Function at 0x1002ca26
Capabilities:
Capture screenshot
Compare security identifiers
Create process on windows
Delete directory
Extract resource via kernel32 functions
Get common file path
Get disk information
Get graphical window text
Get session user name
Get system information on windows
Modify service
Parse pe header
Query or enumerate registry key
Read .ini file

Disassembly:
mov eax, 0x10081c5d
call fcn.100801d0
mov eax, 0x1b4c
call fcn.1007c980
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
push 3
pop ebx
push 0
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x79], dl
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x20], ebx
pop eax
jmp 0x1002ca74
mov dword [ebp - 0x1c], 0xffffffff
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1002ca6c
push eax
call edi
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002ca7a
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffd
jle 0x1002ca57
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], ebx
jmp 0x1002ca9f
mov dword [ebp - 0x1c], 0xffffffff
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1002ca97
push eax
call edi
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002caa5
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffd
jle 0x1002ca82
mov dword [ebp - 0x34], 0x299d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1002cace
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12c8], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1002cab5
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002caee
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1300], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002cad6
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1002cb10
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
xor eax, eax
dec dword [ebp - 0x12fc]
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x20], eax
jmp 0x1002cb3a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x12d8], 0xc857617
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x1002cb29
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe7
jg 0x1002cd1e
xor esi, esi
push 1
lea ecx, [ebp - 0x400]
call fcn.10015917
push 4
lea ecx, [ebp - 0x1088]
mov dword [ebp - 4], esi
call fcn.10015917
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jge 0x1002cb9a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x400]
call fcn.100159b5
mov dword [eax], 0x22124f84
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1002cb7d
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002cbc4
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1088]
call fcn.100159b5
mov dword [eax], 0x80c6548a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002cba5
xor eax, eax
push eax
lea ecx, [ebp - 0x400]
call fcn.100159b5
xor ecx, ecx
push ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x400]
call fcn.100159b5
xor esi, esi
cmp dword [eax], 0xfffffff9
jne 0x1002ccf7
mov dword [ebp - 0x10], 0x25bfc88e
lea ecx, [ebp - 0x400]
mov dword [ebp - 0x28], 0x8d9dcee3
mov dword [ebp - 0x28], 2
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
push esi
call fcn.100159b5
mov edx, dword [ebp - 0x38]
xor ecx, ecx
imul edx, dword [eax]
mov eax, dword [ebp - 0x10]
cmp eax, edx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
setle cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x10]
jne 0x1002cc47
cmp dword [ebp - 0x38], eax
je 0x1002cc47
xor ecx, ecx
inc ecx
jmp 0x1002cc49
mov ecx, eax
mov eax, dword [ebp - 0x10]
sub eax, ecx
cmp eax, dword [ebp - 0x10]
jle 0x1002cc5f
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002cc61
xor ecx, ecx
inc ecx
jmp 0x1002cc63
xor eax, eax
mov ecx, eax
mov eax, 0x9978
sub eax, ecx
je 0x1002cc7b
mov dword [ebp - 0x1c], 0xefa97f51
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
jmp 0x1002ccd6
mov dword [ebp - 0x38], 3
xor eax, eax
cmp dword [ebp - 0x38], eax
jl 0x1002ccd6
mov dword [ebp - 0x10], eax
jmp 0x1002ccb2
mov dword [ebp - 0x28], eax
jmp 0x1002cca9
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1002cca6
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jle 0x1002cc93
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x1002cc8e
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1002ccd1
push 0x80
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
xor eax, eax
dec dword [ebp - 0x38]
jns 0x1002cc89
xor esi, esi
lea ecx, [ebp - 0x400]
push esi
call fcn.100159b5
push esi
lea ecx, [ebp - 0x400]
dec dword [eax]
call fcn.100159b5
jmp 0x1002cbe2
lea ecx, [ebp - 0x1088]
call fcn.10015999
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x400]
call fcn.10015999
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe7
jle 0x1002cb52
mov dword [ebp - 0x28], 0x4b283066
xor eax, eax
mov dword [ebp - 0x3c], 0x8d72a67f
mov dword [ebp - 0x20], 0xf1edd1ed
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
push 6
pop ecx
jge 0x1002cd56
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x16bc], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1002cd41
xor eax, eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1002cd67
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jne 0x1002cdaa
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x7bc9
setne al
mov dword [ebp - 0x16b8], eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x1002cdad
xor eax, eax
inc eax
mov ecx, 0xde467b47
cmp ecx, eax
mov eax, dword [ebp - 0x20]
push 3
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setge dl
xor ebx, ebx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setge bl
xor ecx, ecx
add ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ebx, eax
pop eax
setl cl
mov dword [ebp - 0x20], ecx
push 5
mov dword [ebp - 0x38], eax
pop ecx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xfffffffd
push 7
pop ebx
jg 0x1002d5b5
xor eax, eax
jmp 0x1002cdff
push 5
pop ecx
mov dword [ebp - 0x44], ecx
xor ebx, ebx
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0xc3c]
inc ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0xb4ef66b1
mov dword [ebp - 0x34], 0xdd7770b1
push 4
call fcn.10015917
mov dword [ebp - 4], esi
lea ecx, [ebp - 0xde0]
mov dword [ebp - 0x34], 0x6d065835
mov dword [ebp - 0x3c], 0x1afe
push ebx
call fcn.10015917
xor eax, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002ce6d
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc3c]
call fcn.100159b5
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002ce52
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1002ce95
push dword [ebp - 0x10]
lea ecx, [ebp - 0xde0]
call fcn.100159b5
mov dword [eax], 1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1002ce76
xor eax, eax
push 0xfffffffffffffff6
pop ecx
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], 4
jge 0x1002d0ca
jmp 0x1002cea9
xor eax, eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x930]
mov dword [ebp - 0x1c], 0xffffffff
push 1
call fcn.10015917
xor eax, eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x20], eax
jmp 0x1002cee2
push dword [ebp - 0x20]
lea ecx, [ebp - 0x930]
call fcn.100159b5
mov dword [eax], 0xf985589b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x1002cecb
mov dword [ebp - 0x2c], esi
jmp 0x1002d080
push 4
lea ecx, [ebp - 0x2ec]
call fcn.10015917
push 5
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0xc24]
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x34], 0xfffffffd
push 4
call fcn.10015917
push 6
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x34], 0xbb30
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002cf4f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x174c], 0xac453072
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002cf36
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], eax
inc ebx
cmp dword [ebp - 0x10], 4
jge 0x1002cf76
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2ec]
call fcn.100159b5
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002cf5b
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002cf92
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc24]
call fcn.100159b5
mov dword [eax], 0x18c9a01c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002cf7b
push ebx
lea ecx, [ebp - 0x2ec]
call fcn.100159b5
push ebx
lea ecx, [ebp - 0x2ec]
and dword [eax], 0
call fcn.100159b5
jmp 0x1002d054
mov dword [ebp - 0x34], 0x6c902da
xor eax, eax
mov dword [ebp - 0x34], 0xc3d069f4
mov dword [ebp - 0x20], eax
jmp 0x1002cfde
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x12e8], 0x9acd4098
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x1002cfcd
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0x2ec]
push 1
call fcn.100159b5
xor ebx, ebx
lea ecx, [ebp - 0xc3c]
inc ebx
push ebx
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x174c]
mov eax, dword [ebp - 0x3c]
imul esi, eax
call fcn.100159b5
lea ecx, [ebp - 0x930]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.100159b5
push ebx
lea ecx, [ebp - 0x2ec]
mov esi, eax
call fcn.100159b5
push ebx
mov ecx, dword [eax]
mov dword [esi], ecx
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x2ec]
call fcn.100159b5
push ebx
lea ecx, [ebp - 0x2ec]
inc dword [eax]
call fcn.100159b5
push 2
pop esi
cmp dword [eax], esi
jle 0x1002cfb8
xor eax, eax
lea ecx, [ebp - 0xc24]
cmp dword [ebp - 0x40], eax
jne 0x1002d08c
call fcn.10015999
lea ecx, [ebp - 0x2ec]
mov byte [ebp - 4], 4
call fcn.10015999
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x10
jl 0x1002cef0
jmp 0x1002d0a0
call fcn.10015999
lea ecx, [ebp - 0x2ec]
mov byte [ebp - 4], 4
call fcn.10015999
xor ebx, ebx
lea ecx, [ebp - 0xde0]
push ebx
call fcn.100159b5
lea ecx, [ebp - 0x930]
mov byte [ebp - 4], 3
call fcn.10015999
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 4
jl 0x1002cea7
lea ecx, [ebp - 0xde0]
call fcn.10015999
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc3c]
call fcn.10015999
movdqa xmm0, xmmword [0x10007c30]
lea eax, [ebp - 0x1358]
push eax
lea eax, [ebp - 0x1368]
mov dword [ebp - 0x24], 0xffffffff
push eax
lea ecx, [ebp - 0x19d0]
movdqu xmmword [ebp - 0x1368], xmm0
call fcn.100159c4
lea ecx, [ebp - 0x169]
mov esi, eax
call fcn.10008cf3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1e0]
push dword [esi]
call fcn.10015973
push 7
pop ebx
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x1c], 0x8cdac369
mov dword [ebp - 0x34], 0x1a2c
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], eax
jl 0x1002d2e9
mov dword [ebp - 0x28], 0xe8c9f369
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1002d177
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor eax, eax
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], eax
jl 0x1002d2dd
mov dword [ebp - 0x40], 0x51d77f17
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x20], eax
jmp 0x1002d1ab
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1948], 0xfffffff8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002d19a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1e0]
call fcn.100159b5
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1e0]
call fcn.100159b5
cmp dword [ebp - 0x40], 3
sbb ecx, ecx
xor edx, edx
neg ecx
cmp dword [eax], ecx
setne dl
mov dword [ebp - 0x1948], edx
mov eax, dword [ebp - 0x28]
sub edx, eax
je 0x1002d1ec
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1e0]
call fcn.100159b5
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp dword [eax], ecx
setg dl
add edx, 0x7bb456e
cmp edx, 0xffffffff
jle 0x1002d227
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1e0]
call fcn.100159b5
xor ebx, ebx
cmp dword [eax], ebx
jne 0x1002d229
mov eax, ebx
jmp 0x1002d22c
xor ebx, ebx
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x1e0]
push dword [ebp - 0x10]
call fcn.100159b5
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, 0xbbda73a1
setne dl
xor ecx, ecx
cmp edx, 0x25bb5a27
setle cl
imul ecx, dword [eax]
mov eax, dword [ebp - 0x10]
add eax, ecx
jne 0x1002d274
push ebx
lea ecx, [ebp - 0x1e0]
call fcn.100159b5
cmp dword [eax], ebx
jne 0x1002d274
mov esi, ebx
jmp 0x1002d277
xor esi, esi
inc esi
push 3
lea ecx, [ebp - 0x1e0]
call fcn.100159b5
mov ecx, dword [ebp - 0x10]
sub esi, ecx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1e0]
sub esi, dword [eax]
neg esi
sbb esi, esi
inc esi
call fcn.100159b5
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp esi, ecx
lea ecx, [ebp - 0x1e0]
sete dl
xor ebx, ebx
cmp edx, 0x7a540f82
setge bl
add ebx, dword [ebp - 0x10]
push dword [ebp - 0x28]
imul ebx, dword [eax]
call fcn.100159b5
xor ecx, ecx
push 0
cmp dword [eax], ebx
pop eax
setge cl
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 0x28]
jns 0x1002d187
dec dword [ebp - 0x10]
jns 0x1002d15f
push 7
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e0]
call fcn.10015999
mov dword [ebp - 0x10], 0x824a8c6a
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x1002d347
push 0x1008
push 0x41e
push 0x3b2
push 0x1fd8
push 0x92d
push 0x1652
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff5
je 0x1002d429
push 3
lea ecx, [ebp - 0x8b0]
call fcn.10015917
mov dword [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x18], 0x9974082
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x20], eax
jmp 0x1002d38e
push dword [ebp - 0x20]
call fcn.100159b5
mov dword [eax], 0x968939f5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
lea ecx, [ebp - 0x8b0]
jl 0x1002d37d
push 2
call fcn.100159b5
push 2
lea ecx, [ebp - 0x8b0]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
call fcn.100159b5
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x3c]
test eax, eax
jne 0x1002d3c4
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x8b0]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push 2
call fcn.100159b5
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp ecx, 1
mov esi, eax
mov ecx, dword [ebp - 0x3c]
setl dl
xor eax, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x18]
setge al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x8b0]
setne dl
xor eax, eax
sub edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x10]
cmp edx, dword [esi]
setge al
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
call fcn.10015999
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff5
jne 0x1002d354
xor eax, eax
mov byte [ebp - 0x11], al
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x40], 0xec51938d
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002d45e
push 0xfffffffffffffff6
pop ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xfd0], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002d449
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002d543
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1002d48e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x89c], 1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x1002d475
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jg 0x1002d514
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002d4bc
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x16d4], 0xfc0233fd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002d4a3
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002d4e8
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x16cc]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x89c], eax
mov eax, dword [ebp - 0xfd0]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x30]
jle 0x1002d4e6
xor eax, eax
inc eax
jmp 0x1002d4e8
xor eax, eax
cmp eax, dword [ebp - 0x30]
jg 0x1002d4f4
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002d4f7
xor eax, eax
inc eax
mov dword [ebp - 0x40], eax
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp eax, 0xfffffff8
push 0
setle cl
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 1
pop eax
jle 0x1002d497
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1002d540
push 0x254
push eax
push eax
push 0x485
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 1
jle 0x1002d466
cmp byte [ebp - 0x11], 0
je 0x1002d59e
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002d57b
push 5
pop ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1794], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002d566
xor eax, eax
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], eax
jl 0x1002d59b
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x1794], 0
jne 0x1002d599
dec dword [ebp - 0x20]
jns 0x1002d587
xor eax, eax
push eax
call edi
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002d5b5
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffffd
push 2
pop esi
jle 0x1002cdfc
push 1
lea ecx, [ebp - 0xdbc]
call fcn.10015917
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x18], 0xdb2bc40e
mov dword [ebp - 0x1c], 0x2d91
push 2
pop ecx
mov dword [ebp - 0xb0c], ecx
mov dword [ebp - 0xb08], ecx
mov dword [ebp - 0xb04], ecx
mov dword [ebp - 0xb00], ecx
mov dword [ebp - 0x40], 0xe7071658
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1002d626
push dword [ebp - 0x10]
lea ecx, [ebp - 0xdbc]
call fcn.100159b5
mov dword [eax], 0x7e17f759
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1002d604
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002d646
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x51c], 0xa1650187
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d62e
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1002d664
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6c8], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1002d64f
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002d679
push 0xf86
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov dword [ebp - 0xb0c], 0x13e1
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
imul eax, dword [ebp - 0x1c], 0x13e1
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x18]
setg cl
sub eax, ecx
jne 0x1002d6b1
cmp dword [ebp - 0x51c], eax
jne 0x1002d6b3
mov edi, eax
jmp 0x1002d6b6
xor eax, eax
xor edi, edi
inc edi
push eax
lea ecx, [ebp - 0xdbc]
call fcn.100159b5
mov ecx, dword [ebp - 0x51c]
xor edx, edx
cmp edi, ecx
mov esi, eax
mov ecx, dword [ebp - 0x51c]
sete dl
xor eax, eax
cmp edx, ecx
setg al
add eax, 0x4e5857e6
imul eax, dword [esi]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
dec dword [esi]
test eax, eax
je 0x1002d6f8
mov eax, dword [ebp - 0xb0c]
mov eax, dword [ebp - 0x518]
lea ecx, [ebp - 0xdbc]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x8a973314
sbb eax, eax
inc eax
mov dword [ebp - 0x6c8], eax
or dword [ebp - 4], 0xffffffff
call fcn.10015999
xor eax, eax
mov dword [ebp - 0x34], 0x299d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1002d74b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12f4], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1002d732
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ebx
cmp dword [ebp - 0x10], ebx
jge 0x1002d76e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1200], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d756
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002d790
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
xor eax, eax
dec dword [ebp - 0x11fc]
mov dword [ebp - 0x28], 0x4b283066
mov dword [ebp - 0x3c], 0x8d72a67f
mov dword [ebp - 0x20], 0xf1edd1ed
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002d7ca
push 6
pop ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x16ec], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002d7b6
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002d7db
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jne 0x1002d81e
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x7bc9
setne al
mov dword [ebp - 0x16e8], eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x1002d821
xor eax, eax
inc eax
mov ecx, 0xde467b47
cmp ecx, eax
mov eax, dword [ebp - 0x20]
push 5
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setge dl
xor ebx, ebx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setge bl
xor ecx, ecx
add ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ebx, eax
pop eax
setl cl
xor ebx, ebx
mov dword [ebp - 0x20], ecx
inc ebx
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0xc6c]
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0xb4ef66b1
mov dword [ebp - 0x34], 0xdd7770b1
push 4
call fcn.10015917
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0xec4]
mov dword [ebp - 0x34], 0x6d065835
mov dword [ebp - 0x3c], 0x1afe
push ebx
call fcn.10015917
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002d8ca
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc6c]
call fcn.100159b5
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002d8af
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1002d8f2
push dword [ebp - 0x10]
lea ecx, [ebp - 0xec4]
call fcn.100159b5
mov dword [eax], 1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1002d8d3
xor eax, eax
push 0xfffffffffffffff6
pop ecx
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], 4
jge 0x1002db23
jmp 0x1002d906
xor eax, eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0xad4]
mov dword [ebp - 0x1c], 0xffffffff
push 1
call fcn.10015917
xor eax, eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x20], eax
jmp 0x1002d93f
push dword [ebp - 0x20]
lea ecx, [ebp - 0xad4]
call fcn.100159b5
mov dword [eax], 0xf985589b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x1002d928
mov dword [ebp - 0x2c], esi
jmp 0x1002dad9
push 4
lea ecx, [ebp - 0x304]
call fcn.10015917
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xc54]
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x34], 0xfffffffd
push 4
call fcn.10015917
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x34], 0xbb30
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002d9a8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1764], 0xac453072
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002d98f
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], eax
inc ebx
cmp dword [ebp - 0x10], 4
jge 0x1002d9cf
push dword [ebp - 0x10]
lea ecx, [ebp - 0x304]
call fcn.100159b5
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002d9b4
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002d9eb
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc54]
call fcn.100159b5
mov dword [eax], 0x18c9a01c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002d9d4
push ebx
lea ecx, [ebp - 0x304]
call fcn.100159b5
push ebx
lea ecx, [ebp - 0x304]
and dword [eax], 0
call fcn.100159b5
jmp 0x1002daad
mov dword [ebp - 0x34], 0x6c902da
xor eax, eax
mov dword [ebp - 0x34], 0xc3d069f4
mov dword [ebp - 0x20], eax
jmp 0x1002da37
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1304], 0x9acd4098
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x1002da26
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0x304]
push 1
call fcn.100159b5
xor ebx, ebx
lea ecx, [ebp - 0xc6c]
inc ebx
push ebx
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x1764]
mov eax, dword [ebp - 0x3c]
imul esi, eax
call fcn.100159b5
lea ecx, [ebp - 0xad4]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.100159b5
push ebx
lea ecx, [ebp - 0x304]
mov esi, eax
call fcn.100159b5
push ebx
mov ecx, dword [eax]
mov dword [esi], ecx
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x304]
call fcn.100159b5
push ebx
lea ecx, [ebp - 0x304]
inc dword [eax]
call fcn.100159b5
push 2
pop esi
cmp dword [eax], esi
jle 0x1002da11
xor eax, eax
lea ecx, [ebp - 0xc54]
cmp dword [ebp - 0x40], eax
jne 0x1002dae5
call fcn.10015999
lea ecx, [ebp - 0x304]
mov byte [ebp - 4], 0xc
call fcn.10015999
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x10
jl 0x1002d94d
jmp 0x1002daf9
call fcn.10015999
lea ecx, [ebp - 0x304]
mov byte [ebp - 4], 0xc
call fcn.10015999
xor ebx, ebx
lea ecx, [ebp - 0xec4]
push ebx
call fcn.100159b5
lea ecx, [ebp - 0xad4]
mov byte [ebp - 4], 0xb
call fcn.10015999
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 4
jl 0x1002d904
lea ecx, [ebp - 0xec4]
call fcn.10015999
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc6c]
call fcn.10015999
movdqa xmm0, xmmword [0x10007c30]
lea eax, [ebp - 0x1578]
push 3
pop ebx
push eax
lea eax, [ebp - 0x1588]
mov dword [ebp - 0x2c], ebx
push eax
lea ecx, [ebp - 0x18e8]
movdqu xmmword [ebp - 0x1588], xmm0
call fcn.100159c4
lea ecx, [ebp - 0x1bd]
mov esi, eax
call fcn.10008cf3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x288]
push dword [esi]
call fcn.10015973
mov dword [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x1c], 0x8cdac369
mov dword [ebp - 0x34], 0x1a2c
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x1002dd39
mov dword [ebp - 0x28], 0xe8c9f369
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002dbcc
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor eax, eax
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x1002dd30
mov dword [ebp - 0x40], 0x51d77f17
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x20], eax
jmp 0x1002dbfc
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1960], 0xfffffff8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002dbeb
push dword [ebp - 0x10]
lea ecx, [ebp - 0x288]
call fcn.100159b5
push dword [ebp - 0x28]
lea ecx, [ebp - 0x288]
call fcn.100159b5
cmp dword [ebp - 0x40], ebx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp dword [eax], ecx
setne dl
mov dword [ebp - 0x1960], edx
mov eax, dword [ebp - 0x28]
sub edx, eax
je 0x1002dc3c
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x288]
call fcn.100159b5
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp dword [eax], ecx
setg dl
add edx, 0x7bb456e
cmp edx, 0xffffffff
jle 0x1002dc77
push dword [ebp - 0x28]
lea ecx, [ebp - 0x288]
call fcn.100159b5
xor ebx, ebx
cmp dword [eax], ebx
jne 0x1002dc79
mov eax, ebx
jmp 0x1002dc7c
xor ebx, ebx
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x288]
push dword [ebp - 0x10]
call fcn.100159b5
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, 0xbbda73a1
setne dl
xor ecx, ecx
cmp edx, 0x25bb5a27
setle cl
imul ecx, dword [eax]
mov eax, dword [ebp - 0x10]
add eax, ecx
jne 0x1002dcc4
push ebx
lea ecx, [ebp - 0x288]
call fcn.100159b5
cmp dword [eax], ebx
jne 0x1002dcc4
mov esi, ebx
jmp 0x1002dcc7
xor esi, esi
inc esi
push 3
lea ecx, [ebp - 0x288]
call fcn.100159b5
mov ecx, dword [ebp - 0x10]
sub esi, ecx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x288]
sub esi, dword [eax]
neg esi
sbb esi, esi
inc esi
call fcn.100159b5
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp esi, ecx
lea ecx, [ebp - 0x288]
sete dl
xor ebx, ebx
cmp edx, 0x7a540f82
setge bl
add ebx, dword [ebp - 0x10]
push dword [ebp - 0x28]
imul ebx, dword [eax]
call fcn.100159b5
xor ecx, ecx
push 0
cmp dword [eax], ebx
pop eax
setge cl
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 0x28]
push 3
pop ebx
jns 0x1002dbd8
dec dword [ebp - 0x10]
jns 0x1002dbb4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x288]
call fcn.10015999
mov dword [ebp - 0x2c], ebx
jmp 0x1002e65c
mov dword [ebp - 0x10], 0x824a8c6a
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002dd9b
push 0x1008
push 0x41e
push 0x3b2
push 0x1fd8
push 0x92d
push 0x1652
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff5
je 0x1002de7b
push ebx
lea ecx, [ebp - 0x770]
call fcn.10015917
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x18], 0x9974082
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x20], eax
jmp 0x1002dde1
push dword [ebp - 0x20]
call fcn.100159b5
mov dword [eax], 0x968939f5
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x770]
cmp dword [ebp - 0x20], ebx
jl 0x1002ddd0
push 2
call fcn.100159b5
push 2
lea ecx, [ebp - 0x770]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
call fcn.100159b5
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x3c]
test eax, eax
jne 0x1002de16
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x770]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push 2
call fcn.100159b5
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp ecx, 1
mov esi, eax
mov ecx, dword [ebp - 0x3c]
setl dl
xor eax, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x18]
setge al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x770]
setne dl
xor eax, eax
sub edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x10]
cmp edx, dword [esi]
setge al
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
call fcn.10015999
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff5
jne 0x1002dda8
xor eax, eax
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x40], 0xec51938d
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002deb4
push 0xfffffffffffffff6
pop ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x12f0], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002de9f
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002df93
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1002dee4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8a4], 1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x1002decb
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jg 0x1002df68
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002df10
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1704], 0xfc0233fd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002def8
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002df3c
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x16fc]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x12f0]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x30]
jle 0x1002df3a
xor eax, eax
inc eax
jmp 0x1002df3c
xor eax, eax
cmp eax, dword [ebp - 0x30]
jg 0x1002df48
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002df4b
xor eax, eax
inc eax
mov dword [ebp - 0x40], eax
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp eax, 0xfffffff8
push 0
setle cl
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 1
pop eax
jle 0x1002deed
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002df90
push 0x254
push eax
push eax
push 0x485
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 1
jle 0x1002debc
push ebx
lea ecx, [ebp - 0x860]
call fcn.10015917
push ebx
lea ecx, [ebp - 0xdd4]
mov dword [ebp - 4], 0x11
call fcn.10015917
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x30], 0xae73598
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x1002dfeb
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x324], 0xb4e1
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
jl 0x1002dfd2
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x1002e011
push dword [ebp - 0x38]
lea ecx, [ebp - 0x860]
call fcn.100159b5
mov dword [eax], 0xb0b44cf5
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1002dff3
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x1002e037
push dword [ebp - 0x38]
lea ecx, [ebp - 0xdd4]
call fcn.100159b5
mov dword [eax], 0xa6001648
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1002e019
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x1002e04d
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1978], 0xdbc2a41b
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
jl 0x1002e03c
dec dword [ebp - 0x31c]
lea ecx, [ebp - 0x860]
mov esi, dword [ebp - 0x31c]
sub esi, 0x6c9c
neg esi
sbb esi, esi
xor ebx, ebx
inc ebx
inc esi
push ebx
call fcn.100159b5
mov dword [eax], esi
test esi, esi
je 0x1002e0aa
push ebx
lea ecx, [ebp - 0x860]
call fcn.100159b5
mov eax, dword [ebp - 0x320]
lea ecx, [ebp - 0x860]
xor eax, eax
push eax
call fcn.100159b5
mov dword [eax], 0xfffc
xor eax, eax
inc eax
jmp 0x1002e0ac
xor eax, eax
mov ecx, dword [ebp - 0x324]
xor edx, edx
imul ecx, dword [ebp - 0x31c]
push ebx
imul ecx, eax
mov eax, dword [ebp - 0x31c]
add ecx, eax
mov eax, dword [ebp - 0x318]
cmp ecx, eax
mov eax, dword [ebp - 0x31c]
mov esi, dword [ebp - 0x320]
setl dl
xor ecx, ecx
cmp eax, edx
setge cl
add esi, ecx
lea ecx, [ebp - 0xdd4]
call fcn.100159b5
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x31c]
cmp esi, eax
setg cl
imul eax, ecx, 0x3488
xor ecx, ecx
cmp eax, 0xfffffffb
setl cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x31c]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, dword [ebp - 0x1978]
jle 0x1002e1a7
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe2
jge 0x1002e1e3
push 8
pop ecx
mov dword [ebp - 0x56c], ecx
mov dword [ebp - 0x568], ecx
mov dword [ebp - 0x564], ecx
mov dword [ebp - 0x560], ecx
mov dword [ebp - 0x56c], eax
cmp dword [ebp - 0x56c], 2
jg 0x1002e194
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e182
push 0x5fa
push eax
push 0x1e06
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
xor eax, eax
inc dword [ebp - 0x56c]
cmp dword [ebp - 0x56c], 2
jle 0x1002e163
push 8
pop ecx
cmp dword [ebp - 0x564], eax
jne 0x1002e1e3
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe2
jl 0x1002e13c
jmp 0x1002e1e3
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002e1cb
push 0x14e4
push 0x1ea
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e1e3
push 0x2001
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
lea ecx, [ebp - 0xdd4]
call fcn.10015999
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x860]
call fcn.10015999
xor eax, eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 0x11], al
push ebx
call fcn.10015917
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 4], 0x13
lea ecx, [ebp - 0x1a60]
movdqa xmm0, xmmword [0x10007c50]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1378]
push eax
lea eax, [ebp - 0x1388]
mov dword [ebp - 0x40], 0x54c97515
push eax
movdqu xmmword [ebp - 0x1388], xmm0
call fcn.100159c4
lea ecx, [ebp - 0x151]
mov esi, eax
call fcn.10008cf3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x10a0]
push dword [esi]
call fcn.10015973
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1002e297
push dword [ebp - 0x20]
lea ecx, [ebp - 0x418]
call fcn.100159b5
mov dword [eax], 1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x1002e278
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x1002e351
push 1
lea ecx, [ebp - 0x478]
call fcn.10015917
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1002e2dd
push dword [ebp - 0x20]
lea ecx, [ebp - 0x478]
call fcn.100159b5
push 6
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x1002e2bf
xor eax, eax
push eax
lea ecx, [ebp - 0x478]
call fcn.100159b5
xor ebx, ebx
mov dword [eax], ebx
jmp 0x1002e324
push ebx
call fcn.100159b5
lea ecx, [ebp - 0x418]
push dword [eax]
call fcn.100159b5
push dword [ebp - 0x10]
lea ecx, [ebp - 0x418]
mov esi, eax
call fcn.100159b5
mov ecx, dword [esi]
push ebx
mov dword [eax], ecx
lea ecx, [ebp - 0x478]
call fcn.100159b5
inc dword [eax]
push ebx
lea ecx, [ebp - 0x478]
call fcn.100159b5
lea ecx, [ebp - 0x478]
cmp dword [eax], ebx
jle 0x1002e2ef
mov byte [ebp - 4], 0x14
call fcn.10015999
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1002e2a3
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x1002e3e7
mov dword [ebp - 0x1c], 0x7ef5d870
lea ecx, [ebp - 0x418]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x10]
call fcn.100159b5
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
push dword [ebp - 0x10]
cmp dword [eax], ecx
lea ecx, [ebp - 0x418]
sete bl
call fcn.100159b5
push 0
lea ecx, [ebp - 0x418]
cmp dword [eax], ebx
pop ebx
setge bl
xor eax, eax
push eax
call fcn.100159b5
sub ebx, dword [eax]
mov eax, dword [ebp - 0x40]
sub ebx, eax
je 0x1002e3d0
mov dword [ebp - 0x1c], 4
lea ecx, [ebp - 0x10a0]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], eax
push 3
call fcn.100159b5
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
jmp 0x1002e3de
mov dword [ebp - 0x1c], 0xf8716b5b
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002e3e7
dec dword [ebp - 0x10]
jns 0x1002e35d
lea ecx, [ebp - 0x10a0]
call fcn.10015999
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x418]
call fcn.10015999
cmp byte [ebp - 0x11], 0
je 0x1002e609
push 0xfffffffffffffff9
mov dword [ebp - 0x20], 8
xor eax, eax
pop esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], eax
jmp 0x1002e430
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1314], 0xc857617
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x1002e41f
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x20], eax
jmp 0x1002e5f6
push 1
lea ecx, [ebp - 0x4d8]
call fcn.10015917
push 4
lea ecx, [ebp - 0x12c4]
mov dword [ebp - 4], 0x16
call fcn.10015917
xor eax, eax
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1002e490
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4d8]
call fcn.100159b5
mov dword [eax], 0x22124f84
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1002e471
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002e4b8
push dword [ebp - 0x10]
lea ecx, [ebp - 0x12c4]
call fcn.100159b5
mov dword [eax], 0x80c6548a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002e499
xor eax, eax
push eax
lea ecx, [ebp - 0x4d8]
call fcn.100159b5
xor ebx, ebx
mov dword [eax], ebx
jmp 0x1002e5c5
mov dword [ebp - 0x10], 0x25bfc88e
lea ecx, [ebp - 0x4d8]
mov dword [ebp - 0x28], 0x8d9dcee3
mov dword [ebp - 0x28], 2
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
push ebx
call fcn.100159b5
mov edx, dword [ebp - 0x38]
xor ecx, ecx
imul edx, dword [eax]
mov eax, dword [ebp - 0x10]
cmp eax, edx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
setle cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x10]
jne 0x1002e529
cmp dword [ebp - 0x38], eax
je 0x1002e529
xor ecx, ecx
inc ecx
jmp 0x1002e52b
mov ecx, eax
mov eax, dword [ebp - 0x10]
sub eax, ecx
cmp eax, dword [ebp - 0x10]
jle 0x1002e541
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002e543
xor ecx, ecx
inc ecx
jmp 0x1002e545
xor eax, eax
mov ecx, eax
mov eax, 0x9978
sub eax, ecx
je 0x1002e55d
mov dword [ebp - 0x1c], 0xefa97f51
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
jmp 0x1002e5b5
push 3
pop ebx
mov dword [ebp - 0x38], ebx
xor eax, eax
cmp dword [ebp - 0x38], eax
jl 0x1002e5b5
mov dword [ebp - 0x10], eax
jmp 0x1002e592
mov dword [ebp - 0x28], eax
jmp 0x1002e58a
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e587
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x1002e574
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1002e56f
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e5b0
push 0x80
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
xor eax, eax
dec dword [ebp - 0x38]
jns 0x1002e56a
xor ebx, ebx
lea ecx, [ebp - 0x4d8]
push ebx
call fcn.100159b5
dec dword [eax]
push ebx
lea ecx, [ebp - 0x4d8]
call fcn.100159b5
cmp dword [eax], esi
je 0x1002e4cd
lea ecx, [ebp - 0x12c4]
call fcn.10015999
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d8]
call fcn.10015999
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe7
jle 0x1002e441
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xor eax, eax
mov dword [ebp - 0x20], 1
push 3
mov dword [ebp - 0x20], eax
pop ebx
cmp dword [ebp - 0x20], ebx
jge 0x1002e634
push 5
pop ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x17c4], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002e620
xor eax, eax
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], eax
jl 0x1002e654
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x17c4], 0
jne 0x1002e652
dec dword [ebp - 0x20]
jns 0x1002e640
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1002e666
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffffd
jle 0x1002dd50
mov dword [ebp - 0x44], 0x571177e8
lea ecx, [ebp - 0x10b8]
push 2
call fcn.10015917
xor eax, eax
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002e6ab
push dword [ebp - 0x20]
lea ecx, [ebp - 0x10b8]
call fcn.100159b5
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002e68c
xor eax, eax
mov ebx, dword [sym.imp.GDI32.dll_MoveToEx]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffef
jl 0x1002e7be
xor eax, eax
inc eax
xor ecx, ecx
mov dword [ebp - 0x2c], 0x1e2c0d37
mov dword [ebp - 0x2c], ecx
jmp 0x1002e7a8
mov dword [ebp - 0x24], 0x4f147909
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jl 0x1002e788
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 4
jge 0x1002e704
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb8c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002e6ee
xor eax, eax
inc eax
mov dword [ebp - 0xb8c], ecx
jmp 0x1002e777
mov dword [ebp - 0x18], 0x7979b389
mov byte [ebp - 0x11], cl
cmp byte [ebp - 0x11], 0
je 0x1002e738
push ecx
push 0xe34
push 0x1fd5
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
inc eax
xor ecx, ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jl 0x1002e771
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e767
push 0x1df1
push 0xf3a
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002e742
xor eax, eax
inc eax
xor ecx, ecx
inc dword [ebp - 0xb8c]
cmp dword [ebp - 0xb8c], eax
jle 0x1002e70c
dec dword [ebp - 0x24]
jns 0x1002e6e5
mov byte [ebp - 0x11], cl
cmp byte [ebp - 0x11], 0
je 0x1002e7a5
push 0x503
push ecx
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
inc eax
xor ecx, ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x1002e6d2
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xffffffef
jge 0x1002e6c3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10b8]
call fcn.10015999
push 1
lea ecx, [ebp - 0xc84]
call fcn.10015917
mov dword [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x18], 0xdb2bc40e
mov dword [ebp - 0x1c], 0x2d91
push 2
pop ecx
mov dword [ebp - 0xb2c], ecx
mov dword [ebp - 0xb28], ecx
mov dword [ebp - 0xb24], ecx
mov dword [ebp - 0xb20], ecx
mov dword [ebp - 0x40], 0xe7071658
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1002e83e
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc84]
call fcn.100159b5
mov dword [eax], 0x7e17f759
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1002e81c
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002e85e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x52c], 0xa1650187
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002e846
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1002e880
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8c4], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1002e867
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e895
push 0xf86
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov dword [ebp - 0xb2c], 0x13e1
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
imul eax, dword [ebp - 0x1c], 0x13e1
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x18]
setg cl
sub eax, ecx
jne 0x1002e8cd
cmp dword [ebp - 0x52c], eax
jne 0x1002e8cf
mov edi, eax
jmp 0x1002e8d2
xor eax, eax
xor edi, edi
inc edi
push eax
lea ecx, [ebp - 0xc84]
call fcn.100159b5
mov ecx, dword [ebp - 0x52c]
mov esi, eax
xor eax, eax
cmp edi, ecx
mov ecx, dword [ebp - 0x52c]
sete al
xor edx, edx
cmp eax, ecx
setg dl
add edx, 0x4e5857e6
imul edx, dword [esi]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
dec dword [esi]
test eax, eax
je 0x1002e915
mov eax, dword [ebp - 0xb2c]
mov eax, dword [ebp - 0x528]
lea ecx, [ebp - 0xc84]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x8a973314
sbb eax, eax
inc eax
mov dword [ebp - 0x8c4], eax
or dword [ebp - 4], 0xffffffff
call fcn.10015999
xor eax, eax
mov dword [ebp - 0x34], 0x299d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1002e968
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1338], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1002e94f
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002e98a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1218], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002e971
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e9ac
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
xor eax, eax
dec dword [ebp - 0x1214]
mov dword [ebp - 0x10], 0x824a8c6a
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002e9fc
push 0x1008
push 0x41e
push 0x3b2
push 0x1fd8
push 0x92d
push 0x1652
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002eacd
push 3
lea ecx, [ebp - 0x788]
call fcn.10015917
mov dword [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x18], 0x9974082
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x20], eax
jmp 0x1002ea3e
push dword [ebp - 0x20]
call fcn.100159b5
mov dword [eax], 0x968939f5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
lea ecx, [ebp - 0x788]
jl 0x1002ea2d
push 2
call fcn.100159b5
push 2
lea ecx, [ebp - 0x788]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
call fcn.100159b5
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x3c]
test eax, eax
jne 0x1002ea74
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x788]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push 2
call fcn.100159b5
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp ecx, 1
mov esi, eax
mov ecx, dword [ebp - 0x3c]
setl dl
xor eax, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x18]
setge al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x788]
setne dl
xor eax, eax
sub edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x10]
cmp edx, dword [esi]
setge al
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
call fcn.10015999
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff5
jne 0x1002ea04
mov dword [ebp - 0x44], 0x571177e8
lea ecx, [ebp - 0x10c8]
push 2
call fcn.10015917
xor eax, eax
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002eb1c
push dword [ebp - 0x20]
lea ecx, [ebp - 0x10c8]
call fcn.100159b5
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002eafd
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffef
jl 0x1002ec29
xor eax, eax
inc eax
xor ecx, ecx
mov dword [ebp - 0x2c], 0x1e2c0d37
mov dword [ebp - 0x2c], ecx
jmp 0x1002ec13
mov dword [ebp - 0x24], 0x4f147909
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jl 0x1002ebf3
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 4
jge 0x1002eb6f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xbcc], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002eb59
xor eax, eax
inc eax
mov dword [ebp - 0xbcc], ecx
jmp 0x1002ebe2
mov dword [ebp - 0x18], 0x7979b389
mov byte [ebp - 0x11], cl
cmp byte [ebp - 0x11], 0
je 0x1002eba3
push ecx
push 0xe34
push 0x1fd5
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
inc eax
xor ecx, ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jl 0x1002ebdc
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002ebd2
push 0x1df1
push 0xf3a
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002ebad
xor eax, eax
inc eax
xor ecx, ecx
inc dword [ebp - 0xbcc]
cmp dword [ebp - 0xbcc], eax
jle 0x1002eb77
dec dword [ebp - 0x24]
jns 0x1002eb50
mov byte [ebp - 0x11], cl
cmp byte [ebp - 0x11], 0
je 0x1002ec10
push 0x503
push ecx
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
inc eax
xor ecx, ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x1002eb3d
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xffffffef
jge 0x1002eb2e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10c8]
call fcn.10015999
push 1
lea ecx, [ebp - 0xe64]
call fcn.10015917
mov dword [ebp - 4], 0x1c
xor eax, eax
mov dword [ebp - 0x18], 0xdb2bc40e
mov dword [ebp - 0x1c], 0x2d91
push 2
pop ebx
mov dword [ebp - 0xb4c], ebx
mov dword [ebp - 0xb48], ebx
mov dword [ebp - 0xb44], ebx
mov dword [ebp - 0xb40], ebx
mov dword [ebp - 0x40], 0xe7071658
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1002eca6
push dword [ebp - 0x10]
lea ecx, [ebp - 0xe64]
call fcn.100159b5
mov dword [eax], 0x7e17f759
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1002ec87
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002ecc6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x544], 0xa1650187
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002ecae
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1002ece8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6a8], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1002eccf
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002ecfd
push 0xf86
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov dword [ebp - 0xb4c], 0x13e1
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
imul eax, dword [ebp - 0x1c], 0x13e1
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x18]
setg cl
sub eax, ecx
jne 0x1002ed35
cmp dword [ebp - 0x544], eax
jne 0x1002ed37
mov edi, eax
jmp 0x1002ed3a
xor eax, eax
xor edi, edi
inc edi
push eax
lea ecx, [ebp - 0xe64]
call fcn.100159b5
mov ecx, dword [ebp - 0x544]
mov esi, eax
xor eax, eax
cmp edi, ecx
mov ecx, dword [ebp - 0x544]
sete al
xor edx, edx
cmp eax, ecx
setg dl
add edx, 0x4e5857e6
imul edx, dword [esi]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
dec dword [esi]
test eax, eax
je 0x1002ed7d
mov eax, dword [ebp - 0xb4c]
mov eax, dword [ebp - 0x540]
lea ecx, [ebp - 0xe64]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x8a973314
sbb eax, eax
or edi, 0xffffffff
inc eax
mov dword [ebp - 0x6a8], eax
mov dword [ebp - 4], edi
call fcn.10015999
mov dword [ebp - 0x28], 0xab3921de
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x294], eax
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x10], 0x606dc068
mov dword [ebp - 0x30], 0x1e7ff518
mov dword [ebp - 0x18], 0xe70d5dd2
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], 0xe8ba
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28c], eax
test eax, eax
jne 0x1002ee71
mov eax, dword [ebp - 0x28c]
add eax, dword [ebp - 0x28]
jne 0x1002ee0d
mov eax, dword [ebp - 0x290]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x298], ecx
mov eax, dword [ebp - 0x28]
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xe4cf
mov eax, dword [ebp - 0x30]
setne cl
xor edx, edx
cmp ecx, eax
setge dl
xor ecx, ecx
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
add edx, 0x6b6ebaff
cmp edx, eax
setg cl
cmp ecx, edi
je 0x1002ee6e
mov eax, dword [ebp - 0x28c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setl dl
imul edx, dword [ebp - 0x30]
test edx, edx
jne 0x1002eea0
xor eax, eax
cmp dword [ebp - 0x28c], eax
jne 0x1002eea0
mov ecx, eax
jmp 0x1002eea3
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x10]
add ecx, 0x501314d4
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setl bl
xor ecx, ecx
cmp ebx, eax
setge cl
add ecx, 3
jne 0x1002eed6
xor eax, eax
cmp dword [ebp - 0x28c], eax
je 0x1002eed9
xor eax, eax
inc eax
mov edx, dword [ebp - 0x28]
add edx, eax
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor eax, eax
neg edx
xor ebx, ebx
mov dword [ebp - 0x38], edx
inc ebx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 8
jle 0x1002f11d
mov dword [ebp - 0x2c], 0xb047c147
mov dword [ebp - 0x44], 0xed6
mov dword [ebp - 0x20], 0x66c3c348
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x48], eax
push 5
pop eax
mov dword [ebp - 0xf18], eax
mov dword [ebp - 0xf14], eax
mov dword [ebp - 0xf10], eax
mov dword [ebp - 0xf0c], eax
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x1002ef71
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x10], eax
je 0x1002ef71
xor esi, esi
xor ebx, ebx
inc esi
inc ebx
jmp 0x1002ef73
mov esi, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x30]
cmp eax, 0x2f47d66a
mov eax, dword [ebp - 0x2c]
setl cl
xor edx, edx
cmp esi, ecx
setle dl
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
imul ecx, dword [ebp - 0x44]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
je 0x1002f044
movdqa xmm0, xmmword [0x10007c00]
lea eax, [ebp - 0x14d8]
push eax
lea eax, [ebp - 0x14e8]
push eax
lea ecx, [ebp - 0x18f8]
movdqu xmmword [ebp - 0x14e8], xmm0
call fcn.100159c4
lea ecx, [ebp - 0x153]
mov esi, eax
call fcn.10008cf3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1334]
push dword [esi]
call fcn.10015973
xor eax, eax
mov dword [ebp - 4], 0x1d
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002f00b
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push ebx
lea ecx, [ebp - 0x1334]
call fcn.100159b5
mov edx, dword [ebp - 0x20]
mov esi, eax
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp edx, ecx
mov dword [ebp - 4], edi
setl al
xor ecx, ecx
cmp eax, 0x443a54d8
setne cl
neg ecx
mov dword [esi], ecx
lea ecx, [ebp - 0x1334]
call fcn.10015999
jmp 0x1002f0a4
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x40], 0xaf445564
cmp dword [ebp - 0x44], eax
jne 0x1002f074
cmp dword [ebp - 0x24], eax
je 0x1002f074
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
neg eax
je 0x1002f074
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, 0x3086
setle cl
dec ecx
jne 0x1002f095
xor eax, eax
cmp dword [ebp - 0x290], eax
jne 0x1002f095
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x1002f097
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x40], ecx
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002f0b0
mov eax, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002f0bc
cmp dword [ebp - 0x30], eax
je 0x1002f0bc
mov eax, ebx
mov edx, dword [ebp - 0x2c]
sub edx, eax
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x28c], edx
mov eax, dword [ebp - 0x48]
cmp edx, eax
mov eax, dword [ebp - 0xf18]
setl cl
xor edx, edx
cmp ecx, 8
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setne cl
add eax, 0x8280
cmp eax, ecx
jne 0x1002f103
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x28c], eax
je 0x1002f105
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
add eax, ecx
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 8
push 0
pop eax
jg 0x1002ef21
mov dword [ebp - 0x34], 0x299d
mov edi, 0xbaf43b7c
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 0xede0b407
mov dword [ebp - 0x34], 0xf0aa6e6f
mov dword [ebp - 0x34], 0xfad5
mov dword [ebp - 0x34], 0xb43d2717
mov dword [ebp - 0x1c], 0xd2e9
mov dword [ebp - 0x20], eax
jmp 0x1002f168
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x358], 0x48c66f5a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002f157
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x19e8]
mov eax, dword [ebp - 0x358]
movdqa xmm0, xmmword [0x10007ca0]
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1398]
push eax
lea eax, [ebp - 0x13a8]
push eax
movdqu xmmword [ebp - 0x13a8], xmm0
call fcn.100159c4
lea ecx, [ebp - 0x155]
mov esi, eax
call fcn.10008cf3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1650]
push dword [esi]
call fcn.10015973
mov dword [ebp - 0x18], 0x82bd7b1c
xor eax, eax
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x18], eax
jl 0x1002f23e
mov dword [ebp - 0x20], 0xffffffff
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f20e
push eax
push 0xb39
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002f233
mov dword [ebp - 0x1c], 0x865925ef
dec dword [ebp - 0x1c]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f230
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x1002f213
dec dword [ebp - 0x18]
jns 0x1002f1e1
lea ecx, [ebp - 0x1650]
call fcn.10015999
mov dword [ebp - 0x34], edi
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 0xede0b407
mov dword [ebp - 0x34], 0xf0aa6e6f
mov dword [ebp - 0x34], 0xfad5
mov dword [ebp - 0x34], 0xb43d2717
mov dword [ebp - 0x1c], 0xd2e9
mov dword [ebp - 0x20], eax
jmp 0x1002f28a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x3a4], 0x48c66f5a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002f279
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x40], eax
or edi, 0xffffffff
mov dword [ebp - 0x3c], 0xd816f93b
mov dword [ebp - 0x1c], 0xfc657863
mov dword [ebp - 0x18], 0x850270f9
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x20], eax
jmp 0x1002f2eb
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x914], 0xcf5aa05
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002f2da
inc dword [ebp - 0x3c]
xor edx, edx
mov dword [ebp - 0x1c], 0x3dec995f
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x90c]
setge dl
xor ecx, ecx
push 0xfffffffffffffff8
pop esi
cmp eax, esi
mov eax, dword [ebp - 0x18]
setne cl
imul edx, ecx
imul eax, edx
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002f330
cmp dword [ebp - 0x40], eax
je 0x1002f332
mov eax, ebx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x910]
mov edx, dword [ebp - 0x3c]
sub edx, eax
mov eax, dword [ebp - 0x908]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x90c]
sete cl
xor edx, edx
cmp ecx, 0x3e91cb64
setg dl
sub edx, eax
add edx, 0x385d06f6
cmp edx, 3
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x908], ecx
mov eax, dword [ebp - 0x24]
add eax, ecx
jns 0x1002f38b
xor eax, eax
cmp dword [ebp - 0x908], eax
je 0x1002f38b
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
inc ecx
cmp ecx, eax
setg dl
xor ecx, ecx
cmp edx, ebx
setg cl
xor eax, eax
cmp ecx, 0xb0f7
setne al
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002f3cc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10bc], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002f3bb
mov dword [ebp - 0x3c], 0xccddd1d8
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0x4cb8
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x3c], 0x3b1a
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x1c]
jg 0x1002f420
mov dword [ebp - 0x1c], ebx
inc dword [ebp - 0x1c]
jmp 0x1002f493
push 3
lea ecx, [ebp - 0xa98]
call fcn.10015917
xor eax, eax
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002f45a
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa98]
call fcn.100159b5
push 3
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002f43f
push 2
lea ecx, [ebp - 0xa98]
call fcn.100159b5
push 2
lea ecx, [ebp - 0xa98]
mov esi, eax
call fcn.100159b5
mov ecx, dword [esi]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0xa98]
mov dword [ebp - 4], edi
call fcn.10015999
push 0xfffffffffffffff8
pop esi
xor eax, eax
mov dword [ebp - 0x20], 0xf18c9a01
mov dword [ebp - 0x10], eax
jmp 0x1002f4b2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1230], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002f4a1
push ebx
lea ecx, [ebp - 0x264]
call fcn.10015917
mov dword [ebp - 4], 0x1f
lea ecx, [ebp - 0xa14]
xor eax, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x40], eax
push 3
call fcn.10015917
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x8f0]
xor eax, eax
mov dword [ebp - 0x3c], 0x7d1a
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0xff06982b
push ebx
call fcn.10015917
mov byte [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x1c], 0xce404d46
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002f536
push dword [ebp - 0x10]
lea ecx, [ebp - 0x264]
call fcn.100159b5
mov dword [eax], 0xbbf9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002f518
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002f55e
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa14]
call fcn.100159b5
mov dword [eax], 0x19d81479
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002f53f
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002f580
push dword [ebp - 0x10]
lea ecx, [ebp - 0x8f0]
call fcn.100159b5
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002f566
xor eax, eax
push eax
lea ecx, [ebp - 0x264]
call fcn.100159b5
lea ecx, [ebp - 0x264]
cmp dword [eax], 0xbb9cf7d1
sbb esi, esi
xor eax, eax
push eax
neg esi
call fcn.100159b5
cmp esi, dword [eax]
jg 0x1002f5d2
xor eax, eax
lea ecx, [ebp - 0x264]
push eax
call fcn.100159b5
xor ecx, ecx
cmp dword [eax], ecx
jne 0x1002f5d4
push ecx
lea ecx, [ebp - 0x264]
call fcn.100159b5
xor ecx, ecx
cmp dword [eax], ecx
jne 0x1002f5d4
mov eax, ebx
jmp 0x1002f5d6
xor ecx, ecx
mov eax, ecx
push ecx
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x264]
call fcn.100159b5
mov ecx, dword [ebp - 0x1c]
mov esi, eax
xor eax, eax
mov edx, 0xfffe
sub edx, ecx
mov ecx, dword [ebp - 0x18]
cmp edx, ecx
setl al
xor ecx, ecx
cmp eax, ebx
setle cl
xor eax, eax
cmp ecx, dword [esi]
lea ecx, [ebp - 0x264]
setl al
mov dword [ebp - 0x24], eax
xor eax, eax
push eax
call fcn.100159b5
xor edx, edx
push ebx
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0xa14]
setg dl
add esi, edx
call fcn.100159b5
xor ebx, ebx
lea ecx, [ebp - 0x8f0]
cmp esi, dword [ebp - 0x24]
mov dword [eax], esi
setl bl
xor eax, eax
push eax
call fcn.100159b5
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x40]
cmp ebx, eax
setne cl
test ecx, ecx
jne 0x1002f681
xor ebx, ebx
lea ecx, [ebp - 0x8f0]
push ebx
call fcn.100159b5
cmp dword [eax], ebx
je 0x1002f681
xor esi, esi
inc esi
xor eax, eax
jmp 0x1002f685
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x264]
call fcn.100159b5
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp esi, ecx
push 5
sete dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, 0xb4b72b41
setl cl
cmp eax, ecx
pop ecx
sbb eax, eax
xor ebx, ebx
neg eax
cmp eax, ecx
lea ecx, [ebp - 0x264]
setg bl
xor eax, eax
push eax
call fcn.100159b5
lea ecx, [ebp - 0x8f0]
mov eax, dword [eax]
imul eax, ebx
mov dword [ebp - 0x1c], eax
xor eax, eax
push eax
call fcn.100159b5
xor ebx, ebx
lea ecx, [ebp - 0xa14]
inc ebx
mov esi, eax
push ebx
call fcn.100159b5
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0x8f0]
call fcn.10015999
lea ecx, [ebp - 0xa14]
call fcn.10015999
lea ecx, [ebp - 0x264]
mov dword [ebp - 4], edi
call fcn.10015999
xor eax, eax
mov byte [ebp - 0x11], al
mov dword [ebp - 0x10], 0x824a8c6a
mov dword [ebp - 0x40], 0x2715ee56
push 8
pop ecx
mov dword [ebp - 0xbac], ecx
mov dword [ebp - 0xba8], ecx
mov dword [ebp - 0xba4], ecx
mov dword [ebp - 0xba0], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002f762
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1320], 0x4d92
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002f74a
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002f7f1
mov dword [ebp - 0x20], 0x1d69f428
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x14
je 0x1002f7ee
push 3
lea ecx, [ebp - 0xc9c]
call fcn.10015917
xor eax, eax
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x2c], eax
jmp 0x1002f7ad
push dword [ebp - 0x2c]
call fcn.100159b5
mov dword [eax], 0xa61f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
lea ecx, [ebp - 0xc9c]
jl 0x1002f79c
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.100159b5
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], edi
mov dword [eax], ecx
lea ecx, [ebp - 0xc9c]
call fcn.10015999
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x14
jne 0x1002f781
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jne 0x1002f76a
mov eax, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0xba0]
mov ecx, ebx
sub ecx, eax
mov eax, dword [ebp - 0xba4]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
push 6
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
dec ecx
cmp ecx, 9
pop ecx
setl al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, ebx
setg cl
sub eax, ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x10], eax
cmp byte [ebp - 0x11], 0
je 0x1002f8b5
xor eax, eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002f874
push 5
pop ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x10e0], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002f85f
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jg 0x1002f89c
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + eax*4 - 0x10e0]
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x10e0], ecx
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 2
jle 0x1002f87d
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
jmp 0x1002f8bb
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
movdqa xmm0, xmmword [0x10007d00]
lea eax, [ebp - 0x15d8]
push eax
lea eax, [ebp - 0x15e8]
push eax
lea ecx, [ebp - 0x1908]
movdqu xmmword [ebp - 0x15e8], xmm0
call fcn.100159c4
lea ecx, [ebp - 0x157]
mov esi, eax
call fcn.10008cf3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xdec]
push dword [esi]
call fcn.10015973
xor eax, eax
mov dword [ebp - 4], 0x23
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002f92b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa4], 0xd4081c29
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002f913
xor eax, eax
mov dword [ebp - 0xa4], eax
jmp 0x1002f95b
push dword [ebp - 0xa4]
call fcn.100159b5
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xdec]
mov esi, eax
call fcn.100159b5
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [ebp - 0xa4]
cmp dword [ebp - 0xa4], 3
lea ecx, [ebp - 0xdec]
jle 0x1002f933
or dword [ebp - 4], 0xffffffff
call fcn.10015999
dec dword [ebp - 0x122c]
lea ecx, [ebp - 0x10f8]
mov dword [ebp - 0x44], 0x571177e8
push 2
call fcn.10015917
xor eax, eax
mov dword [ebp - 4], 0x24
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002f9be