Function at 0x1002a2e0
Capabilities:
Compare security identifiers
Get common file path
Get disk information
Get disk size
Get file size
Get session user name
Log keystrokes via polling
Modify service
Parse pe header
Query service status
Read .ini file
Start service

Disassembly:
mov eax, 0x1008f279
call fcn.1008dfcc
mov eax, 0x1354
call fcn.10073ea0
push ebx
mov ebx, dword [sym.imp.GDI32.dll_CreateBrushIndirect]
xor eax, eax
mov dword [ebp - 0x24], 0xfffffff6
mov byte [ebp - 0x49], al
push esi
push edi
mov byte [ebp - 0x59], dl
mov dword [ebp - 0x50], ecx
cmp byte [ebp - 0x49], al
je 0x1002a319
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov esi, 0xb4e1265a
jmp 0x1002a334
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x24], eax
jne 0x1002a33a
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], 5
je 0x1002a323
mov dword [ebp - 0x24], 0xfffffff6
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002a34f
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002a365
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x24], eax
jne 0x1002a36b
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], 5
je 0x1002a354
mov dword [ebp - 0x24], 0xfffffff6
or ecx, 0xffffffff
mov dword [ebp - 0x3c], ecx
xor eax, eax
mov dword [ebp - 0x3c], 0xdb505206
inc eax
mov dword [ebp - 0x3c], 0xfc558bac
mov dword [ebp - 0x3c], 0x214c405b
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x7b8f5f49
mov dword [ebp - 0x3c], 0x30cc2fdc
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0xc84]
push eax
call fcn.10014de1
xor eax, eax
xor edi, edi
mov dword [ebp - 4], eax
inc edi
mov dword [ebp - 0x18], 0x5d367296
mov dword [ebp - 0x24], eax
jmp 0x1002a3e2
push dword [ebp - 0x24]
call fcn.10014e7f
mov dword [eax], 0x831eb239
inc dword [ebp - 0x24]
lea ecx, [ebp - 0xc84]
cmp dword [ebp - 0x24], edi
jl 0x1002a3d1
dec dword [ebp - 0x18]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10014e63
xor eax, eax
mov byte [ebp - 0xd], al
push 0xfffffffffffffff9
mov dword [ebp - 0x24], 0x1824a8c6
mov dword [ebp - 0x24], 0xf
pop edi
jmp 0x1002a428
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002a425
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jne 0x1002a413
neg dword [ebp - 0x24]
cmp byte [ebp - 0xd], 0
je 0x1002a439
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002a451
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x24], eax
jne 0x1002a457
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], 5
je 0x1002a440
mov edi, dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [ebp - 0x2c], 0x90ac204e
mov dword [ebp - 0x1c], 0xb143e95a
push 3
mov dword [ebp - 0x2c], eax
pop esi
cmp dword [ebp - 0x2c], esi
je 0x1002a574
xor edx, edx
inc edx
jmp 0x1002a481
xor eax, eax
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jge 0x1002a4a8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x394], 0x95e1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002a490
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jge 0x1002a4c8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa0], 0xbf390197
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002a4b0
xor eax, eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], eax
jl 0x1002a4e5
mov dword [ebp - 0x1c], 0x576c3a0b
dec dword [ebp - 0xa0]
jns 0x1002a4d6
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xa0]
imul eax, dword [ebp - 0x18], 0xffff
cmp eax, dword [ebp - 0x1c]
je 0x1002a508
xor eax, eax
cmp dword [ebp - 0x394], eax
je 0x1002a50a
mov ecx, edx
jmp 0x1002a50c
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x394]
add eax, ecx
jne 0x1002a51d
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1002a51f
mov ecx, edx
xor eax, eax
cmp ecx, 0xfffffff8
setge al
sub eax, 0x168a6459
cmp dword [ebp - 0x2c], eax
jne 0x1002a552
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002a554
jmp 0x1002a574
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002a568
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor edx, edx
inc edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jne 0x1002a47f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x24], 0x928c176b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002a5aa
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0xfc8
push 0x1981
push 0x19e5
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor eax, eax
mov dword [ebp - 0x24], 0xffffffe5
jmp 0x1002a5d9
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002a5d6
push 0x1917
push eax
push 0x5c6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x11
jle 0x1002a5b3
mov dword [ebp - 0x2c], 0xfffffffb
lea ecx, [ebp - 0x9dc]
mov dword [ebp - 0x24], 6
push esi
call fcn.10014de1
xor eax, eax
inc eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002a626
push dword [ebp - 0x24]
lea ecx, [ebp - 0x9dc]
call fcn.10014e7f
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002a609
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x17
push 2
pop esi
jg 0x1002a7b7
push esi
pop ebx
push 3
pop esi
push esi
lea ecx, [ebp - 0x328]
call fcn.10014de1
mov byte [ebp - 4], bl
xor eax, eax
mov dword [ebp - 0x30], 0x3f2f34e4
mov dword [ebp - 0x44], 0xebdb88dc
mov dword [ebp - 0x24], eax
jmp 0x1002a672
push dword [ebp - 0x24]
lea ecx, [ebp - 0x328]
call fcn.10014e7f
mov dword [eax], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002a65f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1002a790
xor eax, eax
lea ecx, [ebp - 0x328]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
push ebx
call fcn.10014e7f
xor ebx, ebx
lea ecx, [ebp - 0x328]
push ebx
call fcn.10014e7f
cmp dword [eax], ebx
je 0x1002a733
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002a6f5
push 2
pop eax
push eax
lea ecx, [ebp - 0x328]
call fcn.10014e7f
xor ecx, ecx
cmp dword [eax], 0xf748
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
inc ecx
cmp ecx, 0x6aa1
setge dl
add eax, edx
mov dword [ebp - 0x30], eax
jne 0x1002a6f5
xor eax, eax
xor edx, edx
mov ecx, eax
inc edx
jmp 0x1002a6fa
xor edx, edx
inc edx
mov ecx, edx
mov eax, dword [ebp - 0x18]
imul eax, ecx
cmp eax, dword [ebp - 0x44]
je 0x1002a710
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002a712
mov eax, edx
jmp 0x1002a712
xor eax, eax
add eax, 0xffff9dd5
jne 0x1002a889
push edx
lea ecx, [ebp - 0x328]
call fcn.10014e7f
xor ebx, ebx
cmp dword [eax], ebx
jne 0x1002a88b
mov eax, ebx
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x328]
push ebx
call fcn.10014e7f
imul ecx, dword [ebp - 0x30], 7
xor ebx, ebx
cmp ecx, 0x1f7b
lea ecx, [ebp - 0x328]
setl bl
sub ebx, 0x765e4bc
neg ebx
sbb ebx, ebx
inc ebx
sub ebx, dword [eax]
xor eax, eax
inc eax
push eax
call fcn.10014e7f
push 2
lea ecx, [ebp - 0x9dc]
mov esi, dword [eax]
add esi, ebx
pop ebx
push ebx
call fcn.10014e7f
mov dword [eax], esi
dec dword [ebp - 0x24]
jns 0x1002a68b
push 3
pop esi
xor eax, eax
lea ecx, [ebp - 0x328]
inc eax
mov byte [ebp - 4], al
call fcn.10014e63
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x17
jle 0x1002a63b
mov ebx, dword [sym.imp.GDI32.dll_CreateBrushIndirect]
push 2
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0x9dc]
mov dword [ebp - 4], eax
call fcn.10014e63
mov dword [ebp - 0x24], 0xfffffff6
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x274], eax
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x30], 0x8f9c3281
cmp dword [ebp - 0x278], eax
je 0x1002a823
cmp dword [ebp - 0x280], eax
je 0x1002a818
mov eax, dword [ebp - 0x274]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002a823
mov eax, dword [ebp - 0x274]
xor eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x278]
test eax, eax
jne 0x1002a83d
mov eax, dword [ebp - 0x280]
mov eax, dword [ebp - 0x278]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, 0xec6e
mov eax, dword [ebp - 0x27c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x280]
setge cl
cmp ecx, 0xdf47f28a
sbb ecx, ecx
inc ecx
add eax, ecx
jne 0x1002a893
cmp dword [ebp - 0x30], eax
jne 0x1002a893
xor ecx, ecx
inc ecx
jmp 0x1002a898
xor ebx, ebx
xor eax, eax
inc eax
jmp 0x1002a735
xor ecx, ecx
inc ecx
mov eax, ecx
cmp eax, dword [ebp - 0x18]
jle 0x1002a8b7
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002a916
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x1002a916
push ecx
lea ecx, [ebp - 0x9d0]
call fcn.10014de1
push 3
pop eax
mov dword [ebp - 4], eax
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1002a8f7
push dword [ebp - 0x24]
lea ecx, [ebp - 0x9d0]
call fcn.10014e7f
mov dword [eax], 0x47f9
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jl 0x1002a8d6
xor eax, eax
push eax
lea ecx, [ebp - 0x9d0]
call fcn.10014e7f
lea ecx, [ebp - 0x9d0]
dec dword [eax]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10014e63
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x3c], ecx
inc eax
mov dword [ebp - 0x3c], 0xdb505206
mov dword [ebp - 0x3c], 0xfc558bac
mov dword [ebp - 0x3c], 0x214c405b
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x7b8f5f49
mov dword [ebp - 0x3c], 0x30cc2fdc
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0xe48]
push eax
call fcn.10014de1
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x18], 0x5d367296
mov dword [ebp - 0x24], eax
jmp 0x1002a987
push dword [ebp - 0x24]
call fcn.10014e7f
mov dword [eax], 0x831eb239
inc dword [ebp - 0x24]
xor eax, eax
lea ecx, [ebp - 0xe48]
inc eax
cmp dword [ebp - 0x24], eax
jl 0x1002a976
dec dword [ebp - 0x18]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10014e63
xor eax, eax
mov byte [ebp - 0x49], al
push 0xfffffffffffffff9
mov dword [ebp - 0x24], 0x1824a8c6
mov dword [ebp - 0x24], 0xf
pop ecx
jmp 0x1002a9d3
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002a9d0
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0xfffffffffffffff9
xor eax, eax
pop ecx
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jne 0x1002a9bb
neg dword [ebp - 0x24]
cmp byte [ebp - 0x49], 0
je 0x1002acbe
mov dword [ebp - 0x34], 0x71177e8e
or ecx, 0xffffffff
mov dword [ebp - 0x18], 0x96840eb4
xor eax, eax
mov dword [ebp - 0x14], 0x82b
inc eax
mov dword [ebp - 0x30], 0x6d23205e
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0xefc]
mov dword [ebp - 0x3c], 0xd7e6de11
mov dword [ebp - 0x3c], 0x43ca3807
push eax
call fcn.10014de1
xor eax, eax
mov dword [ebp - 4], 5
xor ecx, ecx
mov dword [ebp - 0x28], eax
inc ecx
cmp dword [ebp - 0x28], ecx
jge 0x1002aa74
push dword [ebp - 0x28]
lea ecx, [ebp - 0xefc]
call fcn.10014e7f
xor ecx, ecx
inc ecx
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002aa53
xor eax, eax
push 3
mov dword [ebp - 0x28], eax
pop edx
jmp 0x1002aa89
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xaf0], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002aa7c
mov dword [ebp - 0x34], 0xffffffe5
jmp 0x1002ac9e
mov dword [ebp - 0x44], 0xffff
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x7b4]
mov dword [ebp - 0x30], 0xf9e6
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x3c], 0xab81d4b4
mov dword [ebp - 0x24], 0xc9ee5212
mov dword [ebp - 0x3c], edx
push esi
call fcn.10014de1
xor eax, eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002aaf8
push dword [ebp - 0x24]
lea ecx, [ebp - 0x7b4]
call fcn.10014e7f
and dword [eax], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002aadd
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002ab00
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
add eax, 7
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, 0x7f3c88fe
jne 0x1002ab21
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x38], 0xffff
ja 0x1002ab31
cmp dword [ebp - 0x34], eax
jne 0x1002ab3a
cmp dword [ebp - 0x30], eax
jne 0x1002ab3a
mov edx, eax
jmp 0x1002ab3f
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
sete cl
xor edx, edx
imul ecx, dword [ebp - 0x30]
inc edx
cmp ecx, edx
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
cmp eax, edx
mov eax, dword [ebp - 0x34]
setl cl
cmp ecx, 0xe9843c6b
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setge dl
xor eax, eax
add edx, dword [ebp - 0x44]
cmp edx, 0xfffffffc
setge al
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp esi, eax
sbb eax, eax
inc eax
cmp eax, 0xfff7
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xd518
jne 0x1002ac4a
or eax, 0xffffffff
lea ecx, [ebp - 0xc9c]
mov dword [ebp - 0x30], eax
xor eax, eax
inc eax
mov dword [ebp - 0x44], 0x745c5bb0
mov dword [ebp - 0x3c], 0xfffffffa
push eax
call fcn.10014de1
mov byte [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x3c], 0xf514fc6b
mov dword [ebp - 0x24], eax
jmp 0x1002abf4
push dword [ebp - 0x24]
lea ecx, [ebp - 0xc9c]
call fcn.10014e7f
mov dword [eax], 0x4911ccfe
inc dword [ebp - 0x24]
xor eax, eax
inc eax
cmp dword [ebp - 0x24], eax
jl 0x1002abdd
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [ebp - 0x30], edx
inc ecx
mov eax, dword [ebp - 0xae8]
dec dword [ebp - 0xae8]
cmp eax, ecx
jge 0x1002ac23
mov esi, ecx
jmp 0x1002ac27
xor eax, eax
mov esi, eax
push ecx
lea ecx, [ebp - 0x7b4]
call fcn.10014e7f
mov ecx, dword [ebp - 0x44]
sub esi, ecx
lea ecx, [ebp - 0xc9c]
mov dword [eax], esi
call fcn.10014e63
push 2
pop esi
jmp 0x1002ac86
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002ac6d
push 0x8fb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor eax, eax
lea ecx, [ebp - 0x7b4]
inc eax
push eax
call fcn.10014e7f
mov ecx, 0x730a04a
mov dword [eax], ecx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x7b4]
mov byte [ebp - 4], 5
call fcn.10014e63
dec dword [ebp - 0x34]
push 1
pop ecx
push 3
pop edx
cmp dword [ebp - 0x34], 0xffffffe3
jne 0x1002aa9a
or eax, 0xffffffff
lea ecx, [ebp - 0xefc]
mov dword [ebp - 4], eax
call fcn.10014e63
xor eax, eax
push eax
call ebx
mov dword [ebp - 0x24], 0x8e56f9b2
mov dword [ebp - 0x3c], 0xae5a60d0
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x24], 0x6bdde0bc
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], 0xffffffe8
jl 0x1002ad11
or ecx, 0xffffffff
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ad03
push eax
push eax
push 0x5e7
push eax
call dword [sym.imp.USER32.dll_AppendMenuA]
xor eax, eax
or ecx, 0xffffffff
cmp dword [ebp - 0x18], eax
jne 0x1002ad11
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe8
jge 0x1002ace4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 5
jne 0x1002b009
xor ebx, ebx
inc ebx
push esi
lea ecx, [ebp - 0x624]
call fcn.10014de1
mov dword [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x44], 0x971867b8
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x30], 0xd3672969
mov dword [ebp - 0x18], 0xf49c23ed
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002ad7a
push dword [ebp - 0x28]
lea ecx, [ebp - 0x624]
call fcn.10014e7f
mov dword [eax], 0x65683c8f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002ad5c
xor eax, eax
push 3
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x1002ad9d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xcb4], 0xba47c9d5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002ad85
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x18], eax
jne 0x1002adac
mov esi, eax
cmp dword [ebp - 0x44], eax
je 0x1002adae
mov esi, ebx
push ebx
lea ecx, [ebp - 0x624]
call fcn.10014e7f
xor edx, edx
cmp dword [eax], esi
mov eax, dword [ebp - 0xcac]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xfffa
setne cl
cmp eax, ecx
lea ecx, [ebp - 0x624]
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
xor eax, eax
push eax
call fcn.10014e7f
push ebx
lea ecx, [ebp - 0x624]
mov esi, dword [eax]
add esi, 0xddbc
call fcn.10014e7f
xor ecx, ecx
cmp dword [eax], esi
mov eax, dword [ebp - 0x18]
setne cl
sub eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
or esi, 0xffffffff
inc eax
sub ecx, eax
add ecx, 0x3380ee91
mov dword [ebp - 0xcac], ecx
lea ecx, [ebp - 0x624]
mov dword [ebp - 4], esi
call fcn.10014e63
mov dword [ebp - 0x30], 0xb4e1265a
lea ecx, [ebp - 0xe60]
mov dword [ebp - 0x3c], esi
push 3
pop esi
mov dword [ebp - 0x3c], 0xa76aabec
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0x8adae8c9
push esi
call fcn.10014de1
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x18], 0xb76d
mov dword [ebp - 0x14], eax
jmp 0x1002ae7f
push dword [ebp - 0x14]
call fcn.10014e7f
mov dword [eax], 0x87f2fb5a
inc dword [ebp - 0x14]
lea ecx, [ebp - 0xe60]
cmp dword [ebp - 0x14], esi
jl 0x1002ae6e
dec dword [ebp - 0x18]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10014e63
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002b004
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002aed6
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9e8], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002aec2
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x34], eax
jl 0x1002afdc
push 3
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x74c]
pop eax
push eax
call fcn.10014de1
xor eax, eax
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x14], eax
push 3
pop eax
cmp dword [ebp - 0x14], eax
jge 0x1002af2c
push eax
pop esi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x74c]
call fcn.10014e7f
mov dword [eax], 0xaf87
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002af0d
push 2
pop esi
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x74c]
mov eax, dword [ebp + eax*4 - 0x9e8]
mov dword [ebp - 0x18], ebx
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x9e8]
mov eax, dword [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x18], ebx
inc eax
push eax
call fcn.10014e7f
mov ecx, dword [ebp - 0x18]
push ebx
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
xor eax, eax
inc eax
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x34]
sbb edx, edx
neg edx
mov ecx, dword [ebp + eax*4 - 0x9e8]
mov eax, dword [ebp - 0x34]
add eax, edx
xor edx, edx
cmp ecx, eax
sete dl
xor ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
lea ecx, [ebp - 0x74c]
setl al
mov dword [ebp - 0x18], eax
call fcn.10014e7f
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x74c]
setle dl
or eax, 0xffffffff
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 0x18], ebx
jne 0x1002afd2
call fcn.10014e63
dec dword [ebp - 0x34]
push ebx
pop eax
push 1
pop ebx
jns 0x1002aee5
jmp 0x1002afd7
call fcn.10014e63
xor ebx, ebx
xor eax, eax
inc ebx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002aff2
push 0x1354
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov eax, dword [ebp - 0x30]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 5
je 0x1002ad21
jmp 0x1002b007
push 2
pop esi
xor eax, eax
mov dword [ebp - 0x2c], 0x90ac204e
xor ebx, ebx
mov dword [ebp - 0x1c], 0xb143e95a
inc ebx
push 3
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
je 0x1002b0e7
jmp 0x1002b02d
xor eax, eax
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002b054
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x374], 0x95e1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002b03c
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002b074
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xb0], 0xbf390197
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002b05c
xor eax, eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], eax
jl 0x1002b091
mov dword [ebp - 0x1c], 0x576c3a0b
dec dword [ebp - 0xb0]
jns 0x1002b082
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xb0]
imul eax, dword [ebp - 0x18], 0xffff
cmp eax, dword [ebp - 0x1c]
je 0x1002b0b4
xor eax, eax
cmp dword [ebp - 0x374], eax
je 0x1002b0b6
mov ecx, ebx
jmp 0x1002b0b8
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x374]
add eax, ecx
jne 0x1002b0c9
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1002b0cb
mov ecx, ebx
xor eax, eax
cmp ecx, 0xfffffff8
setge al
sub eax, 0x168a6459
cmp dword [ebp - 0x2c], eax
jne 0x1002b136
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002b138
push 3
pop ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002b119
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x12b8], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002b101
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002b16b
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b149
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
inc dword [ebp - 0x2c]
push 3
pop ecx
cmp dword [ebp - 0x2c], ecx
jne 0x1002b02b
jmp 0x1002b0e7
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x97c], 0x1ad67a4b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002b15a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
xor eax, eax
inc dword [ebp - 0x978]
mov dword [ebp - 0x2c], 0x90ac204e
mov dword [ebp - 0x1c], 0xb143e95a
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
je 0x1002b292
push 3
pop esi
jmp 0x1002b19f
xor eax, eax
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002b1c6
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x384], 0x95e1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002b1ae
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002b1e6
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xb8], 0xbf390197
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002b1ce
xor eax, eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], eax
jl 0x1002b203
mov dword [ebp - 0x1c], 0x576c3a0b
dec dword [ebp - 0xb8]
jns 0x1002b1f4
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xb8]
imul eax, dword [ebp - 0x18], 0xffff
cmp eax, dword [ebp - 0x1c]
je 0x1002b226
xor eax, eax
cmp dword [ebp - 0x384], eax
je 0x1002b228
mov ecx, ebx
jmp 0x1002b22a
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x384]
add eax, ecx
jne 0x1002b23b
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x1002b23d
mov ecx, ebx
xor eax, eax
cmp ecx, 0xfffffff8
setge al
sub eax, 0x168a6459
cmp dword [ebp - 0x2c], eax
jne 0x1002b270
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002b272
jmp 0x1002b28f
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b283
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jne 0x1002b19d
push 2
pop esi
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov dword [ebp - 0x1c], eax
or edi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x40], edi
mov eax, dword [ebp - 0x28]
cmp eax, 0x7084
push 0xfffffffffffffffd
setge cl
xor edx, edx
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
pop ecx
setge dl
sub edx, 0x4cb8
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x4b0b
setg al
xor edx, edx
cmp eax, ecx
mov ecx, dword [ebp - 0x28]
setg dl
sub ecx, 0x26ff23b1
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setl al
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0x52cb
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffe3
jl 0x1002b4b3
push 3
pop edi
push edi
lea ecx, [ebp - 0x1c8]
call fcn.10014de1
xor eax, eax
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002b362
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1c8]
call fcn.10014e7f
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002b344
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], esi
jg 0x1002b48d
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x1c8]
push dword [ebp - 0x40]
call fcn.10014e7f
push esi
lea ecx, [ebp - 0x1c8]
call fcn.10014e7f
push dword [ebp - 0x40]
lea ecx, [ebp - 0x1c8]
call fcn.10014e7f
cmp dword [eax], 0
jne 0x1002b3a7
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x40], eax
je 0x1002b3a9
mov edi, ebx
push esi
lea ecx, [ebp - 0x1c8]
call fcn.10014e7f
push ebx
lea ecx, [ebp - 0x1c8]
imul esi, dword [eax], 0x37b3
call fcn.10014e7f
mov ecx, dword [ebp - 0x40]
xor edx, edx
cmp edi, ecx
mov ecx, 0x8b9628ea
setl dl
cmp ecx, edx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp esi, ecx
setge dl
xor ebx, ebx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x34]
setne bl
xor ecx, ecx
cmp ebx, eax
setne cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x1c8]
push dword [ebp - 0x40]
call fcn.10014e7f
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
push dword [ebp - 0x40]
cmp dword [eax], ecx
lea ecx, [ebp - 0x1c8]
setg bl
call fcn.10014e7f
mov eax, dword [eax]
add eax, ebx
neg eax
je 0x1002b432
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002b434
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x1002b439
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x1c8]
call fcn.10014e7f
xor ecx, ecx
push 2
cmp esi, dword [eax]
pop esi
setge cl
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], eax
jmp 0x1002b477
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b474
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x1002b45b
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jle 0x1002b36e
push 3
xor eax, eax
pop edi
cmp dword [ebp - 0x28], eax
lea ecx, [ebp - 0x1c8]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10014e63
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe3
jge 0x1002b327
xor eax, eax
or edi, 0xffffffff
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b4cc
push 0x19e4
call dword [sym.imp.USER32.dll_GetKeyState]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b4df
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
push 0xfffffffffffffffb
pop esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x30], eax
push 3
mov dword [ebp - 0x28], eax
pop edx
cmp dword [ebp - 0x28], edx
jge 0x1002b507
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1288], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002b4f3
xor eax, eax
push 2
mov dword [ebp - 0x28], eax
pop ecx
jmp 0x1002b520
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x994], 0x1ad67a4b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002b50f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
xor eax, eax
inc dword [ebp - 0x990]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jge 0x1002b555
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x12ac], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002b541
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002b56b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x98c], 0x1ad67a4b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002b55a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
xor eax, eax
inc dword [ebp - 0x988]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0xfffc
mov dword [ebp - 0x14], 0x54c97515
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], 0x3e52509e
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002b5bf
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1b8], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002b5ab
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x18], eax
je 0x1002b5c8
mov esi, ebx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
sub edx, 0x65420764
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setne cl
xor edx, edx
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
xor eax, eax
cmp eax, edx
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
je 0x1002b609
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002b60b
mov eax, ebx
xor ecx, ecx
cmp esi, eax
mov eax, dword [ebp - 0x30]
setne cl
xor ebx, ebx
cmp ecx, eax
setne bl
xor edx, edx
sub ebx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ebx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1002b691
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1b8], 0
je 0x1002b660
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002b676
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
jmp 0x1002b674
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x1b8]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1b8], ecx
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b687
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002b640
xor eax, eax
mov dword [ebp - 0x28], eax
xor ecx, ecx
xor ebx, ebx
inc ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x40], edi
mov eax, dword [ebp - 0x28]
cmp eax, 0x7084
push 0xfffffffffffffffd
setge cl
xor edx, edx
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
pop ecx
setge dl
sub edx, 0x4cb8
neg edx
push 2
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x4b0b
pop edi
setg al
xor edx, edx
cmp eax, ecx
mov ecx, dword [ebp - 0x28]
setg dl
sub ecx, 0x26ff23b1
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setl al
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0x52cb
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffe3
jl 0x1002b8ad
push 3
pop esi
push esi
lea ecx, [ebp - 0x1d8]
call fcn.10014de1
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002b75c
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1d8]
call fcn.10014e7f
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002b73e
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], edi
jg 0x1002b88a
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x1d8]
push dword [ebp - 0x40]
call fcn.10014e7f
push edi
lea ecx, [ebp - 0x1d8]
call fcn.10014e7f
push dword [ebp - 0x40]
lea ecx, [ebp - 0x1d8]
call fcn.10014e7f
cmp dword [eax], 0
jne 0x1002b7a1
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x40], eax
je 0x1002b7a3
mov edi, ebx
push 2
pop eax
push eax
lea ecx, [ebp - 0x1d8]
call fcn.10014e7f
push ebx
lea ecx, [ebp - 0x1d8]
imul esi, dword [eax], 0x37b3
call fcn.10014e7f
mov ecx, dword [ebp - 0x40]
xor edx, edx
cmp edi, ecx
mov ecx, 0x8b9628ea
setl dl
cmp ecx, edx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp esi, ecx
setge dl
xor ebx, ebx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x34]
setne bl
xor ecx, ecx
cmp ebx, eax
setne cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x1d8]
push dword [ebp - 0x40]
call fcn.10014e7f
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
push dword [ebp - 0x40]
cmp dword [eax], ecx
lea ecx, [ebp - 0x1d8]
setg bl
call fcn.10014e7f
mov eax, dword [eax]
add eax, ebx
neg eax
je 0x1002b82f
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002b831
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x1002b836
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x1d8]
call fcn.10014e7f
xor ecx, ecx
push 2
pop edi
cmp esi, dword [eax]
setge cl
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], eax
jmp 0x1002b874
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b871
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jle 0x1002b858
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edi
jle 0x1002b768
push 3
xor eax, eax
pop esi
cmp dword [ebp - 0x28], eax
lea ecx, [ebp - 0x1d8]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10014e63
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe3
jge 0x1002b721
xor eax, eax
or esi, 0xffffffff
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], esi
jmp 0x1002b8f6
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x24], edi
jmp 0x1002b8ed
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002b8ea
push eax
push 0x25c1
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x16
jle 0x1002b8c4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x19
jne 0x1002b8b8
mov dword [ebp - 0x40], 0x99841b3c
lea ecx, [ebp - 0x54c]
mov dword [ebp - 0x48], 5
push 4
call fcn.10014de1
mov dword [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002b94e
push dword [ebp - 0x24]
lea ecx, [ebp - 0x54c]
call fcn.10014e7f
mov dword [eax], 0x83cc47d1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002b92f
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 7
jle 0x1002bc02
jmp 0x1002b95f
xor eax, eax
mov dword [ebp - 0x1c], 0xdad5
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x24], eax
jmp 0x1002b986
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc6c], 0xf8bf216a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002b975
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x40], eax
je 0x1002b9e1
xor eax, eax
lea ecx, [ebp - 0x54c]
mov dword [ebp - 0x48], eax
mov esi, dword [ebp - 0x48]
push edi
call fcn.10014e7f
mov dword [eax], esi
test esi, esi
je 0x1002b9dd
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002b9bf
cmp dword [ebp - 0x48], 0xf9ed
mov edx, ebx
jne 0x1002b9c1
mov edx, eax
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
imul ecx, dword [ebp - 0x40]
add ecx, dword [ebp - 0x1c]
cmp ecx, edi
setle al
neg eax
je 0x1002b9e1
xor eax, eax
jmp 0x1002b9e3
mov eax, ebx
cmp eax, dword [ebp - 0x1c]
je 0x1002b9eb
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
sub ecx, 0xf888c55
neg ecx
sbb ecx, ecx
inc eax
inc ecx
add eax, ecx
cmp eax, dword [ebp - 0x40]
jne 0x1002bbcd
xor eax, eax
mov dword [ebp - 0x24], 0x652f5217
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002ba34
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x60], 0xd9fd593b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002ba1f
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002bbff
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x54c]
mov eax, dword [ebp - 0x1c]
neg eax
push 3
sbb eax, eax
inc eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x48]
pop eax
push eax
call fcn.10014e7f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x60]
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
sub eax, 0xbefc
jne 0x1002ba78
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x24]
sub edx, eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
imul ecx, edx
xor edx, edx
cmp ecx, eax
setg dl
sub edx, 0x24bfcc0c
cmp edx, dword [ebp - 0x2c]
jne 0x1002baa5
xor eax, eax
cmp dword [ebp - 0x60], eax
je 0x1002baa8
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x54c]
push edi
call fcn.10014e7f
mov ecx, dword [ebp - 0x24]
cmp dword [eax], ecx
je 0x1002bac9
xor eax, eax
cmp dword [ebp - 0x60], eax
je 0x1002bacb
mov ecx, ebx
jmp 0x1002bacd
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x18]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x2c]
je 0x1002bbbb
mov dword [ebp - 0x44], 0xfffffff8
xor eax, eax
mov dword [ebp - 0x30], 0x384641b4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xffffffeb
jmp 0x1002bbaf
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], eax
jl 0x1002bbac
mov dword [ebp - 0x24], 0xfffffffa
xor ecx, ecx
mov eax, dword [ebp - 0x44]
cmp eax, 0xdabf261b
setne cl
xor eax, eax
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
je 0x1002bb30
cmp dword [ebp - 0x38], eax
je 0x1002bb30
mov eax, ebx
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x54c]
push ebx
call fcn.10014e7f
mov ecx, dword [ebp - 0x48]
mov esi, eax
xor eax, eax
mov edx, dword [ebp + ecx*4 - 0x60]
mov ecx, dword [ebp - 0x30]
cmp ecx, edx
setle al
xor ecx, ecx
cmp dword [esi], eax
setg cl
cmp ecx, dword [ebp - 0x60]
jg 0x1002bb61
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x60]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
cmp eax, ebx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
setge cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x38]
cmp edx, eax
mov eax, dword [ebp - 0x48]
setg cl
imul ecx, ecx, 0xfffffff6
mov dword [ebp + eax*4 - 0x60], ecx
dec dword [ebp - 0x48]
jns 0x1002bb0b
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x25
jle 0x1002baff
jmp 0x1002bbef
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002bbef
call dword [sym.imp.USER32.dll_DestroyCaret]
jmp 0x1002bbef
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0x84cf7483
mov dword [ebp - 0x3c], 0xfdd83981
mov dword [ebp - 0x3c], 0x2a635bd1
mov dword [ebp - 0x30], 4
dec dword [ebp - 0x30]
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 7
push 0xffffffffffffffff
pop esi
jg 0x1002b95d
or esi, 0xffffffff
lea ecx, [ebp - 0x54c]
mov dword [ebp - 4], esi
call fcn.10014e63
push 3
mov dword [ebp - 0x2c], 0x8ade19d2
xor eax, eax
pop esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], eax
jmp 0x1002bc35
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x190], 0xf37d45db
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002bc24
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002bc70
mov dword [ebp - 0x18], 0xf5872d9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x190]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x190], ecx
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jle 0x1002bc47
mov dword [ebp - 0x34], 0x90ac204e
lea ecx, [ebp - 0xeb4]
mov dword [ebp - 0x40], 0xb143e95a
or ebx, 0xffffffff
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0xb63e8e1b
push 4
call fcn.10014de1
mov dword [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x3c], 0x8fa48a2b
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002bcd6
push 0xfffffffffffffffd
pop ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x63c], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002bcc2
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1002bcfe
push dword [ebp - 0x28]
lea ecx, [ebp - 0xeb4]
call fcn.10014e7f
mov dword [eax], 0xb4e94f93
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002bcdf
xor eax, eax
mov dword [ebp - 0x634], eax
jmp 0x1002bdb4
push 0xfffffffffffffffd
mov dword [ebp - 0x3c], 0x6318d581
lea ecx, [ebp - 0xccc]
pop eax
mov dword [ebp - 0x3c], 0xfb023ed1
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0xfcf33f23
push edi
call fcn.10014de1
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x9ef4a042
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x3c], 0x10e5e534
mov dword [ebp - 0x18], 0x5f43
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002bd7b
push dword [ebp - 0x24]
lea ecx, [ebp - 0xccc]
call fcn.10014e7f
mov dword [eax], 0x86b6feb9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002bd5d
xor eax, eax
inc dword [ebp - 0x18]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002bd9f
push eax
push 0x22bc
push 0x545
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
lea ecx, [ebp - 0xccc]
mov byte [ebp - 4], 0xe
call fcn.10014e63
dec dword [ebp - 0x634]
cmp dword [ebp - 0x634], 0xfffffff0
jl 0x1002bd09
lea ecx, [ebp - 0xeb4]
mov dword [ebp - 4], ebx
call fcn.10014e63
xor eax, eax
mov ebx, 0x3ec58f55
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
je 0x1002cdff
jmp 0x1002bde6
xor eax, eax
mov dword [ebp - 0x28], 0x9b2cfb63
mov dword [ebp - 0x18], 0x1720348f
mov dword [ebp - 0x18], 0x24307a32
push 4
mov dword [ebp - 0x18], 0xea2c39d5
mov dword [ebp - 0x24], eax
pop edi
jmp 0x1002be1b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf18], 0xa7609fa8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002be0a
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
xor edx, edx
add eax, 0xddeada93
mov dword [ebp - 0x18], eax
imul eax, dword [ebp - 0x18], 0xfff7
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xf10], ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, 0x126c
setge cl
add eax, 0x6564705c
add eax, ecx
mov dword [ebp - 0x18], eax
or eax, 0xffffffff
cmp dword [ebp - 0x18], eax
jl 0x1002be8a
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002bee0
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
jmp 0x1002bede
mov dword [ebp - 0x28], esi
xor eax, eax
cmp dword [ebp - 0x28], eax
jl 0x1002bec5
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xf18], 0xb7b88cdf
xor eax, eax
mov dword [ebp - 0x18], 0xb7b88cdf
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002bebe
push 0x1f6e
call dword [sym.imp.USER32.dll_GetSystemMetrics]
dec dword [ebp - 0x28]
jns 0x1002be94
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002bede
push eax
push 0x1e0b
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002bef3
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor eax, eax
mov dword [ebp - 0x14], edi
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002bf18
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002bf55
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x18
je 0x1002bf4d
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002bf41
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x18
jne 0x1002bf2f
push 0xfffffffffffffffd
pop ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002bf23
mov eax, 0xffff
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0xd24b5e49
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0xc34], ebx
mov dword [ebp - 0xc30], ebx
mov dword [ebp - 0xc2c], ebx
mov dword [ebp - 0xc28], ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
sub edx, 0x6373
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
setge dl
xor ebx, ebx
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne bl
xor edx, edx
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, ebx
setg al
xor ebx, ebx
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov eax, dword [ebp - 0x18]
inc ebx
cmp eax, ebx
setg cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0xffffffed
cmp dword [ebp - 0x24], 0xffffffe2
jle 0x1002c048
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jg 0x1002c03f
or ecx, 0xffffffff
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c027
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
push 0
mov eax, dword [ebp + eax*4 - 0xc34]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], esi
jle 0x1002c008
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe2
jg 0x1002bffd
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002c060
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x3b4], 0x95e1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002c04f
mov dword [ebp - 0x30], 0xfffffff8
lea ecx, [ebp - 0x7f0]
or eax, 0xffffffff
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 0x61be360d
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x18], 0x336a
push ebx
call fcn.10014de1
xor eax, eax
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002c0b8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1e8], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002c0a4
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002c0d4
push dword [ebp - 0x28]
lea ecx, [ebp - 0x7f0]
call fcn.10014e7f
mov dword [eax], 0x29c2
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002c0bd
mov eax, dword [ebp - 0x1e0]
mov edx, 0x924b5411
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov eax, dword [ebp - 0x44]
sub edx, eax
mov eax, dword [ebp - 0x1e0]
sub edx, eax
mov eax, dword [ebp - 0x1e0]
cmp edx, eax
setge cl
inc ecx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x1e8]
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], ebx
je 0x1002c149
cmp dword [ebp - 0x24], eax
je 0x1002c149
mov eax, ebx
cmp eax, dword [ebp - 0x18]
jge 0x1002c15c
xor eax, eax
cmp dword [ebp - 0x1e0], eax
je 0x1002c15e
mov esi, ebx
jmp 0x1002c160
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x7f0]
call fcn.10014e7f
xor ebx, ebx
lea ecx, [ebp - 0x7f0]
push ebx
mov dword [eax], esi
call fcn.10014e7f
cmp dword [eax], ebx
je 0x1002c195
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1e0], eax
add eax, 0xa77d77fc
je 0x1002c195
inc ebx
mov edx, ebx
jmp 0x1002c19c
xor eax, eax
xor ebx, ebx
mov edx, eax
inc ebx
mov eax, dword [ebp - 0x24]
mov ecx, 0xfffe
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
imul eax, edx
neg ecx
sub eax, ecx
lea ecx, [ebp - 0x7f0]
mov dword [ebp - 0x24], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10014e63
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002c1e8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xac], 0xbf390197
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002c1d0
xor eax, eax
mov dword [ebp - 0xac], eax
push 2
pop esi
cmp dword [ebp - 0xac], eax
jl 0x1002c2d8
mov dword [ebp - 0x48], esi
or ecx, 0xffffffff
mov dword [ebp - 0x18], 0xd68f985
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x48], eax
jmp 0x1002c241
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c237
call dword [sym.imp.USER32.dll_GetCapture]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x18], 0x3638ecf5
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xd
jle 0x1002c220
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
cmp eax, 0xfffffff9
mov eax, dword [ebp - 0x48]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
push 0
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setle bl
xor ecx, ecx
cmp ebx, eax
setg cl
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 0x61fc42ff
setne cl
or eax, 0xffffffff
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
xor ebx, ebx
inc ebx
cmp eax, ebx
setge cl
cmp ecx, ebx
sbb ecx, ecx
xor eax, eax
neg ecx
sub ecx, dword [ebp - 0x48]
add ecx, dword [ebp - 0x48]
cmp ecx, 0x7d02
setle al
imul eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], 0x576c3a0b
dec dword [ebp - 0xac]
pop eax
jns 0x1002c1fd
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xac]
imul eax, dword [ebp - 0x14], 0xffff
cmp eax, dword [ebp - 0x40]
je 0x1002c2fb
xor eax, eax
cmp dword [ebp - 0x3b4], eax
je 0x1002c2fd
mov ecx, ebx
jmp 0x1002c2ff
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3b4]
add eax, ecx
jne 0x1002c310
mov ecx, eax
cmp dword [ebp - 0x14], eax
je 0x1002c312
mov ecx, ebx
xor eax, eax
cmp ecx, 0xfffffff8
setge al
sub eax, 0x168a6459
cmp dword [ebp - 0x34], eax
jne 0x1002c97d
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002c97d
push esi
lea ecx, [ebp - 0x700]
call fcn.10014de1
mov dword [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002c371
push dword [ebp - 0x24]
lea ecx, [ebp - 0x700]
call fcn.10014e7f
mov dword [eax], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002c357
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x1002c40c
mov dword [ebp - 0x24], 0xbdfadf62
lea ecx, [ebp - 0x700]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.10014e7f
push 0xfffffffffffffff9
pop ecx
cmp dword [eax], ecx
jle 0x1002c3a5
mov eax, dword [ebp - 0x24]
push ebx
lea ecx, [ebp - 0x700]
call fcn.10014e7f
push dword [ebp - 0x14]
lea ecx, [ebp - 0x700]
call fcn.10014e7f
mov dword [eax], 0x964a90c6
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002c3fe
mov dword [ebp - 0x38], 0xb9c279a2
mov dword [ebp - 0x38], eax
jmp 0x1002c3f6
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c3f3
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x1002c3d8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1002c3cc
dec dword [ebp - 0x14]
jns 0x1002c37d
or esi, 0xffffffff
lea ecx, [ebp - 0x700]
mov dword [ebp - 4], esi
call fcn.10014e63
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x1002cdff
mov dword [ebp - 0x3c], 0xa8ea
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002c453
push 0xed2
push 0x19c4
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c464
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov dword [ebp - 0x40], 5
cmp dword [ebp - 0x40], 0xffffffe8
jge 0x1002cdeb
push 2
pop edi
mov dword [ebp - 0x3c], esi
lea ecx, [ebp - 0xce4]
mov dword [ebp - 0x3c], 0xdb505206
mov dword [ebp - 0x3c], 0xfc558bac
mov dword [ebp - 0x3c], 0x214c405b
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0x7b8f5f49
mov dword [ebp - 0x3c], 0x30cc2fdc
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], esi
push ebx
call fcn.10014de1
mov dword [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x18], 0x5d367296
mov dword [ebp - 0x24], eax
jmp 0x1002c4e3
push dword [ebp - 0x24]
call fcn.10014e7f
mov dword [eax], 0x831eb239
inc dword [ebp - 0x24]
lea ecx, [ebp - 0xce4]
cmp dword [ebp - 0x24], ebx
jl 0x1002c4d2
dec dword [ebp - 0x18]
mov dword [ebp - 4], esi
call fcn.10014e63
mov dword [ebp - 0x20], 0x7b5ca986
lea ecx, [ebp - 0x654]
push edi
call fcn.10014de1
push 3
pop esi
mov dword [ebp - 4], 0x13
lea ecx, [ebp - 0x534]
mov dword [ebp - 0x24], 0xe0b2f67a
push esi
call fcn.10014de1
mov byte [ebp - 4], 0x14
or eax, 0xffffffff
mov dword [ebp - 0x2c], 0xb5c4ce10
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x44], 0xfff9
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x1002c569
push dword [ebp - 0x28]
lea ecx, [ebp - 0x654]
call fcn.10014e7f
mov dword [eax], 0x96a0b597
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1002c54b
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002c585
push dword [ebp - 0x28]
lea ecx, [ebp - 0x534]
call fcn.10014e7f
mov dword [eax], 0xa3c47aa2
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002c56e
mov eax, dword [ebp - 0x20]
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x20], eax
je 0x1002c598
mov esi, ebx
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x654]
xor ebx, ebx
push ebx
call fcn.10014e7f
mov ecx, 0xb667f5ae
cmp ecx, esi
push ebx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x654]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
call fcn.10014e7f
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
sub edx, eax
inc ebx
add edx, 0xf9a0b4d
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp eax, ebx
setg cl
xor edx, edx
add ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
imul ecx, ecx, 0x7cd9
cmp ecx, eax
mov eax, dword [ebp - 0x20]
mov ecx, 0xe3cf9575
setle dl
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, edx
jle 0x1002c61b
push ebx
lea ecx, [ebp - 0x51c]
call fcn.10014de1
mov dword [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x38], 0x81c2900
mov dword [ebp - 0x3c], 0x9be5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002c9c6
push dword [ebp - 0x24]
lea ecx, [ebp - 0x51c]
call fcn.10014e7f
mov dword [eax], 0x1713b910
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002c9a8
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], eax
jl 0x1002cb24
mov dword [ebp - 0x24], 0x751c76d7
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x1002cb18
mov dword [ebp - 0x30], 0x88e1b61b
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x1002caea
xor ebx, ebx
mov dword [ebp - 0x44], 0x1e0b
lea ecx, [ebp - 0x51c]
mov dword [ebp - 0x18], 0x27359b50
push dword [ebp - 0x38]
call fcn.10014e7f
cmp dword [eax], ebx
je 0x1002ca47
mov dword [ebp - 0x18], 0x8dc2
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002cae8
push eax
lea ecx, [ebp - 0x51c]
call fcn.10014e7f
xor ebx, ebx
cmp dword [eax], ebx
jne 0x1002cadf
jmp 0x1002cad8
xor eax, eax
mov dword [ebp - 0x18], 0xb74c38b6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1002cad6
xor ebx, ebx
lea ecx, [ebp - 0x594]
inc ebx
push ebx
call fcn.10014de1
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002ca93
push dword [ebp - 0x14]
lea ecx, [ebp - 0x594]
call fcn.10014e7f
mov dword [eax], 0x25155467
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002ca75
xor eax, eax
push eax
lea ecx, [ebp - 0x594]
call fcn.10014e7f
xor ebx, ebx
mov dword [eax], ebx
jmp 0x1002cab0
dec dword [ebp - 0x44]
push ebx
call fcn.10014e7f
inc dword [eax]
push ebx
lea ecx, [ebp - 0x594]
call fcn.10014e7f
lea ecx, [ebp - 0x594]
cmp dword [eax], ebx
jle 0x1002caa5
mov byte [ebp - 4], 0x18
call fcn.10014e63
dec dword [ebp - 0x18]
jns 0x1002ca58
jmp 0x1002cad8
xor ebx, ebx
mov dword [ebp - 0x18], 0x6a056ebf
dec dword [ebp - 0x30]
jns 0x1002c9fa
xor eax, eax
push eax
lea ecx, [ebp - 0x51c]
call fcn.10014e7f
push dword [ebp - 0x24]
lea ecx, [ebp - 0x51c]
mov esi, eax
call fcn.10014e7f
mov ecx, dword [esi]
mov dword [eax], ecx
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1002c9e5
dec dword [ebp - 0x38]
jns 0x1002c9d2
xor ebx, ebx
inc ebx
or esi, 0xffffffff
lea ecx, [ebp - 0x51c]
mov dword [ebp - 4], esi
call fcn.10014e63
mov dword [ebp - 0x18], 0x6893
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], 0xe4b0ad8e
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1002cb6a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe18], 0x88d96753
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002cb51
xor eax, eax
push 2
mov dword [ebp - 0x28], eax
pop edi
jmp 0x1002cb83
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xdd4], 0xb24adc9f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1002cb72
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1002cb95
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
cmp ecx, 0xfff8
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x30]
jle 0x1002cbf5
mov dword [ebp - 0x18], 0xd94e8fe7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002cbdd
cmp dword [ebp - 0x18], eax
je 0x1002cbdd
mov eax, ebx
mov dword [ebp - 0xe14], eax
mov ecx, ebx
mov eax, dword [ebp - 0xe14]
sub ecx, eax
mov dword [ebp - 0x18], ecx
jmp 0x1002cd57
push 4
mov dword [ebp - 0x24], 0xa797
lea ecx, [ebp - 0x66c]
pop eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x30], 0x5ad33d2a
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x18], esi
push eax
call fcn.10014de1
xor eax, eax
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x1002cc47
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x11dc], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1002cc33
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1002cc6b
push dword [ebp - 0x28]
lea ecx, [ebp - 0x66c]
call fcn.10014e7f
mov dword [eax], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002cc50
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002cc89
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe18], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002cc74
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002cca1
mov eax, dword [ebp - 0xdd4]
push 4
pop ecx
sub ecx, eax
jne 0x1002cca1
xor eax, eax
mov edi, eax
jmp 0x1002cca3
mov edi, ebx
push ebx
lea ecx, [ebp - 0x66c]
call fcn.10014e7f
mov ecx, dword [ebp - 0x30]
imul ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x18]
cmp eax, ebx
jl 0x1002ccc9
mov esi, ebx
jmp 0x1002cccd
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0x66c]
call fcn.10014e7f
xor ecx, ecx
cmp esi, dword [eax]
setne cl
xor eax, eax
cmp edi, 0x5f5c9b8d
setne al
xor ebx, ebx
cmp eax, ecx
lea ecx, [ebp - 0x66c]
setl bl
xor eax, eax
inc eax
push eax
call fcn.10014e7f
cmp ebx, dword [eax]
jne 0x1002cd28
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002cd20
cmp dword [ebp - 0x24], 0xfffffff5
jl 0x1002cd0c
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002cd40
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
or esi, 0xffffffff
lea ecx, [ebp - 0x66c]
mov dword [ebp - 4], esi
call fcn.10014e63
xor ebx, ebx
push 2
inc ebx
pop edi
xor eax, eax
lea ecx, [ebp - 0xe78]
mov byte [ebp - 0x49], al
push edi
call fcn.10014de1
mov dword [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x18], 0x9bdba76a
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002cd9a
inc dword [ebp - 0x34]
mov ebx, 0x3ec58f55
push 3
pop esi
cmp dword [ebp - 0x34], esi
jne 0x1002bde4
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x11c4]
movdqa xmm0, xmmword [0x100089d0]
xor ebx, ebx
mov dword [ebp - 0x40], eax
inc ebx
push 2
pop edi
mov dword [ebp - 0x3c], 0xa6847dfa
lea eax, [ebp - 0xfd8]
push eax
mov dword [ebp - 0x3c], edi
lea eax, [ebp - 0xfe8]
mov dword [ebp - 0x3c], 0xb96ca2c
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0x50e6da50
push eax
movdqu xmmword [ebp - 0xfe8], xmm0
call fcn.10014e8e
lea ecx, [ebp - 0x211]
mov esi, eax
call fcn.10009f53
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1138]
push dword [esi]
call fcn.10014e3d
mov dword [ebp - 0x18], 0x39e22401
xor eax, eax
dec dword [ebp - 0x18]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002ce8f
push eax
push eax
push 0x1fe9
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea ecx, [ebp - 0x1138]
call fcn.10014e63
xor eax, eax
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002ceb4
push 0x19e4
call dword [sym.imp.USER32.dll_GetKeyState]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cec5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 6
pop eax
mov dword [ebp - 0x1c], ebx
or esi, 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jge 0x1002d081
push edi
lea ecx, [ebp - 0x304]
call fcn.10014de1
mov dword [ebp - 4], 0x1c
xor eax, eax
mov dword [ebp - 0x2c], 0x137b1891
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002cf1c
push dword [ebp - 0x24]
lea ecx, [ebp - 0x304]
call fcn.10014e7f
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002cefe
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cf2e
push eax
call dword [sym.imp.COMDLG32.dll_FindTextW]
xor eax, eax
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x1002d066
or edi, 0xffffffff
mov dword [ebp - 0x34], 0x1dfe4b28
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jg 0x1002d057
mov dword [ebp - 0x14], 0x5613717b
lea ecx, [ebp - 0x304]
push dword [ebp - 0x2c]
call fcn.10014e7f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x304]
mov esi, eax
call fcn.10014e7f
mov ecx, dword [esi]
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002d040
mov dword [ebp - 0x24], 0x28a062b0
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1002d03d
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002cfaa
push 0xea4
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x304]
push dword [ebp - 0x34]
call fcn.10014e7f
mov esi, eax
lea ecx, [ebp - 0x304]
xor eax, eax
push eax
call fcn.10014e7f
mov esi, dword [esi]
lea ecx, [ebp - 0x304]
push dword [ebp - 0x2c]
sub esi, dword [eax]
neg esi
sbb esi, esi
inc esi
call fcn.10014e7f
cmp esi, dword [eax]
jle 0x1002d019
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
dec eax
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
je 0x1002d019
push dword [ebp - 0x34]
lea ecx, [ebp - 0x304]
call fcn.10014e7f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x304]
mov dword [eax], ebx
call fcn.10014e7f
mov dword [eax], edi
jmp 0x1002d031
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002d031
push eax
push eax
push 0x5e7
push eax
call dword [sym.imp.USER32.dll_AppendMenuA]
dec dword [ebp - 0x24]
push 0
pop eax
jns 0x1002cf96
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1002cf83
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x1002cf50
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x1002cf3d
push 2
pop edi
or esi, 0xffffffff
lea ecx, [ebp - 0x304]
mov dword [ebp - 4], esi
call fcn.10014e63
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 6
jl 0x1002ceda
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x28]
cmp eax, 0x7084
push 0xfffffffffffffffd
setge cl
xor edx, edx
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
pop ecx
setge dl
sub edx, 0x4cb8
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x4b0b
setg al
xor edx, edx
cmp eax, ecx
mov ecx, dword [ebp - 0x28]
setg dl
sub ecx, 0x26ff23b1
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setl al
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0x52cb
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffe3
jl 0x1002d2a0
push 3
pop esi
push esi
lea ecx, [ebp - 0x1f8]
call fcn.10014de1
xor eax, eax
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002d14e
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1f8]
call fcn.10014e7f
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002d130
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], edi
jg 0x1002d27c
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x1f8]
push dword [ebp - 0x40]
call fcn.10014e7f
push edi
lea ecx, [ebp - 0x1f8]
call fcn.10014e7f
push dword [ebp - 0x40]
lea ecx, [ebp - 0x1f8]
call fcn.10014e7f
cmp dword [eax], 0
jne 0x1002d193
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x40], eax
je 0x1002d195
mov edi, ebx
push 2
pop eax
push eax
lea ecx, [ebp - 0x1f8]
call fcn.10014e7f
push ebx
lea ecx, [ebp - 0x1f8]
imul esi, dword [eax], 0x37b3
call fcn.10014e7f
mov ecx, dword [ebp - 0x40]
xor edx, edx
cmp edi, ecx
mov ecx, 0x8b9628ea
setl dl
cmp ecx, edx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp esi, ecx
setge dl
xor ebx, ebx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x34]
setne bl
xor ecx, ecx
cmp ebx, eax
setne cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x1f8]
push dword [ebp - 0x40]
call fcn.10014e7f
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
push dword [ebp - 0x40]
cmp dword [eax], ecx
lea ecx, [ebp - 0x1f8]
setg bl
call fcn.10014e7f
mov eax, dword [eax]
add eax, ebx
neg eax
je 0x1002d221
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002d223
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x1002d228
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x1f8]
call fcn.10014e7f
xor ecx, ecx
push 2
pop edi
cmp esi, dword [eax]
setge cl
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], eax
jmp 0x1002d266
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d263
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jle 0x1002d24a
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edi
jle 0x1002d15a
push 3
xor eax, eax
pop esi
cmp dword [ebp - 0x28], eax
lea ecx, [ebp - 0x1f8]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10014e63
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe3
jge 0x1002d113
or esi, 0xffffffff
push ebx
lea ecx, [ebp - 0xa00]
call fcn.10014de1
mov dword [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x38], 0x81c2900
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002d2e2
push dword [ebp - 0x24]
lea ecx, [ebp - 0xa00]
call fcn.10014e7f
mov dword [eax], 0x1713b910
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002d2c4
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], eax
jl 0x1002d3e5
mov dword [ebp - 0x14], 0x751c76d7
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x1002d3d9
push edi
lea ecx, [ebp - 0x498]
call fcn.10014de1
xor eax, eax
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002d339
push dword [ebp - 0x24]
lea ecx, [ebp - 0x498]
call fcn.10014e7f
mov dword [eax], 0xe1b61bab
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002d31b
xor eax, eax
push eax
lea ecx, [ebp - 0x498]
call fcn.10014e7f
xor ebx, ebx
mov dword [eax], ebx
jmp 0x1002d39e
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002d36a
cmp byte [ebp - 0xd], 0
je 0x1002d367
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
mov byte [ebp - 0xd], al
jle 0x1002d358
cmp byte [ebp - 0xd], 0
je 0x1002d38e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
xor eax, eax
push eax
lea ecx, [ebp - 0x498]
call fcn.10014e7f
dec dword [eax]
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x498]
call fcn.10014e7f
cmp dword [eax], ebx
jge 0x1002d34b
push dword [ebp - 0x38]
lea ecx, [ebp - 0xa00]
call fcn.10014e7f
lea ecx, [ebp - 0x498]
mov byte [ebp - 4], 0x1e
call fcn.10014e63
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1002d301
xor eax, eax
dec dword [ebp - 0x38]
jns 0x1002d2ee
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xa00]
mov dword [ebp - 4], esi
call fcn.10014e63
mov dword [ebp - 0x18], ebx
xor eax, eax
mov dword [ebp - 0x1c], 0xfffc
mov dword [ebp - 0x14], 0x54c97515
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], 0x3e52509e
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002d436
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x198], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002d422
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x18], eax
je 0x1002d43f
mov esi, ebx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
sub edx, 0x65420764
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setne cl
xor edx, edx
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
xor eax, eax
cmp eax, edx
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
je 0x1002d480
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002d482
mov eax, ebx
xor ecx, ecx
cmp esi, eax
mov eax, dword [ebp - 0x30]
setne cl
xor ebx, ebx
cmp ecx, eax
setne bl
xor edx, edx
sub ebx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ebx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1002d508
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x198], 0
je 0x1002d4d7
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002d4ed
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
jmp 0x1002d4eb
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x198]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x198], ecx
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d4fe
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002d4b7
xor eax, eax
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d521
push 0x19e4
call dword [sym.imp.USER32.dll_GetKeyState]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d534
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
mov dword [ebp - 0x20], 0x9244
xor ebx, ebx
mov dword [ebp - 0x34], 0xfffffff7
inc ebx
mov dword [ebp - 0x18], 0xd4db1d70
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002d569
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x70], 0xfffffff7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002d554
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002d5a4
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002d585
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002d585
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x34], eax
push 3
pop esi
cmp dword [ebp - 0x34], eax
jl 0x1002d680
push esi
lea ecx, [ebp - 0x808]
call fcn.10014de1
xor eax, eax
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x24], eax
jmp 0x1002d5ef
push dword [ebp - 0x24]
lea ecx, [ebp - 0x808]
call fcn.10014e7f
mov dword [eax], 0x531364f2
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002d5d8
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x70]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002d605
mov eax, dword [ebp - 0x70]
push edi
lea ecx, [ebp - 0x808]
call fcn.10014e7f
push edi
lea ecx, [ebp - 0x808]
call fcn.10014e7f
mov edx, dword [ebp - 0x70]
imul edx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp + ecx*4 - 0x70]
add edx, 0x1552b9cb
imul ecx, edx
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x70]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setge cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x70]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
sete dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x34]
setle cl
mov dword [ebp + eax*4 - 0x70], ecx
or eax, 0xffffffff
lea ecx, [ebp - 0x808]
mov dword [ebp - 4], eax
call fcn.10014e63
dec dword [ebp - 0x34]
jns 0x1002d5be
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], ecx
jmp 0x1002d6c9
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x24], edi
jmp 0x1002d6c0
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d6bd
push eax
push 0x25c1
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x16
jle 0x1002d697
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x19
jne 0x1002d68b
mov dword [ebp - 0x20], 0x8cccddd
lea ecx, [ebp - 0x718]
mov dword [ebp - 0x2c], 0x6c51
mov dword [ebp - 0x24], 0x77dcda72
mov dword [ebp - 0x38], 0xb4d258d0
push esi
call fcn.10014de1
mov dword [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x14], 0xb30b137d
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x14], eax
jmp 0x1002d72d
push dword [ebp - 0x14]
lea ecx, [ebp - 0x718]
call fcn.10014e7f
mov dword [eax], 0xa3a7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002d716
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
je 0x1002d757
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002d759
mov eax, ebx
jmp 0x1002d759
xor eax, eax
xor edx, edx
cmp eax, 0xdf8e3bf1
mov eax, dword [ebp - 0x24]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
imul ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x1002d792
mov edx, ebx
cmp dword [ebp - 0x24], eax
jne 0x1002d794
mov edx, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, 0x637b3047
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
setl cl
xor edx, edx
cmp eax, ecx
setl dl
xor eax, eax
add edx, dword [ebp - 0x24]
cmp edx, 0x8eaf6082
setne al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x20]
je 0x1002d7cb
mov eax, dword [ebp - 0x2c]
xor eax, eax
lea ecx, [ebp - 0x718]
push eax
call fcn.10014e7f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002d84f
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x12
jl 0x1002d84c
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x2c], eax
jmp 0x1002d83e
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], eax
jl 0x1002d83b
dec dword [ebp - 0x18]
lea ecx, [ebp - 0x718]
push dword [ebp - 0x14]
call fcn.10014e7f
push dword [ebp - 0x14]
lea ecx, [ebp - 0x718]
mov esi, eax
call fcn.10014e7f
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x14]
jns 0x1002d80c
push 0xfffffffffffffffd
xor eax, eax
pop ecx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jne 0x1002d804
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x12
jge 0x1002d7ff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
je 0x1002d7ec
or eax, 0xffffffff
lea ecx, [ebp - 0x718]
mov dword [ebp - 4], eax
call fcn.10014e63
mov dword [ebp - 0x18], 0xf6f08421
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x44], 0x2c593c86
mov dword [ebp - 0x30], 0xea445a8c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0x9f2e
mov dword [ebp - 0x30], 0x98436572
push 2
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x1002d8b3
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x288], 0x2a727599
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002d89b
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002d8d3
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xde8], 0x5cd1d2a6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002d8bb
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002d8e2
mov esi, ebx
cmp dword [ebp - 0x288], eax
jne 0x1002d8e4
mov esi, eax
mov eax, dword [ebp - 0x288]
xor ecx, ecx
cmp eax, 0x6c849023
push 0xfffffffffffffffd
setle cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x288]
add eax, ecx
mov ecx, dword [ebp - 0x30]
add ecx, eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg dl
xor ecx, ecx
cmp edx, 6
setne cl
xor eax, eax
cmp esi, ecx
sete al
xor edx, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x288]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xde4]
mov eax, dword [ebp - 0x288]
cmp eax, ecx
pop ecx
setge dl
sub edx, 0xffff
neg edx
push 4
sbb edx, edx
inc edx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax, 0xfffffffc
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x288]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x28], 0x68ec0ae9
call fcn.10014de1
mov dword [ebp - 4], 0x22
xor eax, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x34], 0x8ba832a4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1002d9ce
push dword [ebp - 0x28]
lea ecx, [ebp - 0x310]
call fcn.10014e7f
mov dword [eax], 0x1d1b984
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002d9af
xor eax, eax
push 3
mov dword [ebp - 0x28], eax
pop esi
cmp dword [ebp - 0x28], esi
jge 0x1002d9f1
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x12c4], 0x94d85d5f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002d9d9
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xf
push 2
pop edi
jle 0x1002da84
mov dword [ebp - 0x2c], 0x1ece
lea ecx, [ebp - 0x310]
or eax, 0xffffffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x24], 0x393e75cb
mov dword [ebp - 0x38], 0xeec299e
mov dword [ebp - 0x18], 0xfff8
mov dword [ebp - 0x44], 0xfafe44fa
push edi
call fcn.10014e7f
mov edx, dword [ebp - 0x24]
mov esi, eax
mov ecx, dword [ebp - 0x30]
xor eax, eax
cmp ecx, edx
setne al
xor ecx, ecx
cmp eax, 0x243e
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
setge cl
mov dword [esi], ecx
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xf
jg 0x1002da01
push 3
xor eax, eax
pop esi
cmp dword [ebp - 0x28], eax
je 0x1002daaf
push edi
lea ecx, [ebp - 0x310]
call fcn.10014e7f
cmp dword [eax], 0x694
jle 0x1002daa0
mov eax, dword [ebp - 0x28]
push edi
lea ecx, [ebp - 0x310]
call fcn.10014e7f
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x310]
mov eax, dword [ebp - 0x34]
push esi
call fcn.10014e7f
mov eax, dword [eax]
sub eax, 0xb63111
je 0x1002dacd
mov eax, dword [ebp - 0x28]
push edi
lea ecx, [ebp - 0x310]
call fcn.10014e7f
xor eax, eax
lea ecx, [ebp - 0x310]
push eax
call fcn.10014e7f
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp ecx, ebx
lea ecx, [ebp - 0x310]
setge dl
mov dword [eax], edx
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10014e63
or eax, 0xffffffff
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002db33