Function at 0x1002c8b6
Capabilities:
Allocate thread local storage
Check for time delay via queryperformancecounter
Compare security identifiers
Enumerate files on windows
Enumerate gui resources
Get common file path
Get geographical location
Query environment variable
Terminate process

Disassembly:
mov eax, 0x100830cd
call fcn.10082a58
mov eax, 0x10a4
call fcn.10069430
push ebx
push esi
push edi
push 2
mov dword [ebp - 0x10], 0x2ee76f50
xor eax, eax
pop edi
mov dword [ebp - 0x48], 0x5e314a5e
mov dword [ebp - 0x10], eax
push 1
mov byte [ebp - 0x5d], dl
mov dword [ebp - 0x5c], ecx
pop esi
cmp dword [ebp - 0x10], edi
jge 0x1002c905
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x270], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002c8f1
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002c925
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5b0], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002c90d
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_ShowCursor]
mov edx, 0xfab8c3ad
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x10], esi
jg 0x1002ca8c
mov dword [ebp - 0x2b8], edx
mov dword [ebp - 0x2b4], edx
mov dword [ebp - 0x2b0], edx
mov dword [ebp - 0x2ac], edx
mov dword [ebp - 0x14], 0x19e9
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2b8], esi
cmp dword [ebp - 0x2b8], eax
jl 0x1002c9f0
jmp 0x1002c979
xor eax, eax
mov dword [ebp - 0x4c], 0xbdfadf62
cmp dword [ebp - 0x10], eax
jne 0x1002c9b7
mov eax, dword [ebp - 0x2b4]
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x2b8]
mov ecx, dword [ebp + eax*4 - 0x270]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setg dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x270]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2b8]
mov eax, dword [ebp + eax*4 - 0x270]
imul eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x1002c9e8
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002c9e3
push esi
call ebx
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1002c9d5
dec dword [ebp - 0x2b8]
jns 0x1002c977
mov ecx, dword [ebp - 0x26c]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setne dl
imul eax, edx
mov dword [ebp - 0x2b8], eax
test eax, eax
je 0x1002ca1e
xor eax, eax
cmp dword [ebp - 0x270], eax
je 0x1002ca20
mov ecx, esi
jmp 0x1002ca22
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x10]
mov edx, 0xfab8c3ad
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x10]
neg ecx
mov eax, dword [ebp - 0x26c]
sbb ecx, ecx
xor eax, eax
neg ecx
cmp eax, ecx
push 0
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x8f7cf8fb
setne cl
mov dword [ebp - 0x5b0], ecx
mov eax, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x10]
pop eax
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x10], esi
jle 0x1002c93f
or ecx, ecx
mov dword [ebp - 0x10], 0x2ee76f50
mov dword [ebp - 0x48], 0x5e314a5e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002cab6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x23c], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002caa2
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002cad6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5b8], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002cabe
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jg 0x1002cc2d
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 0x14], 0x19e9
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x288], esi
cmp dword [ebp - 0x288], eax
jl 0x1002cb93
jmp 0x1002cb1c
xor eax, eax
mov dword [ebp - 0x4c], 0xbdfadf62
cmp dword [ebp - 0x10], eax
jne 0x1002cb5a
mov eax, dword [ebp - 0x284]
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp + eax*4 - 0x23c]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setg dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x288]
mov eax, dword [ebp + eax*4 - 0x23c]
imul eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x1002cb8b
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002cb86
push esi
call ebx
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1002cb78
dec dword [ebp - 0x288]
jns 0x1002cb1a
mov ecx, dword [ebp - 0x238]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setne dl
imul eax, edx
mov dword [ebp - 0x288], eax
test eax, eax
je 0x1002cbc1
xor eax, eax
cmp dword [ebp - 0x23c], eax
je 0x1002cbc3
mov ecx, esi
jmp 0x1002cbc5
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x10]
mov edx, 0xfab8c3ad
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x280]
mov eax, dword [ebp - 0x10]
neg ecx
mov eax, dword [ebp - 0x238]
sbb ecx, ecx
xor eax, eax
neg ecx
cmp eax, ecx
push 0
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x8f7cf8fb
setne cl
mov dword [ebp - 0x5b8], ecx
mov eax, dword [ebp - 0x238]
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x10]
pop eax
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x10], esi
jle 0x1002cae2
mov dword [ebp - 0x20], 0xca4f833f
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
push 2
pop ebx
jge 0x1002cc58
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x67c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002cc43
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002cc78
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3d0], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002cc60
xor eax, eax
push 7
mov dword [ebp - 0x20], eax
pop ecx
jmp 0x1002cdba
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002cca6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x17c], 0x77dd6887
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002cc8e
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002ccc4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xfb0], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002ccaf
xor eax, eax
mov dword [ebp - 0x17c], ebx
cmp dword [ebp - 0x17c], eax
jl 0x1002cdb7
or ecx, 0xffffffff
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002cd03
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5c4], 0x302aff63
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002cceb
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002cd15
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbec], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002cd08
mov eax, dword [ebp - 0x17c]
cmp dword [ebp + eax*4 - 0x67c], 0
jne 0x1002cd88
mov dword [ebp - 0x4c], 0x8694a219
xor ebx, ebx
mov eax, dword [ebp - 0x4c]
dec dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
push 2
mov eax, dword [ebp + eax*4 - 0x67c]
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov edx, dword [ebp - 0xbe8]
mov eax, dword [ebp - 0x5c4]
setg bl
imul edx, ebx
xor ecx, ecx
pop ebx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x24]
jle 0x1002cd85
mov eax, dword [ebp - 0x17c]
mov eax, dword [ebp + eax*4 - 0x67c]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x3d0]
mov eax, dword [ebp - 0x17c]
push 0
mov eax, dword [ebp + eax*4 - 0x67c]
mov dword [ebp - 0x3d0], 0x57a8360e
dec dword [ebp - 0x17c]
pop eax
jns 0x1002ccd9
push 7
pop ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1002cc83
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002cddd
push eax
push eax
push 0xc1b
push eax
push eax
call edi
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x10], 0xada439be
mov dword [ebp - 0x4c], 6
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 0x16
cmp dword [ebp - 0x10], 0xfffffff2
jl 0x1002cea2
mov dword [ebp - 0x48], 0x80444555
xor eax, eax
mov dword [ebp - 0x4c], 0xf3faa32f
mov dword [ebp - 0x24], 0x1a05132d
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x48], eax
je 0x1002ce2d
cmp dword [ebp - 0x10], eax
jne 0x1002ce2f
mov esi, eax
mov eax, dword [ebp - 0x48]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x48]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x24]
jl 0x1002ce64
cmp dword [ebp - 0x10], eax
je 0x1002ce64
lea ecx, [eax + 1]
jmp 0x1002ce66
mov ecx, eax
xor eax, eax
cmp ecx, 0xdae974ca
sete al
xor ecx, ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp esi, eax
setle cl
xor eax, eax
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002ce92
push eax
call dword [sym.imp.USER32.dll_SetCursor]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff2
push 1
pop esi
jge 0x1002ce09
mov dword [ebp - 0x10], 0x2ee76f50
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffc
or edx, 0xffffffff
mov dword [ebp - 0x48], 0xfffffff9
mov dword [ebp - 0x4c], 0x33ee6768
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002ceda
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbfc], edx
inc dword [ebp - 0x14]
jmp 0x1002cec6
mov dword [ebp - 0x20], 0xfffffffd
jmp 0x1002cf74
mov dword [ebp - 0x14], 0xa654
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x24], 0xc0a9c5a7
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002cf23
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
dec eax
neg eax
sbb eax, eax
neg eax
inc eax
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x20]
jl 0x1002cf23
xor eax, eax
mov ecx, eax
jmp 0x1002cf25
mov ecx, esi
mov eax, dword [ebp - 0x14]
add eax, ecx
cmp eax, 0xc312fbb6
je 0x1002cf38
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002cf3a
mov eax, esi
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002cf6c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbfc], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002cf5f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x17
jne 0x1002cee6
mov dword [ebp - 0x48], 0x5e314a5e
mov dword [ebp - 0x14], 0x1f2c29a3
mov dword [ebp - 0x24], 0xbe76d238
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], 0x3cc25429
mov dword [ebp - 0x24], 0xef068cd5
push 6
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x24], 0xe6fc2e60
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x24], 0x2e6c0b33
mov dword [ebp - 0x24], 0x3f6a0837
mov dword [ebp - 0x24], 0x3cef3392
mov dword [ebp - 0x24], 0x56e623b2
mov dword [ebp - 0x24], 0x8993dd61
push 7
pop eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x24], 0xb4b26d8f
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x24], 0x890ba5fc
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002d049
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbb8], 0xfffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002d031
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x1002d081
mov dword [ebp - 0x24], 0xdb785b64
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002d06d
push 0xfbf
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], 0xd1a4e665
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1002d051
dec dword [ebp - 0x4c]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002d0a0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x260], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d08c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002d0c0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5cc], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002d0a8
xor eax, eax
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2cc], eax
mov dword [ebp - 0x4c], 0xfc3c737e
mov dword [ebp - 0x24], 0xa391de2f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002d106
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbc], 0x8261
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002d0ee
xor eax, eax
mov dword [ebp - 0x2d4], esi
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x2d4], eax
jl 0x1002d257
xor edx, edx
inc edx
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x1002d148
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x98], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002d130
xor eax, eax
mov dword [ebp - 0x98], eax
jmp 0x1002d23f
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x1002d239
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], eax
jl 0x1002d196
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002d18e
push 0x241c
push 0x1aba
call esi
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x1002d170
xor edx, edx
inc edx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], eax
jl 0x1002d230
mov dword [ebp - 0x48], 0x5493e623
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x2d0], eax
je 0x1002d20c
mov ecx, edx
cmp dword [ebp - 0x98], eax
jne 0x1002d1cb
mov ecx, eax
mov eax, dword [ebp - 0x2d8]
imul eax, ecx
test eax, eax
je 0x1002d1e6
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
cmp dword [ebp + eax*4 - 0xbc], ebx
jne 0x1002d1ec
xor eax, eax
xor ebx, ebx
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x10]
je 0x1002d203
cmp dword [ebp - 0x24], ebx
je 0x1002d203
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x48]
inc edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xbc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x10]
jns 0x1002d1a2
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002d162
inc dword [ebp - 0x98]
cmp dword [ebp - 0x98], edx
jle 0x1002d153
dec dword [ebp - 0x2d4]
jns 0x1002d121
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x2d4]
mov ecx, dword [ebp - 0xb8]
sub ecx, eax
mov eax, dword [ebp - 0x2d4]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, eax
xor eax, eax
inc eax
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x2d4], edx
mov eax, dword [ebp - 0xbc]
cmp edx, eax
mov eax, dword [ebp - 0xbc]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xbc]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0xb8]
setg bl
xor ecx, ecx
cmp ebx, eax
setne cl
cmp ecx, dword [ebp - 0xbc]
jl 0x1002d2d5
xor eax, eax
cmp dword [ebp - 0xb8], eax
jne 0x1002d2d5
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x1002d2da
xor ebx, ebx
inc ebx
mov edx, ebx
mov eax, dword [ebp - 0xb8]
xor ecx, ecx
cmp edx, eax
push 4
setl cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
cmp ecx, eax
mov eax, dword [ebp - 0xbc]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ebx
jg 0x1002d77f
jmp 0x1002d332
push 4
pop ecx
mov dword [ebp - 0x30], 0xb1cecb45
mov dword [ebp - 0x24], 0x2abb
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], 0xf2fdad5
mov dword [ebp - 0x4c], 0x79b69b2e
mov dword [ebp - 0x40], 0x17473468
mov dword [ebp - 0x50], 6
mov dword [ebp - 0x810], ecx
mov dword [ebp - 0x80c], ecx
mov dword [ebp - 0x808], ecx
mov dword [ebp - 0x804], ecx
mov dword [ebp - 0x28], 0x4b67
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x14], eax
jmp 0x1002d397
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xfe0], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002d386
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x4c]
jg 0x1002d3bf
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x1002d3c1
mov ecx, ebx
jmp 0x1002d3c3
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x48]
cmp eax, ecx
jne 0x1002d3d1
mov eax, ebx
jmp 0x1002d3d3
xor eax, eax
xor edx, edx
cmp eax, 0x7b332e0c
mov eax, dword [ebp - 0x80c]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x810]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
mov eax, 0xfab8c3ad
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x330], eax
mov dword [ebp - 0x32c], eax
xor eax, eax
mov dword [ebp - 0x20], 0xada439be
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002d452
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x934], 0xbbca
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002d439
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x1002d64d
mov dword [ebp - 0x34], 0x4cdb8faa
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002d47e
push eax
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], eax
jl 0x1002d4a9
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002d4a1
push eax
push 0x23f9
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
dec dword [ebp - 0x34]
jns 0x1002d486
push 3
pop ecx
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], eax
jl 0x1002d644
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x1002d613
mov dword [ebp - 0x38], 0x8d3a18e4
mov dword [ebp - 0x48], 0xca779041
mov dword [ebp - 0x4c], 0xe07ea4c5
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], eax
jl 0x1002d60a
mov dword [ebp - 0x14], 0x17c10977
mov dword [ebp - 0x54], 0xd058bbe5
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002d520
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc08], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002d507
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jg 0x1002d601
mov edx, 0xf15cc7c4
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x934]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x934]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x934]
cmp edx, eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x14]
jge 0x1002d5e7
mov dword [ebp - 0x48], ecx
xor eax, eax
mov dword [ebp - 0x4c], 0x4c3f121f
cmp dword [ebp - 0x34], eax
je 0x1002d58d
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x48]
test eax, eax
je 0x1002d58b
mov esi, ebx
jmp 0x1002d58f
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp eax, 0xff93
mov eax, dword [ebp - 0xc08]
push 3
setle dl
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x34]
cmp eax, edx
setg cl
xor edx, edx
sub esi, ecx
add esi, dword [ebp - 0x4c]
add esi, dword [ebp - 0x54]
mov dword [ebp - 0x24], esi
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x34]
sub ecx, 0x7a5e1371
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, 0xf15cc7c4
setge cl
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x4c], ecx
pop ecx
jmp 0x1002d5f3
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x1002d531
xor eax, eax
dec dword [ebp - 0x38]
jns 0x1002d4f0
dec dword [ebp - 0x1c]
jns 0x1002d4cf
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002d635
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x934], 0x3b7d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002d61c
xor eax, eax
dec dword [ebp - 0x34]
jns 0x1002d4b5
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
dec dword [ebp - 0x20]
jns 0x1002d461
mov dword [ebp - 0x14], 0x19e9
or ecx, 0xffffffff
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x338], ebx
cmp dword [ebp - 0x338], eax
jl 0x1002d6ed
jmp 0x1002d672
xor eax, eax
mov dword [ebp - 0x4c], 0xbdfadf62
cmp dword [ebp - 0x10], eax
jne 0x1002d6b0
mov eax, dword [ebp - 0x334]
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x338]
mov ecx, dword [ebp + eax*4 - 0x260]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setg dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x260]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x338]
mov eax, dword [ebp + eax*4 - 0x260]
imul eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x1002d6e5
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002d6e0
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1002d6ce
dec dword [ebp - 0x338]
jns 0x1002d670
mov ecx, dword [ebp - 0x25c]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setne dl
imul eax, edx
mov dword [ebp - 0x338], eax
test eax, eax
je 0x1002d71b
xor eax, eax
cmp dword [ebp - 0x260], eax
je 0x1002d71d
mov ecx, ebx
jmp 0x1002d71f
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x330]
mov eax, dword [ebp - 0x10]
neg ecx
mov eax, dword [ebp - 0x25c]
sbb ecx, ecx
xor eax, eax
neg ecx
cmp eax, ecx
push 0
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x8f7cf8fb
setne cl
mov dword [ebp - 0x5cc], ecx
mov eax, dword [ebp - 0x25c]
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x10]
pop eax
cmp dword [ebp - 0x10], ebx
jle 0x1002d32f
mov dword [ebp - 0x20], 0xca4f833f
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002d7ab
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x64c], 2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002d792
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002d7cb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3cc], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d7b3
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002d911
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002d7f8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x190], 0x77dd6887
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002d7df
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002d819
push 7
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xff8], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002d804
xor eax, eax
mov dword [ebp - 0x190], 2
cmp dword [ebp - 0x190], eax
jl 0x1002d90e
or ecx, 0xffffffff
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002d85c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5dc], 0x302aff63
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d844
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002d86e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc18], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002d861
mov eax, dword [ebp - 0x190]
cmp dword [ebp + eax*4 - 0x64c], 0
jne 0x1002d8e2
mov dword [ebp - 0x4c], 0x8694a219
xor ebx, ebx
mov eax, dword [ebp - 0x4c]
dec dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x64c]
mov eax, dword [ebp - 0x18c]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18c]
cmp eax, ecx
mov edx, dword [ebp - 0xc14]
mov eax, dword [ebp - 0x5dc]
setg bl
imul edx, ebx
xor ecx, ecx
cmp edx, eax
setg cl
xor ebx, ebx
inc ebx
cmp ecx, dword [ebp - 0x24]
jle 0x1002d8df
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp + eax*4 - 0x64c]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x3cc]
mov eax, dword [ebp - 0x190]
push 0
mov eax, dword [ebp + eax*4 - 0x64c]
mov dword [ebp - 0x3cc], 0x57a8360e
dec dword [ebp - 0x190]
pop eax
jns 0x1002d832
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x1002d7d3
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002d931
push eax
push eax
push 0xc1b
push eax
push eax
call edi
xor eax, eax
mov dword [ebp - 0x34], 0x2ee6d058
or ecx, 0xffffffff
mov dword [ebp - 0x4c], 0xfffffffc
push 2
pop edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x4c], 0xcc09
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x4c], 4
mov dword [ebp - 0x4c], 0xf7762406
mov dword [ebp - 0x24], 0xe525036f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002d984
push 7
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7f0], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002d972
mov eax, dword [ebp - 0x34]
xor edx, edx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setne dl
mov dword [ebp - 0x7f0], edx
xor edx, edx
mov dword [ebp - 0x4c], ebx
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
add ecx, dword [ebp - 0x34]
je 0x1002d9c5
mov edx, ebx
cmp dword [ebp - 0x34], eax
jne 0x1002d9c7
mov edx, eax
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
inc edx
sub eax, edx
je 0x1002da07
xor eax, eax
cmp dword [ebp - 0x7f0], eax
je 0x1002da09
mov eax, ebx
jmp 0x1002da09
xor eax, eax
mov dword [ebp - 0x4c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
or edx, 0xffffffff
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp eax, edx
push 7
setne cl
sub ecx, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, 0xdfdaf0b5
add ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
sub ecx, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffb
setne al
xor edx, edx
cmp eax, 0xc7e7
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xfffffff7
pop ecx
setl al
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002dab9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa9c], 0x8bfc4f27
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002daa0
xor eax, eax
mov dword [ebp - 0x48], 0x452a
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], eax
je 0x1002dacb
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0x30]
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xa98]
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], eax
jl 0x1002db2a
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002db25
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1002db10
mov dword [ebp - 0x4c], 0xffff
mov dword [ebp - 0x30], 0x9a488d51
mov dword [ebp - 0x24], 0x2a1efe0c
mov dword [ebp - 0x50], 0x2169
mov dword [ebp - 0x48], 0x72f
mov dword [ebp - 0x24], 0x5a258d3b
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002db77
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8b4], 0xa8eac8b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002db5f
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002db97
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2f8], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002db7f
xor eax, eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 3
jg 0x1002dbc7
mov eax, dword [ebp - 0x2ec]
cmp dword [ebp + eax*4 - 0x8b4], 0
jne 0x1002dbc5
inc dword [ebp - 0x2ec]
cmp dword [ebp - 0x2ec], 3
jle 0x1002dba6
xor eax, eax
cmp dword [ebp - 0x8b4], eax
je 0x1002dc0c
cmp dword [ebp - 0x2ec], eax
je 0x1002dc01
mov eax, dword [ebp - 0x48]
inc dword [ebp - 0x48]
test eax, eax
jg 0x1002dbe5
mov edx, ebx
jmp 0x1002dbe9
xor eax, eax
mov edx, eax
inc dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
cmp eax, edx
setg cl
cmp dword [ebp - 0x4c], ecx
jg 0x1002dbff
mov eax, ebx
jmp 0x1002dc01
xor eax, eax
cmp eax, dword [ebp - 0x50]
jge 0x1002dc0a
mov edx, ebx
jmp 0x1002dc0e
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x8ac]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2ec]
setge cl
sub ecx, eax
mov eax, dword [ebp - 0x50]
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x2f8]
cmp ecx, 0x757a
setne al
imul eax, eax, 0x5697
cmp eax, 0x4aec7014
jl 0x1002dc54
xor eax, eax
cmp dword [ebp - 0x2ec], eax
je 0x1002dc56
mov edx, ebx
jmp 0x1002dc58
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x2ec]
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x2f8], ecx
mov dword [ebp - 0x8b4], ecx
mov eax, dword [ebp - 0x4c]
imul eax, ecx
test eax, eax
je 0x1002dc89
xor eax, eax
cmp dword [ebp - 0x2f8], eax
je 0x1002dc8b
mov eax, ebx
jmp 0x1002dc8b
xor eax, eax
or ecx, 0xffffffff
cmp ecx, eax
mov eax, dword [ebp - 0x50]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x24], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002dcc2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x64], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002dcb1
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002dce2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5e4], 3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002dcca
xor eax, eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 8
jl 0x1002de05
mov dword [ebp - 0x14], 0x4768c0aa
mov dword [ebp - 0x4c], 0xfffffffe
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002dd1b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd18], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002dd06
xor eax, eax
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], eax
jl 0x1002ddf5
mov dword [ebp - 0x4c], 0xfffffffe
mov dword [ebp - 0x24], 0x9953
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x1002dd59
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x194], 3
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1002dd41
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002dd78
push 0x1ed0
push 0x25f8
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
xor eax, eax
cmp dword [ebp - 0x64], eax
je 0x1002dda4
mov eax, dword [ebp - 0x64]
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x194]
setns cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
sete dl
add eax, dword [ebp - 0x64]
cmp eax, edx
jne 0x1002dda4
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xd18]
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xd18]
mov eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x64]
xor eax, eax
cmp dword [ebp - 0x194], eax
jne 0x1002dde1
cmp dword [ebp - 0x64], eax
je 0x1002dde3
mov eax, ebx
mov dword [ebp - 0x5e4], eax
dec dword [ebp - 0x14]
push 0
pop eax
jns 0x1002dd2b
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], 8
jge 0x1002dcef
or ecx, 0xffffffff
mov dword [ebp - 0x34], 0x2ee76f50
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x10], 0xada439be
push 6
pop esi
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 0x16
cmp dword [ebp - 0x10], 0xfffffff2
jl 0x1002decf
mov dword [ebp - 0x48], 0x80444555
xor eax, eax
mov dword [ebp - 0x4c], 0xf3faa32f
mov dword [ebp - 0x24], 0x1a05132d
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x48], eax
je 0x1002de5d
mov esi, ebx
cmp dword [ebp - 0x10], eax
jne 0x1002de5f
mov esi, eax
mov eax, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x48]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x24]
jl 0x1002de8e
mov ecx, ebx
cmp dword [ebp - 0x10], eax
jne 0x1002de90
mov ecx, eax
xor eax, eax
cmp ecx, 0xdae974ca
sete al
xor ecx, ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp esi, eax
setle cl
xor eax, eax
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002debc
push eax
call dword [sym.imp.USER32.dll_SetCursor]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff2
push 0xffffffffffffffff
pop ecx
jge 0x1002de37
push 6
pop esi
mov dword [ebp - 0x44], 0x5e314a5e
push 0xfffffffffffffff9
mov dword [ebp - 0x20], 0xfffffffc
pop eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x4c], 0x33ee6768
or edx, 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002df06
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc30], edx
inc dword [ebp - 0x14]
jmp 0x1002def2
mov dword [ebp - 0x20], 0xfffffffd
jmp 0x1002dfa0
mov dword [ebp - 0x14], 0xa654
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x24], 0xc0a9c5a7
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002df4f
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
dec eax
neg eax
sbb eax, eax
neg eax
inc eax
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x20]
jl 0x1002df4f
xor eax, eax
mov ecx, eax
jmp 0x1002df51
mov ecx, ebx
mov eax, dword [ebp - 0x14]
add eax, ecx
cmp eax, 0xc312fbb6
je 0x1002df64
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002df66
mov eax, ebx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002df98
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc30], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002df8b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x17
jne 0x1002df12
mov dword [ebp - 0x14], 0x1f2c29a3
mov dword [ebp - 0x24], 0xbe76d238
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], 0x3cc25429
mov dword [ebp - 0x24], 0xef068cd5
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x24], 0xe6fc2e60
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x24], 0x2e6c0b33
mov dword [ebp - 0x24], 0x3f6a0837
mov dword [ebp - 0x24], 0x3cef3392
mov dword [ebp - 0x24], 0x56e623b2
mov dword [ebp - 0x24], 0x8993dd61
push 7
pop eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x24], 0xb4b26d8f
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], edx
push 5
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0x890ba5fc
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x4c], esi
xor esi, esi
mov dword [ebp - 0x14], eax
inc esi
cmp dword [ebp - 0x14], esi
jge 0x1002e069
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbc8], 0xfffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002e051
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x1002e0a1
mov dword [ebp - 0x24], 0xdb785b64
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002e08d
push 0xfbf
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], 0xd1a4e665
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1002e071
dec dword [ebp - 0x4c]
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x37c], eax
mov dword [ebp - 0x378], eax
mov dword [ebp - 0x374], eax
mov dword [ebp - 0x4c], 0xfc3c737e
mov dword [ebp - 0x24], 0xa391de2f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002e0ea
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xcc], 0x8261
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002e0d2
xor eax, eax
mov dword [ebp - 0x37c], esi
cmp dword [ebp - 0x37c], eax
jl 0x1002e234
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002e123
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9c], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002e10b
xor eax, eax
mov dword [ebp - 0x9c], eax
jmp 0x1002e21c
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x1002e216
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x1002e172
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002e16d
push 0x241c
push 0x1aba
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x1002e14b
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x1002e20d
mov dword [ebp - 0x48], 0x5493e623
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x378], eax
je 0x1002e1e9
mov ecx, esi
cmp dword [ebp - 0x9c], eax
jne 0x1002e1a7
mov ecx, eax
mov eax, dword [ebp - 0x380]
imul eax, ecx
test eax, eax
je 0x1002e1c6
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
cmp dword [ebp + eax*4 - 0xcc], ebx
je 0x1002e1c6
mov edx, esi
jmp 0x1002e1cc
xor eax, eax
xor ebx, ebx
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x10]
je 0x1002e1e3
cmp dword [ebp - 0x24], ebx
je 0x1002e1e3
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xcc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x10]
jns 0x1002e17e
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002e13d
inc dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], esi
jle 0x1002e12e
dec dword [ebp - 0x37c]
jns 0x1002e0fc
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x37c]
mov ecx, dword [ebp - 0xc8]
sub ecx, eax
mov eax, dword [ebp - 0x37c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, eax
cmp ecx, esi
setge dl
xor ecx, ecx
mov dword [ebp - 0x37c], edx
mov eax, dword [ebp - 0xcc]
cmp edx, eax
mov eax, dword [ebp - 0xcc]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xcc]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0xc8]
setg bl
xor ecx, ecx
cmp ebx, eax
setne cl
cmp ecx, dword [ebp - 0xcc]
jl 0x1002e2aa
xor eax, eax
mov edx, eax
cmp dword [ebp - 0xc8], eax
je 0x1002e2ac
mov edx, esi
mov eax, dword [ebp - 0xc8]
xor ecx, ecx
cmp edx, eax
push 2
setl cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x378]
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc8]
cmp ecx, eax
mov eax, dword [ebp - 0xcc]
setle dl
xor ecx, ecx
cmp edx, eax
pop ebx
sete cl
xor eax, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002e30f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x220], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002e2fb
xor eax, eax
mov dword [ebp - 0x30], 0xb1cecb45
mov dword [ebp - 0x24], 0x2abb
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], 0xf2fdad5
mov dword [ebp - 0x28], 0x79b69b2e
mov dword [ebp - 0x40], 0x17473468
mov dword [ebp - 0x50], 6
push 4
pop ecx
mov dword [ebp - 0x7b8], ecx
mov dword [ebp - 0x7b4], ecx
mov dword [ebp - 0x7b0], ecx
mov dword [ebp - 0x7ac], ecx
mov dword [ebp - 0x4c], 0x4b67
push 3
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x14], eax
pop edi
jmp 0x1002e37a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1010], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002e369
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x4c], eax
jg 0x1002e3a1
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x1002e3a3
mov ecx, esi
jmp 0x1002e3a5
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x48]
cmp eax, ecx
je 0x1002e3b1
xor eax, eax
xor edx, edx
cmp eax, 0x7b332e0c
mov eax, dword [ebp - 0x7b4]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x7b8]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002e403
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5ec], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002e3eb
xor eax, eax
mov dword [ebp - 0x20], 0xada439be
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002e433
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x974], 0xbbca
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002e41a
xor eax, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x1002e61b
mov dword [ebp - 0x34], 0x4cdb8faa
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002e459
push eax
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], eax
jl 0x1002e485
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002e480
push eax
push 0x23f9
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
dec dword [ebp - 0x34]
jns 0x1002e461
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], eax
jl 0x1002e612
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x1002e5e7
mov dword [ebp - 0x38], 0x8d3a18e4
mov dword [ebp - 0x48], 0xca779041
mov dword [ebp - 0x4c], 0xe07ea4c5
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x38], eax
jl 0x1002e5de
mov dword [ebp - 0x14], 0x17c10977
mov dword [ebp - 0x54], 0xd058bbe5
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002e4fa
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc44], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002e4e2
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jg 0x1002e5d5
mov ecx, 0xf15cc7c4
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x974]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x974]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x974]
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x14]
jge 0x1002e5bb
mov dword [ebp - 0x48], edi
xor eax, eax
mov dword [ebp - 0x4c], 0x4c3f121f
cmp dword [ebp - 0x34], eax
je 0x1002e561
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x48]
test eax, eax
jne 0x1002e563
mov esi, eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp eax, 0xff93
mov eax, dword [ebp - 0xc44]
setle dl
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x34]
cmp eax, edx
setg cl
xor edx, edx
sub esi, ecx
add esi, dword [ebp - 0x4c]
add esi, dword [ebp - 0x54]
mov dword [ebp - 0x24], esi
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x34]
sub ecx, 0x7a5e1371
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor esi, esi
sub ecx, dword [ebp - 0x20]
inc esi
mov dword [ebp - 0x4c], ecx
mov ecx, 0xf15cc7c4
jmp 0x1002e5c7
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1002e50b
xor eax, eax
dec dword [ebp - 0x38]
jns 0x1002e4cc
dec dword [ebp - 0x1c]
jns 0x1002e4ab
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002e609
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x974], 0x3b7d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002e5f0
xor eax, eax
dec dword [ebp - 0x34]
jns 0x1002e491
dec dword [ebp - 0x20]
jns 0x1002e43f
mov edi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jg 0x1002f765
xor ebx, ebx
mov esi, 0x846f2633
inc ebx
mov dword [ebp - 0x24], 0xfffffffc
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002e64e
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002e660
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor eax, eax
mov ecx, 0xfab8c3ad
mov dword [ebp - 0x318], ecx
mov dword [ebp - 0x314], ecx
mov dword [ebp - 0x310], ecx
mov dword [ebp - 0x30c], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x24], 0x46cdead9
cmp dword [ebp - 0x38], eax
je 0x1002e6d3
mov dword [ebp - 0x24], 0xb7f37c04
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], 0x1a
jne 0x1002e6db
mov dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002e6c2
cmp dword [ebp - 0x24], eax
jne 0x1002e6c8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x2b
jge 0x1002e6ba
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x1a
je 0x1002e6a6
jmp 0x1002e6d9
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x14], 0x19e9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002e707
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb6c], 0x4778
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002e6ee
xor eax, eax
push 2
pop edx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], eax
jl 0x1002e7a4
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002e73f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd58], 0x39ba095a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002e726
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002e793
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], eax
jl 0x1002e790
mov dword [ebp - 0x48], eax
mov dword [ebp - 0xd4c], 0x924c0001
mov ecx, dword [ebp - 0xb68]
mov eax, dword [ebp - 0x10]
push 0
mov dword [ebp + eax*4 - 0xb6c], ecx
mov eax, dword [ebp - 0xd58]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x30]
pop eax
jns 0x1002e753
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1002e744
dec dword [ebp - 0x10]
jns 0x1002e716
or ecx, 0xffffffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe6
je 0x1002e7f6
mov dword [ebp - 0x48], 0x4d07ddbf
mov dword [ebp - 0x24], 0x6ac3a608
mov dword [ebp - 0x14], eax
jmp 0x1002e7d1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc58], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002e7c0
mov dword [ebp - 0xc54], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
neg eax
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe6
push 0
pop eax
jne 0x1002e7ad
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002e82c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xeac], 5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002e813
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002e84e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x86c], 0xa284868f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002e835
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002e860
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6f0], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002e853
imul eax, dword [ebp - 0x20], 0xffff
xor edx, edx
cmp eax, 8
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp eax, edx
setle cl
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x864]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x864]
xor eax, eax
cmp dword [ebp - 0x864], eax
je 0x1002e8c6
mov dword [ebp - 0x24], 0xa025ec56
mov dword [ebp - 0x24], 0x2ad015b0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x24], ebx
inc dword [ebp - 0x6f0]
jmp 0x1002e906
push 2
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jl 0x1002e906
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002e8fa
push eax
push 0x1fea
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
xor eax, eax
mov dword [ebp - 0x24], 0xfffffffd
dec dword [ebp - 0x14]
jns 0x1002e8d4
mov eax, dword [ebp - 0x20]
xor eax, eax
or edx, 0xffffffff
mov dword [ebp - 0xeac], eax
mov dword [ebp - 0x28], eax
push 3
mov dword [ebp - 0x50], edx
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x14], eax
jmp 0x1002e939
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xec4], 0x2b000cd9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002e928
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jle 0x1002e956
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
cmp edx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0xec4], eax
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002e979
push eax
call edi
push 3
xor eax, eax
or edx, 0xffffffff
pop ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x48], 0xd743ccc
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x24], 0xffe61709
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002e9b3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x83c], 0x89b5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002e99b
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002e9d5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x580], 0x3b1d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002e9bc
xor eax, eax
mov dword [ebp - 0x1c], 0x16
cmp dword [ebp - 0x1c], 0xf
je 0x1002eb92
jmp 0x1002e9ea
xor eax, eax
mov dword [ebp - 0x10], 0xffab8c3a
mov dword [ebp - 0x54], 0xc700
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 0xffff
mov dword [ebp - 0x3c], 0xa2dd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002ea2b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xedc], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002ea12
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x1002eae0
mov dword [ebp - 0x4c], 0x4653ffd0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x40], 0x8d23
mov dword [ebp - 0x14], eax
jmp 0x1002ea5f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x800], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002ea4e
mov eax, dword [ebp - 0x7fc]
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
cmp dword [ebp - 0x54], ecx
je 0x1002ea97
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002ea97
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x83c], ecx
mov dword [ebp - 0x800], ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002ead0
push 0x1311
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
push 0
pop eax
jle 0x1002ea38
cmp dword [ebp - 0x838], eax
jne 0x1002eb35
cmp dword [ebp - 0x1c], eax
je 0x1002eafd
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
inc dword [ebp - 0x30]
test eax, eax
jne 0x1002eb02
inc dword [ebp - 0x50]
je 0x1002eb0d
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x1002eb0f
mov edx, ebx
jmp 0x1002eb11
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
add eax, 0xfffffff7
cmp eax, 6
setne cl
imul eax, ecx, 0x53cf
cmp edx, eax
je 0x1002eb35
xor eax, eax
mov ecx, eax
jmp 0x1002eb37
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
add eax, ecx
jne 0x1002eb41
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x57c]
xor ecx, ecx
mov eax, dword [ebp - 0x83c]
cmp eax, 9
push 1
setge cl
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x57c]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setne bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x3c]
pop ebx
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0xed8], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
jne 0x1002e9e8
mov eax, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x57c]
cmp eax, 0x40e6
mov eax, dword [ebp - 0x50]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], 0x1e1e87df
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002ebdd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa68], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002ebc4
xor eax, eax
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], eax
jl 0x1002ec26
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ec0a
push 0x205a
push eax
push 0x11e2
push eax
push 0x1140
push eax
call dword [sym.imp.KERNEL32.dll_CompareStringW]
mov eax, dword [ebp - 0x14]
push 0
mov ecx, dword [ebp + eax*4 - 0xa68]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa68], ecx
dec dword [ebp - 0x14]
pop eax
jns 0x1002ebe9
mov dword [ebp - 0x318], ebx
cmp dword [ebp - 0x318], eax
jl 0x1002f60b
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x14], eax
jmp 0x1002ec55
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe54], 0xffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002ec44
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
jmp 0x1002eca0
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x14], 0xd435
cmp dword [ebp - 0x24], ebx
sbb eax, eax
neg eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002ec98
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ec95
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1002ec82
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jne 0x1002ec63
mov dword [ebp - 0x4c], 0xbdfadf62
mov dword [ebp - 0x1c], 0x167fa5c6
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x24], 0x4f5ac3d6
mov dword [ebp - 0x44], 0x936be856
mov dword [ebp - 0x54], 0xa5308633
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], 0x6ac3a608
mov dword [ebp - 0x4c], 9
mov dword [ebp - 0x48], 0xbfc7
push 3
mov dword [ebp - 0x10], eax
pop edi
cmp dword [ebp - 0x10], edi
jge 0x1002ed14
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6ac], 0x315b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002ecfc
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002ed2a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb94], 0x6237ddc4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002ed19
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x4c]
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setg cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x54]
jle 0x1002ed62
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x6ac]
mov eax, dword [ebp - 0x6ac]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x6ac]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x48]
inc dword [ebp - 0x48]
mov dword [ebp - 0x58], ebx
mov eax, dword [ebp - 0x6ac]
mov ecx, dword [ebp - 0x14]
neg eax
sbb eax, eax
neg eax
imul ecx, eax
sub ecx, 0x56014efc
neg ecx
sbb ecx, ecx
or edx, 0xffffffff
xor eax, eax
inc ecx
cmp ecx, edx
setle al
xor edx, edx
add eax, 0x1939
imul ecx, eax, 0xd913
mov eax, dword [ebp - 0xb90]
cmp ecx, eax
setle dl
neg edx
cmp edx, dword [ebp - 0x1c]
jne 0x1002edcc
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp eax, ecx
setge bl
add ebx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ebx
mov eax, dword [ebp - 0xb94]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
je 0x1002f095
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002ee25
push 0x4e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
xor edi, edi
inc edi
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002ee3a
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x1002ee71
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002f0b5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1dc], 0x8a84a00
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002f09d
xor eax, eax
cmp dword [ebp - 0x1d8], eax
je 0x1002f0d8
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1dc]
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1d4]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x50]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1dc]
setne dl
imul edx, eax
mov eax, dword [ebp - 0x58]
imul eax, edx
test eax, eax
jne 0x1002f138
mov dword [ebp - 0x24], 0x5a2910e9
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1d4], eax
jmp 0x1002ee23
mov dword [ebp - 0x14], 0x339bca7a
xor edi, edi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1dc], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x12
jne 0x1002f189
inc edi
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x1002f15f
mov edx, edi
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x14]
neg ecx
push 0
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, edx
setle al
mov dword [ebp - 0x1dc], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x12
pop eax
je 0x1002f156
xor eax, eax
jmp 0x1002ee27
mov dword [ebp - 0x10], 0xfe0a8eac
mov dword [ebp - 0x1c], 0x5e790e86
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff1
jl 0x1002f67e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002f641
push 7
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa90], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002f62e
mov eax, dword [ebp - 0xa8c]
xor ecx, ecx
mov eax, dword [ebp - 0xa90]
imul edx, eax, 0x729c
mov eax, dword [ebp - 0x10]
cmp eax, 0x97a6
push 0
setle cl
xor eax, eax
cmp edx, ecx
setle al
sub eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff1
pop eax
jge 0x1002f622
cmp dword [ebp - 0x1c], eax
jne 0x1002f6b9
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add eax, 0xffff97bb
add eax, ecx
xor ecx, ecx
cmp eax, 0xfffffff7
setl cl
imul ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x10], eax
jge 0x1002f6b9
xor eax, eax
mov edx, eax
jmp 0x1002f6bb
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x21c]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setne dl
imul eax, edx
mov dword [ebp - 0x318], eax
test eax, eax
je 0x1002f6fb
xor eax, eax
cmp dword [ebp - 0x220], eax
je 0x1002f6fd
mov ecx, ebx
jmp 0x1002f6ff
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x310]
mov eax, dword [ebp - 0x34]
neg ecx
mov eax, dword [ebp - 0x21c]
sbb ecx, ecx
xor eax, eax
neg ecx
cmp eax, ecx
push 0
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x8f7cf8fb
setne cl
mov dword [ebp - 0x5ec], ecx
mov eax, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x34]
pop eax
cmp dword [ebp - 0x34], ebx
jle 0x1002e635
xor esi, esi
push 2
inc esi
pop ebx
mov dword [ebp - 0x20], 0xca4f833f
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002f78d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x61c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002f778
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002f7ad
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x410], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002f795
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002f8ec
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002f7d8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x15c], 0x77dd6887
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002f7c0
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002f7f9
push 7
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1028], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002f7e4
xor eax, eax
mov dword [ebp - 0x15c], ebx
cmp dword [ebp - 0x15c], eax
jl 0x1002f8e9
or ecx, 0xffffffff
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002f838
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4cc], 0x302aff63
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002f820
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002f84a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc6c], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002f83d
mov eax, dword [ebp - 0x15c]
cmp dword [ebp + eax*4 - 0x61c], 0
jne 0x1002f8bd
mov dword [ebp - 0x28], 0x8694a219
xor ebx, ebx
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
push 2
mov eax, dword [ebp + eax*4 - 0x61c]
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x158]
cmp eax, ecx
mov edx, dword [ebp - 0xc68]
mov eax, dword [ebp - 0x4cc]
setg bl
imul edx, ebx
xor ecx, ecx
pop ebx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x24]
jle 0x1002f8ba
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp + eax*4 - 0x61c]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x410]
mov eax, dword [ebp - 0x15c]
push 0
mov eax, dword [ebp + eax*4 - 0x61c]
mov dword [ebp - 0x410], 0x57a8360e
dec dword [ebp - 0x15c]
pop eax
jns 0x1002f80e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1002f7b5
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002f90f
push eax
push eax
push 0xc1b
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
mov dword [ebp - 0x30], 0xaabecba2
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002f932
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe6c], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002f91e
xor eax, eax
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x30], eax
jl 0x1002f950
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002f94b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x1002f93a
mov dword [ebp - 0x34], 0x2ee6d058
or ecx, 0xffffffff
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 0xcc09
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x28], 0xf7762406
mov dword [ebp - 0x24], 0xe525036f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002f9a0
push 7
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x708], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002f98e
mov eax, dword [ebp - 0x34]
xor edx, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setne dl
mov dword [ebp - 0x708], edx
xor edx, edx
mov dword [ebp - 0x28], esi
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
add ecx, dword [ebp - 0x34]
je 0x1002f9e1
mov edx, esi
cmp dword [ebp - 0x34], eax
jne 0x1002f9e3
mov edx, eax
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
inc edx
sub eax, edx
je 0x1002fa23
xor eax, eax
cmp dword [ebp - 0x708], eax
je 0x1002fa25
mov eax, esi
jmp 0x1002fa25
xor eax, eax
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov eax, dword [ebp - 0x28]
or edx, 0xffffffff
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp eax, edx
setne cl
sub ecx, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, 0xdfdaf0b5
add ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffb
setne al
xor edx, edx
cmp eax, 0xc7e7
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xfffffff7
setl al
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002faba
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbd8], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002faa6
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002fada
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3dc], 0xba394643
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002fac2
xor eax, eax
mov dword [ebp - 0x3dc], eax
jmp 0x1002fb29
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0xb2bc40ed
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002fb02
push 0x127b
call dword [sym.imp.USER32.dll_MessageBeep]
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x1002fb23
or ecx, 0xffffffff
mov dword [ebp - 0x24], 0x79e672ca
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0xa233712
dec dword [ebp - 0x30]
jns 0x1002fb0d
inc dword [ebp - 0x3dc]
cmp dword [ebp - 0x3dc], eax
jle 0x1002fae2
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002fb4d
push 0x565
push 0x1cb2
push eax
call dword [sym.imp.USER32.dll_RemoveMenu]
xor eax, eax
mov dword [ebp - 0x20], esi
or ecx, 0xffffffff
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x30], 0x1b7e280b
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x1002fb8a
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x110], 0x7cef
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1002fb72
xor eax, eax
cmp dword [ebp - 0x10c], eax
je 0x1002fc00
mov eax, dword [ebp - 0x10c]
xor eax, eax
cmp dword [ebp - 0x10c], eax
je 0x1002fc00
cmp dword [ebp - 0x20], eax
jne 0x1002fbb9
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x10c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10c]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
imul eax, ecx, 3
test eax, eax
je 0x1002fbfe
mov eax, esi
jmp 0x1002fc00
xor eax, eax
mov dword [ebp - 0x38], eax
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x110]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
sete dl
sub edx, eax
imul edx, dword [ebp - 0x38]
mov dword [ebp - 0x48], edx
xor edx, edx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setge dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x38], eax
jle 0x1002fc5b
xor eax, eax
cmp dword [ebp - 0x10c], eax
je 0x1002fc5d
mov eax, esi
cmp eax, dword [ebp - 0x20]
jne 0x1002fc65
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x30], eax
push 0xfffffffffffffff9
mov dword [ebp - 0x20], 0xfffffffc
pop eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x28], 0x33ee6768
or edx, 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002fca4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc7c], edx
inc dword [ebp - 0x14]
jmp 0x1002fc90
mov dword [ebp - 0x20], 0xfffffffd
jmp 0x1002fd3e
mov dword [ebp - 0x14], 0xa654
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x24], 0xc0a9c5a7
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x1002fced
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
dec eax
neg eax
sbb eax, eax
neg eax
inc eax
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x20]
jl 0x1002fced
xor eax, eax
mov ecx, eax
jmp 0x1002fcef
mov ecx, esi
mov eax, dword [ebp - 0x14]
add eax, ecx
cmp eax, 0xc312fbb6
je 0x1002fd02
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1002fd04
mov eax, esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002fd36
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc7c], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002fd29
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x17
jne 0x1002fcb0
mov dword [ebp - 0x24], 0x3a4a
xor eax, eax
mov dword [ebp - 0x24], 0x6aabecba
mov dword [ebp - 0x24], 0x7a888ada
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x28], 0x5077
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002fd92
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1080], 0x690f1d89
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002fd79
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002fdb5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1040], 0xa94b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002fd9d
xor eax, eax
inc dword [ebp - 0x28]
mov dword [ebp - 0x34], 0xca4f833f
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xdb97
mov dword [ebp - 0x24], 0x3b16
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], 0xbd77dfcc
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002fdfc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc00], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002fde8
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1002fe13
mov dword [ebp - 0x28], 0xbb11accb
inc dword [ebp - 0x28]
dec dword [ebp - 0x14]
jns 0x1002fe04
mov dword [ebp - 0x28], 0x589d3895
cmp dword [ebp - 0x28], eax
jne 0x1002fe24
cmp dword [ebp - 0x14], eax
je 0x1002fe26
mov eax, esi
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x14], eax
jmp 0x1002fe4a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf0c], 0x2b000cd9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002fe39
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jle 0x1002fe67
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
cmp edx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0xf0c], eax
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002fe84
push eax
call edi
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
jmp 0x1002feb9
cmp dword [ebp - 0x10], 0xffffffec
jg 0x1002fe8f