax
dec dword [ebp - 0x28]
push 0
pop eax
cmp dword [ebp - 0x28], 0xffffffef
jl 0x1002e943
cmp byte [ebp - 0xd], 0
je 0x1002eb8d
push ebx
lea ecx, [ebp - 0x30c]
call fcn.10015fe6
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1002e9d0
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xec0], 0x82062403
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002e9b7
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002e9f6
push dword [ebp - 0x28]
lea ecx, [ebp - 0x30c]
call fcn.10016087
mov dword [eax], 0xb743d837
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002e9d8
xor eax, eax
push eax
lea ecx, [ebp - 0x30c]
call fcn.10016087
mov dword [eax], 3
jmp 0x1002eaff
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x7f8]
push ebx
call fcn.10015fe6
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002ea4b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x7f8]
call fcn.10016087
mov dword [eax], 0x59008cf5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002ea2d
xor eax, eax
push eax
lea ecx, [ebp - 0x30c]
call fcn.10016087
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xec0], 0
jne 0x1002eb18
mov dword [ebp - 0x14], 3
xor eax, eax
cmp dword [ebp - 0x14], eax
jl 0x1002eae0
mov dword [ebp - 0x34], 0x5a1fa147
lea ecx, [ebp - 0xd2c]
mov dword [ebp - 0x34], 0x9e3cf957
push 3
call fcn.10015fe6
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002eabe
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd2c]
call fcn.10016087
mov dword [eax], 0x2e96673e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002ea9f
xor eax, eax
push eax
lea ecx, [ebp - 0x7f8]
call fcn.10016087
lea ecx, [ebp - 0xd2c]
inc dword [eax]
mov byte [ebp - 4], 0xd
call fcn.1001606b
dec dword [ebp - 0x14]
jns 0x1002ea75
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0xc
call fcn.1001606b
xor eax, eax
lea ecx, [ebp - 0x30c]
push eax
call fcn.10016087
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x30c]
push eax
call fcn.10016087
cmp dword [eax], 0
jge 0x1002ea0d
jmp 0x1002eb23
lea ecx, [ebp - 0x7f8]
call fcn.1001606b
mov dword [ebp - 0x420], 0xffffffed
jmp 0x1002eb6a
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x420]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xebc]
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x20]
add eax, 7
mov dword [ebp - 0xeb8], eax
inc dword [ebp - 0x420]
cmp dword [ebp - 0x420], 0xfffffffb
jge 0x1002eb2f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30c]
call fcn.1001606b
push 0x418
xor eax, eax
push eax
push eax
call edi
push 3
mov dword [ebp - 0x30], 0xb26bdde0
mov dword [ebp - 0x30], 0xffffffe6
pop edi
jmp 0x1002ec79
mov dword [ebp - 0x20], 0x23ed15de
lea ecx, [ebp - 0x660]
push edi
call fcn.10015fe6
xor eax, eax
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002ebe5
push dword [ebp - 0x18]
lea ecx, [ebp - 0x660]
call fcn.10016087
mov dword [eax], 0x545ee28f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002ebc7
xor eax, eax
mov dword [ebp - 0x20], 0xfb6318d5
mov dword [ebp - 0x20], 0x13
cmp dword [ebp - 0x20], 0xf
jle 0x1002ec67
jmp 0x1002ebfd
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002ec1d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xec], 0xc04ccb63
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002ec05
xor eax, eax
mov dword [ebp - 0xec], eax
jmp 0x1002ec44
cmp dword [ebp - 0x30], eax
jne 0x1002ec4d
push eax
lea ecx, [ebp - 0x660]
call fcn.10016087
mov ecx, dword [ebp - 0x20]
push 0
mov dword [eax], ecx
dec dword [ebp - 0xec]
pop eax
cmp dword [ebp - 0xec], 0xfffffffe
jg 0x1002ec25
push ebx
lea ecx, [ebp - 0x660]
call fcn.10016087
cmp dword [eax], 0
jne 0x1002ec67
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xf
jg 0x1002ebfb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x660]
call fcn.1001606b
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x1002eba3
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x48], 0xd0e75d
mov dword [ebp - 0x1c], 0xa2b82c44
mov dword [ebp - 0x30], 0x5248
push ebx
call fcn.10015fe6
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x18], eax
jmp 0x1002ecd5
push dword [ebp - 0x18]
call fcn.10016087
mov dword [eax], ebx
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x94]
cmp dword [ebp - 0x18], ebx
jl 0x1002ecc8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x30], 0x8e503485
push eax
call fcn.10016087
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], eax
jg 0x1002f0dd
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x4c], 0xf12afbca
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x50], eax
push dword [ebp - 0x48]
call fcn.10016087
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x94]
push dword [ebp - 0x48]
call fcn.10016087
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
lea ecx, [ebp - 0x94]
setge dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
imul eax, edx, 0x6cad
sub eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x48]
call fcn.10016087
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x94]
neg eax
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
call fcn.10016087
cmp dword [eax], 0xe0c80d67
je 0x1002edb4
mov eax, dword [ebp - 0x4c]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x94]
call fcn.10016087
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x4c], ecx
imul eax, dword [ebp - 0x4c], 0x906e
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], eax
jg 0x1002f0cb
mov dword [ebp - 0x5c], 0xfffffffe
mov dword [ebp - 0x14], 0x8eb26348
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x5c], eax
xor eax, eax
cmp dword [ebp - 0x5c], eax
je 0x1002ee23
push eax
lea ecx, [ebp - 0x94]
call fcn.10016087
cmp dword [eax], 0
je 0x1002ee21
mov esi, ebx
jmp 0x1002ee25
xor eax, eax
mov esi, eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x94]
call fcn.10016087
push dword [ebp - 0x48]
xor ebx, ebx
lea ecx, [ebp - 0x94]
cmp dword [eax], ebx
setle bl
call fcn.10016087
xor ecx, ecx
cmp dword [eax], esi
mov eax, dword [ebp - 0x50]
setne cl
xor edx, edx
cmp ebx, ecx
setg dl
sub eax, edx
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], eax
jl 0x1002f0ba
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x54], 0xb75e0bd0
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1002ee9c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ee97
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x1002ee85
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x1002f0b1
mov dword [ebp - 0x3c], 0x16fbb122
lea ecx, [ebp - 0x94]
push dword [ebp - 0x4c]
call fcn.10016087
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x40], eax
jl 0x1002eec8
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x4c], eax
je 0x1002eede
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002eee0
xor edi, edi
inc edi
mov esi, edi
jmp 0x1002eee5
xor eax, eax
xor edi, edi
mov esi, eax
inc edi
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x94]
call fcn.10016087
push dword [ebp - 0x48]
xor ebx, ebx
lea ecx, [ebp - 0x94]
cmp dword [eax], esi
setg bl
call fcn.10016087
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp ebx, ecx
setl dl
cmp dword [eax], edx
jle 0x1002ef2d
push dword [ebp - 0x48]
lea ecx, [ebp - 0x94]
call fcn.10016087
cmp dword [eax], 0
je 0x1002ef2d
mov esi, edi
jmp 0x1002ef31
xor eax, eax
mov esi, eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x94]
call fcn.10016087
xor ebx, ebx
lea ecx, [ebp - 0x94]
cmp esi, dword [eax]
setge bl
xor eax, eax
push eax
call fcn.10016087
mov ecx, dword [ebp - 0x38]
sub ebx, ecx
push dword [ebp - 0x40]
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
xor ebx, ebx
cmp ecx, 0xffffffff
lea ecx, [ebp - 0x94]
setle bl
call fcn.10016087
mov ecx, dword [ebp - 0x1c]
mov esi, eax
xor eax, eax
cmp ebx, ecx
mov ecx, dword [ebp - 0x5c]
setl al
xor edx, edx
cmp eax, ecx
setg dl
xor eax, eax
mov dword [esi], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002f0a3
mov dword [ebp - 0x24], 0xab487867
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x1002f09a
push dword [ebp - 0x48]
lea ecx, [ebp - 0x94]
call fcn.10016087
xor ecx, ecx
cmp dword [eax], 2
sete cl
add ecx, 0x439e
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x94]
push dword [ebp - 0x40]
call fcn.10016087
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor ebx, ebx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x94]
setle bl
call fcn.10016087
push dword [ebp - 0x48]
xor ecx, ecx
cmp dword [eax], ebx
setl cl
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x94]
call fcn.10016087
mov edx, dword [ebp - 0x54]
xor ecx, ecx
cmp dword [eax], edx
setge cl
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x94]
push dword [ebp - 0x40]
call fcn.10016087
mov ecx, dword [ebp - 0x14]
xor edx, edx
push dword [ebp - 0x48]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x94]
setg dl
sub edx, 0x691f75fc
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x54], edx
call fcn.10016087
mov ecx, dword [ebp - 0x54]
xor ebx, ebx
push dword [ebp - 0x40]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x94]
sete bl
call fcn.10016087
xor ecx, ecx
cmp dword [eax], ebx
setge cl
mov dword [ebp - 0x54], ecx
dec dword [ebp - 0x28]
jns 0x1002efaf
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002ef9c
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x1002eea8
xor eax, eax
dec dword [ebp - 0x40]
jns 0x1002ee6f
inc dword [ebp - 0x4c]
push 1
pop ebx
cmp dword [ebp - 0x4c], eax
jle 0x1002edf1
xor eax, eax
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], eax
jle 0x1002ed2a
push 2
pop esi
push 3
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.1001606b
mov dword [ebp - 0x2c], 0x367f5ed9
xor eax, eax
mov dword [ebp - 0x28], 0x9f6d4a0d
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x28], eax
je 0x1002f127
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
je 0x1002f125
mov eax, ebx
jmp 0x1002f127
xor eax, eax
mov dword [ebp - 0x1c], eax
xor edx, edx
mov dword [ebp - 0x2c], 0x8974b66
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setge dl
imul eax, edx, 0x4d07
mov edx, dword [ebp - 0x2c]
sub edx, eax
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x30]
jne 0x1002f1a6
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002f1a6
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002f181
push 0x735
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
mov dword [ebp - 0x2c], 0x1b
jmp 0x1002f19b
mov dword [ebp - 0x24], 0xfff7
mov dword [ebp - 0x24], 0xddc4ea3c
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xf
jne 0x1002f18a
jmp 0x1002f228
mov dword [ebp - 0x20], 0xffffffff
xor edx, edx
mov dword [ebp - 0x50], 0xfffffffa
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
dec edx
jne 0x1002f1f1
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002f1f3
mov eax, ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0xffffffec
jmp 0x1002f222
xor eax, eax
xor edx, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x54], 0x6014efc7
imul ecx, dword [ebp - 0x24], 0xffff000a
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
mov dword [ebp - 0x54], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 5
jl 0x1002f1ff
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x16
jle 0x1002f253
mov dword [ebp - 0x24], 0x3620
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
setle cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x16
jg 0x1002f233
xor eax, eax
mov dword [ebp - 0x28], 0x7e2799ac
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002f27a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcc4], 0xd19ac196
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002f262
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffea
jl 0x1002f2fa
mov dword [ebp - 0x20], 0x8b72fd49
mov dword [ebp - 0x20], eax
jmp 0x1002f2e2
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x1002f2d9
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f2ac
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f2d4
push eax
push 0x84e
push eax
push 0x1f45
push 0x13d9
push eax
push 0x15ac
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1002f29a
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], 0xe
jge 0x1002f28f
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffea
push 0
pop eax
jge 0x1002f283
mov dword [ebp - 0x28], 0xfffffff8
jmp 0x1002f330
mov dword [ebp - 0x18], eax
jmp 0x1002f319
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1254], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002f308
mov eax, dword [ebp - 0xcc4]
mov dword [ebp - 0x1250], eax
dec dword [ebp - 0x28]
push 0
pop eax
cmp dword [ebp - 0x28], 0xffffffef
jl 0x1002f303
mov dword [ebp - 0x30], 0xfe0a8eac
mov dword [ebp - 0x50], ebx
push 6
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x58], 0x2d4ad446
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002f375
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5cc], 0xd79339b8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002f35d
xor eax, eax
mov dword [ebp - 0x30], 0xd
cmp dword [ebp - 0x30], 0xf
je 0x1002f51d
jmp 0x1002f38a
xor eax, eax
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x3c], 0x56979f9f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002f3b8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe0c], 0xf51b4373
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002f3a0
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x20], eax
jne 0x1002f3c5
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002f420
mov eax, dword [ebp - 0x2c]
mov ecx, 0xffff1a79
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x2c]
sub ecx, eax
sub ecx, dword [ebp - 0x50]
add ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp eax, edx
setne cl
cmp ecx, 0xffff
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x20]
jne 0x1002f414
cmp dword [ebp - 0x20], eax
je 0x1002f416
mov eax, ebx
neg eax
je 0x1002f41e
mov ecx, ebx
jmp 0x1002f422
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x5cc], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
sub eax, edi
je 0x1002f472
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0xbde6b786
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xffffffff
dec dword [ebp - 0x3c]
jmp 0x1002f4ff
push edi
lea ecx, [ebp - 0x750]
call fcn.10015fe6
xor eax, eax
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002f4aa
push dword [ebp - 0x18]
lea ecx, [ebp - 0x750]
call fcn.10016087
or dword [eax], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002f48f
xor eax, eax
push eax
lea ecx, [ebp - 0x750]
call fcn.10016087
cmp dword [eax], 0
je 0x1002f4e6
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002f4f0
push eax
push 0x8b3
push 0x3b7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
jmp 0x1002f4f0
xor eax, eax
cmp dword [ebp - 0xe0c], eax
jne 0x1002f50e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x750]
call fcn.1001606b
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xf
jne 0x1002f388
jmp 0x1002f51d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x750]
call fcn.1001606b
dec dword [ebp - 0x58]
lea ecx, [ebp - 0x8dc]
mov dword [ebp - 0x14], 0xfc07
mov dword [ebp - 0x54], 0x51da622a
mov dword [ebp - 0x24], 0x40ed3c15
push esi
call fcn.10015fe6
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0x678]
mov dword [ebp - 0x50], 0xffffffff
push esi
call fcn.10015fe6
xor eax, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002f583
push dword [ebp - 0x28]
lea ecx, [ebp - 0x8dc]
call fcn.10016087
mov dword [eax], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002f569
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002f59f
push dword [ebp - 0x28]
lea ecx, [ebp - 0x678]
call fcn.10016087
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002f588
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x8dc]
add esi, 4
neg esi
push ebx
sbb esi, esi
neg esi
call fcn.10016087
xor ecx, ecx
push ebx
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
cmp esi, eax
setl cl
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x678]
call fcn.10016087
mov edx, dword [ebp - 0x50]
mov esi, eax
mov ecx, dword [ebp - 0x54]
xor eax, eax
cmp ecx, edx
mov ecx, dword [ebp - 0x14]
setg al
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x678]
setge dl
xor ebx, ebx
cmp eax, edx
setge bl
sub ebx, dword [esi]
neg ebx
sbb ebx, ebx
xor esi, esi
inc esi
inc ebx
push esi
call fcn.10016087
mov edi, dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x14]
setge cl
sub ecx, eax
je 0x1002f640
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002f6cb
push eax
push 0x2ac
push eax
call edi
jmp 0x1002f6cb
mov dword [ebp - 0x34], 4
lea ecx, [ebp - 0xb04]
xor eax, eax
mov dword [ebp - 0x34], 0xbde64f6c
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x56095dbc
push esi
call fcn.10015fe6
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002f68c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc8c], 0x255ebda1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002f674
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002f6b2
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb04]
call fcn.10016087
mov dword [eax], 0x9e4a0435
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002f694
xor eax, eax
push eax
lea ecx, [ebp - 0xb04]
call fcn.10016087
lea ecx, [ebp - 0xb04]
inc dword [eax]
call fcn.1001606b
lea ecx, [ebp - 0x678]
call fcn.1001606b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8dc]
call fcn.1001606b
push 3
mov dword [ebp - 0x30], 0xb26bdde0
mov dword [ebp - 0x30], 0xffffffe6
pop ebx
jmp 0x1002f7d1
mov dword [ebp - 0x20], 0x23ed15de
lea ecx, [ebp - 0x7c8]
push ebx
call fcn.10015fe6
xor eax, eax
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002f73d
push dword [ebp - 0x18]
lea ecx, [ebp - 0x7c8]
call fcn.10016087
mov dword [eax], 0x545ee28f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002f71f
xor eax, eax
mov dword [ebp - 0x20], 0xfb6318d5
mov dword [ebp - 0x20], 0x13
cmp dword [ebp - 0x20], 0xf
jle 0x1002f7bf
jmp 0x1002f755
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002f775
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe0], 0xc04ccb63
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002f75d
xor eax, eax
mov dword [ebp - 0xe0], eax
jmp 0x1002f79c
cmp dword [ebp - 0x30], eax
jne 0x1002f7a5
push eax
lea ecx, [ebp - 0x7c8]
call fcn.10016087
mov ecx, dword [ebp - 0x20]
push 0
mov dword [eax], ecx
dec dword [ebp - 0xe0]
pop eax
cmp dword [ebp - 0xe0], 0xfffffffe
jg 0x1002f77d
push esi
lea ecx, [ebp - 0x7c8]
call fcn.10016087
cmp dword [eax], 0
jne 0x1002f7bf
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xf
jg 0x1002f753
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c8]
call fcn.1001606b
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1002f6fb
push 2
pop ebx
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x48], 0xd0e75d
mov dword [ebp - 0x1c], 0xa2b82c44
mov dword [ebp - 0x30], 0x5248
push esi
call fcn.10015fe6
mov dword [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x18], eax
jmp 0x1002f830
push dword [ebp - 0x18]
call fcn.10016087
mov dword [eax], esi
inc dword [ebp - 0x18]
lea ecx, [ebp - 0xac]
cmp dword [ebp - 0x18], esi
jl 0x1002f823
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x30], 0x8e503485
push eax
call fcn.10016087
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], eax
jg 0x1002fc36
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x4c], 0xf12afbca
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x50], eax
push dword [ebp - 0x48]
call fcn.10016087
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0xac]
push dword [ebp - 0x48]
call fcn.10016087
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
lea ecx, [ebp - 0xac]
setge dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
imul eax, edx, 0x6cad
sub eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x48]
call fcn.10016087
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xac]
neg eax
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
call fcn.10016087
cmp dword [eax], 0xe0c80d67
je 0x1002f90f
mov eax, dword [ebp - 0x4c]
push dword [ebp - 0x48]
lea ecx, [ebp - 0xac]
call fcn.10016087
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x4c], ecx
imul eax, dword [ebp - 0x4c], 0x906e
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], eax
jg 0x1002fc24
mov dword [ebp - 0x5c], 0xfffffffe
mov dword [ebp - 0x14], 0x8eb26348
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x5c], eax
xor eax, eax
cmp dword [ebp - 0x5c], eax
je 0x1002f981
push eax
lea ecx, [ebp - 0xac]
call fcn.10016087
cmp dword [eax], 0
je 0x1002f97f
xor eax, eax
lea esi, [eax + 1]
jmp 0x1002f983
xor eax, eax
mov esi, eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xac]
call fcn.10016087
push dword [ebp - 0x48]
xor ebx, ebx
lea ecx, [ebp - 0xac]
cmp dword [eax], ebx
setle bl
call fcn.10016087
xor ecx, ecx
cmp dword [eax], esi
mov eax, dword [ebp - 0x50]
setne cl
xor edx, edx
cmp ebx, ecx
setg dl
sub eax, edx
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], eax
jl 0x1002fc16
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x54], 0xb75e0bd0
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1002f9fa
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f9f5
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x1002f9e3
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x1002fc0d
mov dword [ebp - 0x3c], 0x16fbb122
lea ecx, [ebp - 0xac]
push dword [ebp - 0x4c]
call fcn.10016087
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x40], eax
jl 0x1002fa26
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x4c], eax
je 0x1002fa3a
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002fa3c
lea esi, [eax + 1]
jmp 0x1002fa3e
xor eax, eax
mov esi, eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xac]
call fcn.10016087
push dword [ebp - 0x48]
xor ebx, ebx
lea ecx, [ebp - 0xac]
cmp dword [eax], esi
setg bl
call fcn.10016087
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp ebx, ecx
setl dl
cmp dword [eax], edx
jle 0x1002fa89
push dword [ebp - 0x48]
lea ecx, [ebp - 0xac]
call fcn.10016087
cmp dword [eax], 0
je 0x1002fa89
xor eax, eax
lea esi, [eax + 1]
jmp 0x1002fa8d
xor eax, eax
mov esi, eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0xac]
call fcn.10016087
xor ebx, ebx
lea ecx, [ebp - 0xac]
cmp esi, dword [eax]
setge bl
xor eax, eax
push eax
call fcn.10016087
mov ecx, dword [ebp - 0x38]
sub ebx, ecx
push dword [ebp - 0x40]
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
xor ebx, ebx
cmp ecx, 0xffffffff
lea ecx, [ebp - 0xac]
setle bl
call fcn.10016087
mov ecx, dword [ebp - 0x1c]
mov esi, eax
xor eax, eax
cmp ebx, ecx
mov ecx, dword [ebp - 0x5c]
setl al
xor edx, edx
cmp eax, ecx
setg dl
xor eax, eax
mov dword [esi], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002fbff
mov dword [ebp - 0x24], 0xab487867
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x1002fbf6
push dword [ebp - 0x48]
lea ecx, [ebp - 0xac]
call fcn.10016087
xor ecx, ecx
cmp dword [eax], 2
sete cl
add ecx, 0x439e
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0xac]
push dword [ebp - 0x40]
call fcn.10016087
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor ebx, ebx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0xac]
setle bl
call fcn.10016087
push dword [ebp - 0x48]
xor ecx, ecx
cmp dword [eax], ebx
setl cl
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0xac]
call fcn.10016087
mov edx, dword [ebp - 0x54]
xor ecx, ecx
cmp dword [eax], edx
setge cl
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0xac]
push dword [ebp - 0x40]
call fcn.10016087
mov ecx, dword [ebp - 0x14]
xor edx, edx
push dword [ebp - 0x48]
cmp ecx, dword [eax]
lea ecx, [ebp - 0xac]
setg dl
sub edx, 0x691f75fc
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x54], edx
call fcn.10016087
mov ecx, dword [ebp - 0x54]
xor ebx, ebx
push dword [ebp - 0x40]
cmp ecx, dword [eax]
lea ecx, [ebp - 0xac]
sete bl
call fcn.10016087
xor ecx, ecx
cmp dword [eax], ebx
setge cl
mov dword [ebp - 0x54], ecx
dec dword [ebp - 0x28]
jns 0x1002fb0b
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002faf8
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x1002fa06
xor eax, eax
dec dword [ebp - 0x40]
jns 0x1002f9cd
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
jle 0x1002f94c
xor eax, eax
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], eax
jle 0x1002f885
xor esi, esi
push 2
inc esi
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
call fcn.1001606b
mov dword [ebp - 0x20], 0xfffffffa
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffe
cmp dword [ebp - 0x20], 0xffffffe4
jle 0x1002fca5
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002fc82
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe78], 0xdf251d69
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002fc6a
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002fc9b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002fc98
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x1002fc87
dec dword [ebp - 0x20]
jmp 0x1002fc55
mov dword [ebp - 0x20], 0xaa810d21
mov dword [ebp - 0x28], 0x469ad59e
mov dword [ebp - 0x50], 0x1a0c844f
mov dword [ebp - 0x34], 0x4fa75558
mov dword [ebp - 0x3c], 0xfd6e
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002fcea
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x134], 0xfffffffe
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002fcd1
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002fd0a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc9c], 9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002fcf2
xor eax, eax
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x10030018
mov dword [ebp - 0x1c], 0x390197f0
mov dword [ebp - 0x20], 0x6de6b933
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1003000c
lea eax, [ebp - 0x1058]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x1068]
push eax
lea ecx, [ebp - 0x1348]
movdqu xmmword [ebp - 0x1068], xmm0
call fcn.10016096
lea ecx, [ebp - 0x181]
mov esi, eax
call fcn.10008ab3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x330]
push dword [esi]
call fcn.10016045
mov dword [ebp - 4], 0x17
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x134]
mov eax, dword [ebp - 0x28]
cmp ecx, dword [ebp + eax*4 - 0x134]
jne 0x1002ffe6
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x134]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x134], 0
je 0x1002fdb0
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x134]
mov eax, dword [ebp - 0x134]
sub eax, 0x6dd
cmp edx, eax
mov eax, dword [ebp - 0x28]
setge cl
cmp ecx, 0xffff
sbb ecx, ecx
neg ecx
cmp ecx, dword [ebp + eax*4 - 0x134]
jge 0x1002fdf3
xor eax, eax
cmp dword [ebp - 0x130], eax
je 0x1002fdf5
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x1002fdfa
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
push 2
lea ecx, [ebp - 0x330]
call fcn.10016087
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x134]
cmp esi, eax
mov eax, dword [ebp - 0x28]
setge cl
cmp ecx, dword [ebp + eax*4 - 0x134]
jle 0x1002ffe6
push 2
lea ecx, [ebp - 0x690]
call fcn.10015fe6
lea eax, [ebp - 0xf78]
mov byte [ebp - 4], 0x18
movdqa xmm0, xmmword [0x10007b10]
lea ecx, [ebp - 0x12c0]
push eax
lea eax, [ebp - 0xf88]
push eax
movdqu xmmword [ebp - 0xf88], xmm0
call fcn.10016096
lea ecx, [ebp - 0x182]
mov esi, eax
call fcn.10008ab3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xa5c]
push dword [esi]
call fcn.10016045
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002feb0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x690]
call fcn.10016087
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002fe91
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002ffc4
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x50], 0x26fbc79a
mov dword [ebp - 0x24], 0x70c0f3ad
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], eax
jl 0x1002ffbe
cmp dword [ebp - 0x28], eax
je 0x1002ff1d
push dword [ebp - 0x28]
lea ecx, [ebp - 0x330]
call fcn.10016087
push ebx
lea ecx, [ebp - 0x690]
mov esi, eax
call fcn.10016087
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x1002ff17
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x690]
push ebx
call fcn.10016087
mov ecx, dword [ebp - 0x50]
push dword [ebp - 0x1c]
mov dword [eax], ecx
lea ecx, [ebp - 0x330]
call fcn.10016087
mov ecx, dword [ebp - 0x20]
xor ebx, ebx
push 2
cmp dword [eax], ecx
lea ecx, [ebp - 0xa5c]
setl bl
call fcn.10016087
xor ecx, ecx
push 3
cmp ebx, dword [eax]
setl cl
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0xa5c]
call fcn.10016087
mov esi, dword [ebp - 0x134]
lea ecx, [ebp - 0x330]
push dword [ebp - 0x28]
mov eax, dword [eax]
add eax, dword [ebp - 0x24]
imul esi, eax
call fcn.10016087
xor ecx, ecx
push 2
cmp dword [eax], esi
setge cl
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x330]
call fcn.10016087
mov ecx, dword [ebp - 0x50]
push 0
imul ecx, dword [eax]
imul eax, ecx, 0xbf5c
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x14]
pop eax
push 1
pop ebx
jns 0x1002fedd
inc dword [ebp - 0x20]
push 1
pop ebx
cmp dword [ebp - 0x20], 3
jle 0x1002feb8
lea ecx, [ebp - 0xa5c]
call fcn.1001606b
lea ecx, [ebp - 0x690]
call fcn.1001606b
jmp 0x1002ffef
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x20], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x330]
call fcn.1001606b
dec dword [ebp - 0x1c]
jns 0x1002fd30
push 2
xor eax, eax
pop ebx
dec dword [ebp - 0x28]
jns 0x1002fd16
xor esi, esi
inc esi
inc dword [ebp - 0x3c]
mov dword [ebp - 0x4c], 0x367f5ed9
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x5c], 0x5ef1355
mov dword [ebp - 0x38], 0xd61c0642
mov dword [ebp - 0x24], 0x64d7eeac
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030056
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov dword [ebp - 0x2c], 0x13
jmp 0x100303a9
mov dword [ebp - 0x1c], esi
lea ecx, [ebp - 0x2e0]
mov dword [ebp - 0x18], esi
push 3
call fcn.10015fe6
xor eax, eax
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1003009e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5bc], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10030086
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x100300c6
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2e0]
call fcn.10016087
mov dword [eax], 4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x100300a7
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xc
je 0x10030397
push esi
lea ecx, [ebp - 0x2bc]
call fcn.10015fe6
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x8f4]
mov dword [ebp - 0x14], 0xec3203b
mov dword [ebp - 0x20], 0x855f075f
push esi
call fcn.10015fe6
xor eax, eax
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10030129
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2bc]
call fcn.10016087
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1003010b
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10030145
push dword [ebp - 0x28]
lea ecx, [ebp - 0x8f4]
call fcn.10016087
mov dword [eax], 0x6553ecf3
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1003012e
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2bc]
xor eax, eax
push eax
call fcn.10016087
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.10016087
xor ecx, ecx
cmp dword [eax], esi
setge cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x2c], eax
je 0x10030187
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2e0]
call fcn.1001606b
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 8
je 0x10030062
mov dword [ebp - 0x40], 0x9f6d4a0d
lea ecx, [ebp - 0xe94]
mov dword [ebp - 0x34], esi
xor eax, eax
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0x12b57e8b
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xfffffffb
push ebx
call fcn.10015fe6
mov dword [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x50], 0xffff
mov dword [ebp - 0x18], eax
jmp 0x10030410
push dword [ebp - 0x18]
call fcn.10016087
mov dword [eax], 0x162c9cc1
inc dword [ebp - 0x18]
lea ecx, [ebp - 0xe94]
cmp dword [ebp - 0x18], ebx
jl 0x100303ff
dec dword [ebp - 0x50]
or dword [ebp - 4], 0xffffffff
call fcn.1001606b
mov dword [ebp - 0x30], 0xfffffff7
lea ecx, [ebp - 0xd44]
mov dword [ebp - 0x1c], esi
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0x12b57e8b
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xfffffffb
push ebx
call fcn.10015fe6
mov dword [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x50], 0xffff
mov dword [ebp - 0x18], eax
jmp 0x10030487