Function at 0x1002a71b
Capabilities:
Check os version
Create process on windows
Get common file path
Get file size
Get graphical window text
Get system information on windows
Identify system language via api
Modify service

Disassembly:
mov eax, 0x10070e16
call fcn.10070ba0
mov eax, 0x1158
call fcn.1006d460
mov dword [ebp - 0x1c], 0xea75c96
push 8
pop eax
mov dword [ebp - 0x550], eax
mov dword [ebp - 0x54c], eax
mov dword [ebp - 0x548], eax
mov dword [ebp - 0x544], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
mov byte [ebp - 0x85], dl
mov dword [ebp - 0x58], ecx
jge 0x1002a77e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa9c], 0x7c70ab22
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002a765
xor eax, eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowPlacement]
mov dword [ebp - 0x1c], 0x17
jmp 0x1002a7aa
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002a7a7
push eax
call ebx
push eax
call edi
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002a796
mov dword [ebp - 0x1c], 3
push 1
mov dword [ebp - 0xcc], 0xffffffff
pop esi
cmp dword [ebp - 0x1c], eax
jl 0x1002a856
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x48], 0x333c
mov dword [ebp - 0x20], eax
jmp 0x1002a7f1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x4a8], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002a7e0
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x550]
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x548]
mov eax, dword [ebp - 0xa98]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x550]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x550]
cmp ecx, eax
setne dl
or eax, 0xffffffff
sub eax, edx
cmp eax, dword [ebp - 0x28]
jle 0x1002a845
xor eax, eax
cmp dword [ebp - 0x4a8], eax
je 0x1002a847
mov eax, esi
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x1c]
push 0
pop eax
jns 0x1002a7cd
mov dword [ebp - 0x1c], 0xea75c96
push 8
pop ecx
mov dword [ebp - 0x564], ecx
mov dword [ebp - 0x560], ecx
mov dword [ebp - 0x55c], ecx
mov dword [ebp - 0x558], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002a89a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa04], 0x7c70ab22
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002a881
xor eax, eax
mov dword [ebp - 0x1c], 0x17
jmp 0x1002a8b7
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002a8b4
push eax
call ebx
push eax
call edi
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002a8a3
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x1002a956
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x48], 0x333c
mov dword [ebp - 0x20], eax
jmp 0x1002a8f1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x4b4], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002a8e0
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x564]
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x55c]
mov eax, dword [ebp - 0xa00]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x564]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x564]
cmp ecx, eax
setne dl
or eax, 0xffffffff
sub eax, edx
cmp eax, dword [ebp - 0x28]
jle 0x1002a945
xor eax, eax
cmp dword [ebp - 0x4b4], eax
je 0x1002a947
mov eax, esi
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x1c]
push 0
pop eax
jns 0x1002a8cd
mov esi, dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002a96e
push eax
push eax
call esi
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002a98b
push 0x1078
push eax
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor eax, eax
push 8
pop ecx
mov dword [ebp - 0x44], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], ecx
push 3
mov dword [ebp - 0x20], eax
pop edx
cmp dword [ebp - 0x20], edx
jge 0x1002a9bd
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xce0], 0xe91b76e1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002a9a5
xor eax, eax
mov dword [ebp - 0x44], 0xffffffef
cmp dword [ebp - 0x44], 0xfffffffc
jne 0x1002aaa3
xor ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x4c], 0x941c
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x18
je 0x1002aa93
or eax, 0xffffffff
mov dword [ebp - 0x30], 0x6c19
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xb5af
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
sub eax, edx
xor edx, edx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
setg dl
mov dword [ebp - 0xcd8], edx
xor edx, edx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
add ecx, 0x4fbdfbf1
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x48], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x18
jne 0x1002a9f5
xor ecx, ecx
xor eax, eax
inc ecx
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xfffffffc
je 0x1002a9d1
push 3
pop edx
mov dword [ebp - 0x1c], 0xea75c96
mov dword [ebp - 0x43c], edx
mov dword [ebp - 0x438], edx
mov dword [ebp - 0x434], edx
mov dword [ebp - 0x430], edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002aae4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xeb4], 9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002aacb
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x43c], 0xfffffff2
inc ecx
cmp dword [ebp - 0x43c], 0xfffffff7
jle 0x1002abe6
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x40], 0xab593421
mov dword [ebp - 0x40], 0x8f21009d
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x40], 0x552bf338
mov dword [ebp - 0x40], 0x71013923
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0x4dbf0cf8
mov dword [ebp - 0x40], 0x63069be5
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 0x5e0e2bf3
mov dword [ebp - 0x40], 0xba8d7d2a
mov dword [ebp - 0x40], 0xc9b6cd04
mov dword [ebp - 0x40], 0x83afd470
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0x69376522
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002abbc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb38], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002aba4
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002abd8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9c4], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002abc4
xor eax, eax
inc dword [ebp - 0x48]
inc dword [ebp - 0x43c]
jmp 0x1002aaf1
mov dword [ebp - 0x578], 8
mov dword [ebp - 0x574], 8
mov dword [ebp - 0x570], 8
mov dword [ebp - 0x56c], 8
mov dword [ebp - 0x14], 0xf36f6dd8
mov dword [ebp - 0x4c], 0xffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002ac3c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa78], 0x198a8f93
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002ac24
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002ac5c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8c], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002ac44
xor eax, eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], eax
jg 0x1002ac8d
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002ac79
push eax
push eax
call esi
xor eax, eax
inc dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], eax
jle 0x1002ac6a
xor ecx, ecx
push 3
inc ecx
pop edx
mov dword [ebp - 0x14], eax
push 2
pop esi
cmp dword [ebp - 0x14], eax
jl 0x1002ada3
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jge 0x1002acc2
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x124], 0xbca9d692
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002acaa
xor eax, eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], eax
jg 0x1002ad77
mov eax, dword [ebp - 0x11c]
cmp dword [ebp + eax*4 - 0x8c], 0
je 0x1002acea
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp + eax*4 - 0x8c]
cmp dword [ebp - 0xcc], eax
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x8c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x8c]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x8c]
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x4c], eax
jne 0x1002ad4b
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x28], eax
xor eax, eax
inc dword [ebp - 0x11c]
cmp dword [ebp - 0x11c], eax
jle 0x1002acd4
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002ad9a
push 0xe4
push eax
push eax
push eax
push eax
call ebx
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
xor eax, eax
push 3
inc ecx
pop edx
dec dword [ebp - 0x14]
jns 0x1002ac9c
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x70], 0xffffffff
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x20], 0xe5ccc90a
mov dword [ebp - 0x20], eax
jmp 0x1002adea
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002ade4
push ecx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 3
xor eax, eax
pop edx
inc dword [ebp - 0x20]
push 1
pop ecx
cmp dword [ebp - 0x20], edx
jle 0x1002adcb
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002ae0f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb00], 0x7c70ab22
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002adf7
xor eax, eax
mov dword [ebp - 0x14], 0xee76f502
push 4
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1002ae35
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8d0], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002ae21
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x14], eax
jmp 0x1002aec4
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], 0xdf0442e1
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002ae75
push eax
push 0xe73
push eax
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 3
xor eax, eax
pop edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jg 0x1002aec1
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x8d0]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x8d0], ecx
je 0x1002aea6
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x8d0], ecx
je 0x1002aea6
xor eax, eax
inc eax
jmp 0x1002aeaa
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x8d0]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1002ae7f
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1002ae43
mov dword [ebp - 0x1c], 0x17
push 0xfffffffffffffffe
pop ecx
cmp dword [ebp - 0x1c], edx
jge 0x1002b0d5
jmp 0x1002aee4
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov dword [ebp - 0x34], eax
inc ecx
mov dword [ebp - 0x24], ecx
push 0xfffffffffffffffa
pop edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jle 0x1002b060
jmp 0x1002af0c
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x4c], 2
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002af38
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x72c], 0x405732aa
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002af1f
xor eax, eax
push 8
mov dword [ebp - 0x38], 0xffffffe5
pop edx
cmp dword [ebp - 0x38], edx
je 0x1002b053
jmp 0x1002af4f
xor eax, eax
mov dword [ebp - 0x24], eax
or edx, 0xffffffff
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x38], ecx
je 0x1002b00c
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x18], 0x6f37
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ecx
jg 0x1002b031
mov dword [ebp - 0x28], 0x9150faeb
mov dword [ebp - 0x24], eax
jmp 0x1002afbf
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002afbc
push eax
push 0x16a3
push 0x5b2
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
xor ecx, ecx
xor eax, eax
inc ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x1002af97
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x72c], 0
jne 0x1002afd8
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002afda
mov eax, ecx
neg eax
jne 0x1002afe1
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x728]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x44]
push 0
pop eax
cmp dword [ebp - 0x44], ecx
jle 0x1002af8b
jmp 0x1002b02f
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x1002b01c
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b02f
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x1002b041
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
inc dword [ebp - 0x38]
push 8
pop eax
push 1
pop ecx
cmp dword [ebp - 0x38], eax
jne 0x1002af4d
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffa
jg 0x1002af0a
mov dword [ebp - 0x24], 0xb8342836
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1002b0a9
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0xf851
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x34]
jl 0x1002b0a9
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002b0ac
xor eax, eax
inc eax
imul eax, eax, 0xa404
mov dword [ebp - 0x28], eax
cmp byte [ebp - 0xd], 0
je 0x1002b0c3
xor eax, eax
push eax
call ebx
push eax
call edi
dec dword [ebp - 0x1c]
push 3
pop edx
push 0xfffffffffffffffe
pop ecx
cmp dword [ebp - 0x1c], edx
jl 0x1002aee2
mov dword [ebp - 0x30], 0x7bf0
or edi, 0xffffffff
mov dword [ebp - 0x34], 0x9b95
xor eax, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], eax
jmp 0x1002b101
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xda0], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002b0f0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xd98], eax
mov dword [ebp - 0x24], 0xffffffe3
cmp dword [ebp - 0x24], 0x1b
jle 0x1002b197
mov edi, 0xdf860956
mov dword [ebp - 0x30], 0xcfd6
mov dword [ebp - 0x28], 0x5950cfdf
mov eax, dword [ebp - 0x30]
neg eax
jne 0x1002b159
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1002b159
mov ecx, eax
jmp 0x1002b15e
xor eax, eax
lea ecx, [eax + 1]
mov eax, 0x42ad5d7c
sub eax, ecx
xor ecx, ecx
add eax, dword [ebp - 0x30]
cmp eax, 0xef90
mov eax, dword [ebp - 0x30]
setg cl
cmp edi, ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
setge dl
mov dword [ebp - 0x28], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1b
jg 0x1002b139
mov edi, dword [ebp - 0xcc]
push 3
pop edx
mov dword [ebp - 0x1c], edx
xor eax, eax
cmp dword [ebp - 0x1c], eax
jl 0x1002b22e
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x48], 0x333c
mov dword [ebp - 0x20], eax
jmp 0x1002b1c9
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x4c0], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002b1b8
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x578]
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x570]
mov eax, dword [ebp - 0xafc]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x578]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x578]
cmp ecx, eax
mov eax, edi
setne dl
sub eax, edx
cmp eax, dword [ebp - 0x28]
jle 0x1002b21c
xor eax, eax
cmp dword [ebp - 0x4c0], eax
je 0x1002b21f
xor eax, eax
inc eax
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x1c]
push 0
pop eax
jns 0x1002b1a5
mov dword [ebp - 0x40], eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b244
push eax
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b261
push 0x1078
push eax
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor eax, eax
mov dword [ebp - 0x1c], 0xc93b4e1
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x48], 0xe61175c8
mov dword [ebp - 0x48], 0xce65
push 4
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1002b29c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xdf4], 0x49562184
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002b284
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002b405
mov dword [ebp - 0x39c], ecx
xor edi, edi
mov dword [ebp - 0x398], ecx
inc edi
mov dword [ebp - 0x394], ecx
mov dword [ebp - 0x390], ecx
mov dword [ebp - 0x2c], 0xcb8ce3e
mov dword [ebp - 0x28], 0x543b
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x1002b349
mov dword [ebp - 0x20], eax
jmp 0x1002b2ec
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8a8], 0x16501874
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002b2db
mov eax, dword [ebp - 0x2c]
push 0
mov eax, dword [ebp + eax*4 - 0x39c]
mov eax, dword [ebp - 0x8a8]
mov eax, dword [ebp - 0x8a8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x39c], ecx
xor ecx, ecx
mov dword [ebp - 0x8a8], edi
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
cmp eax, edi
mov eax, dword [ebp - 0x1c]
setl cl
sub eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
pop eax
jle 0x1002b2d6
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x1002b402
mov dword [ebp - 0x48], 0xb7f464f6
mov ecx, 0xd633
mov eax, dword [ebp - 0x390]
sub ecx, eax
jne 0x1002b375
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002b37e
jmp 0x1002b377
xor eax, eax
mov edx, edi
cmp dword [ebp - 0x1c], eax
jne 0x1002b380
mov edx, eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x39c]
mov eax, dword [ebp - 0x1c]
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov ecx, edi
setne dl
xor eax, eax
add edx, dword [ebp - 0xde8]
cmp edx, edi
setle al
xor edx, edx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
add ecx, dword [ebp - 0x394]
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x28]
imul ecx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x39c]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x390]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x48], edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x1002b356
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x11
mov ecx, 0x33efc07e
jg 0x1002b2a4
push 3
pop edx
mov dword [ebp - 0x46c], edx
mov dword [ebp - 0x468], edx
mov dword [ebp - 0x464], edx
mov dword [ebp - 0x460], edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002b451
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xefc], 9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002b438
xor eax, eax
xor edi, edi
mov dword [ebp - 0x46c], 0xfffffff2
inc edi
cmp dword [ebp - 0x46c], 0xfffffff7
jle 0x1002b54a
or ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 0xab593421
mov dword [ebp - 0x40], 0x8f21009d
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 0x552bf338
mov dword [ebp - 0x40], 0x71013923
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0x4dbf0cf8
mov dword [ebp - 0x40], 0x63069be5
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x40], 0x5e0e2bf3
mov dword [ebp - 0x40], 0xba8d7d2a
mov dword [ebp - 0x40], 0xc9b6cd04
mov dword [ebp - 0x40], 0x83afd470
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0x69376522
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002b518
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9d0], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002b504
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002b534
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xaec], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002b520
xor eax, eax
inc dword [ebp - 0x48]
inc dword [ebp - 0x46c]
cmp dword [ebp - 0x46c], 0xfffffff7
jg 0x1002b46e
mov dword [ebp - 0x14], 0xf36f6dd8
mov ecx, 0xffff
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002b579
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9dc], 0x198a8f93
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002b561
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002b599
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9c], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002b581
xor eax, eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], eax
jg 0x1002b5cb
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b5ba
push eax
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
inc dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], eax
jle 0x1002b5a7
push 3
pop edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1002b6de
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jge 0x1002b601
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x160], 0xbca9d692
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002b5e9
xor eax, eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], eax
jg 0x1002b6b5
or ecx, 0xffffffff
mov eax, dword [ebp - 0x158]
cmp dword [ebp + eax*4 - 0x9c], 0
je 0x1002b62c
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp + eax*4 - 0x9c]
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x15c]
jne 0x1002b689
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x28], eax
xor eax, eax
inc dword [ebp - 0x158]
cmp dword [ebp - 0x158], eax
jle 0x1002b616
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b6d5
push 0xe4
push eax
push eax
push eax
push eax
call ebx
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 3
xor eax, eax
pop edx
dec dword [ebp - 0x14]
jns 0x1002b5d7
mov dword [ebp - 0x2c], 0xea75c96
or ecx, 0xffffffff
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x20], 0xe5ccc90a
mov dword [ebp - 0x20], eax
jmp 0x1002b71c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b719
push edi
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 3
xor eax, eax
pop edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1002b700
push 8
pop ecx
mov dword [ebp - 0x5a4], ecx
mov dword [ebp - 0x5a0], ecx
mov dword [ebp - 0x59c], ecx
mov dword [ebp - 0x598], ecx
mov dword [ebp - 0x14], 0xee76f502
push 4
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1002b766
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8f0], 2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002b74e
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002b7ee
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], 0xdf0442e1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b7a0
push eax
push 0xe73
push eax
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 3
xor eax, eax
pop edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jg 0x1002b7eb
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x8f0]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x8f0], ecx
je 0x1002b7d0
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x8f0], ecx
je 0x1002b7d0
mov eax, edi
jmp 0x1002b7d4
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x8f0]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1002b7aa
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1002b76e
mov dword [ebp - 0x30], 0x7bf0
or ecx, 0xffffffff
mov dword [ebp - 0x34], 0x9b95
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
jmp 0x1002b821
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xcf8], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002b810
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xcf0], eax
mov dword [ebp - 0x24], 0xffffffe3
cmp dword [ebp - 0x24], 0x1b
jle 0x1002b8ac
mov dword [ebp - 0x30], 0xcfd6
mov dword [ebp - 0x28], 0x5950cfdf
mov eax, dword [ebp - 0x30]
neg eax
jne 0x1002b872
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x30], eax
je 0x1002b874
mov ecx, edi
mov eax, 0x42ad5d7c
sub eax, ecx
xor ecx, ecx
add eax, dword [ebp - 0x30]
cmp eax, 0xef90
mov eax, 0xdf860956
setg cl
cmp eax, ecx
mov eax, dword [ebp - 0x30]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
setge dl
mov dword [ebp - 0x28], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1b
jg 0x1002b854
or ecx, 0xffffffff
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], edi
push 0xfffffffffffffffa
pop edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jle 0x1002ba24
jmp 0x1002b8d3
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x4c], 2
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002b8ff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x7fc], 0x405732aa
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002b8e6
xor eax, eax
push 8
mov dword [ebp - 0x38], 0xffffffe5
pop edx
cmp dword [ebp - 0x38], edx
je 0x1002ba14
jmp 0x1002b916
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x38], edi
je 0x1002b9cd
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x18], 0x6f37
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], edi
jg 0x1002b9f2
mov dword [ebp - 0x28], 0x9150faeb
mov dword [ebp - 0x24], eax
jmp 0x1002b980
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b97d
push eax
push 0x16a3
push 0x5b2
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x1002b95b
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x7fc], 0
jne 0x1002b999
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002b99b
mov eax, edi
neg eax
jne 0x1002b9a2
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x7f8]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x44]
push 0
pop eax
cmp dword [ebp - 0x44], edi
jle 0x1002b94f
jmp 0x1002b9f0
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002b9dd
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b9f0
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ba02
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
inc dword [ebp - 0x38]
push 8
pop eax
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x38], eax
jne 0x1002b914
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffa
push 0xffffffffffffffff
pop ecx
jg 0x1002b8d1
mov dword [ebp - 0x24], 0xb8342836
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1002ba6d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0xf851
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x34]
jl 0x1002ba6d
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002ba6f
mov eax, edi
imul eax, eax, 0xa404
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002ba9c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xab0], 0x7c70ab22
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002ba83
xor eax, eax
push 8
pop ecx
mov dword [ebp - 0x24], ecx
push 0xfffffffffffffffb
pop ecx
mov dword [ebp - 0x1c], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x4c], ecx
push 4
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1002bad8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xba0], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002bac0
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002bae9
mov dword [ebp - 0x1c], 0xbf3087d0
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002bb18
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, dword [ebp - 0x24]
jl 0x1002bb09
cmp dword [ebp - 0x24], eax
je 0x1002bb09
mov eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
neg eax
push 3
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
xor eax, eax
pop ecx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x1002bbb2
mov dword [ebp - 0x48], 0x657c
mov dword [ebp - 0x28], 0x5701832d
mov dword [ebp - 0x34], 0x27f44fb6
cmp dword [ebp - 0x1c], eax
je 0x1002bb58
cmp dword [ebp - 0xb94], eax
je 0x1002bb58
mov eax, edi
xor edx, edx
cmp eax, 0xa426
mov eax, dword [ebp - 0x48]
setl dl
xor ecx, ecx
cmp eax, edx
push 0
setg cl
xor edx, edx
cmp ecx, 0x2c2a
setg dl
xor ecx, ecx
sub edx, dword [ebp - 0x48]
sub edx, dword [ebp - 0x28]
imul edx, dword [ebp - 0x4c]
imul edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xba0]
cmp eax, edx
setle cl
xor eax, eax
cmp ecx, 0x58a8ce9b
setl al
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x1c]
pop eax
jns 0x1002bb34
push 3
pop ecx
mov edi, dword [sym.imp.GDI32.dll_RoundRect]
mov dword [ebp - 0x2c], 0x17
cmp dword [ebp - 0x2c], ecx
jge 0x1002bdaf
jmp 0x1002bbcc
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002bbec
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1154], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002bbd4
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002bc1d
push 0x250f
push 0x14dd
push 0x2466
push 0x1d11
push 0x195b
push 0xce3
call ebx
push eax
call esi
push eax
call edi
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002bc4e
push 0x250f
push 0x14dd
push 0x2466
push 0x1d11
push 0x195b
push 0xce3
call ebx
push eax
call esi
push eax
call edi
xor eax, eax
mov byte [ebp - 0xd], al
or edx, 0xffffffff
mov dword [ebp - 0x40], 0x56834504
xor ecx, ecx
mov dword [ebp - 0x40], edx
inc ecx
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x40], 0x568d526d
mov dword [ebp - 0x40], 0xd3f7bf48
push 3
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 0x45625132
mov dword [ebp - 0x40], 0xfffffff8
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x40], 0xfaf07207
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0x40], 0x7bb7ab61
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x48], 0x61fbc9fa
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x40], 0xcae2fe81
mov dword [ebp - 0x40], 0x6986d6db
mov dword [ebp - 0x48], 0x8b01
mov dword [ebp - 0x20], eax
jmp 0x1002bcf6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x10ac], 0xc0198ab7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002bce5
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
cmp byte [ebp - 0xd], 0
je 0x1002bda3
xor eax, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], eax
jmp 0x1002bd90
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002bd3a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa14], 0x5710
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002bd21
xor eax, eax
cmp dword [ebp - 0xa10], eax
jne 0x1002bd96
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002bd8d
push 0x1e4b
push 0x608
push 0x11b
push eax
push 0x2c0
push 0x1583
call ebx
push eax
call esi
push eax
push 0x233d
push 0xced
push 0x1c6e
push 0x1e3
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe9
jne 0x1002bd18
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 3
pop ecx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002bbca
xor eax, eax
mov dword [ebp - 0x30], 0xa32b1cec
push 4
mov dword [ebp - 0x20], eax
pop edx
cmp dword [ebp - 0x20], edx
jge 0x1002bddb
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe04], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002bdc3
xor eax, eax
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jl 0x1002be1f
mov dword [ebp - 0x20], eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002bdfb
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jg 0x1002be1a
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xe04], 0
jne 0x1002be18
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jle 0x1002be03
xor eax, eax
dec dword [ebp - 0x30]
jns 0x1002bde3
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jl 0x1002c4e0
xor edx, edx
push 2
inc edx
pop edi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], 0xd8da8e97
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x14], 0x4137d6c5
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x20], eax
jmp 0x1002be69
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa30], 0x5674
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002be58
mov eax, dword [ebp - 0x44]
neg eax
mov dword [ebp - 0x14], eax
jne 0x1002be7b
mov eax, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1002be8b
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
push 0xfffffffffffffffa
pop ecx
sub ecx, eax
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
sub eax, 0xdd2e
cmp eax, 0x4132
setne cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x44]
je 0x1002c0f3
xor eax, eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jg 0x1002bef8
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xa30]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1002bee1
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x40], 0x933bd3e0
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1002bf25
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x31c], 0xa876e6ba
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1002bf0d
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xf
je 0x1002c0a5
mov dword [ebp - 0x1c], 0x4696a485
mov dword [ebp - 0x24], 0x1d91e66
mov dword [ebp - 0x28], 0x2f2aa787
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x1002bfb0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002bf76
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2e8], 7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002bf5e
xor eax, eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], edx
jg 0x1002bfa8
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x31c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x31c], ecx
inc dword [ebp - 0x2e8]
cmp dword [ebp - 0x2e8], edx
jle 0x1002bf84
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002bf56
or ecx, 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jg 0x1002c093
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x24], 0xa96141e4
mov eax, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jge 0x1002bfee
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd8], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1002bfda
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002c00b
push 8
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x31c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002bff9
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x31c]
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, 5
setle al
xor edx, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, 0x7f2bd0ad
je 0x1002c051
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x31c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
push 0xffffffffffffffff
setge dl
mov dword [ebp - 0x48], edx
xor edx, edx
inc dword [ebp - 0x1c]
inc edx
pop ecx
cmp dword [ebp - 0x1c], edx
jle 0x1002bfbc
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xf
push 0xffffffffffffffff
pop ecx
jne 0x1002bf32
or ecx, ecx
mov dword [ebp - 0x4c], 0xfffffffd
mov dword [ebp - 0x48], 0xfffffff9
mov dword [ebp - 0x48], 0x46c2e7cc
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x48], 0x89fff12f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002c0eb
push 4
pop edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x590], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002c0d4
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x1c], eax
jmp 0x1002c22a
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x17
jg 0x1002c216
mov dword [ebp - 0x48], 0xfffffff8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff0
jl 0x1002c1eb
mov dword [ebp - 0x4c], 0x7903
mov dword [ebp - 0x34], 0xc8a2db63
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1002c14a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x968], 0x77974d37
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1002c132
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jg 0x1002c184
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c179
push 0x1a8
push eax
push 0xe2
push 0x1b4e
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x1002c152
xor edx, edx
inc edx
cmp dword [ebp - 0x4c], eax
jne 0x1002c1bc
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x48]
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setge dl
sub eax, edx
je 0x1002c1ab
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002c1ad
xor edx, edx
inc edx
mov eax, edx
jmp 0x1002c1b0
xor eax, eax
xor edx, edx
inc edx
cmp dword [ebp - 0xa2c], eax
jg 0x1002c1bc
xor eax, eax
jmp 0x1002c1be
mov eax, edx
mov dword [ebp - 0x34], eax
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
cmp eax, edi
mov eax, 0x4b9053ad
setge cl
sub eax, ecx
mov dword [ebp - 0x968], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff0
push 0
pop eax
jge 0x1002c11c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c1ff
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
push 1
pop edx
jle 0x1002c108
xor eax, eax
jmp 0x1002bef8
xor eax, eax
jmp 0x1002befb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x510], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002c21d
mov eax, dword [ebp - 0x588]
xor edx, edx
mov eax, dword [ebp - 0x588]
mov ecx, dword [ebp - 0x588]
mov eax, dword [ebp - 0x588]
add eax, ecx
mov dword [ebp - 0x510], eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x588]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x588]
cmp ecx, eax
setne dl
xor eax, eax
mov dword [ebp - 0x48], edx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002c294
push 0x14b7
call ebx
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
xor eax, eax
mov dword [ebp - 0x28], 0x333c
xor ecx, ecx
mov dword [ebp - 0x24], 0xfffffffa
inc ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002c2c5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x218], 0x2d5e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002c2ad
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1002c3b5
mov dword [ebp - 0x14], 6
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c2eb
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x218], ecx
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002c3a0
mov dword [ebp - 0x38], 0x5b40194
mov dword [ebp - 0x38], eax
jmp 0x1002c394
mov dword [ebp - 0x20], 0x7a9a9718
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x1002c391
push 8
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x1002c378
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c353
push 0x249
push 0x148c
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c370
push 0x25a0
push eax
push 0x2ea
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x1002c332
push 8
pop ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x218], 0
jne 0x1002c38f
inc dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
jle 0x1002c327
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jle 0x1002c315
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1002c309
dec dword [ebp - 0x24]
push 0
pop eax
jns 0x1002c2d1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c3c5
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
or eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0x3f0244c3
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jle 0x1002c405
jne 0x1002c405
mov ecx, eax
jmp 0x1002c40d
xor edi, edi
push 2
lea ecx, [edi + 1]
pop edi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jle 0x1002c440
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002c455
push 0x1078
push eax
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
jmp 0x1002c453
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002c453
call ebx
push eax
call dword [sym.imp.USER32.dll_GetMenu]
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002c46b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x4cc], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1002c45a
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x5a4]
mov dword [ebp - 0x4cc], eax
mov eax, dword [ebp - 0x59c]
mov eax, dword [ebp - 0xaac]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x5a4]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x5a4]
cmp ecx, eax
setne dl
or eax, 0xffffffff
sub eax, edx
cmp eax, dword [ebp - 0x4c]
jle 0x1002c4c3
xor eax, eax
cmp dword [ebp - 0x4cc], eax
jne 0x1002c4c3
xor edx, edx
inc edx
jmp 0x1002c4c8
xor edx, edx
inc edx
mov eax, edx
push 0
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x2c]
pop eax
push 3
pop ecx
jns 0x1002be31
mov edi, dword [sym.imp.GDI32.dll_RoundRect]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c4f6
push eax
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c513
push 0x1078
push eax
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor eax, eax
mov dword [ebp - 0x1c], 0xc93b4e1
or ecx, 0xffffffff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x48], 0xe61175c8
mov dword [ebp - 0x48], 0xce65
push 4
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1002c551
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe1c], 0x49562184
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002c539
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x11
jle 0x1002c6d7
mov ecx, 0x33efc07e
xor edx, edx
mov dword [ebp - 0x3bc], ecx
inc edx
mov dword [ebp - 0x3b8], ecx
mov dword [ebp - 0x3b4], ecx
mov dword [ebp - 0x3b0], ecx
mov dword [ebp - 0x2c], 0xcb8ce3e
mov dword [ebp - 0x28], 0x543b
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x1002c608
mov dword [ebp - 0x20], eax
jmp 0x1002c5ab
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x854], 0x16501874
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002c59a
mov eax, dword [ebp - 0x2c]
push 0
mov eax, dword [ebp + eax*4 - 0x3bc]
mov eax, dword [ebp - 0x854]
mov eax, dword [ebp - 0x854]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x3bc], ecx
xor ecx, ecx
mov dword [ebp - 0x854], edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setl cl
sub eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
pop eax
jle 0x1002c595
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x1002c6c4
mov dword [ebp - 0x48], 0xb7f464f6
mov ecx, 0xd633
mov eax, dword [ebp - 0x3b0]
sub ecx, eax
jne 0x1002c634
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002c63b
jmp 0x1002c636
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002c63d
mov edx, eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x3bc]
mov eax, dword [ebp - 0x1c]
imul ecx, edx
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
add edx, dword [ebp - 0xe10]
xor edi, edi
inc edi
cmp edx, edi
mov ecx, edi
push edi
setle al
xor edx, edx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
add ecx, dword [ebp - 0x3b4]
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x28]
imul ecx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x3bc]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x3b0]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x48], edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
pop edx
jle 0x1002c615
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x11
jg 0x1002c55e
mov edi, dword [sym.imp.GDI32.dll_RoundRect]
mov ecx, 0xfff7
xor edx, edx
mov dword [ebp - 0x78], ecx
inc edx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jge 0x1002c70b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x174], 0xfffffff6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002c6f3
xor eax, eax
mov dword [ebp - 0x174], 3
cmp dword [ebp - 0x174], eax
jl 0x1002c773
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c768
push 0x1e4b
push 0x608
push 0x11b
push eax
push 0x2c0
push 0x1583
call ebx
push eax
call esi
push eax
push 0x233d
push 0xced
push 0x1c6e
push 0x1e3
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
xor eax, eax
dec dword [ebp - 0x174]
jns 0x1002c71d
xor edx, edx
inc edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x40], 0x53072226
push 8
pop ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002c7b4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x100c], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002c79b
xor eax, eax
inc dword [ebp - 0x24]
mov dword [ebp - 0x24], 0xffffffe4
jmp 0x1002c7e3
mov dword [ebp - 0x28], 0x69aed23b
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x40], 0x76ec
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x28], eax
jne 0x1002c7e9
dec dword [ebp - 0x48]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xa
jle 0x1002c7c0
mov dword [ebp - 0x1c], 0xc93b4e1
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x48], 0xe61175c8
mov dword [ebp - 0x48], 0xce65
push 4
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1002c824
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe34], 0x49562184
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002c80c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x11
jle 0x1002c9aa
mov ecx, 0x33efc07e
mov dword [ebp - 0x3ac], ecx
mov dword [ebp - 0x3a8], ecx
mov dword [ebp - 0x3a4], ecx
mov dword [ebp - 0x3a0], ecx
mov dword [ebp - 0x2c], 0xcb8ce3e
mov dword [ebp - 0x28], 0x543b
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x1002c8d8
mov dword [ebp - 0x20], eax
jmp 0x1002c87b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8c0], 0x16501874
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002c86a
mov eax, dword [ebp - 0x2c]
push 0
mov eax, dword [ebp + eax*4 - 0x3ac]
mov eax, dword [ebp - 0x8c0]
mov eax, dword [ebp - 0x8c0]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x3ac], ecx
xor ecx, ecx
mov dword [ebp - 0x8c0], edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setl cl
sub eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
pop eax
jle 0x1002c865
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x1002c994
mov dword [ebp - 0x48], 0xb7f464f6
mov ecx, 0xd633
mov eax, dword [ebp - 0x3a0]
sub ecx, eax
jne 0x1002c904
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002c90b
jmp 0x1002c906
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002c90d
mov edx, eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x3ac]
mov eax, dword [ebp - 0x1c]
imul ecx, edx
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
add edx, dword [ebp - 0xe28]
xor edi, edi
inc edi
cmp edx, edi
mov ecx, edi
push edi
setle al
xor edx, edx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
add ecx, dword [ebp - 0x3a4]
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x28]
imul ecx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x3ac]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x3a0]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x48], edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
pop edx
jle 0x1002c8e5
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x11
push 1
pop edx
jg 0x1002c831
mov edi, dword [sym.imp.GDI32.dll_RoundRect]
mov dword [ebp - 0x2c], 9
xor edx, edx
mov dword [ebp - 0x24], 0xfffffff9
inc edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1002c9de
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2a4], 0x9a56718e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002c9c6
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002c9fd
push 0xfffffffffffffffe
pop ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd70], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002c9ea
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp eax, edx
push 0
setle cl
sub ecx, dword [ebp - 0x2c]
neg ecx
pop eax
sbb ecx, ecx
inc ecx
sets al
add eax, dword [ebp - 0x2c]
jne 0x1002ca46
cmp dword [ebp - 0x2a4], eax
je 0x1002ca48
mov eax, edx
mov dword [ebp - 0xd70], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
dec eax
neg eax
push 8
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jle 0x1002caef
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1d
je 0x1002caa3
cmp dword [ebp - 0x28], eax
jne 0x1002caa0
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ca97
push 0x1d0e
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1d
jne 0x1002ca7b
push 8
pop ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xb
jg 0x1002cae4
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cabd
call dword [sym.imp.USER32.dll_WaitMessage]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cad8
push eax
push 0x1ffe
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xb
jle 0x1002caac
push 8
pop ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jg 0x1002ca6f
xor edx, edx
inc edx
mov dword [ebp - 0x1c], 0xf6af1124
mov dword [ebp - 0x30], 0x3cc25429
mov dword [ebp - 0x28], 0x607d19fa
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jl 0x1002cbc5
or edi, 0xffffffff
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
jmp 0x1002cb36
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x170], 0xc312fbb6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002cb25
mov eax, dword [ebp - 0x170]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x170]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
imul eax, edx
test eax, eax
je 0x1002cb79
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002cbac
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
push 0
pop eax
push 1
pop edx
jge 0x1002cb17
mov edi, dword [sym.imp.GDI32.dll_RoundRect]
mov dword [ebp - 0x40], 0x6f5020f8
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cbe3
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cbf8
push eax
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
xor eax, eax
push 8
mov dword [ebp - 0x40], eax
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x40], 0x94fe5f36
push 2
mov dword [ebp - 0x20], eax
pop esi
cmp dword [ebp - 0x20], esi
jge 0x1002cc2b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe0c], 0x9b3198a8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002cc13
xor eax, eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jl 0x1002cc45
mov dword [ebp - 0x48], 0x3034d006
dec dword [ebp - 0x48]
dec dword [ebp - 0x30]
jns 0x1002cc36
mov dword [ebp - 0x24], 0xfffa
mov dword [ebp - 0x28], 0x66c93ee3
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x40], 0xedd1edb6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002cc83
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa44], 0x125d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002cc6a
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002cca3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x520], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002cc8b
xor eax, eax
inc dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jg 0x1002cd63
mov dword [ebp - 0x40], 0x10d21dfe
mov dword [ebp - 0x40], 0xe9fb1c03
mov dword [ebp - 0x40], 0x9f5fa318
mov dword [ebp - 0x1c], 0xae45661c
mov dword [ebp - 0x28], 0xa75e3aa9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002ccf5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa88], 0xfffffff6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002ccdd
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cd05
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
dec dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x48e6bae0
mov dword [ebp - 0x520], eax
setne cl
xor eax, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], eax
jmp 0x1002cd4c
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0xa44]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xa44], 0
jne 0x1002cd51
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002cd25
inc dword [ebp - 0x24]
push 0
pop eax
push 1
pop ecx
cmp dword [ebp - 0x24], esi
jle 0x1002ccb2
mov byte [ebp - 0x4d], al
push 8
mov dword [ebp - 0x1c], 0x7e2799ac
pop edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002cd93
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa24], 0x74a6e8f5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002cd7b
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDlgItemTextW]
mov dword [ebp - 0x1c], 0xffffffea
jmp 0x1002ce5e
mov dword [ebp - 0x24], 0xe8b72fd4
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0xffffffeb
jmp 0x1002cde7
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cdd4
push 0x1fb5
push eax
push 0x19b8
call ebx
push eax
call esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp ecx, eax
push ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x24]
pop eax
cmp dword [ebp - 0x24], 0xffffffea
jle 0x1002cdbb
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
cmp eax, 0x78e045dc
mov eax, dword [ebp - 0x28]
push 0
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0xa20], ecx
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setl cl
xor edx, edx
neg ecx
cmp ecx, eax
pop eax
setle dl
imul edx, dword [ebp - 0x34]
push 1
pop ecx
sub edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x28], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xb
je 0x1002cda5
cmp byte [ebp - 0x4d], 0
je 0x1002d01d
mov dword [ebp - 0x14], 0xca2cb51d
xor eax, eax
mov dword [ebp - 0x20], 0x74bf90ed
mov dword [ebp - 0x24], 0x5950cfdf
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x6ae69ed9
mov dword [ebp - 0x48], eax
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
dec ecx
neg ecx
push 0
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], 0x36fbc6a6
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
pop ecx
sets cl
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
add edx, dword [ebp - 0x24]
cmp edx, 3
setg al
cmp dword [ebp - 0x24], eax
jg 0x1002cefe
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002cefe
mov edx, eax
jmp 0x1002cf03
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
cmp dword [ebp - 0x14], ecx
jge 0x1002cfa1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x15
jg 0x1002d013
xor edi, edi
inc edi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002cf4a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb50], 0x4f2ca125
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002cf31
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cf6e
push edi
push 0xeaa
push 0x195b
push 0x1fe7
call ebx
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002cf90
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb50], 0xa83cd0cd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002cf77
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x15
jle 0x1002cf28
mov edi, dword [sym.imp.GDI32.dll_RoundRect]
jmp 0x1002d013
push 2
mov dword [ebp - 0x20], eax
pop ecx
jmp 0x1002cfb6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf8], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002cfa9
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0xf4], eax
je 0x1002cfcb
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xf4], eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
push 8
mov dword [ebp - 0x1c], 0x7e2799ac
pop eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002d04e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa38], 0x74a6e8f5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002d035
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffea
cmp dword [ebp - 0x1c], 0xb
jne 0x1002d128
xor edi, edi
inc edi
mov dword [ebp - 0x24], 0xe8b72fd4
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0xffffffeb
jmp 0x1002d0a4
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d091
push 0x1fb5
push eax
push 0x19b8
call ebx
push eax
call esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp ecx, eax
push ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x24]
pop eax
cmp dword [ebp - 0x24], 0xffffffea
jle 0x1002d078
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
cmp eax, 0x78e045dc
mov eax, dword [ebp - 0x28]
push 0
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0xa34], ecx
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setl cl
xor edx, edx
neg ecx
cmp ecx, eax
pop eax
setle dl
imul edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x28], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xb
je 0x1002d062
mov edi, dword [sym.imp.GDI32.dll_RoundRect]
mov dword [ebp - 0x2c], 0x52cb1363
mov dword [ebp - 0x34], 0xb9aa6b35
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2c]
jne 0x1002d30e
mov dword [ebp - 0x24], 0xd9ba5f27
or eax, 0xffffffff
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
jmp 0x1002d171
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x420], 0x76c5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002d160
mov eax, dword [ebp - 0x41c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002d199
cmp dword [ebp - 0x41c], eax
je 0x1002d199
xor esi, esi
inc esi
mov eax, esi
jmp 0x1002d19c
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x41c]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setge bl
xor ecx, ecx
cmp ebx, eax
setl cl
cmp ecx, dword [ebp - 0x418]
jge 0x1002d1d4
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002d1d4
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x41c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x41c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 6
jmp 0x1002d2e7
xor eax, eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002d217
push 8
pop ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1f4], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002d205
mov dword [ebp - 0x20], 0x11
cmp dword [ebp - 0x20], 0xfffffff4
jg 0x1002d2d3
or ebx, 0xffffffff
mov dword [ebp - 0x28], 0xfffd
mov dword [ebp - 0x48], 0x828c040c
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x28]
sub eax, 0xa97a
neg eax
sbb eax, eax
inc eax
neg eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1f4]
neg eax
sbb eax, eax
xor edx, edx
neg eax
add eax, 0xffff0001
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1f4]
add ecx, eax
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, ebx
setle al
xor ecx, ecx
cmp eax, 0xc239
mov eax, dword [ebp - 0x2c]
setg cl
xor edx, edx
cmp ecx, eax
setne dl
lea ecx, [edx + 0x7cc512a2]
xor edx, edx
imul ecx, dword [ebp - 0x1f4]
mov eax, dword [ebp - 0x2c]
inc ecx
cmp ecx, eax
sete dl
xor eax, eax
sub edx, dword [ebp - 0x2c]
cmp edx, 0xa6f5
setg al
xor ecx, ecx
cmp eax, 0xf61c
setl cl
inc ecx
mov dword [ebp - 0x48], ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff4
jle 0x1002d22b
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002d2e4
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x1002d1f5
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
mov byte [ebp - 0x4d], al
push 4
mov dword [ebp - 0x20], 0x69fdf99f
mov dword [ebp - 0x20], eax
pop ecx
jmp 0x1002d402
mov dword [ebp - 0x48], 0x5359
xor esi, esi
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x30], eax
inc esi
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002d342
push 4
pop ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf0], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002d32e
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x1002d362
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xf0], 6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002d34a
xor eax, eax
cmp dword [ebp - 0xf0], eax
je 0x1002d373
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xf0]
sub eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], esi
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
mov eax, dword [ebp - 0xf0]
add ecx, eax
mov eax, dword [ebp - 0xf0]
cmp ecx, eax
setg dl
imul eax, edx, 0x99d0
add eax, 0x19b80da0
cmp eax, dword [ebp - 0x34]
jg 0x1002d3ba
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
jmp 0x1002d2f7
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d3fa
push 0x166f
push 0xcd6
push 0x77c
push 0xd12
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 4
xor eax, eax
pop ecx
cmp dword [ebp - 0x20], eax
jne 0x1002d407
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002d3c8
cmp byte [ebp - 0x4d], 0
je 0x1002d476
mov dword [ebp - 0x28], eax
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x40], 0xa43d9532
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], 0x5425a80e
mov dword [ebp - 0x40], 0x16db6d03
mov dword [ebp - 0x48], 0x8b1647c2
mov dword [ebp - 0x20], eax
jmp 0x1002d451
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xfac], 0x5af8b513
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002d440
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
xor eax, eax
dec dword [ebp - 0x48]
push 0x1078
push eax
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor eax, eax
mov dword [ebp - 0x40], 0xac78
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d491
call ebx
push eax
call dword [sym.imp.USER32.dll_IsWindow]
xor eax, eax
mov esi, dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d4b9
push eax
push 0x693
push 0x10db
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
xor eax, eax
mov ecx, 0xfff7
xor edx, edx
mov dword [ebp - 0x78], ecx
inc edx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jge 0x1002d4ed
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x168], 0xfffffff6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002d4d5
xor eax, eax
mov dword [ebp - 0x168], 3
cmp dword [ebp - 0x168], eax
jl 0x1002d562
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d552
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jge 0x1002d58e