Function at 0x1002c16d
Capabilities:
Accept command line arguments
Allocate thread local storage
Clear file content
Connect pipe
Create process on windows
Enumerate gui resources
Get common file path
Get file attributes
Log keystrokes via polling
Parse pe header
Query environment variable
Write and execute a file

Disassembly:
mov eax, 0x1008c80f
call fcn.1008b0b0
mov eax, 0x17cc
call fcn.10088de0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x60], ecx
push edi
inc eax
mov dword [ebp - 0x30], 0x7dfa
push eax
lea ecx, [ebp - 0xc94]
mov byte [ebp - 0x71], dl
call fcn.10015795
xor eax, eax
xor esi, esi
mov dword [ebp - 4], eax
inc esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002c1d7
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc94]
call fcn.10015802
mov dword [eax], 0xfb871c7b
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002c1b3
xor esi, esi
xor eax, eax
inc esi
push eax
lea ecx, [ebp - 0xc94]
call fcn.10015802
mov ecx, dword [ebp - 0x30]
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002c289
mov dword [ebp - 0x18], 0x50e6da50
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002c245
push 0x1823
push 0x23c0
push 0x1685
call edi
push eax
call ebx
push eax
push 0x191
push 0x3ef
push 0x1bba
push 0x1ae8
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1002c286
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002c281
push 0x1c3c
push 0x1753
push 0x261e
push 0x220d
push 0x10ec
push eax
push eax
push eax
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002c24d
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x1002c1fe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc94]
call fcn.100157fd
mov dword [ebp - 0x40], 6
lea ecx, [ebp - 0x634]
mov dword [ebp - 0x30], 0x1bf506e6
push 3
call fcn.10015795
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x28], 0x2a42bbd4
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x58], 0xe458c458
mov dword [ebp - 0x14], eax
jmp 0x1002c2ef
push dword [ebp - 0x14]
call fcn.10015802
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
lea ecx, [ebp - 0x634]
jl 0x1002c2e2
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.10015802
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x634]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.10015802
mov ecx, dword [ebp - 0x44]
mov esi, eax
xor eax, eax
xor edx, edx
inc eax
cmp ecx, eax
mov ecx, dword [ebp - 0x28]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x44]
setle bl
xor eax, eax
cmp ebx, ecx
setle al
cmp dword [esi], eax
jl 0x1002c35f
xor esi, esi
lea ecx, [ebp - 0x634]
inc esi
push esi
call fcn.10015802
cmp dword [eax], 0
jne 0x1002c362
xor eax, eax
jmp 0x1002c364
xor esi, esi
inc esi
mov eax, esi
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x634]
xor eax, eax
push eax
call fcn.10015802
mov edx, dword [ebp - 0x48]
xor ebx, ebx
mov ecx, dword [ebp - 0x30]
cmp ecx, edx
lea ecx, [ebp - 0x634]
setl bl
imul ebx, dword [eax]
xor eax, eax
push eax
call fcn.10015802
xor ecx, ecx
cmp ebx, dword [eax]
setg cl
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x634]
or dword [ebp - 4], 0xffffffff
call fcn.100157fd
mov dword [ebp - 0x28], 0x4a12b57e
lea ecx, [ebp - 0xe14]
push esi
call fcn.10015795
mov dword [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x10], 0x3df603fa
push 3
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], eax
pop ebx
jmp 0x1002c3eb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9a8], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002c3da
mov eax, dword [ebp - 0x10]
mov ecx, 0xd714f98c
cmp ecx, eax
mov eax, dword [ebp - 0x10]
push 0
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 5
setl al
neg eax
pop eax
sets al
cmp eax, 0xfffe
je 0x1002c51d
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002c51f
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x10], eax
jge 0x1002c44a
mov eax, dword [ebp - 0x9a0]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
push 0xfffffffffffffffb
pop edx
cmp dword [ebp - 0x20], eax
je 0x1002c624
mov dword [ebp - 0x18], 0xadf890ba
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002c487
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x358], 0x39200279
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002c46e
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002c4a7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb1c], 0xaeaba4a2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002c48f
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xa
jl 0x1002c612
mov dword [ebp - 0x48], 0x6d8f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002c4db
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb34], 0x66d9918c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002c4c3
xor eax, eax
cmp dword [ebp - 0x9a4], eax
jne 0x1002c544
mov eax, dword [ebp - 0x358]
xor ecx, ecx
mov eax, dword [ebp - 0x358]
mov eax, dword [ebp - 0x358]
mov eax, dword [ebp - 0x48]
cmp eax, 0x9342
setl cl
sub ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xb1c]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x358]
cmp eax, dword [ebp - 0x18]
jg 0x1002c544
xor eax, eax
jmp 0x1002c546
xor eax, eax
cmp dword [ebp - 0x9a4], eax
je 0x1002c529
mov eax, esi
cmp dword [ebp - 0x10], eax
jle 0x1002c437
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002c439
mov eax, esi
jmp 0x1002c439
mov eax, esi
mov dword [ebp - 0xb34], eax
shl eax, 3
test eax, eax
je 0x1002c5cf
mov dword [ebp - 0x28], 0xfffffffc
mov eax, dword [ebp - 0xb34]
mov eax, dword [ebp - 0x9a4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
cmp edx, eax
mov eax, dword [ebp - 0x358]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0xb1c]
setl dl
xor ecx, ecx
cmp edx, 0xfffffff6
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xb1c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 0x1e9572ab
je 0x1002c5bb
mov eax, dword [ebp - 0xb1c]
mov eax, dword [ebp - 0x358]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0xb34]
jmp 0x1002c5ff
mov dword [ebp - 0x20], 2
xor eax, eax
cmp dword [ebp - 0x20], eax
jl 0x1002c602
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002c5ed
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0x20]
push 0
mov dword [ebp + eax*4 - 0xb34], esi
dec dword [ebp - 0x20]
pop eax
jns 0x1002c5dd
push 0xfffffffffffffffb
pop edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xa
push 0
pop eax
jge 0x1002c4b4
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002c63f
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
jmp 0x1002c63d
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1002c63f
push 0xf80
push 0x1a96
push eax
call dword [sym.imp.GDI32.dll_PtInRegion]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002c65a
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe14]
call fcn.10015802
push 0xfffffffffffffffb
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002c644
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x1002c680
push dword [ebp - 0x40]
call fcn.10015802
mov dword [eax], 0xc7555b7c
inc dword [ebp - 0x40]
xor eax, eax
lea ecx, [ebp - 0xe14]
inc eax
cmp dword [ebp - 0x40], eax
jl 0x1002c66f
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.100157fd
xor eax, eax
mov dword [ebp - 0x40], 6
inc eax
mov dword [ebp - 0x28], 0x4a12b57e
push eax
lea ecx, [ebp - 0xcac]
call fcn.10015795
mov dword [ebp - 4], ebx
xor eax, eax
push 0xfffffffffffffffb
mov dword [ebp - 0x14], eax
pop ebx
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jge 0x1002c6de
push dword [ebp - 0x14]
lea ecx, [ebp - 0xcac]
call fcn.10015802
mov dword [eax], ebx
inc dword [ebp - 0x14]
jmp 0x1002c6c1
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x1002c6fc
push dword [ebp - 0x40]
call fcn.10015802
mov dword [eax], 0xc7555b7c
inc dword [ebp - 0x40]
xor eax, eax
lea ecx, [ebp - 0xcac]
inc eax
cmp dword [ebp - 0x40], eax
jl 0x1002c6eb
mov dword [ebp - 4], esi
call fcn.100157fd
xor eax, eax
mov dword [ebp - 0x40], 6
inc eax
mov dword [ebp - 0x28], 0x4a12b57e
push eax
lea ecx, [ebp - 0xed4]
call fcn.10015795
xor eax, eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], eax
jmp 0x1002c750
push dword [ebp - 0x14]
lea ecx, [ebp - 0xed4]
call fcn.10015802
mov dword [eax], ebx
inc dword [ebp - 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002c73d
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x1002c776
push dword [ebp - 0x40]
call fcn.10015802
mov dword [eax], 0xc7555b7c
inc dword [ebp - 0x40]
xor eax, eax
lea ecx, [ebp - 0xed4]
inc eax
cmp dword [ebp - 0x40], eax
jl 0x1002c765
mov dword [ebp - 4], esi
call fcn.100157fd
push 2
lea ecx, [ebp - 0x1020]
call fcn.10015795
mov dword [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002c7cd
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1020]
call fcn.10015802
mov dword [eax], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002c7ae
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1002c803
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002c7fe
push eax
push 0x1ca
push 0x4d9
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002c7d8
lea ecx, [ebp - 0x1020]
mov dword [ebp - 4], esi
call fcn.100157fd
mov dword [ebp - 0x10], 0xfffffffc
mov eax, 0x8d72a67f
mov dword [ebp - 0xf50], eax
mov dword [ebp - 0xf4c], eax
mov dword [ebp - 0xf48], eax
mov dword [ebp - 0xf44], eax
xor eax, eax
mov dword [ebp - 0x28], 0x2e4ed383
mov dword [ebp - 0x38], 0x8f1edd1e
push 3
mov dword [ebp - 0x14], eax
pop esi
cmp dword [ebp - 0x14], esi
jge 0x1002c868
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x698], 2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002c850
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002c879
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002c94c
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setne dl
xor ebx, ebx
cmp edx, 0xffffffff
setge bl
sub ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setg cl
imul ecx, ecx, 0xa8e5
mov dword [ebp - 0xf44], ecx
mov eax, dword [ebp - 0x10]
cmp ecx, dword [ebp + eax*4 - 0x698]
jge 0x1002c8d3
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x698], 0
jne 0x1002c8d3
xor eax, eax
mov ecx, eax
jmp 0x1002c8d8
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x698]
imul eax, ecx
xor ecx, ecx
imul eax, eax, 0x2e58
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x10]
setg cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x698]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x698]
cmp eax, edx
setle cl
xor ebx, ebx
imul ecx, dword [ebp - 0x690]
inc ebx
cmp ecx, ebx
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1002c949
push eax
push 0xb24
push 0x1803
push 0x1062
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x1002c881
mov dword [ebp - 0x30], 0x7dfa
lea ecx, [ebp - 0xcc4]
push ebx
call fcn.10015795
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002c9a1
push dword [ebp - 0x14]
lea ecx, [ebp - 0xcc4]
call fcn.10015802
mov dword [eax], 0xfb871c7b
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002c97d
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0xcc4]
call fcn.10015802
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002ca53
mov dword [ebp - 0x18], 0x50e6da50
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002ca0b
push 0x1823
push 0x23c0
push 0x1685
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x191
push 0x3ef
push 0x1bba
push 0x1ae8
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1002ca50
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002ca4b
push 0x1c3c
push 0x1753
push 0x261e
push 0x220d
push 0x10ec
push eax
push eax
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002ca13
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x1002c9bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc4]
call fcn.100157fd
mov dword [ebp - 0x40], 6
lea ecx, [ebp - 0xe2c]
mov dword [ebp - 0x28], 0x4a12b57e
push ebx
call fcn.10015795
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x5ec]
mov dword [ebp - 0x30], 0x1bf506e6
push esi
call fcn.10015795
push 8
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x28], 0x2a42bbd4
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x58], 0xe458c458
mov dword [ebp - 0x14], eax
jmp 0x1002cad5
push dword [ebp - 0x14]
call fcn.10015802
mov dword [eax], ebx
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x5ec]
cmp dword [ebp - 0x14], esi
jl 0x1002cac8
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.10015802
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x5ec]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.10015802
mov ecx, dword [ebp - 0x44]
xor edx, edx
cmp ecx, ebx
mov esi, eax
mov ecx, dword [ebp - 0x28]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x44]
setle bl
xor eax, eax
cmp ebx, ecx
setle al
cmp dword [esi], eax
jl 0x1002cb41
xor esi, esi
lea ecx, [ebp - 0x5ec]
inc esi
push esi
call fcn.10015802
cmp dword [eax], 0
jne 0x1002cb44
xor eax, eax
jmp 0x1002cb46
xor esi, esi
inc esi
mov eax, esi
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x5ec]
xor eax, eax
push eax
call fcn.10015802
mov edx, dword [ebp - 0x48]
xor ebx, ebx
mov ecx, dword [ebp - 0x30]
cmp ecx, edx
lea ecx, [ebp - 0x5ec]
setl bl
imul ebx, dword [eax]
xor eax, eax
push eax
call fcn.10015802
xor ecx, ecx
cmp ebx, dword [eax]
setg cl
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x5ec]
mov byte [ebp - 4], 7
call fcn.100157fd
mov dword [ebp - 0x10], 0x3df603fa
xor eax, eax
push 3
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], eax
pop ebx
jmp 0x1002cbb3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb4c], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002cba2
mov eax, dword [ebp - 0x10]
mov ecx, 0xd714f98c
cmp ecx, eax
mov eax, dword [ebp - 0x10]
push 0
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 5
setl al
neg eax
pop eax
sets al
cmp eax, 0xfffe
je 0x1002cce2
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002cce4
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x10], eax
jge 0x1002cc12
mov eax, dword [ebp - 0xb44]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002cde9
mov dword [ebp - 0x18], 0xadf890ba
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002cc4c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x360], 0x39200279
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002cc33
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002cc6c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb64], 0xaeaba4a2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002cc54
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xa
jl 0x1002cdd7
mov dword [ebp - 0x48], 0x6d8f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002cca0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb7c], 0x66d9918c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002cc88
xor eax, eax
cmp dword [ebp - 0xb48], eax
jne 0x1002cd09
mov eax, dword [ebp - 0x360]
xor ecx, ecx
mov eax, dword [ebp - 0x360]
mov eax, dword [ebp - 0x360]
mov eax, dword [ebp - 0x48]
cmp eax, 0x9342
setl cl
sub ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xb64]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x360]
cmp eax, dword [ebp - 0x18]
jg 0x1002cd09
xor eax, eax
jmp 0x1002cd0b
xor eax, eax
cmp dword [ebp - 0xb48], eax
je 0x1002ccee
mov eax, esi
cmp dword [ebp - 0x10], eax
jle 0x1002cbff
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002cc01
mov eax, esi
jmp 0x1002cc01
mov eax, esi
mov dword [ebp - 0xb7c], eax
shl eax, 3
test eax, eax
je 0x1002cd97
mov dword [ebp - 0x28], 0xfffffffc
mov eax, dword [ebp - 0xb7c]
mov eax, dword [ebp - 0xb48]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
push 0xfffffffffffffffb
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x360]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0xb64]
setl dl
xor ecx, ecx
cmp edx, 0xfffffff6
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xb64]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 0x1e9572ab
je 0x1002cd83
mov eax, dword [ebp - 0xb64]
mov eax, dword [ebp - 0x360]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0xb7c]
jmp 0x1002cdc7
mov dword [ebp - 0x20], 2
xor eax, eax
cmp dword [ebp - 0x20], eax
jl 0x1002cdc7
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002cdb5
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0x20]
push 0
mov dword [ebp + eax*4 - 0xb7c], esi
dec dword [ebp - 0x20]
pop eax
jns 0x1002cda5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xa
push 0
pop eax
jge 0x1002cc79
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002ce04
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
jmp 0x1002ce02
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1002ce04
push 0xf80
push 0x1a96
push eax
call dword [sym.imp.GDI32.dll_PtInRegion]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002ce1f
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe2c]
call fcn.10015802
push 0xfffffffffffffffb
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002ce09
push 2
lea ecx, [ebp - 0x314]
call fcn.10015795
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x10], 0x5c8094a
mov dword [ebp - 0x28], 0x1a80d1c1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002ce70
push dword [ebp - 0x14]
lea ecx, [ebp - 0x314]
call fcn.10015802
mov dword [eax], 0x9f9b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002ce51
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], eax
inc ebx
jmp 0x1002cf65
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x1002cf62
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002ce9d
call dword [sym.imp.USER32.dll_WaitMessage]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x314]
call fcn.10015802
push dword [ebp - 0x10]
lea ecx, [ebp - 0x314]
call fcn.10015802
push ebx
lea ecx, [ebp - 0x314]
mov esi, eax
call fcn.10015802
push dword [ebp - 0x10]
xor ebx, ebx
mov ecx, dword [eax]
cmp ecx, dword [esi]
lea ecx, [ebp - 0x314]
setle bl
call fcn.10015802
mov eax, dword [eax]
imul eax, ebx
test eax, eax
je 0x1002cef5
push dword [ebp - 0x10]
lea ecx, [ebp - 0x314]
call fcn.10015802
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x314]
mov eax, dword [ebp - 0x20]
xor ebx, ebx
mov eax, dword [ebp - 0x10]
inc ebx
push ebx
call fcn.10015802
mov esi, eax
lea ecx, [ebp - 0x314]
xor eax, eax
push eax
call fcn.10015802
mov ecx, dword [eax]
cmp ecx, dword [esi]
jle 0x1002cf3a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x314]
call fcn.10015802
cmp dword [eax], 0
je 0x1002cf3a
mov eax, ebx
jmp 0x1002cf3c
xor eax, eax
xor edx, edx
cmp eax, 0xc023
mov eax, dword [ebp - 0x20]
sete dl
xor ecx, ecx
cmp edx, eax
push 0
setge cl
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], ebx
jle 0x1002ce8e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1002ce7b
lea ecx, [ebp - 0x314]
mov byte [ebp - 4], 7
call fcn.100157fd
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x978]
push 3
pop esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0xfffffff8
push esi
call fcn.10015795
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x28], 0x80ebbd48
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1002cfc8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x167c], 0xc544087
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002cfaf
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002cfe4
push dword [ebp - 0x20]
lea ecx, [ebp - 0x978]
call fcn.10015802
mov dword [eax], 0x27d373ee
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002cfcd
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x10]
cmp ebx, eax
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setle cl
mov dword [ebp - 0x1674], ecx
lea ecx, [ebp - 0x978]
mov eax, dword [ebp - 0x10]
xor eax, eax
push eax
call fcn.10015802
push ebx
lea ecx, [ebp - 0x978]
call fcn.10015802
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], 0x1a
jmp 0x1002d05f
mov dword [ebp - 0x28], 0x60de5741
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 9
je 0x1002d04f
lea ecx, [ebp - 0x978]
mov byte [ebp - 4], 7
call fcn.100157fd
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x1002d0dd
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], 0xfff7
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002d0ab
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x126c], 0x8c66f5a9
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002d08d
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x14], eax
jmp 0x1002d0bd
mov dword [ebp - 0x38], 0xfffffffa
dec dword [ebp - 0x48]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jg 0x1002d0b0
push dword [ebp - 0x40]
lea ecx, [ebp - 0xe2c]
call fcn.10015802
push 0
mov dword [eax], 0xc7555b7c
inc dword [ebp - 0x40]
pop eax
cmp dword [ebp - 0x40], ebx
jl 0x1002d07b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe2c]
call fcn.100157fd
push 2
lea ecx, [ebp - 0x11f4]
call fcn.10015795
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002d136
push dword [ebp - 0x14]
lea ecx, [ebp - 0x11f4]
call fcn.10015802
mov dword [eax], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002d117
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1002d169
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002d164
push eax
push 0x1ca
push 0x4d9
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002d13e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11f4]
call fcn.100157fd
push ebx
lea ecx, [ebp - 0x228]
call fcn.10015795
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002d1b9
push dword [ebp - 0x14]
lea ecx, [ebp - 0x228]
call fcn.10015802
mov dword [eax], 0xb26bdde0
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002d195
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x228]
call fcn.10015802
lea ecx, [ebp - 0x228]
mov dword [eax], 0xffffffee
xor eax, eax
push eax
call fcn.10015802
cmp dword [eax], 0x1b
jne 0x1002d3b2
jmp 0x1002d1e7
xor ebx, ebx
inc ebx
push esi
lea ecx, [ebp - 0x424]
call fcn.10015795
mov byte [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002d229
push dword [ebp - 0x14]
lea ecx, [ebp - 0x424]
call fcn.10015802
mov dword [eax], 0xd581
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002d20b
xor eax, eax
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x1002d36a
jmp 0x1002d23e
xor ebx, ebx
inc ebx
mov dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x424]
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], 0x56ee9734
push dword [ebp - 0x10]
call fcn.10015802
cmp dword [ebp - 0x18], 0xfffffffc
push dword [ebp - 0x10]
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x424]
setg bl
call fcn.10015802
lea ecx, [ebp - 0x228]
mov esi, dword [eax]
xor eax, eax
push eax
imul esi, ebx
call fcn.10015802
lea ecx, [ebp - 0x424]
mov edi, dword [eax]
add edi, esi
neg edi
sbb edi, edi
xor eax, eax
inc eax
inc edi
push eax
call fcn.10015802
xor ebx, ebx
lea ecx, [ebp - 0x228]
cmp edi, dword [eax]
setge bl
xor eax, eax
push eax
call fcn.10015802
lea ecx, [ebp - 0x424]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, ebx
call fcn.10015802
cmp esi, dword [eax]
jne 0x1002d2de
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002d2e0
lea esi, [eax + 1]
jmp 0x1002d2e2
xor eax, eax
mov esi, eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x424]
call fcn.10015802
xor ecx, ecx
cmp dword [eax], esi
setle cl
xor eax, eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x228]
push eax
call fcn.10015802
cmp dword [eax], 0
je 0x1002d31b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x424]
call fcn.10015802
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x228]
xor eax, eax
push eax
call fcn.10015802
mov ecx, dword [ebp - 0x48]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x228]
setne bl
xor eax, eax
push eax
call fcn.10015802
lea ecx, [ebp - 0x228]
mov esi, dword [eax]
xor eax, eax
push eax
imul esi, ebx
call fcn.10015802
sub esi, dword [eax]
mov dword [ebp - 0x48], esi
dec dword [ebp - 0x10]
jns 0x1002d23b
push 3
xor eax, eax
pop esi
lea ecx, [ebp - 0x424]
cmp dword [ebp - 0x48], eax
jne 0x1002d3a7
mov byte [ebp - 4], 0xc
call fcn.100157fd
xor eax, eax
lea ecx, [ebp - 0x228]
push eax
call fcn.10015802
lea ecx, [ebp - 0x228]
inc dword [eax]
xor eax, eax
push eax
call fcn.10015802
cmp dword [eax], 0x1b
je 0x1002d1e4
jmp 0x1002d3ac
call fcn.100157fd
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.100157fd
push 2
lea ecx, [ebp - 0x1038]
call fcn.10015795
mov dword [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002d406
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1038]
call fcn.10015802
mov dword [eax], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002d3e7
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1002d43c
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002d437
push eax
push 0x1ca
push 0x4d9
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002d411
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1038]
call fcn.100157fd
push ebx
lea ecx, [ebp - 0x240]
call fcn.10015795
xor eax, eax
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002d48c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x240]
call fcn.10015802
mov dword [eax], 0xb26bdde0
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002d468
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x240]
call fcn.10015802
lea ecx, [ebp - 0x240]
mov dword [eax], 0xffffffee
xor eax, eax
push eax
call fcn.10015802
cmp dword [eax], 0x1b
jne 0x1002d67f
jmp 0x1002d4ba
xor ebx, ebx
inc ebx
push esi
lea ecx, [ebp - 0x418]
call fcn.10015795
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002d4fc
push dword [ebp - 0x14]
lea ecx, [ebp - 0x418]
call fcn.10015802
mov dword [eax], 0xd581
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002d4de
xor eax, eax
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x1002d63d
jmp 0x1002d511
xor ebx, ebx
inc ebx
mov dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x418]
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], 0x56ee9734
push dword [ebp - 0x10]
call fcn.10015802
cmp dword [ebp - 0x18], 0xfffffffc
push dword [ebp - 0x10]
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x418]
setg bl
call fcn.10015802
lea ecx, [ebp - 0x240]
mov esi, dword [eax]
xor eax, eax
push eax
imul esi, ebx
call fcn.10015802
lea ecx, [ebp - 0x418]
mov edi, dword [eax]
add edi, esi
neg edi
sbb edi, edi
xor eax, eax
inc eax
inc edi
push eax
call fcn.10015802
xor ebx, ebx
lea ecx, [ebp - 0x240]
cmp edi, dword [eax]
setge bl
xor eax, eax
push eax
call fcn.10015802
lea ecx, [ebp - 0x418]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, ebx
call fcn.10015802
cmp esi, dword [eax]
jne 0x1002d5b1
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002d5b3
lea esi, [eax + 1]
jmp 0x1002d5b5
xor eax, eax
mov esi, eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x418]
call fcn.10015802
xor ecx, ecx
cmp dword [eax], esi
setle cl
xor eax, eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x240]
push eax
call fcn.10015802
cmp dword [eax], 0
je 0x1002d5ee
push dword [ebp - 0x10]
lea ecx, [ebp - 0x418]
call fcn.10015802
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x240]
xor eax, eax
push eax
call fcn.10015802
mov ecx, dword [ebp - 0x48]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x240]
setne bl
xor eax, eax
push eax
call fcn.10015802
lea ecx, [ebp - 0x240]
mov esi, dword [eax]
xor eax, eax
push eax
imul esi, ebx
call fcn.10015802
sub esi, dword [eax]
mov dword [ebp - 0x48], esi
dec dword [ebp - 0x10]
jns 0x1002d50e
push 3
xor eax, eax
pop esi
lea ecx, [ebp - 0x418]
cmp dword [ebp - 0x48], eax
jne 0x1002d67a
mov byte [ebp - 4], 0xf
call fcn.100157fd
xor eax, eax
lea ecx, [ebp - 0x240]
push eax
call fcn.10015802
lea ecx, [ebp - 0x240]
inc dword [eax]
xor eax, eax
push eax
call fcn.10015802
cmp dword [eax], 0x1b
je 0x1002d4b7
jmp 0x1002d67f
call fcn.100157fd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.100157fd
xor ebx, ebx
lea ecx, [ebp - 0x1e0]
inc ebx
push ebx
call fcn.10015795
xor eax, eax
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002d6d2
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1e0]
call fcn.10015802
mov dword [eax], 0xb26bdde0
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002d6ae
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x1e0]
call fcn.10015802
lea ecx, [ebp - 0x1e0]
mov dword [eax], 0xffffffee
xor eax, eax
push eax
call fcn.10015802
jmp 0x1002d8ad
push esi
lea ecx, [ebp - 0x430]
call fcn.10015795
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002d739
push dword [ebp - 0x14]
lea ecx, [ebp - 0x430]
call fcn.10015802
mov dword [eax], 0xd581
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002d71b
xor eax, eax
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x1002d878
mov dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], 0x56ee9734
push dword [ebp - 0x10]
call fcn.10015802
cmp dword [ebp - 0x18], 0xfffffffc
push dword [ebp - 0x10]
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x430]
setg bl
call fcn.10015802
lea ecx, [ebp - 0x1e0]
mov esi, dword [eax]
xor eax, eax
push eax
imul esi, ebx
call fcn.10015802
lea ecx, [ebp - 0x430]
mov edi, dword [eax]
add edi, esi
neg edi
sbb edi, edi
xor eax, eax
inc eax
inc edi
push eax
call fcn.10015802
xor ebx, ebx
lea ecx, [ebp - 0x1e0]
cmp edi, dword [eax]
setge bl
xor eax, eax
push eax
call fcn.10015802
lea ecx, [ebp - 0x430]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, ebx
call fcn.10015802
cmp esi, dword [eax]
jne 0x1002d7e9
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002d7eb
lea esi, [eax + 1]
jmp 0x1002d7ed
xor eax, eax
mov esi, eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x430]
call fcn.10015802
xor ecx, ecx
cmp dword [eax], esi
setle cl
xor eax, eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x1e0]
push eax
call fcn.10015802
cmp dword [eax], 0
je 0x1002d826
push dword [ebp - 0x10]
lea ecx, [ebp - 0x430]
call fcn.10015802
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1e0]
xor eax, eax
push eax
call fcn.10015802
mov ecx, dword [ebp - 0x48]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x1e0]
setne bl
xor eax, eax
push eax
call fcn.10015802
lea ecx, [ebp - 0x1e0]
mov esi, dword [eax]
xor eax, eax
push eax
imul esi, ebx
call fcn.10015802
push 1
pop ebx
sub esi, dword [eax]
mov dword [ebp - 0x48], esi
dec dword [ebp - 0x10]
jns 0x1002d749
push 3
xor eax, eax
pop esi
lea ecx, [ebp - 0x430]
cmp dword [ebp - 0x48], eax
jne 0x1002d8b8
mov byte [ebp - 4], 0x11
call fcn.100157fd
xor eax, eax
lea ecx, [ebp - 0x1e0]
push eax
call fcn.10015802
lea ecx, [ebp - 0x1e0]
inc dword [eax]
xor eax, eax
push eax
call fcn.10015802
push 1
pop ebx
cmp dword [eax], 0x1b
je 0x1002d6f7
jmp 0x1002d8bd
call fcn.100157fd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e0]
call fcn.100157fd
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x14], eax
inc ebx
cmp dword [ebp - 0x14], ebx
jge 0x1002d8f7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd0], 0x5b9b55bb
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002d8d9
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0xd0], eax
jmp 0x1002d929
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1002d923
push 0x173a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
xor eax, eax
inc dword [ebp - 0xd0]
cmp dword [ebp - 0xd0], esi
jge 0x1002d8ff
push esi
lea ecx, [ebp - 0xf34]
call fcn.10015795
mov dword [ebp - 4], 0x13
lea ecx, [ebp - 0xcdc]
mov dword [ebp - 0x14], ebx
push 0xfffffffffffffffe
mov dword [ebp - 0x38], 0x26ff23b1
pop edi
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0xf118c84b
mov dword [ebp - 0x38], 0x93be
push esi
call fcn.10015795
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002d99d
push dword [ebp - 0x20]
lea ecx, [ebp - 0xf34]
call fcn.10015802
mov dword [eax], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002d983
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002d9c3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xff8], 0
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x1002d9a5
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002d9e9
push dword [ebp - 0x20]
lea ecx, [ebp - 0xcdc]
call fcn.10015802
mov dword [eax], 0x736e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002d9cb
xor eax, eax
push 2
pop edi
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], eax
jl 0x1002da0c
push dword [ebp - 0x14]
lea ecx, [ebp - 0xf34]
call fcn.10015802
cmp dword [eax], 0
jne 0x1002da0c
dec dword [ebp - 0x14]
jns 0x1002d9f4
push edi
lea ecx, [ebp - 0xcdc]
call fcn.10015802
lea ecx, [ebp - 0xcdc]
dec dword [eax]
call fcn.100157fd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf34]
call fcn.100157fd
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x129c]
xor eax, eax
mov dword [ebp - 0x38], 0x7632667a
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], edi
push esi
call fcn.10015795
mov dword [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x14], eax
jmp 0x1002da7b
push dword [ebp - 0x14]
call fcn.10015802
mov dword [eax], 0xcbd94543
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x129c]
cmp dword [ebp - 0x14], esi
jl 0x1002da6a
inc dword [ebp - 0x48]
or dword [ebp - 4], 0xffffffff
call fcn.100157fd
push edi
lea ecx, [ebp - 0x125c]
call fcn.10015795
push 4
pop eax
mov dword [ebp - 4], 0x16
lea ecx, [ebp - 0xcf4]
mov dword [ebp - 0x38], eax
push eax
call fcn.10015795
mov byte [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x14], 0xf951fe7
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002daeb
push dword [ebp - 0x14]
lea ecx, [ebp - 0xcf4]
call fcn.10015802
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002dad0
xor eax, eax
dec dword [ebp - 0x48]
mov dword [ebp - 0x14], eax
jmp 0x1002db08
mov dword [ebp - 0x28], 0xac31e13c
mov eax, dword [ebp - 0x28]
push esi
call fcn.10015802
mov dword [eax], ebx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffef
lea ecx, [ebp - 0xcf4]
jne 0x1002daf3
mov byte [ebp - 4], 0x16
call fcn.100157fd
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x30], 0x7e2799ac
mov dword [ebp - 0x30], 0xfffffffe
jmp 0x1002dbd2
push edi
lea ecx, [ebp - 0x1050]
call fcn.10015795
mov byte [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x14], 0xa9d19ac1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002db76
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1050]
call fcn.10015802
mov dword [eax], 0x14d2edc7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002db58
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002db93
cmp byte [ebp - 0x21], 0
je 0x1002db90
push 0x1d75
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
mov byte [ebp - 0x21], al
jle 0x1002db7b
cmp byte [ebp - 0x21], 0
je 0x1002dbc0
push eax
push 0x1737
push 0xc06
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
lea ecx, [ebp - 0x1050]
mov byte [ebp - 4], 0x16
call fcn.100157fd
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x17
je 0x1002db37
xor eax, eax
mov ecx, 0xffff
inc eax
mov dword [ebp - 0x388], eax
mov dword [ebp - 0x384], eax
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x37c], eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x58], 0xfffffff9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002dc27
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe44], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002dc13
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002dc47
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x14a8], 4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002dc2f
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002dc67
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x120c], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002dc4f
xor eax, eax
push 2
pop ebx
mov dword [ebp - 0x37c], ebx
cmp dword [ebp - 0x37c], eax
jl 0x1002dd55
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], 0xd1d8475
mov dword [ebp - 0x48], 0x585ca258
mov dword [ebp - 0x14], eax
jmp 0x1002dca6
xor edi, edi
mov dword [ebp - 0x10], eax
inc edi
cmp dword [ebp - 0x10], ebx
jg 0x1002de96