Function at 0x1002d5bf
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Delete directory
Get common file path
Get disk size
Get file size
Get file system object information
Get graphical window text
Get keyboard layout
Identify system language via api
Modify service
Parse pe header
Query service status
Read .ini file
Resume thread

Disassembly:
mov eax, 0x1007a91a
call fcn.10079240
mov eax, 0x1634
call fcn.100759f0
movdqa xmm0, xmmword [0x10007b30]
lea eax, [ebp - 0xf90]
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xfa0]
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x38], 0x40d7f825
lea ecx, [ebp - 0x1500]
push eax
mov byte [ebp - 0x79], dl
movdqu xmmword [ebp - 0xfa0], xmm0
call fcn.10016596
lea ecx, [ebp - 0x1c4]
mov esi, eax
call fcn.10008b13
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xe40]
push dword [esi]
call fcn.10016545
xor eax, eax
mov dword [ebp - 4], eax
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x48], 0xf69a0165
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002d662
push eax
push 0x588
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x1002d9ad
movdqa xmm0, xmmword [0x10007b80]
lea eax, [ebp - 0x11d0]
push eax
lea eax, [ebp - 0x11e0]
push eax
lea ecx, [ebp - 0x1438]
movdqu xmmword [ebp - 0x11e0], xmm0
call fcn.10016596
lea ecx, [ebp - 0x231]
mov esi, eax
call fcn.10008b13
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x370]
push dword [esi]
call fcn.10016545
xor eax, eax
lea ecx, [ebp - 0xc5c]
inc eax
mov byte [ebp - 4], al
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop eax
mov dword [ebp - 0x28], 0x81eca6c8
push eax
call fcn.100164e9
push 2
pop ecx
xor eax, eax
mov byte [ebp - 4], cl
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002d703
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc5c]
call fcn.10016587
push 2
mov dword [eax], 7
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x1002d6e2
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002d71c
push eax
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
xor eax, eax
mov dword [ebp - 0x14], eax
push 3
pop eax
cmp dword [ebp - 0x14], eax
jg 0x1002d98f
mov dword [ebp - 0x1c], 0xa445a8cc
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x30], 0x58e9d28b
push dword [ebp - 0x14]
call fcn.10016587
xor ecx, ecx
cmp dword [eax], 0xec21
mov eax, dword [ebp - 0x14]
sete cl
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x28], ecx
inc eax
push eax
lea ecx, [ebp - 0x370]
call fcn.10016587
mov edx, dword [ebp - 0x28]
mov esi, eax
mov ecx, dword [ebp - 0x38]
xor eax, eax
cmp edx, ecx
lea ecx, [ebp - 0x370]
setge al
imul eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
cmp dword [esi], eax
setge bl
xor eax, eax
inc eax
push eax
call fcn.10016587
push dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [eax]
add eax, ebx
cmp eax, 0xfffffffd
setne cl
imul edi, ecx, 0x2b4b
lea ecx, [ebp - 0x370]
call fcn.10016587
push dword [ebp - 0x14]
lea ecx, [ebp - 0x370]
mov esi, eax
call fcn.10016587
mov ecx, dword [esi]
push 3
add ecx, dword [eax]
xor eax, eax
cmp ecx, edi
pop ecx
setne al
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x1002d977
jmp 0x1002d7f0
xor eax, eax
mov dword [ebp - 0x4c], 0xd28e4879
mov dword [ebp - 0x28], 0xa0c09020
mov dword [ebp - 0x3c], 0x3de76903
mov dword [ebp - 0x30], 0x5c8bb6af
cmp dword [ebp - 0x38], eax
je 0x1002d842
cmp dword [ebp - 0x14], eax
je 0x1002d822
cmp dword [ebp - 0x4c], eax
je 0x1002d822
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x1002d825
xor ebx, ebx
inc ebx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x3c]
test eax, eax
je 0x1002d840
mov edi, ebx
jmp 0x1002d847
xor eax, eax
xor ebx, ebx
mov edi, eax
inc ebx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x370]
call fcn.10016587
push dword [ebp - 0x14]
lea ecx, [ebp - 0x370]
mov esi, eax
call fcn.10016587
push 3
mov ecx, dword [eax]
pop eax
mov dword [esi], ecx
lea ecx, [ebp - 0xe40]
push eax
call fcn.10016587
xor ecx, ecx
mov edx, 0x5fcb
cmp edi, edx
push 3
mov dword [eax], edx
setge cl
xor eax, eax
cmp dword [esi], ecx
pop ecx
sete al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
jl 0x1002d96e
push ecx
mov dword [ebp - 0x30], 0x1d67a3d5
lea ecx, [ebp - 0xe28]
call fcn.100164e9
push 3
pop ecx
xor eax, eax
mov byte [ebp - 4], cl
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002d8f0
push ecx
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe28]
call fcn.10016587
mov dword [eax], 0xe776e9f8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002d8cc
xor ebx, ebx
xor eax, eax
push 3
inc ebx
pop ecx
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jl 0x1002d951
jmp 0x1002d8fd
push 3
pop ecx
push ecx
lea ecx, [ebp - 0x910]
call fcn.100164e9
xor eax, eax
mov byte [ebp - 4], 4
push 3
mov dword [ebp - 0x18], eax
pop esi
jmp 0x1002d928
push dword [ebp - 0x18]
call fcn.10016587
mov dword [eax], 0x6e2e31b5
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x910]
cmp dword [ebp - 0x18], esi
jl 0x1002d917
push ebx
call fcn.10016587
push 3
lea ecx, [ebp - 0x910]
inc dword [eax]
pop eax
mov byte [ebp - 4], al
call fcn.1001656b
dec dword [ebp - 0x3c]
jns 0x1002d8fa
push 2
pop eax
lea ecx, [ebp - 0xe28]
mov byte [ebp - 4], al
call fcn.1001656b
dec dword [ebp - 0x48]
push 3
pop ecx
jns 0x1002d8a7
dec dword [ebp - 0x1c]
jns 0x1002d7ee
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x1002d72b
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, dword [sym.imp.USER32.dll_GetDC]
lea ecx, [ebp - 0xc5c]
call fcn.1001656b
xor eax, eax
lea ecx, [ebp - 0x370]
mov byte [ebp - 4], al
call fcn.1001656b
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x1d
je 0x1002d66a
or esi, 0xffffffff
lea ecx, [ebp - 0xe40]
mov dword [ebp - 4], esi
call fcn.1001656b
mov dword [ebp - 0x20], 0xfffffff9
xor edx, edx
mov dword [ebp - 0x14], 0x915a
inc edx
xor eax, eax
mov dword [ebp - 0x1c], edx
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002da01
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x458], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002d9e9
xor eax, eax
mov dword [ebp - 0x14], 0x8ec0ae97
mov dword [ebp - 0x14], eax
jmp 0x1002db51
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x458]
cmp dword [ebp - 0x34], eax
jne 0x1002da2e
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x454]
xor ecx, ecx
cmp eax, 0x4bcd
setne cl
cmp ecx, dword [ebp - 0x14]
jge 0x1002da54
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x458], 0
jne 0x1002da54
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x458]
cmp eax, edx
setge cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp eax, 0x6eab3cf8
setl cl
cmp ecx, 0xeec54165
jbe 0x1002db19
xor edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x458]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
cmp eax, edx
setle cl
cmp ecx, edx
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffea
jg 0x1002db4e
push 2
pop ecx
cmp dword [ebp - 0x24], eax
jne 0x1002db4b
mov dword [ebp - 0x34], eax
jmp 0x1002db09
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002dae4
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x24], eax
jmp 0x1002db01
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002dafe
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x1002dae9
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jle 0x1002dacf
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffea
jle 0x1002dac1
jmp 0x1002db4b
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002db30
push 0x4a8
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002db4b
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor edx, edx
inc edx
inc dword [ebp - 0x14]
push 2
pop eax
cmp dword [ebp - 0x14], eax
jle 0x1002da10
mov dword [ebp - 0x30], 0xfffffff8
lea ecx, [ebp - 0xc74]
mov dword [ebp - 0x38], edx
push 4
call fcn.100164e9
mov dword [ebp - 4], 5
xor ecx, ecx
inc ecx
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002dbb8
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc74]
call fcn.10016587
push 4
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002db98
xor ecx, ecx
xor eax, eax
inc ecx
push 3
mov dword [ebp - 0x18], eax
pop edx
jmp 0x1002dbec
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jl 0x1002dbe9
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002dbde
push eax
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002dbcb
xor ecx, ecx
push 3
inc ecx
pop edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x1002dbc0
lea ecx, [ebp - 0xc74]
mov dword [ebp - 4], esi
call fcn.1001656b
push 3
pop eax
mov dword [ebp - 0x30], 0xe704f3d4
lea ecx, [ebp - 0xc8c]
push eax
call fcn.100164e9
mov dword [ebp - 4], 6
xor ecx, ecx
mov dword [ebp - 0x20], 8
inc ecx
xor eax, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002dc58
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc8c]
call fcn.10016587
push 3
mov dword [eax], 0x7571177e
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x1002dc34
xor ecx, ecx
xor eax, eax
inc ecx
push 2
pop esi
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1002dd8c
push ecx
lea ecx, [ebp - 0x470]
call fcn.100164e9
push 7
pop eax
mov byte [ebp - 4], al
xor ecx, ecx
mov dword [ebp - 0x30], 0x8f6efba1
xor eax, eax
mov dword [ebp - 0x30], 0xfffffffa
inc ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002dcb5
push dword [ebp - 0x14]
lea ecx, [ebp - 0x470]
call fcn.10016587
mov dword [eax], 0xe2c0d37a
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002dc94
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002dcd8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x15c0], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002dcc0
xor eax, eax
push eax
lea ecx, [ebp - 0x470]
call fcn.10016587
and dword [eax], 0
jmp 0x1002dd43
xor eax, eax
mov dword [ebp - 0x30], ecx
inc eax
lea ecx, [ebp - 0xe58]
push eax
call fcn.100164e9
xor eax, eax
mov byte [ebp - 4], 8
mov dword [ebp - 0x18], eax
jmp 0x1002dd17
push dword [ebp - 0x18]
call fcn.10016587
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x18]
xor eax, eax
lea ecx, [ebp - 0xe58]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x1002dd06
inc dword [ebp - 0x28]
push 7
pop eax
mov byte [ebp - 4], al
call fcn.1001656b
xor eax, eax
lea ecx, [ebp - 0x470]
push eax
call fcn.10016587
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x470]
push eax
call fcn.10016587
push 2
pop ecx
cmp dword [eax], ecx
jle 0x1002dce9
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002dd6e
push 0x16c0
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
lea ecx, [ebp - 0x470]
mov byte [ebp - 4], 6
call fcn.1001656b
dec dword [ebp - 0x20]
push 1
pop ecx
jns 0x1002dc67
push 2
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0xc8c]
mov dword [ebp - 4], eax
call fcn.1001656b
mov dword [ebp - 0x30], 0xfffffffe
xor ecx, ecx
mov dword [ebp - 0x30], 6
inc ecx
mov dword [ebp - 0x30], ecx
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x40], 0x9dc86695
mov dword [ebp - 0x30], 0xf9a4d91f
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x30], 0x89be67e7
mov dword [ebp - 0x30], 0x33c8a0c0
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], 0x52783de7
mov dword [ebp - 0x4c], 0xffeac8e4
mov dword [ebp - 0x28], eax
push 3
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x1002de25
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe70], 0xd7f825e7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002de0d
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x1002de45
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x132c], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002de2d
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1002df85
or esi, 0xffffffff
mov dword [ebp - 0x1c], 0xb3b9da4d
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x44], 0x57257ea0
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x74], 0xfffffffb
mov dword [ebp - 0x70], 0xfffffffb
mov dword [ebp - 0x6c], 0xfffffffb
mov dword [ebp - 0x68], 0xfffffffb
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1002deaf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe70], 0x3ff82ff4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002de97
xor eax, eax
cmp dword [ebp - 0xe68], eax
je 0x1002df13
mov dword [ebp - 0x30], 0x135e1f6f
push ecx
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0xca4]
mov dword [ebp - 0x30], 0x32456160
call fcn.100164e9
push 9
pop ecx
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], eax
jmp 0x1002def8
push dword [ebp - 0x18]
call fcn.10016587
mov dword [eax], 0xc2184e5a
inc dword [ebp - 0x18]
xor eax, eax
lea ecx, [ebp - 0xca4]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x1002dee7
inc dword [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.1001656b
jmp 0x1002df70
mov dword [ebp - 0x28], 0x9ce07b88
xor edx, edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x44]
add eax, 0x951f1b00
add ecx, eax
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x1324]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setle cl
xor eax, eax
shl ecx, 2
cmp ecx, 0x6ca241e2
setge al
sub eax, 0x996d
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x20]
push 0
pop eax
push 1
pop ecx
push 3
pop edx
jns 0x1002de54
push 2
pop esi
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], 0xe704f3d4
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x40], 0x9dc86695
mov dword [ebp - 0x30], 0xf9a4d91f
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x30], 0x89be67e7
mov dword [ebp - 0x30], 0x33c8a0c0
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], 0x52783de7
mov dword [ebp - 0x4c], 0xffeac8e4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x1002e01d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe88], 0xd7f825e7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002e005
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x1002e03d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x12cc], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002e025
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1002e182
or esi, 0xffffffff
mov dword [ebp - 0x1c], 0xb3b9da4d
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x44], 0x57257ea0
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x74], 0xfffffffb
mov dword [ebp - 0x70], 0xfffffffb
mov dword [ebp - 0x6c], 0xfffffffb
mov dword [ebp - 0x68], 0xfffffffb
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1002e0a7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe88], 0x3ff82ff4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002e08f
xor eax, eax
cmp dword [ebp - 0xe80], eax
je 0x1002e110
mov dword [ebp - 0x30], 0x135e1f6f
push ecx
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0xcbc]
mov dword [ebp - 0x30], 0x32456160
call fcn.100164e9
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x18], eax
jmp 0x1002e0f5
push dword [ebp - 0x18]
call fcn.10016587
mov dword [eax], 0xc2184e5a
inc dword [ebp - 0x18]
xor eax, eax
lea ecx, [ebp - 0xcbc]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x1002e0e4
inc dword [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.1001656b
jmp 0x1002e16d
mov dword [ebp - 0x28], 0x9ce07b88
xor edx, edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x44]
add eax, 0x951f1b00
add ecx, eax
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x12c4]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setle cl
xor eax, eax
shl ecx, 2
cmp ecx, 0x6ca241e2
setge al
sub eax, 0x996d
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x20]
push 0
pop eax
push 1
pop ecx
push 3
pop edx
jns 0x1002e04c
push 2
pop esi
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], 0xe704f3d4
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x40], 0x9dc86695
mov dword [ebp - 0x30], 0xf9a4d91f
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x30], 0x89be67e7
mov dword [ebp - 0x30], 0x33c8a0c0
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], 0x52783de7
mov dword [ebp - 0x4c], 0xffeac8e4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x1002e21a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xea0], 0xd7f825e7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002e202
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x1002e23a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x138c], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002e222
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1002e374
push 0xfffffffffffffffb
pop esi
jmp 0x1002e24e
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], 0xb3b9da4d
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x44], 0x57257ea0
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1002e299
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xea0], 0x3ff82ff4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002e281
xor eax, eax
cmp dword [ebp - 0xe98], eax
je 0x1002e308
mov dword [ebp - 0x30], 0x135e1f6f
or esi, 0xffffffff
push ecx
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0xcd4]
mov dword [ebp - 0x30], 0x32456160
call fcn.100164e9
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x18], eax
jmp 0x1002e2ea
push dword [ebp - 0x18]
call fcn.10016587
mov dword [eax], 0xc2184e5a
inc dword [ebp - 0x18]
xor eax, eax
lea ecx, [ebp - 0xcd4]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x1002e2d9
inc dword [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.1001656b
push 0xfffffffffffffffb
pop esi
jmp 0x1002e365
mov dword [ebp - 0x28], 0x9ce07b88
xor edx, edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x44]
add eax, 0x951f1b00
add ecx, eax
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x1384]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setle cl
xor eax, eax
shl ecx, 2
cmp ecx, 0x6ca241e2
setge al
sub eax, 0x996d
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x20]
push 0
pop eax
push 3
pop edx
jns 0x1002e24b
mov dword [ebp - 0x38], 0x643c
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x1c], 0xed3c15d0
mov dword [ebp - 0x1c], 0xfd06bde6
mov dword [ebp - 0x3c], 0xb1a7a81a
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jne 0x1002e3d8
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002e3c7
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x38], eax
jl 0x1002e3d8
xor eax, eax
xor edx, edx
mov ecx, eax
inc edx
jmp 0x1002e3dd
xor edx, edx
inc edx
mov ecx, edx
xor eax, eax
test ecx, ecx
setle al
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
cmp eax, 0x1e707165
setle cl
imul ecx, dword [ebp - 0x38]
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x1c]
test eax, eax
je 0x1002e4af
mov dword [ebp - 0x44], 0xa41b8700
mov dword [ebp - 0x4c], 0xfffffff9
mov dword [ebp - 0x28], 0x6c8c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002e439
mov esi, edx
cmp dword [ebp - 0x38], eax
jne 0x1002e43b
mov esi, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x44]
cmp eax, 0x56cd219f
setge cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
or ecx, 0xffffffff
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov eax, dword [ebp - 0x44]
setge dl
sub edx, 0xe34f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x1c], 0xfffffffd
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
or esi, 0xffffffff
mov dword [ebp - 0x1c], edx
jmp 0x1002e565
push 3
pop eax
mov dword [ebp - 0x38], 0xfc5c2da5
lea ecx, [ebp - 0xa0c]
mov dword [ebp - 0x4c], 0xfffffff7
push eax
call fcn.100164e9
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x18], eax
jmp 0x1002e4f1
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa0c]
call fcn.10016587
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x18]
push 3
pop eax
cmp dword [ebp - 0x18], eax
jl 0x1002e4da
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
inc ecx
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x38]
cmp eax, ecx
jl 0x1002e518
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1002e51a
mov eax, ecx
jmp 0x1002e51a
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
je 0x1002e536
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002e538
mov esi, ecx
jmp 0x1002e53a
xor eax, eax
mov esi, eax
push 2
pop eax
push eax
lea ecx, [ebp - 0xa0c]
call fcn.10016587
imul ecx, esi, 0xfff7
or esi, 0xffffffff
mov dword [ebp - 4], esi
add ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
lea ecx, [ebp - 0xa0c]
call fcn.1001656b
mov dword [ebp - 0x38], 0xbc6e5c7a
xor eax, eax
mov dword [ebp - 0x3c], 0x54bcd76c
mov dword [ebp - 0x1c], 0xfffffffd
cmp dword [ebp - 0x38], eax
je 0x1002e595
mov eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
neg eax
cmp eax, esi
jle 0x1002e593
xor eax, eax
inc eax
jmp 0x1002e595
xor eax, eax
mov ecx, dword [ebp - 0x38]
xor edx, edx
imul ecx, eax
xor eax, eax
inc eax
sub eax, ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setne dl
add edx, dword [ebp - 0x1c]
je 0x1002e5c0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
jmp 0x1002e658
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002e5e8
push 0x133
push eax
push eax
push eax
push eax
push 0x21bf
push 0x2143
call edi
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffe5
cmp dword [ebp - 0x1c], 0xffffffed
jle 0x1002e658
jmp 0x1002e5f9
xor eax, eax
mov dword [ebp - 0x48], 0xfffffffe
cmp dword [ebp - 0x48], eax
je 0x1002e60d
cmp dword [ebp - 0x3c], eax
je 0x1002e60d
xor eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x48], 0xffffffe6
cmp dword [ebp - 0x48], 0x1f
jge 0x1002e64f
push 2
xor eax, eax
pop esi
mov dword [ebp - 0x38], eax
jmp 0x1002e641
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002e63e
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x1002e627
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x1f
jl 0x1002e622
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffed
jg 0x1002e5f7
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002e677
push 0x24bf
push eax
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
xor eax, eax
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x44], 0xef33
push 3
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jge 0x1002e6af
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x129c], 0xcd546735
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002e697
xor eax, eax
cmp dword [ebp - 0x24], 0x1124f01c
jg 0x1002e771
mov dword [ebp - 0x28], 0x78d8
mov dword [ebp - 0x24], eax
jmp 0x1002e6eb
mov dword [ebp - 0x4c], 0x1249
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002e6df
push eax
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], 0xd
je 0x1002e6c8
mov eax, dword [ebp - 0x28]
xor ecx, ecx
xor esi, esi
inc esi
cmp eax, esi
push 3
setg cl
xor edx, edx
mov dword [ebp - 0x129c], ecx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
add edx, 2
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, 0xd714f98c
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x28]
setge bl
xor ecx, ecx
cmp ebx, eax
pop ebx
setl cl
xor eax, eax
cmp ecx, 0xf6a0
setle al
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x20], eax
jmp 0x1002e780
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002e780
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movdqa xmm0, xmmword [0x10007b30]
lea eax, [ebp - 0xfd0]
push eax
lea eax, [ebp - 0xfe0]
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x38], 0x40d7f825
lea ecx, [ebp - 0x1448]
push eax
movdqu xmmword [ebp - 0xfe0], xmm0
call fcn.10016596
lea ecx, [ebp - 0x1c6]
mov esi, eax
call fcn.10008b13
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xed0]
push dword [esi]
call fcn.10016545
mov dword [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x48], 0xf69a0165
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002e809
push eax
push 0x588
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x1002eb4b
movdqa xmm0, xmmword [0x10007b80]
lea eax, [ebp - 0x1130]
push eax
lea eax, [ebp - 0x1140]
push eax
lea ecx, [ebp - 0x1518]
movdqu xmmword [ebp - 0x1140], xmm0
call fcn.10016596
lea ecx, [ebp - 0x249]
mov esi, eax
call fcn.10008b13
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x338]
push dword [esi]
call fcn.10016545
xor eax, eax
mov byte [ebp - 4], 0xe
push 2
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xcec]
pop eax
mov dword [ebp - 0x28], 0x81eca6c8
push eax
call fcn.100164e9
xor eax, eax
mov byte [ebp - 4], 0xf
push 2
mov dword [ebp - 0x18], eax
pop edx
cmp dword [ebp - 0x18], edx
jge 0x1002e8a9
push dword [ebp - 0x18]
lea ecx, [ebp - 0xcec]
call fcn.10016587
push 2
mov dword [eax], 7
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x1002e888
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002e8c6
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002eb1f
mov dword [ebp - 0x1c], 0xa445a8cc
lea ecx, [ebp - 0x338]
mov dword [ebp - 0x30], 0x58e9d28b
push dword [ebp - 0x14]
call fcn.10016587
xor ecx, ecx
cmp dword [eax], 0xec21
mov eax, dword [ebp - 0x14]
sete cl
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x28], ecx
inc eax
push eax
lea ecx, [ebp - 0x338]
call fcn.10016587
mov edx, dword [ebp - 0x28]
mov esi, eax
mov ecx, dword [ebp - 0x38]
xor eax, eax
cmp edx, ecx
lea ecx, [ebp - 0x338]
setge al
imul eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
cmp dword [esi], eax
setge bl
xor eax, eax
inc eax
push eax
call fcn.10016587
push dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [eax]
add eax, ebx
cmp eax, 0xfffffffd
setne cl
imul edi, ecx, 0x2b4b
lea ecx, [ebp - 0x338]
call fcn.10016587
push dword [ebp - 0x14]
lea ecx, [ebp - 0x338]
mov esi, eax
call fcn.10016587
mov ecx, dword [esi]
push 3
pop ebx
add ecx, dword [eax]
xor eax, eax
cmp ecx, edi
setne al
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002eb1c
jmp 0x1002e993
xor eax, eax
mov dword [ebp - 0x4c], 0xd28e4879
mov dword [ebp - 0x28], 0xa0c09020
mov dword [ebp - 0x3c], 0x3de76903
mov dword [ebp - 0x30], 0x5c8bb6af
cmp dword [ebp - 0x38], eax
je 0x1002e9e5
cmp dword [ebp - 0x14], eax
je 0x1002e9c5
cmp dword [ebp - 0x4c], eax
je 0x1002e9c5
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x1002e9c8
xor ebx, ebx
inc ebx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x3c]
test eax, eax
je 0x1002e9e3
mov edi, ebx
jmp 0x1002e9ea
xor eax, eax
xor ebx, ebx
mov edi, eax
inc ebx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x338]
call fcn.10016587
push dword [ebp - 0x14]
lea ecx, [ebp - 0x338]
mov esi, eax
call fcn.10016587
push 3
mov ecx, dword [eax]
pop eax
mov dword [esi], ecx
lea ecx, [ebp - 0xed0]
push eax
call fcn.10016587
xor ecx, ecx
mov edx, 0x5fcb
cmp edi, edx
push 3
mov dword [eax], edx
setge cl
xor eax, eax
cmp dword [esi], ecx
pop ecx
sete al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
jl 0x1002eb10
jmp 0x1002ea4f
push 3
pop ecx
push ecx
mov dword [ebp - 0x30], 0x1d67a3d5
lea ecx, [ebp - 0xeb8]
call fcn.100164e9
xor eax, eax
mov byte [ebp - 4], 0x10
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002ea99
push ecx
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0xeb8]
call fcn.10016587
mov dword [eax], 0xe776e9f8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002ea75
xor ebx, ebx
xor eax, eax
push 3
inc ebx
pop ecx
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jl 0x1002eaf8
jmp 0x1002eaa6
push 3
pop ecx
push ecx
lea ecx, [ebp - 0xa24]
call fcn.100164e9
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x18], eax
jmp 0x1002eace
push dword [ebp - 0x18]
call fcn.10016587
mov dword [eax], 0x6e2e31b5
inc dword [ebp - 0x18]
push 3
pop eax
lea ecx, [ebp - 0xa24]
cmp dword [ebp - 0x18], eax
jl 0x1002eabd
push ebx
call fcn.10016587
lea ecx, [ebp - 0xa24]
inc dword [eax]
mov byte [ebp - 4], 0x10
call fcn.1001656b
dec dword [ebp - 0x3c]
jns 0x1002eaa3
lea ecx, [ebp - 0xeb8]
mov byte [ebp - 4], 0xf
call fcn.1001656b
dec dword [ebp - 0x48]
jns 0x1002ea4c
dec dword [ebp - 0x1c]
jns 0x1002e991
push 3
pop ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1002e8ce
lea ecx, [ebp - 0xcec]
call fcn.1001656b
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 0xd
call fcn.1001656b
inc dword [ebp - 0x38]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x38], 0x1d
je 0x1002e811
or edi, 0xffffffff
lea ecx, [ebp - 0xed0]
mov dword [ebp - 4], edi
call fcn.1001656b
mov dword [ebp - 0x30], 0xfffffff8
xor ebx, ebx
mov dword [ebp - 0x14], 0x915a
inc ebx
xor eax, eax
mov dword [ebp - 0x1c], ebx
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002eb9f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x488], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002eb87
xor eax, eax
mov dword [ebp - 0x14], 0x8ec0ae97
mov dword [ebp - 0x14], eax
jmp 0x1002eced
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x488]
cmp dword [ebp - 0x34], eax
jne 0x1002ebcc
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x484]
xor ecx, ecx
cmp eax, 0x4bcd
setne cl
cmp ecx, dword [ebp - 0x14]
jge 0x1002ebf4
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x488], 0
jne 0x1002ebf4
xor eax, eax
mov edx, eax
jmp 0x1002ebf6
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x488]
cmp eax, edx
setge cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp eax, 0x6eab3cf8
setl cl
cmp ecx, 0xeec54165
jbe 0x1002ecb8
mov dword [ebp - 0x24], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x488]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
cmp eax, ebx
setle cl
cmp ecx, ebx
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffea
jg 0x1002ecea
push 2
pop ecx
cmp dword [ebp - 0x24], eax
jne 0x1002ecea
mov dword [ebp - 0x34], eax
jmp 0x1002eca8
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ec83
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x24], eax
jmp 0x1002eca0
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ec9d
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x1002ec88
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jle 0x1002ec6e
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffea
jle 0x1002ec60
jmp 0x1002ecea
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002eccf
push 0x4a8
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ecea
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
inc dword [ebp - 0x14]
push 2
pop eax
cmp dword [ebp - 0x14], eax
jle 0x1002ebae
mov dword [ebp - 0x50], ebx
lea ecx, [ebp - 0xbd4]
mov dword [ebp - 0x30], 0xe704f3d4
push 4
call fcn.100164e9
mov dword [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002ed4e
push dword [ebp - 0x18]
lea ecx, [ebp - 0xbd4]
call fcn.10016587
push 4
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002ed31
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x1002ed7f
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x1002ed7c
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ed74
push eax
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002ed61
push 3
pop ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x1002ed56
lea ecx, [ebp - 0xbd4]
mov dword [ebp - 4], edi
call fcn.1001656b
push 3
pop eax
mov dword [ebp - 0x30], 0xfffffffe
lea ecx, [ebp - 0xee8]
mov dword [ebp - 0x30], 6
push eax
call fcn.100164e9
mov dword [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x28], ebx
push 3
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x1002edf3
push esi
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0xee8]
call fcn.10016587
mov dword [eax], 0x7571177e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002edcf
xor ebx, ebx
xor eax, eax
push 3
inc ebx
pop esi
push 2
pop edx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jl 0x1002ef11
push ebx
lea ecx, [ebp - 0x4a0]
call fcn.100164e9
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x30], 0x8f6efba1
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002ee48
push dword [ebp - 0x14]
lea ecx, [ebp - 0x4a0]
call fcn.10016587
mov dword [eax], 0xe2c0d37a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002ee2a
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002ee6b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1458], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002ee53
xor eax, eax
push eax
lea ecx, [ebp - 0x4a0]
call fcn.10016587
and dword [eax], 0
jmp 0x1002eece
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0xd04]
push ebx
call fcn.100164e9
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x18], eax
jmp 0x1002eea7
push dword [ebp - 0x18]
call fcn.10016587
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x18]
lea ecx, [ebp - 0xd04]
cmp dword [ebp - 0x18], ebx
jl 0x1002ee96
inc dword [ebp - 0x28]
mov byte [ebp - 4], 0x14
call fcn.1001656b
xor eax, eax
lea ecx, [ebp - 0x4a0]
push eax
call fcn.10016587
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x4a0]
push eax
call fcn.10016587
push 2
pop ecx
cmp dword [eax], ecx
jle 0x1002ee7c
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002eef9
push 0x16c0
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
lea ecx, [ebp - 0x4a0]
mov byte [ebp - 4], 0x13
call fcn.1001656b
dec dword [ebp - 0x20]
jns 0x1002ee02
lea ecx, [ebp - 0xee8]
mov dword [ebp - 4], edi
call fcn.1001656b
mov dword [ebp - 0x30], ebx
xor eax, eax
mov dword [ebp - 0x1c], 0x193e0566
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x28], 0xe3b6
mov dword [ebp - 0x44], 0xa975881d
mov dword [ebp - 0x18], eax
jmp 0x1002ef52
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x128], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002ef45
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setne dl
add eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, 0x53a3
mov eax, dword [ebp - 0x34]
setl cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
add eax, 0x16580849
inc ecx
add eax, ecx
cmp eax, 0x1db6
jg 0x1002efb0
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002f089
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x28], 0xe7baa9d7
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jl 0x1002effb
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002eff6
push eax
push eax
push 0x2018
push 0x9f7
push eax
call dword [sym.imp.USER32.dll_InsertMenuW]
xor eax, eax
dec dword [ebp - 0x34]
jns 0x1002efd8
cmp dword [ebp - 0x4c], eax
je 0x1002f003
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x128]
xor edx, edx
mov eax, dword [ebp - 0x34]
add ecx, 0xffffc1dc
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, 0x3b1067dc
setg al
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002f038
mov ecx, eax
cmp dword [ebp - 0x128], eax
je 0x1002f03a
mov ecx, ebx
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x128]
sub ecx, eax
mov eax, dword [ebp - 0x128]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
sete cl
xor edx, edx
cmp eax, ecx
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4c]
cmp edx, eax
setle cl
xor eax, eax
neg ecx
cmp ecx, 7
setle al
mov dword [ebp - 0x34], eax
jmp 0x1002f125
mov dword [ebp - 0x20], esi
push 2
mov dword [ebp - 0x4c], 0x4bca0f96
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x1002f0ac
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd0c], 0xc31b53a2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f09b
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0xfffffffe
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, 0xfffffff7
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
imul ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x28]
sub esi, ecx
inc esi
add esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp eax, edx
setne cl
cmp ecx, dword [ebp - 0x34]
jl 0x1002f108
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x4c], eax
je 0x1002f10a
mov ecx, ebx
mov eax, dword [ebp - 0x4c]
xor edx, edx
add ecx, 3
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x4c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0xd08], edx
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002f139
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor eax, eax
movdqa xmm0, xmmword [0x10007bf0]
lea ecx, [ebp - 0x13a0]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0xff0]
push eax
lea eax, [ebp - 0x1000]
mov dword [ebp - 0x4c], 0xfffffffa
mov dword [ebp - 0x4c], 0x4524be1
push eax
movdqu xmmword [ebp - 0x1000], xmm0
call fcn.10016596
lea ecx, [ebp - 0x241]
mov esi, eax
call fcn.10008b13
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xd18]
push dword [esi]
call fcn.10016545
xor eax, eax
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002f1b8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3b4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002f1a3
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1002f1d7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1e4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002f1c3
xor eax, eax
mov dword [ebp - 0x1e0], ecx
mov edx, 0x2526041
cmp dword [ebp - 0x1e0], eax
jl 0x1002f323
jmp 0x1002f1f2
xor eax, eax
mov dword [ebp - 0x268], edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x44], 0xc746
mov dword [ebp - 0x260], ecx
cmp dword [ebp - 0x260], eax
jl 0x1002f2df
mov eax, dword [ebp - 0x260]
mov eax, dword [ebp + eax*4 - 0x3b4]
mov eax, dword [ebp - 0x260]
cmp dword [ebp + eax*4 - 0x3b4], 0
jne 0x1002f265
mov eax, dword [ebp - 0x260]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x3b4]
mov eax, dword [ebp - 0x28]
cmp eax, 0xbebf0a0c
setne cl
imul edx, ecx
cmp edx, 0xfffffffe
je 0x1002f272
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp + eax*4 - 0x3b4]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3ac]
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp + eax*4 - 0x3b4]
mov eax, dword [ebp - 0x264]
mov eax, dword [ebp - 0x260]
mov eax, dword [ebp + eax*4 - 0x3b4]
mov eax, dword [ebp - 0x260]
mov eax, dword [ebp + eax*4 - 0x3b4]
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp + eax*4 - 0x3b4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x260]
jns 0x1002f226
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0xd18]
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x260]
xor eax, eax
push eax
call fcn.10016587
mov ecx, dword [ebp - 0x3b0]
mov edx, 0x2526041
mov eax, dword [ebp - 0x1e0]
push 3
mov dword [ebp + eax*4 - 0x3b4], ecx
dec dword [ebp - 0x1e0]
pop ecx
jns 0x1002f1f0
lea ecx, [ebp - 0xd18]
mov dword [ebp - 4], edi
call fcn.1001656b
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x3c], 0x8cff0ea7
mov dword [ebp - 0x20], 0x888999d9
push 2
mov dword [ebp - 0x30], edi
pop eax
mov dword [ebp - 0x4c], 0x26ec17e5
mov dword [ebp - 0x3c], eax
jmp 0x1002f3f3
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], 0x76373a4c
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002f378
push eax
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp eax, edi
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, 0x9896
setge dl
sub eax, edx
add eax, dword [ebp - 0x3c]
cmp eax, ebx
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x1c]
je 0x1002f3a3
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x4c]
xor ecx, ecx
mov dword [ebp - 0x28], 0x858f
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x20]
cmp eax, 0xd4a55f07
mov eax, dword [ebp - 0x28]
setne cl
xor edx, edx
sub eax, ecx
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x4c]
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x3c], 0xb
jl 0x1002f357
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], 0x13dd33a4
mov dword [ebp - 0x28], 0x7a67d926
mov dword [ebp - 0x24], eax
jmp 0x1002f481
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffffb
jl 0x1002f47e
mov dword [ebp - 0x28], 0xe813
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setg bl
xor ecx, ecx
cmp eax, edi
setge cl
xor eax, eax
cmp ecx, ebx
jge 0x1002f45e
cmp dword [ebp - 0x28], eax
je 0x1002f45e
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x1002f463
xor ebx, ebx
mov ecx, eax
inc ebx
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x24]
imul eax, ecx
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffb
jge 0x1002f421
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffef
jle 0x1002f415
mov dword [ebp - 0x54], 0x9dc86695
push 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], eax
pop edx
jmp 0x1002f4fd
mov dword [ebp - 0x20], 0x3248c66
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002f4c2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1610], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002f4a9
xor eax, eax
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], eax
jl 0x1002f4fa
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002f4e1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002f4f2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002f4ce
push 2
pop edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1002f499
mov dword [ebp - 0x30], 0xf9a4d91f
mov dword [ebp - 0x3c], 0x15252cb1
mov dword [ebp - 0x28], 0xba5f27a4
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x30], 4
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002f543
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1f4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f52f
xor eax, eax
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], eax
jl 0x1002f72b
jmp 0x1002f554
push 2
pop edx
mov dword [ebp - 0x24], 0x182eac45
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jg 0x1002f695
mov dword [ebp - 0x14], 0x565e08cc
lea ecx, [ebp - 0xa3c]
mov dword [ebp - 0x28], 0xfffffffa
push ebx
call fcn.100164e9
xor eax, eax
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002f5b0
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa3c]
call fcn.10016587
mov dword [eax], 0xebc5f93b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002f592
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jg 0x1002f678
jmp 0x1002f5c3
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002f5da
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x1f4]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], 0xd7770b16
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1f4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x1f4]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setl dl
imul edx, dword [ebp + eax*4 - 0x1f4]
xor eax, eax
cmp eax, edx
sbb eax, eax
xor ebx, ebx
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x1f4]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
lea ecx, [ebp - 0xa3c]
setle bl
xor eax, eax
neg ebx
mov dword [ebp - 0x1f4], ebx
push eax
call fcn.10016587
xor ecx, ecx
test ebx, ebx
push 2
setne cl
mov dword [eax], ecx
inc dword [ebp - 0x14]
pop eax
push 1
pop ebx
cmp dword [ebp - 0x14], eax
jle 0x1002f5c1
lea ecx, [ebp - 0xa3c]
mov dword [ebp - 4], edi
call fcn.1001656b
inc dword [ebp - 0x24]
push 2
pop eax
cmp dword [ebp - 0x24], eax
jle 0x1002f567
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setl dl
cmp dword [ebp - 0x24], 0xffff
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
setge cl
add ecx, 0xf6da
jne 0x1002f6c4
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x1002f6c6
mov edx, ebx
mov eax, dword [ebp - 0x3c]
xor ebx, ebx
push 0
mov ecx, dword [ebp + eax*4 - 0x1f4]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x1f4]
cmp ecx, eax
mov eax, dword [ebp - 0x1f0]
setg bl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x44]
sete cl
xor edx, edx
cmp ebx, ecx
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1ec]
setge bl
xor ecx, ecx
sub ebx, 0x3c23
cmp ebx, eax
mov eax, dword [ebp - 0x3c]
setg cl
mov dword [ebp + eax*4 - 0x1f4], ecx
dec dword [ebp - 0x3c]
pop eax
push 1
pop ebx
jns 0x1002f551
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x1c], 0xa61928c1
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002f75c
push 0x17f0
push eax
call edi
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffff8
cmp dword [ebp - 0x1c], 0xffffffe5
jge 0x1002f80f
push 3
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002f790
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4fc], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f778
xor eax, eax
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 0xfffffff9
jne 0x1002f802
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002f7f0
push 0x18fb
push 0x4b8
push 0x1adc
push eax
push 0x1cf5
push 0x1708
call edi
mov ebx, dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push eax
push 0x164c
push 0x16c7
push 0xc39
push 0x131a
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
xor eax, eax
dec dword [ebp - 0x4f4]
cmp dword [ebp - 0x4f4], 0xfffffff9
je 0x1002f79f
push 3
pop ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe5
jl 0x1002f770
movdqa xmm0, xmmword [0x10007b50]
lea eax, [ebp - 0x1230]
push eax
lea eax, [ebp - 0x1240]
mov dword [ebp - 0x5c], 0xfffffff9
push eax
lea ecx, [ebp - 0x1468]
movdqu xmmword [ebp - 0x1240], xmm0
call fcn.10016596
lea ecx, [ebp - 0x269]
mov esi, eax
call fcn.10008b13
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xa84]
push dword [esi]
call fcn.10016545
mov dword [ebp - 4], 0x18
lea ecx, [ebp - 0x694]
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x1c], 0x54e3f157
push 2
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x38], eax
pop eax
push eax
call fcn.100164e9
mov byte [ebp - 4], 0x19
push 8
pop eax
mov dword [ebp - 0x820], eax
mov dword [ebp - 0x81c], eax
mov dword [ebp - 0x818], eax
mov dword [ebp - 0x814], eax
xor eax, eax
mov dword [ebp - 0x18], eax
push 2
pop eax
cmp dword [ebp - 0x18], eax
jge 0x1002f8dc
push eax
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x694]
call fcn.10016587
mov dword [eax], 0xacae7bf1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002f8bd
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0xa84]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
push ebx
call fcn.10016587
or esi, 0xffffffff
mov dword [eax], esi
mov dword [ebp - 0x48], esi
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x3c]
sub eax, 0xb2fc
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
setl dl
sub ecx, edx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
lea ecx, [ebp - 0x694]
setl dl
sub edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, eax
setle bl
xor eax, eax
push eax
call fcn.10016587
xor ecx, ecx
cmp ebx, 0x89c0
setg cl
mov dword [eax], ebx
mov eax, esi
sub eax, ecx
mov dword [ebp - 0x820], ebx
sub eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x3c]
jle 0x1002facc
push 2
pop eax
xor ebx, ebx
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x38], eax
inc ebx
cmp dword [ebp - 0x38], 0x19
jle 0x1002fa22
mov dword [ebp - 0x20], ebx
xor ecx, ecx
mov dword [ebp - 0x5c], 0xec8167ba
mov dword [ebp - 0x28], 9
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
imul edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x1c]
je 0x1002f9cb
cmp dword [ebp - 0x1c], eax
je 0x1002f9cb
mov eax, ebx
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0xa84]
push ebx
call fcn.10016587
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, dword [eax]
setne dl
add edx, 0x832d46
jne 0x1002f9ef
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x81c]
lea ecx, [ebp - 0x694]
xor eax, eax
push eax
call fcn.10016587
mov ecx, dword [ebp - 0x20]
sub ecx, 0xaafe7dda
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
imul eax, dword [ebp - 0x20], 6
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x38]
jmp 0x1002f98b
mov dword [ebp - 0x48], 0xffffffe7
cmp dword [ebp - 0x48], 0xffffffe5
je 0x1002fb14
xor eax, eax
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x1002fabd
push 3
pop eax
push eax
lea ecx, [ebp - 0xa54]
call fcn.100164e9
xor eax, eax
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x18], eax
push 3
pop eax
cmp dword [ebp - 0x18], eax
jge 0x1002fa81
push eax
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa54]
call fcn.10016587
mov dword [eax], 0xfa629a01
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002fa62
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0xa54]
call fcn.10016587
inc dword [eax]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002faa4
push 0x177b
call dword [sym.imp.USER32.dll_GetSysColorBrush]
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 0x19
call fcn.1001656b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
je 0x1002fa40
xor eax, eax
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xffffffe5
jne 0x1002fa35
jmp 0x1002fb14
push 3
pop ebx
push ebx
lea ecx, [ebp - 0xa6c]
call fcn.100164e9
xor eax, eax
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x18], eax
jmp 0x1002faf3
push dword [ebp - 0x18]
call fcn.10016587
mov dword [eax], esi
inc dword [ebp - 0x18]
lea ecx, [ebp - 0xa6c]
cmp dword [ebp - 0x18], ebx
jl 0x1002fae6
xor ebx, ebx
inc ebx
push ebx
call fcn.10016587
lea ecx, [ebp - 0xa6c]
dec dword [eax]
call fcn.1001656b
lea ecx, [ebp - 0x694]
call fcn.1001656b
lea ecx, [ebp - 0xa84]
mov dword [ebp - 4], esi
call fcn.1001656b
mov dword [ebp - 0x5c], 0x89be67e7
xor eax, eax
mov dword [ebp - 0x1c], 0x9e57ad95
mov dword [ebp - 0x20], 0x22e974a5
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002fb64
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa8], 0xc204e2db
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002fb4c
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002fb84
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1cc], 0xbdebf889
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002fb6c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002fbd2
mov dword [ebp - 0x28], esi
xor edx, edx
mov eax, dword [ebp - 0xa8]
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xa8]
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xa8]
cmp edx, eax
setg cl
xor eax, eax
test ecx, ecx
sets al
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x1c]
jns 0x1002fb8c
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002fc21
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x4c], 0x576660b2
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xa8]
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002fc00
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1cc]
inc dword [ebp - 0x1cc]
test eax, eax
js 0x1002fc1a
mov eax, ebx
jmp 0x1002fc1c
xor eax, eax
mov dword [ebp - 0x4c], eax
jmp 0x1002fc32
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002fc34
push eax
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
xor eax, eax
mov dword [ebp - 0x5c], 0x33c8a0c0
mov dword [ebp - 0x1c], 0x2c70bb74
mov dword [ebp - 0x4c], ebx
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002fc68
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x12e4], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002fc50
xor eax, eax
push 2
pop edx
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x1002fc84
mov dword [ebp - 0x4c], 0x6ff55e00
dec dword [ebp - 0x1c]
jns 0x1002fc73
cmp dword [ebp - 0x1c], eax
je 0x1002fc9a
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x12e0]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002fc98
mov eax, ebx
jmp 0x1002fc9a
xor eax, eax
push ecx
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0xa9c]
mov dword [ebp - 0x5c], 0xfffffffa
call fcn.100164e9
xor eax, eax
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002fce5
push 3
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa9c]
call fcn.10016587
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002fcc8
xor ebx, ebx
xor eax, eax
inc ebx
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002fcff
push eax
push eax
call edi
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
xor eax, eax
mov dword [ebp - 0x1c], eax
push 3
pop eax
cmp dword [ebp - 0x1c], eax
jge 0x1002fd2b
push eax
pop ebx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa9c]
call fcn.10016587
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002fd0c
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xa9c]
mov dword [ebp - 4], esi
call fcn.1001656b
mov dword [ebp - 0x5c], 0x52783de7
lea ecx, [ebp - 0x204]
push ebx
call fcn.100164e9
mov dword [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002fd78
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb4], 0x831713b9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002fd60
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002fd9a
push dword [ebp - 0x14]
lea ecx, [ebp - 0x204]
call fcn.10016587
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002fd80
xor eax, eax
mov dword [ebp - 0xb4], eax
jmp 0x1002ffd9
push 2
pop eax
mov dword [ebp - 0x3c], 5
lea ecx, [ebp - 0xab4]
push eax
call fcn.100164e9
mov byte [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x4c], 0x8784
push 2
mov dword [ebp - 0x18], eax
pop edx
cmp dword [ebp - 0x18], edx
jge 0x1002fdf2
push edx
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0xab4]
call fcn.10016587
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002fdd5
xor ebx, ebx
xor eax, eax
inc ebx
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002fe1d
push 0x10bb
push eax
push 0x62c
push 0x4f1
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
xor eax, eax
mov dword [ebp - 0x3c], 0x1d
jmp 0x1002ffba
mov dword [ebp - 0x24], 0x588e1b61
mov dword [ebp - 0x28], 0x63780d77
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x1002ffa8
cmp dword [ebp - 0x3c], 0xffffffe9
jge 0x1002fe29
lea ecx, [ebp - 0xab4]
mov byte [ebp - 4], 0x1d
call fcn.1001656b
dec dword [ebp - 0xb4]
cmp dword [ebp - 0xb4], 0xfffffff7
jge 0x1002fda5
lea ecx, [ebp - 0x204]
mov dword [ebp - 4], esi
call fcn.1001656b
mov dword [ebp - 0x5c], 0xffeac8e4
lea ecx, [ebp - 0x79c]
mov dword [ebp - 0x1c], 0x841b3c69
push ebx
call fcn.100164e9
xor eax, eax
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10030040
push dword [ebp - 0x18]
lea ecx, [ebp - 0x79c]
call fcn.10016587
mov dword [eax], 0xb733c633
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10030022
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10030055
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x11
jle 0x10030178
push 3
pop ecx
push 2
pop edx
mov dword [ebp - 0x18], 0x48f6
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x28], 0xbbf9acf2
mov dword [ebp - 0x28], 0xa34c865b
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 0xf2fdad5a
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x145c1747
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x20], 0x2bad479e
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x100300be
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x858], 0x6520
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100300a6
inc dword [ebp - 0x858]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 6
jg 0x10030168
lea ecx, [ebp - 0x79c]
mov dword [ebp - 4], esi
call fcn.1001656b
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0xacc]
mov dword [ebp - 0x28], 0xdcc590f0
push 4
call fcn.100164e9
mov dword [ebp - 4], 0x20
xor eax, eax
mov dword [ebp - 0x28], 0x12a7b09f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x100301d5
push dword [ebp - 0x14]
lea ecx, [ebp - 0xacc]
call fcn.10016587
mov dword [eax], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100301b6
mov dword [ebp - 0x14], eax
jmp 0x100301e7