Function at 0x100306e6
Capabilities:
Allocate thread local storage
Check for time delay via gettickcount
Connect pipe
Get file attributes
Get geographical location
Get graphical window text
Get keyboard layout
Parse pe header
Query environment variable
Set thread local storage value
Terminate process

Disassembly:
mov eax, 0x1007af8a
call fcn.100795c0
mov eax, 0x1524
call fcn.10075e80
push ebx
push esi
push edi
or eax, 0xffffffff
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x50], eax
xor ebx, ebx
inc ebx
mov byte [ebp - 0x69], dl
mov dword [ebp - 0x28], ebx
mov esi, 0x39523dd9
push 4
pop ecx
mov dword [ebp - 0x3c], ecx
mov edi, 0xee91
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10030739
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x14b0], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003072c
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x50], 2
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x3c]
sub edx, eax
mov eax, dword [ebp - 0x50]
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x10]
push 4
setle cl
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x9a8551b3
pop ecx
sbb eax, eax
neg eax
neg eax
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100307b8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1500], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100307ab
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x3c]
sub edx, eax
mov eax, dword [ebp - 0x50]
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x10]
push 4
setle cl
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0xa30]
cmp dword [ebp - 0x10], 0x9a8551b3
sbb eax, eax
or edi, 0xffffffff
neg eax
neg eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x30], 0xfffffffd
call fcn.10016f3c
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], 0xf7f3e76e
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10030853
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x9f0], 0x77dd6887
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1003083b
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10030875
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x144c], 4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1003085c
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10030899
push dword [ebp - 0x24]
lea ecx, [ebp - 0xa30]
call fcn.10016fad
mov dword [eax], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1003087e
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_OffsetRect]
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x100308b5
push 0xeb4
push 0x61f
push eax
call edi
push esi
lea ecx, [ebp - 0xa30]
call fcn.10016fad
mov edx, dword [eax]
lea ecx, [edx + 1]
mov dword [eax], ecx
test edx, edx
je 0x100308eb
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x100308dd
cmp dword [ebp - 0x9f0], eax
je 0x100308dd
mov eax, ebx
mov dword [ebp - 0x9f0], eax
neg eax
je 0x100308eb
mov ecx, ebx
jmp 0x100308ef
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x50]
add eax, ecx
lea ecx, [ebp - 0xa30]
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016fa8
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1003092c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8f8], 0xc85f70ad
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10030913
xor eax, eax
mov dword [ebp - 0x8f0], 0x18
jmp 0x10030950
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1003094a
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
xor eax, eax
dec dword [ebp - 0x8f0]
cmp dword [ebp - 0x8f0], 9
jle 0x10030938
or eax, 0xffffffff
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x50], eax
push esi
call fcn.10016f3c
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x10], 0x21dfe4b2
mov dword [ebp - 0x1c], 0x64d9248e
mov dword [ebp - 0x1c], eax
jmp 0x10030994
push dword [ebp - 0x1c]
call fcn.10016fad
mov dword [eax], 0xfffb
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x94]
cmp dword [ebp - 0x1c], esi
jl 0x10030983
push ebx
call fcn.10016fad
push ebx
lea ecx, [ebp - 0x94]
call fcn.10016fad
cmp dword [eax], 0
je 0x10030a02
xor eax, eax
lea ecx, [ebp - 0x94]
push eax
call fcn.10016fad
xor eax, eax
lea ecx, [ebp - 0x94]
push eax
call fcn.10016fad
push ebx
lea ecx, [ebp - 0x94]
call fcn.10016fad
push ebx
lea ecx, [ebp - 0x94]
call fcn.10016fad
push ebx
lea ecx, [ebp - 0x94]
call fcn.10016fad
push ebx
lea ecx, [ebp - 0x94]
call fcn.10016fad
xor eax, eax
lea ecx, [ebp - 0x94]
push eax
call fcn.10016fad
push ebx
lea ecx, [ebp - 0x94]
call fcn.10016fad
xor eax, eax
lea ecx, [ebp - 0x94]
push eax
call fcn.10016fad
push ebx
lea ecx, [ebp - 0x94]
call fcn.10016fad
push ebx
lea ecx, [ebp - 0x94]
call fcn.10016fad
push ebx
lea ecx, [ebp - 0x94]
call fcn.10016fad
push ebx
lea ecx, [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
call fcn.10016fad
mov esi, eax
lea ecx, [ebp - 0x94]
xor eax, eax
push eax
call fcn.10016fad
mov ecx, dword [esi]
push 7
add ecx, dword [eax]
pop eax
cmp ecx, eax
sbb eax, eax
neg eax
cmp dword [ebp - 0x10], eax
jg 0x10030a98
push ebx
lea ecx, [ebp - 0x94]
call fcn.10016fad
cmp dword [eax], 0
je 0x10030a98
mov esi, ebx
xor eax, eax
jmp 0x10030a9c
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x94]
call fcn.10016fad
mov eax, dword [eax]
add eax, 0xac2d51bb
add eax, esi
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10030ae8
mov dword [ebp - 0x40], 0xa9c1c73b
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
neg edx
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, ebx
setl al
mov dword [ebp - 0x10], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff0
mov ecx, 0xffff
je 0x10030abb
or esi, 0xffffffff
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], esi
call fcn.10016fa8
mov dword [ebp - 0x28], ebx
xor eax, eax
push 4
pop ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], 0x39523dd9
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x1c], eax
jmp 0x10030b2f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x14e0], 0xee91
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10030b1e
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x3c]
sub edx, eax
mov eax, dword [ebp - 0x50]
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x10]
push 4
setle cl
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0xbf8]
cmp dword [ebp - 0x10], 0x9a8551b3
sbb eax, eax
neg eax
neg eax
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x30], 0xfffffffd
call fcn.10016f3c
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x40], 0xf7f3e76e
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10030bca
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x948], 0x77dd6887
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10030bb2
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10030bec
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x14a0], 4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10030bd3
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10030c11
push dword [ebp - 0x24]
lea ecx, [ebp - 0xbf8]
call fcn.10016fad
or dword [eax], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10030bf5
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10030c27
push 0xeb4
push 0x61f
push eax
call edi
push esi
lea ecx, [ebp - 0xbf8]
call fcn.10016fad
mov edx, dword [eax]
lea ecx, [edx + 1]
mov dword [eax], ecx
test edx, edx
je 0x10030c5d
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x10030c4f
cmp dword [ebp - 0x948], eax
je 0x10030c4f
mov eax, ebx
mov dword [ebp - 0x948], eax
neg eax
je 0x10030c5d
mov ecx, ebx
jmp 0x10030c61
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x50]
add eax, ecx
lea ecx, [ebp - 0xbf8]
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016fa8
movdqa xmm0, xmmword [0x10007a80]
lea eax, [ebp - 0x11e4]
push eax
lea eax, [ebp - 0x11f4]
push eax
lea ecx, [ebp - 0x1340]
movdqu xmmword [ebp - 0x11f4], xmm0
call fcn.10016fbc
lea ecx, [ebp - 0x24e]
mov esi, eax
call fcn.10008913
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x126c]
push dword [esi]
call fcn.10016f7e
push 3
pop esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0xa48]
mov dword [ebp - 0x10], ebx
xor eax, eax
mov dword [ebp - 0x30], 0xbf25cbd9
mov dword [ebp - 0x30], 0xf1813f1a
mov dword [ebp - 0x30], 0xb2006887
mov dword [ebp - 0x30], 0x15aa961
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
or eax, 0xffffffff
mov dword [ebp - 0x30], 0xd82c32b9
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x378f1e0c
push 4
call fcn.10016f3c
xor eax, eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10030d39
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa48]
call fcn.10016fad
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10030d1e
xor eax, eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x10030d73
mov dword [ebp - 0x30], 0xffffffff
lea ecx, [ebp - 0xa48]
mov dword [ebp - 0x30], 0x946507e6
mov dword [ebp - 0x30], 0xe66c619a
mov dword [ebp - 0x30], 0xa4df6f97
push eax
call fcn.10016fad
push 0
dec dword [eax]
dec dword [ebp - 0x10]
pop eax
jns 0x10030d41
lea ecx, [ebp - 0xa48]
call fcn.10016fa8
or eax, 0xffffffff
lea ecx, [ebp - 0x126c]
mov dword [ebp - 4], eax
call fcn.10016fa8
mov dword [ebp - 0x20], 0x2b165808
lea ecx, [ebp - 0x8bc]
mov dword [ebp - 0x24], 0xdc41fd9d
push 4
call fcn.10016f3c
mov dword [ebp - 4], 5
or eax, 0xffffffff
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x40], 0x5d1cc0c7
mov dword [ebp - 0x1c], eax
jmp 0x10030dd9
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x8bc]
call fcn.10016fad
or dword [eax], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10030dc5
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], 0xf792
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10030e02
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10030e13
mov edx, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jl 0x10030f4f
mov dword [ebp - 0x50], 0x105807c1
lea ecx, [ebp - 0x508]
push esi
call fcn.10016f3c
push 6
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10030e77
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x508]
call fcn.10016fad
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10030e59
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10030e91
mov dword [ebp - 0x50], 0x85d06f62
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x24]
je 0x10030e91
xor eax, eax
mov edx, eax
jmp 0x10030e93
mov edx, ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x8bc]
push dword [ebp - 0x24]
call fcn.10016fad
mov ecx, dword [ebp - 0x20]
inc ecx
mov eax, dword [eax]
add eax, ecx
xor ecx, ecx
cmp eax, 0xfffffffa
setg cl
xor eax, eax
cmp ecx, 0xa260df39
lea ecx, [ebp - 0x8bc]
setne al
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x24]
call fcn.10016fad
mov ecx, dword [ebp - 0x3c]
cmp dword [eax], ecx
je 0x10030eea
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x3c], eax
je 0x10030eec
mov esi, ebx
push ebx
lea ecx, [ebp - 0x508]
call fcn.10016fad
mov ecx, dword [ebp - 0x40]
xor edx, edx
cmp esi, ecx
sete dl
xor ecx, ecx
cmp edx, 0x4763
setg cl
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x508]
setge bl
xor eax, eax
inc eax
push eax
call fcn.10016fad
lea ecx, [ebp - 0x508]
mov dword [eax], ebx
xor ebx, ebx
inc ebx
push ebx
call fcn.10016fad
lea ecx, [ebp - 0x508]
mov byte [ebp - 4], 5
call fcn.10016fa8
dec dword [ebp - 0x24]
push 3
pop esi
jns 0x10030e36
or esi, 0xffffffff
lea ecx, [ebp - 0x8bc]
mov dword [ebp - 4], esi
call fcn.10016fa8
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], 0x7b09f595
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10030f8c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x84], 0x4fd3df75
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10030f74
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10030fae
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x13f8], 0x3f36fc75
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10030f95
xor eax, eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xffffffe3
jg 0x1003118c
push 2
lea ecx, [ebp - 0x4b0]
call fcn.10016f3c
push 7
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x7cc]
mov dword [ebp - 0x28], esi
push ebx
call fcn.10016f3c
xor eax, eax
mov byte [ebp - 4], 8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1003100d
push dword [ebp - 0x24]
lea ecx, [ebp - 0x4b0]
call fcn.10016fad
mov dword [eax], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10030ff2
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10031029
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x194], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10031015
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10031041
push dword [ebp - 0x24]
lea ecx, [ebp - 0x7cc]
call fcn.10016fad
mov dword [eax], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1003102e
push ebx
lea ecx, [ebp - 0x4b0]
call fcn.10016fad
mov ecx, dword [ebp - 0x84]
xor edx, edx
cmp ecx, dword [eax]
setl dl
xor eax, eax
mov dword [ebp - 0x194], edx
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x1003115e
push eax
lea ecx, [ebp - 0x7cc]
mov dword [ebp - 0x3c], eax
call fcn.10016fad
inc dword [eax]
jne 0x100310eb
xor eax, eax
lea ecx, [ebp - 0x7cc]
push eax
call fcn.10016fad
xor ecx, ecx
cmp dword [eax], 0xf321
sete cl
xor eax, eax
add ecx, 0x3cfcb8f
cmp ecx, 0xd66e
mov ecx, ebx
setl al
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x100310be
mov ecx, eax
xor eax, eax
cmp ecx, 0x4020
lea ecx, [ebp - 0x4b0]
setl al
neg eax
mov dword [ebp - 0x13f4], eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push dword [ebp - 0x28]
call fcn.10016fad
xor eax, eax
mov esi, eax
jmp 0x100310ed
mov esi, ebx
push ebx
lea ecx, [ebp - 0x4b0]
call fcn.10016fad
xor edx, edx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x194]
jle 0x1003111e
push ebx
lea ecx, [ebp - 0x4b0]
call fcn.10016fad
push dword [ebp - 0x28]
lea ecx, [ebp - 0x4b0]
call fcn.10016fad
mov ecx, dword [ebp - 0x3c]
push 0
sub ecx, dword [eax]
mov eax, dword [ebp - 0x194]
neg ecx
sbb ecx, ecx
inc ecx
imul edx, ecx, 0xce3f
xor ecx, ecx
cmp edx, eax
pop eax
setne cl
mov dword [ebp - 0x194], ecx
dec dword [ebp - 0x28]
jns 0x10031073
or esi, 0xffffffff
lea ecx, [ebp - 0x7cc]
call fcn.10016fa8
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 4], esi
call fcn.10016fa8
dec dword [ebp - 0x84]
cmp dword [ebp - 0x84], 0xffffffe3
jle 0x10030fc1
xor eax, eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x20], 0xcd453606
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x40], 0xfffffffd
push 3
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x100311c7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x17c], 0xfffffff7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100311af
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100311e7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa60], 0xae446f94
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100311cf
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, 0xb0121307
push 2
pop ecx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x100313a9
jmp 0x10031205
xor eax, eax
mov dword [ebp - 0x24], 0x98311173
mov dword [ebp - 0x24], eax
jmp 0x1003138d
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0xcf4]
mov dword [ebp - 0x50], edx
push 4
call fcn.10016f3c
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1003125f
push dword [ebp - 0x28]
lea ecx, [ebp - 0xcf4]
call fcn.10016fad
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10031240
xor eax, eax
dec dword [ebp - 0x34]
push 2
mov dword [ebp - 0x34], eax
pop ecx
jmp 0x10031368
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jl 0x10031365
mov dword [ebp - 0x10], 0x3ffaf072
mov dword [ebp - 0x48], 0xffff
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x1003135c
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x100312ba
push eax
push 0x212e
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xcf4]
push esi
mov eax, dword [ebp + eax*4 - 0x17c]
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x17c]
xor eax, eax
inc eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x17c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x178]
call fcn.10016fad
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
push 0
mov eax, dword [ebp + eax*4 - 0x17c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x17c]
setg dl
imul ecx, edx, 0xffff
xor edx, edx
cmp ecx, eax
setg dl
or eax, 0xffffffff
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
add eax, ecx
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x10]
pop eax
jns 0x100312a1
push 2
pop ecx
dec dword [ebp - 0x18]
jns 0x10031287
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jle 0x1003126d
or eax, 0xffffffff
lea ecx, [ebp - 0xcf4]
mov dword [ebp - 4], eax
call fcn.10016fa8
inc dword [ebp - 0x24]
mov edx, 0xb0121307
push 2
pop ecx
cmp dword [ebp - 0x24], ecx
jle 0x10031214
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x17c]
dec dword [ebp - 0x20]
jns 0x10031203
mov eax, dword [ebp - 0x17c]
xor eax, eax
cmp dword [ebp - 0x178], eax
jne 0x1003140b
mov eax, dword [ebp - 0x17c]
xor ecx, ecx
mov eax, dword [ebp - 0xa58]
cmp eax, 0xb8378c3a
mov eax, dword [ebp - 0x1c]
setne cl
add eax, ecx
cmp eax, dword [ebp - 0x1c]
jle 0x100313f2
xor eax, eax
cmp dword [ebp - 0x178], eax
je 0x100313f4
cmp dword [ebp - 0xa58], eax
je 0x100313f4
xor esi, esi
inc esi
mov eax, esi
jmp 0x100313f7
xor eax, eax
xor esi, esi
inc esi
mov dword [ebp - 0x20], 0xbdd2
neg eax
cmp dword [ebp - 0x20], eax
jle 0x1003140e
xor eax, eax
mov ecx, eax
jmp 0x10031410
xor esi, esi
inc esi
mov ecx, esi
mov dword [ebp - 0xa60], ecx
xor edx, edx
mov eax, dword [ebp - 0x174]
cmp eax, ecx
mov eax, dword [ebp - 0x17c]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x1c]
setge cl
add edx, ecx
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x178]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
sub edx, eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x18], 0xffffffe3
jmp 0x10031523
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0xfffffff0
jmp 0x10031516
or eax, 0xffffffff
lea ecx, [ebp - 0xc10]
mov dword [ebp - 0x28], eax
push 4
call fcn.10016f3c
xor eax, eax
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x100314c5
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xc10]
call fcn.10016fad
mov dword [eax], 0x365653d4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100314a6
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x100314fc
mov dword [ebp - 0x1c], 0x55cc25b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x100314f9
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xc10]
call fcn.10016fad
mov dword [eax], 0x88eb9876
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100314da
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jge 0x100314ca
or eax, 0xffffffff
lea ecx, [ebp - 0xc10]
mov dword [ebp - 4], eax
call fcn.10016fa8
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffff2
jge 0x10031481
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x13
jl 0x10031472
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1003154e
push eax
push eax
push 0x1002
push 0x1d33
call ebx
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
xor eax, eax
mov dword [ebp - 0x44], 4
or edx, 0xffffffff
mov dword [ebp - 0x34], 0x39523dd9
mov dword [ebp - 0x20], 0x643cdf98
mov dword [ebp - 0x3c], 0x59ec1348
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x30], 0x1993e367
mov dword [ebp - 0x30], 0x6842a457
mov dword [ebp - 0x50], 0xfc58ac37
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100315b4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x294], 0xc93b4e1a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1003159b
xor eax, eax
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], eax
jl 0x100316fb
mov dword [ebp - 0x1c], edx
xor ecx, ecx
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x30], 0x5c2da50e
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 0x9369e1d6
mov eax, dword [ebp - 0x294]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x294]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x294]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x294]
mov eax, dword [ebp - 0x28c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x294]
cmp eax, esi
sete cl
imul ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x294]
sub eax, ecx
mov ecx, 0xe00457a2
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x290]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
cmp eax, 7
setg cl
xor eax, eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jne 0x10031688
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x294]
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x290]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp eax, 8
setg cl
xor eax, eax
cmp edx, ecx
jg 0x100317f3
mov dword [ebp - 0x24], eax
jmp 0x100316e6
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x100316e3
push eax
push 0x1425
push eax
push 0x772
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xc
jl 0x100316c6
or edx, 0xffffffff
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x100315c4
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031713
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], 0xfffffff8
jge 0x100317c3
movdqa xmm0, xmmword [0x10007a50]
lea ecx, [ebp - 0x13b8]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x10a4]
push eax
lea eax, [ebp - 0x10b4]
push eax
movdqu xmmword [ebp - 0x10b4], xmm0
call fcn.10016fbc
lea ecx, [ebp - 0x209]
mov esi, eax
call fcn.10008913
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xff4]
push dword [esi]
call fcn.10016f7e
xor eax, eax
mov dword [ebp - 4], 0xb
inc eax
lea ecx, [ebp - 0xff4]
push eax
call fcn.10016fad
mov edx, dword [ebp - 0x40]
mov esi, eax
mov ecx, dword [ebp - 0x28]
xor eax, eax
cmp ecx, edx
mov ecx, dword [ebp - 0x28]
setne al
xor edx, edx
cmp ecx, eax
lea ecx, [ebp - 0xff4]
setl dl
or eax, 0xffffffff
mov dword [esi], edx
mov dword [ebp - 4], eax
call fcn.10016fa8
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff8
push 0
pop eax
jl 0x10031724
xor esi, esi
inc esi
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x100317e7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x908], 0xc85f70ad
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100317ce
xor eax, eax
mov dword [ebp - 0x900], 0x18
jmp 0x10031829
mov dword [ebp - 0x30], 0x75d1
or edx, 0xffffffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], edx
inc dword [ebp - 0x50]
jmp 0x100316ef
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031823
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
xor eax, eax
dec dword [ebp - 0x900]
cmp dword [ebp - 0x900], 9
jle 0x10031811
push 2
lea ecx, [ebp - 0xa4]
call fcn.10016f3c
mov dword [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x28], 0x21dfe4b2
mov dword [ebp - 0x1c], 0x64d9248e
mov dword [ebp - 0x1c], eax
jmp 0x1003186c
push dword [ebp - 0x1c]
call fcn.10016fad
mov dword [eax], 0xfffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
lea ecx, [ebp - 0xa4]
jl 0x1003185b
push esi
call fcn.10016fad
push esi
lea ecx, [ebp - 0xa4]
call fcn.10016fad
cmp dword [eax], 0
je 0x100318db
xor eax, eax
lea ecx, [ebp - 0xa4]
push eax
call fcn.10016fad
xor eax, eax
lea ecx, [ebp - 0xa4]
push eax
call fcn.10016fad
push esi
lea ecx, [ebp - 0xa4]
call fcn.10016fad
push esi
lea ecx, [ebp - 0xa4]
call fcn.10016fad
push esi
lea ecx, [ebp - 0xa4]
call fcn.10016fad
push esi
lea ecx, [ebp - 0xa4]
call fcn.10016fad
xor eax, eax
lea ecx, [ebp - 0xa4]
push eax
call fcn.10016fad
push esi
lea ecx, [ebp - 0xa4]
call fcn.10016fad
xor eax, eax
lea ecx, [ebp - 0xa4]
push eax
call fcn.10016fad
push esi
lea ecx, [ebp - 0xa4]
call fcn.10016fad
push esi
lea ecx, [ebp - 0xa4]
call fcn.10016fad
push esi
lea ecx, [ebp - 0xa4]
call fcn.10016fad
push esi
lea ecx, [ebp - 0xa4]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
call fcn.10016fad
mov esi, eax
lea ecx, [ebp - 0xa4]
xor eax, eax
push eax
call fcn.10016fad
mov ecx, dword [esi]
push 7
add ecx, dword [eax]
pop eax
cmp ecx, eax
sbb eax, eax
neg eax
cmp dword [ebp - 0x28], eax
jg 0x10031972
xor esi, esi
lea ecx, [ebp - 0xa4]
inc esi
push esi
call fcn.10016fad
cmp dword [eax], 0
je 0x10031972
xor eax, eax
jmp 0x10031976
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xa4]
call fcn.10016fad
mov eax, dword [eax]
add eax, 0xac2d51bb
add eax, esi
xor esi, esi
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
inc esi
cmp dword [ebp - 0x1c], 0xfffffff0
jne 0x100319d0
mov dword [ebp - 0x40], 0xa9c1c73b
mov ecx, 0xffff
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
neg edx
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, esi
setl al
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x1c]
jmp 0x10031996
or eax, 0xffffffff
lea ecx, [ebp - 0xa4]
mov dword [ebp - 4], eax
call fcn.10016fa8
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100319f9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1520], 0xee91
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100319e8
push 2
lea ecx, [ebp - 0xce8]
call fcn.10016f3c
or eax, 0xffffffff
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x1c], eax
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10031a49
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xce8]
call fcn.10016fad
mov dword [eax], 0xdf99ff60
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10031a2a
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10031adc
mov dword [ebp - 0x50], 0xfffffffb
lea ecx, [ebp - 0xa78]
push 2
call fcn.10016f3c
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10031a93
push dword [ebp - 0x28]
lea ecx, [ebp - 0xa78]
call fcn.10016fad
mov dword [eax], 0x6141e4f1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x10031a74
xor eax, eax
push eax
lea ecx, [ebp - 0xce8]
call fcn.10016fad
xor eax, eax
lea ecx, [ebp - 0xa78]
push eax
call fcn.10016fad
mov ecx, dword [ebp - 0x50]
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0xa78]
setne dl
dec eax
neg eax
sbb eax, eax
inc eax
add edx, eax
mov dword [ebp - 0x40], edx
mov byte [ebp - 4], 0xd
call fcn.10016fa8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10031a51
or eax, 0xffffffff
lea ecx, [ebp - 0xce8]
mov dword [ebp - 4], eax
call fcn.10016fa8
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x44]
sub edx, eax
mov eax, dword [ebp - 0x50]
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x34]
push 4
setle cl
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x320]
cmp dword [ebp - 0x34], 0x9a8551b3
sbb eax, eax
neg eax
neg eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1c], 5
call fcn.10016f3c
xor eax, eax
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10031b8c
push dword [ebp - 0x10]
lea ecx, [ebp - 0x320]
call fcn.10016fad
mov dword [eax], 0xf2121f90
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10031b6d
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031ba5
push eax
push eax
push 0x20ee
call ebx
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x320]
inc dword [ebp - 0x1c]
push 3
call fcn.10016fad
push esi
lea ecx, [ebp - 0x320]
call fcn.10016fad
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x320]
push 3
imul esi, dword [eax]
call fcn.10016fad
xor ecx, ecx
push 3
cmp esi, dword [eax]
setl cl
xor ebx, ebx
test ecx, ecx
lea ecx, [ebp - 0x320]
setg bl
call fcn.10016fad
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, ebx
push 6
setl dl
pop ecx
cmp edx, ecx
lea ecx, [ebp - 0x320]
sbb esi, esi
inc esi
sub esi, dword [eax]
neg esi
sbb esi, esi
xor ebx, ebx
inc ebx
inc esi
push ebx
call fcn.10016fad
push 3
lea ecx, [ebp - 0x320]
mov eax, dword [eax]
imul eax, esi
imul esi, eax, 0x1085
call fcn.10016fad
lea ecx, [ebp - 0x320]
mov dword [eax], esi
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.10016fa8
mov dword [ebp - 0x50], esi
lea ecx, [ebp - 0xa90]
mov dword [ebp - 0x30], 0xfffffffd
push 4
call fcn.10016f3c
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x40], 0xf7f3e76e
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10031c8e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x9a8], 0x77dd6887
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10031c75
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10031cb0
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1464], 4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10031c97
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10031cd4
push dword [ebp - 0x24]
lea ecx, [ebp - 0xa90]
call fcn.10016fad
mov dword [eax], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10031cb9
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031cea
push 0xeb4
push 0x61f
push eax
call edi
push 2
lea ecx, [ebp - 0xa90]
call fcn.10016fad
mov edx, dword [eax]
lea ecx, [edx + 1]
mov dword [eax], ecx
test edx, edx
je 0x10031d21
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x10031d13
cmp dword [ebp - 0x9a8], eax
je 0x10031d13
mov eax, ebx
mov dword [ebp - 0x9a8], eax
neg eax
je 0x10031d21
mov ecx, ebx
jmp 0x10031d25
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x50]
add eax, ecx
lea ecx, [ebp - 0xa90]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], esi
call fcn.10016fa8
mov edi, dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x10031d57
push eax
push eax
call edi
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031d6c
push 0x12b1
push eax
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
movdqa xmm0, xmmword [0x10007a80]
lea eax, [ebp - 0x1164]
push eax
lea eax, [ebp - 0x1174]
push eax
lea ecx, [ebp - 0x13c8]
movdqu xmmword [ebp - 0x1174], xmm0
call fcn.10016fbc
lea ecx, [ebp - 0x219]
mov esi, eax
call fcn.10008913
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x12e4]
push dword [esi]
call fcn.10016f7e
mov dword [ebp - 4], 0x11
lea ecx, [ebp - 0xc28]
mov dword [ebp - 0x10], ebx
xor eax, eax
mov dword [ebp - 0x30], 0xbf25cbd9
or esi, 0xffffffff
mov dword [ebp - 0x30], 0xf1813f1a
mov dword [ebp - 0x30], 0xb2006887
mov dword [ebp - 0x30], 0x15aa961
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0xd82c32b9
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 0x378f1e0c
push 4
call fcn.10016f3c
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10031e30
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc28]
call fcn.10016fad
mov dword [eax], 3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10031e11
xor eax, eax
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], eax
jl 0x10031e6a
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0xc28]
mov dword [ebp - 0x30], 0x946507e6
mov dword [ebp - 0x30], 0xe66c619a
mov dword [ebp - 0x30], 0xa4df6f97
push eax
call fcn.10016fad
push 0
dec dword [eax]
dec dword [ebp - 0x10]
pop eax
jns 0x10031e3c
lea ecx, [ebp - 0xc28]
call fcn.10016fa8
lea ecx, [ebp - 0x12e4]
mov dword [ebp - 4], esi
call fcn.10016fa8
mov dword [ebp - 0x34], ebx
xor eax, eax
mov dword [ebp - 0x3c], 0xfadacd7d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031eb1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe08], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031e98
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffec
jle 0x10031f9e
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0xaa8]
push 3
call fcn.10016f3c
xor eax, eax
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031efb
push dword [ebp - 0x10]
lea ecx, [ebp - 0xaa8]
call fcn.10016fad
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031ee0
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10031f2c
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
cmp eax, 9
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
cmp ecx, eax
setg dl
mov dword [ebp - 0xe04], edx
mov eax, dword [ebp - 0x1c]
imul eax, edx
test eax, eax
jne 0x10031f2c
mov ecx, eax
jmp 0x10031f2e
mov ecx, ebx
mov eax, dword [ebp - 0x3c]
sub ecx, eax
sub ecx, dword [ebp - 0x1c]
je 0x10031f3b
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0xaa8]
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
mov eax, dword [ebp - 0xe00]
cmp eax, 0x59229a27
push 2
setg bl
call fcn.10016fad
mov ecx, dword [ebp - 0x34]
mov esi, eax
xor eax, eax
cmp ebx, ecx
mov ecx, dword [ebp - 0x1c]
setne al
push 8
pop edx
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esi], ecx
or esi, 0xffffffff
lea ecx, [ebp - 0xaa8]
mov dword [ebp - 4], esi
call fcn.10016fa8
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffec
push 1
pop ebx
jg 0x10031ebe
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10031fb2
push 0x1867
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x1c], 5
lea ecx, [ebp - 0x3e4]
push 4
call fcn.10016f3c
xor eax, eax
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10031ff7
push dword [ebp - 0x10]
lea ecx, [ebp - 0x3e4]
call fcn.10016fad
mov dword [eax], 0xf2121f90
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10031fd8
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10032014
push eax
push eax
push 0x20ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x3e4]
inc dword [ebp - 0x1c]
push 3
call fcn.10016fad
push ebx
lea ecx, [ebp - 0x3e4]
call fcn.10016fad
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x3e4]
push 3
imul esi, dword [eax]
call fcn.10016fad
xor ecx, ecx
push 3
cmp esi, dword [eax]
setl cl
xor ebx, ebx
test ecx, ecx
lea ecx, [ebp - 0x3e4]
setg bl
call fcn.10016fad
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, ebx
push 6
setl dl
pop ecx
cmp edx, ecx
lea ecx, [ebp - 0x3e4]
sbb esi, esi
inc esi
sub esi, dword [eax]
neg esi
sbb esi, esi
xor eax, eax
inc eax
inc esi
push eax
call fcn.10016fad
push 3
pop ebx
push ebx
mov eax, dword [eax]
lea ecx, [ebp - 0x3e4]
imul eax, esi
imul esi, eax, 0x1085
call fcn.10016fad
lea ecx, [ebp - 0x3e4]
mov dword [eax], esi
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.10016fa8
mov dword [ebp - 0x20], esi
mov eax, 0x1f6f0842
mov dword [ebp - 0x754], eax
mov dword [ebp - 0x750], eax
mov dword [ebp - 0x74c], eax
mov dword [ebp - 0x748], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x750]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x750], eax
mov dword [ebp - 0x20], 0xa
cmp dword [ebp - 0x20], 0x11
je 0x10032124
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1003211b
push eax
push eax
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x11
jne 0x10032108
movdqa xmm0, xmmword [0x10007a80]
lea eax, [ebp - 0x10c4]
push eax
lea eax, [ebp - 0x10d4]
push eax
lea ecx, [ebp - 0x1378]
movdqu xmmword [ebp - 0x10d4], xmm0
call fcn.10016fbc
lea ecx, [ebp - 0x1f1]
mov esi, eax
call fcn.10008913
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1284]
push dword [esi]
call fcn.10016f7e
mov dword [ebp - 4], 0x15
lea ecx, [ebp - 0xd60]
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x30], 0xbf25cbd9
mov dword [ebp - 0x30], 0xf1813f1a
mov dword [ebp - 0x30], 0xb2006887
mov dword [ebp - 0x30], 0x15aa961
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
or eax, 0xffffffff
mov dword [ebp - 0x30], 0xd82c32b9
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x378f1e0c
push 4
call fcn.10016f3c
xor eax, eax
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100321e7
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd60]
call fcn.10016fad
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100321cc
xor eax, eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x10032221
mov dword [ebp - 0x30], 0xffffffff
lea ecx, [ebp - 0xd60]
mov dword [ebp - 0x30], 0x946507e6
mov dword [ebp - 0x30], 0xe66c619a
mov dword [ebp - 0x30], 0xa4df6f97
push eax
call fcn.10016fad
push 0
dec dword [eax]
dec dword [ebp - 0x10]
pop eax
jns 0x100321ef
lea ecx, [ebp - 0xd60]
call fcn.10016fa8
or eax, 0xffffffff
lea ecx, [ebp - 0x1284]
mov dword [ebp - 4], eax
call fcn.10016fa8
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x10032253
push eax
push eax
call edi
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10032268
push 0x12b1
push eax
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
mov dword [ebp - 0x18], 0xa75c19c5
lea ecx, [ebp - 0xac0]
mov dword [ebp - 0x28], 0xfa72c25
mov dword [ebp - 0x24], 0xfffffff6
push ebx
call fcn.10016f3c
xor eax, eax
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x10], eax
jmp 0x100322ae
push dword [ebp - 0x10]
lea ecx, [ebp - 0xac0]
call fcn.10016fad
mov dword [eax], 0xd1a4e665
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032297
mov dword [ebp - 0x28], 0xfb37
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
neg eax
mov ebx, dword [sym.imp.USER32.dll_GetDC]
sbb eax, eax
neg ecx
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setne cl
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
cmp eax, esi
jl 0x1003233e
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10032333
mov dword [ebp - 0x40], 0x5467356a
mov dword [ebp - 0x24], 2
cmp dword [ebp - 0x24], eax
jl 0x10032330
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x24]
jns 0x10032328
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x10032315
jmp 0x100324ad
mov dword [ebp - 0x10], 0x79e56e62
xor eax, eax
mov dword [ebp - 0x1c], 0xcaeaba4a
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x24], 0xffffffec
jmp 0x1003237f
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1003237c
push eax
push eax
push 0x5f3
push eax
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff2
jne 0x10032361
push eax
lea ecx, [ebp - 0xac0]
call fcn.10016fad
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x100323b8
mov eax, dword [ebp - 0x10]
mov ecx, 0xffff
sub eax, 0x5a74d4b4
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x10]
cmp eax, ecx
jae 0x100323b6
mov eax, esi
jmp 0x100323b8
xor eax, eax
imul ecx, eax, 0x6a08
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setl dl
add edx, dword [ebp - 0x24]
je 0x100323f4
mov dword [ebp - 0x40], 0x8629342b
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x100324ad
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
jmp 0x100324ad
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x40], 0x84125dbf
mov dword [ebp - 0x1c], eax
jmp 0x100324a3
mov dword [ebp - 0x24], 0xffffffe3
jmp 0x10032462
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
cmp eax, esi
setl cl
xor eax, eax
add ecx, 0xdfd7
cmp ecx, 0xcf86
setge al
xor ecx, ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
cmp eax, 0x3781cdff
mov eax, dword [ebp - 0x40]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, 0xffd02046
setne al
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], 0xfffffffd
jg 0x1003240f
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x100324a0
push 0xc9c
push 0xab
push 0x8f0
push 0xf9e
push 0x193c
push 0x1283
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x32
jle 0x10032406
or eax, 0xffffffff
lea ecx, [ebp - 0xac0]
mov dword [ebp - 4], eax
call fcn.10016fa8
mov dword [ebp - 0x18], 0xe83c773
xor eax, eax
mov dword [ebp - 0x30], 0xc9ebf495
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100324f0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1494], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100324d7
xor eax, eax
mov dword [ebp - 0x18], eax
mov ecx, 0xfff8
jmp 0x1003252f
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x2c], 0xd416db6d
cmp dword [ebp - 0x40], eax
je 0x1003250e
mov dword [ebp - 0x2c], esi
jmp 0x1003252c
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1003252c
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
xor eax, eax
mov ecx, 0xfff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x100324fa
mov edi, dword [sym.imp.USER32.dll_GetWindowInfo]
mov dword [ebp - 0x18], 9
cmp dword [ebp - 0x18], 0xfffffff8
jg 0x100325ef
movdqa xmm0, xmmword [0x10007aa0]
lea eax, [ebp - 0x11c4]
push eax
lea eax, [ebp - 0x11d4]
push eax
lea ecx, [ebp - 0x1400]
movdqu xmmword [ebp - 0x11d4], xmm0
call fcn.10016fbc
lea ecx, [ebp - 0x228]
mov esi, eax
call fcn.10008913
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x12cc]
push dword [esi]
call fcn.10016f7e
xor eax, eax
mov dword [ebp - 0x50], 0x3a00d0e7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100325be
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1388], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100325a5
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x100325d1
or eax, 0xffffffff
lea ecx, [ebp - 0xc40]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0xaa9ac70c
mov dword [ebp - 0x50], 0x229edca8
push esi
call fcn.10016f3c
xor eax, eax
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x10], eax
jmp 0x10032634
cmp dword [ebp - 0x10], esi
jl 0x1003261d