Function at 0x1002da39
Capabilities:
Get disk information
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100837e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x13a0
call fcn.100800c0
push esi
push edi
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x1dc], 0x1b
jmp 0x1002da80
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0x1b
je 0x1002dab9
cmp dword [ebp - 0x1dc], 0
je 0x1002da94
jmp 0x1002dab9
mov byte [ebp - 0x117], 0
movzx eax, byte [ebp - 0x117]
test eax, eax
je 0x1002dab7
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x1002da73
mov dword [ebp - 0xd8], 0xffffffff
mov dword [ebp - 0xce8], 0xffffffff
mov dword [ebp - 0x33c], 0
jmp 0x1002dae6
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 1
jge 0x1002db02
mov eax, dword [ebp - 0x33c]
mov dword [ebp + eax*4 - 0x13c], 1
jmp 0x1002dad9
mov dword [ebp - 0xd8], 0
jmp 0x1002db1b
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jl 0x1002dbba
mov dword [ebp - 0x340], 0
jmp 0x1002db41
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 4
jge 0x1002db5d
mov eax, dword [ebp - 0x340]
mov dword [ebp + eax*4 - 0xf90], 0xffffffff
jmp 0x1002db34
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xf90], 0
jmp 0x1002db8b
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xf90]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xf90], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xf90], 1
jge 0x1002dbb5
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xf90]
mov dword [ebp + eax*4 - 0x13c], 0xfffffffa
jmp 0x1002db70
jmp 0x1002db0e
mov dword [ebp - 0xd8], 0xffffffec
jmp 0x1002dbd3
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x1d
je 0x1002ddf4
mov dword [ebp - 0x18], 0xe6e7f737
mov dword [ebp - 0x26c], 0
jmp 0x1002dc00
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 3
jge 0x1002dc1c
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0x1370], 1
jmp 0x1002dbf3
mov dword [ebp - 0x18], 0
jmp 0x1002dc2c
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1002ddc6
mov dword [ebp - 0xd00], 0xb4e76ab2
mov dword [ebp - 0xac0], 0x8eb16e2c
push 3
lea ecx, [ebp - 0xfa8]
call fcn.10024e73
and dword [ebp - 4], 0
mov dword [ebp - 0x348], 0
jmp 0x1002dc74
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 3
jge 0x1002dc96
push dword [ebp - 0x348]
lea ecx, [ebp - 0xfa8]
call fcn.10024ee0
mov dword [eax], 0xffff
jmp 0x1002dc67
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x13c]
mov dword [ebp - 0x11d0], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x13c], 1
jl 0x1002dcbf
mov dword [ebp - 0x538], 1
jmp 0x1002dcc6
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0xd00], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x13c]
mov dword [ebp - 0x10a4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10ac], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10b4], eax
mov eax, 0xffff
cmp eax, 0xfff8
je 0x1002dd0c
mov dword [ebp - 0x3fc], 1
jmp 0x1002dd13
and dword [ebp - 0x3fc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3fc]
mov dword [ebp + eax - 0x1370], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x13c]
sub eax, dword [ebp - 0x3fc]
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0xac0]
imul eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
cmp dword [ebp + ecx*4 - 0x13c], eax
je 0x1002dd5d
mov dword [ebp - 0xce0], 1
jmp 0x1002dd64
and dword [ebp - 0xce0], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10bc], eax
mov eax, dword [ebp - 0x18]
add eax, 0x5b04
jne 0x1002dd92
push 2
lea ecx, [ebp - 0xfa8]
call fcn.10024ee0
cmp dword [eax], 0
jne 0x1002dd92
and dword [ebp - 0xac8], 0
jmp 0x1002dd9c
mov dword [ebp - 0xac8], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x13c]
add eax, dword [ebp - 0xac8]
mov dword [ebp - 0xce8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfa8]
call fcn.10024edb
jmp 0x1002dc25
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1002ddef
push 0x182f
push 0x5a1
push 0x1e6f
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x1002dbc6
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x29c], 1
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x18c], 0xffffffff
mov dword [ebp - 0x274], 0
jmp 0x1002de32
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 1
jge 0x1002de4e
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0xd4], 3
jmp 0x1002de25
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd4], 0
jmp 0x1002de7c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd4], 0
je 0x1002e020
mov dword [ebp - 0x27c], 0x5a9c4c8d
mov dword [ebp - 0xcf0], 0xe32cf41
mov dword [ebp - 0x350], 0
jmp 0x1002debd
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 1
jge 0x1002ded9
mov eax, dword [ebp - 0x350]
mov dword [ebp + eax*4 - 0x490], 0x4074dd03
jmp 0x1002deb0
mov dword [ebp - 0x27c], 0
jmp 0x1002def2
mov eax, dword [ebp - 0x27c]
dec eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
jl 0x1002e01b
mov dword [ebp - 0xb3c], 4
mov dword [ebp - 0xb4c], 0
mov dword [ebp - 0xcf8], 1
mov eax, dword [ebp - 0xb3c]
mov dword [ebp - 0xcf0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0xd4]
jne 0x1002dfe2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x490]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x490]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xd4]
jl 0x1002df7e
mov dword [ebp - 0xad0], 1
jmp 0x1002df85
and dword [ebp - 0xad0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
cmp dword [ebp - 0xad0], eax
jne 0x1002dfa6
mov dword [ebp - 0xb14], 1
jmp 0x1002dfad
and dword [ebp - 0xb14], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
cmp eax, dword [ebp - 0xb14]
jg 0x1002dfce
mov dword [ebp - 0xb1c], 1
jmp 0x1002dfd5
and dword [ebp - 0xb1c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x490]
cmp dword [ebp - 0xb3c], 0xffffffff
jne 0x1002dff7
mov dword [ebp - 0xb44], 1
jmp 0x1002dffe
and dword [ebp - 0xb44], 0
mov eax, dword [ebp - 0xb44]
mov dword [ebp - 0xb4c], eax
mov eax, dword [ebp - 0xb4c]
mov dword [ebp - 0xcf8], eax
jmp 0x1002dee5
jmp 0x1002de61
mov dword [ebp - 0xd5c], 0x1a8f1edd
mov dword [ebp - 0xe8], 0xffffffff
mov dword [ebp - 0x80], 0xc3a0b8ee
mov dword [ebp - 0xd08], 0xd87263b0
mov dword [ebp - 0x358], 0
jmp 0x1002e05e
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 2
jge 0x1002e07a
mov eax, dword [ebp - 0x358]
mov dword [ebp + eax*4 - 0xadc], 1
jmp 0x1002e051
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xadc], 0
jne 0x1002e096
mov dword [ebp - 0xb54], 1
jmp 0x1002e09d
and dword [ebp - 0xb54], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xadc]
imul eax, dword [ebp - 0xb54]
test eax, eax
je 0x1002e0c7
cmp dword [ebp - 0x80], 0
je 0x1002e0c7
mov dword [ebp - 0xb5c], 1
jmp 0x1002e0ce
and dword [ebp - 0xb5c], 0
mov eax, dword [ebp - 0x80]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xadc]
mov edx, dword [ebp - 0x80]
add edx, dword [ebp - 0xb5c]
imul ecx, edx
add ecx, dword [ebp - 0x80]
imul eax, ecx
cmp dword [ebp - 0x80], eax
jg 0x1002e101
mov dword [ebp - 0xb64], 1
jmp 0x1002e108
and dword [ebp - 0xb64], 0
mov eax, dword [ebp - 0xb64]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jne 0x1002e126
cmp dword [ebp - 0x80], 0
jne 0x1002e126
and dword [ebp - 0xb60], 0
jmp 0x1002e130
mov dword [ebp - 0xb60], 1
mov eax, dword [ebp - 0xb60]
sub eax, 0x6dd
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xadc]
je 0x1002e156
mov dword [ebp - 0xc54], 1
jmp 0x1002e15d
and dword [ebp - 0xc54], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xadc]
mov dword [ebp - 0x10c4], eax
cmp dword [ebp - 0x80], 0
jge 0x1002e182
mov dword [ebp - 0xab8], 1
jmp 0x1002e189
and dword [ebp - 0xab8], 0
mov eax, dword [ebp - 0xab8]
mov dword [ebp - 0xd08], eax
mov byte [ebp - 0x184], 0
movzx eax, byte [ebp - 0x184]
test eax, eax
je 0x1002e1b4
push 0x2623
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [ebp - 0x10cc], 0x23cea2ff
mov dword [ebp - 0xf0], 0x32fe2236
mov dword [ebp - 0x284], 0
jmp 0x1002e1e1
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 4
jge 0x1002e1fd
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0x1040], 0x9b55
jmp 0x1002e1d4
mov dword [ebp - 0xf0], 0
jmp 0x1002e216
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 3
jg 0x1002e2b8
mov dword [ebp - 0x360], 0
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0xf0]
mov eax, dword [ebp + eax*4 - 0x1040]
mov dword [ebp + ecx*4 - 0x1040], eax
mov dword [ebp - 0x360], 0xffffffee
jmp 0x1002e260
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0x15
je 0x1002e2b3
mov dword [ebp - 0x28c], 0xbd4dfbd6
mov dword [ebp - 0x28c], 0
jmp 0x1002e28c
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 3
jg 0x1002e2b1
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0xf0]
mov eax, dword [ebp + eax*4 - 0x1040]
mov dword [ebp + ecx*4 - 0x1040], eax
jmp 0x1002e27f
jmp 0x1002e253
jmp 0x1002e209
mov dword [ebp - 0x544], 0
mov dword [ebp - 0xd30], 0xd437f1bd
mov dword [ebp - 0x1e8], 1
mov dword [ebp - 0xd10], 9
mov dword [ebp - 0x1e8], 0
jmp 0x1002e2f9
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0xfffffff7
jl 0x1002e5c7
mov dword [ebp - 0x220], 8
push 2
lea ecx, [ebp - 0xf28]
call fcn.10024e73
mov dword [ebp - 4], 1
mov dword [ebp - 0x368], 0
jmp 0x1002e33d
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 2
jge 0x1002e35f
push dword [ebp - 0x368]
lea ecx, [ebp - 0xf28]
call fcn.10024ee0
mov dword [eax], 0x6dd8
jmp 0x1002e330
mov dword [ebp - 0x220], 0x17
jmp 0x1002e378
mov eax, dword [ebp - 0x220]
dec eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0xffffffe9
je 0x1002e5b3
mov dword [ebp - 0xbdc], 0xfffffffc
mov dword [ebp - 0xbd8], 0xfffffffc
mov dword [ebp - 0xbd4], 0xfffffffc
mov dword [ebp - 0xbd0], 0xfffffffc
mov dword [ebp - 0x294], 0x20a29822
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xbdc], 1
jmp 0x1002e3e5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbdc]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xbdc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbdc], 0
jl 0x1002e430
mov byte [ebp - 0x165], 0
movzx eax, byte [ebp - 0x165]
test eax, eax
je 0x1002e40f
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xbdc]
lea ecx, [ebp - 0xf28]
call fcn.10024ee0
cmp dword [eax], 0
je 0x1002e42e
jmp 0x1002e430
jmp 0x1002e3ca
mov dword [ebp - 0x294], 0
jmp 0x1002e449
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0x15
jl 0x1002e5ae
mov dword [ebp - 0xd18], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbdc], 0
je 0x1002e48b
mov dword [ebp - 0xd10], 0x1a80d1c2
xor eax, eax
inc eax
je 0x1002e48b
mov dword [ebp - 0x4f4], 1
jmp 0x1002e492
and dword [ebp - 0x4f4], 0
mov esi, dword [ebp - 0x220]
sub esi, dword [ebp - 0x4f4]
push 0
lea ecx, [ebp - 0xf28]
call fcn.10024ee0
cmp esi, dword [eax]
jge 0x1002e4bb
mov dword [ebp - 0x84c], 1
jmp 0x1002e4c2
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x84c]
shl eax, 2
test eax, eax
jne 0x1002e4e1
cmp dword [ebp - 0x1e8], 0
jne 0x1002e4e1
and dword [ebp - 0x4fc], 0
jmp 0x1002e4eb
mov dword [ebp - 0x4fc], 1
mov eax, dword [ebp - 0xd18]
cmp eax, dword [ebp - 0x4fc]
je 0x1002e505
mov dword [ebp - 0xa28], 1
jmp 0x1002e50c
and dword [ebp - 0xa28], 0
imul eax, dword [ebp - 0xa28], 0x874b
cmp eax, 0x9eb11de2
jb 0x1002e557
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x1002e555
push 0
push 0
push 0
push 0x20f8
push 0xbda
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
jmp 0x1002e58d
mov byte [ebp - 0x16d], 0
movzx eax, byte [ebp - 0x16d]
test eax, eax
je 0x1002e58d
push 0xf5d
push 0
push 0
push 0x4d0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov byte [ebp - 0x11b], 0
movzx eax, byte [ebp - 0x11b]
test eax, eax
je 0x1002e5a9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
jmp 0x1002e43c
jmp 0x1002e36b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf28]
call fcn.10024edb
jmp 0x1002e2ec
mov dword [ebp - 0xd20], 0xffffffff
mov dword [ebp - 0x10d4], 0xffffffff
mov byte [ebp - 0x186], 0
movzx eax, byte [ebp - 0x186]
test eax, eax
je 0x1002e603
push 0
push 0
push 0x304
push 0x1fc9
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1002e61d
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 1
lea ecx, [ebp - 0xc14]
call fcn.10024e73
mov dword [ebp - 4], 2
mov dword [ebp - 0xeec], 0xed967aac
mov dword [ebp - 0xee8], 0xed967aac
mov dword [ebp - 0xee4], 0xed967aac
mov dword [ebp - 0xee0], 0xed967aac
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x240], 0x1b
jmp 0x1002e67c
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0x1b
je 0x1002e6b5
cmp dword [ebp - 0x240], 0
je 0x1002e690
jmp 0x1002e6b5
mov byte [ebp - 0x175], 0
movzx eax, byte [ebp - 0x175]
test eax, eax
je 0x1002e6b3
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x1002e66f
mov dword [ebp - 0x370], 0
jmp 0x1002e6ce
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 1
jge 0x1002e6f0
push dword [ebp - 0x370]
lea ecx, [ebp - 0xc14]
call fcn.10024ee0
mov dword [eax], 1
jmp 0x1002e6c1
mov dword [ebp - 0x5c], 0
jmp 0x1002e700
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xe
jge 0x1002e73a
mov byte [ebp - 0x11f], 0
movzx eax, byte [ebp - 0x11f]
test eax, eax
je 0x1002e738
push 0x17b5
push 0x12d8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x1002e6f9
cmp dword [ebp - 0x5c], 0
je 0x1002e886
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
neg eax
je 0x1002e7e6
cmp dword [ebp - 0x29c], 0
je 0x1002e773
cmp dword [ebp - 0x498], 0
je 0x1002e773
mov dword [ebp - 0x504], 1
jmp 0x1002e77a
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
je 0x1002e7aa
cmp dword [ebp - 0x5c], 0
je 0x1002e7aa
cmp dword [ebp - 0x29c], 0
je 0x1002e7aa
mov dword [ebp - 0x854], 1
jmp 0x1002e7b1
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x854], eax
jge 0x1002e7c8
mov dword [ebp - 0x50c], 1
jmp 0x1002e7cf
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x50c], eax
jge 0x1002e7e6
mov dword [ebp - 0x9fc], 1
jmp 0x1002e7ed
and dword [ebp - 0x9fc], 0
cmp dword [ebp - 0x9fc], 0
jne 0x1002e808
mov eax, 0xe92e
test eax, eax
jne 0x1002e808
and dword [ebp - 0x514], 0
jmp 0x1002e812
mov dword [ebp - 0x514], 1
cmp dword [ebp - 0x514], 1
je 0x1002e827
mov dword [ebp - 0x85c], 1
jmp 0x1002e82e
and dword [ebp - 0x85c], 0
cmp dword [ebp - 0x85c], 0xdfe4
je 0x1002e846
mov dword [ebp - 0x51c], 1
jmp 0x1002e84d
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x498]
cmp dword [ebp - 0x51c], eax
jl 0x1002e867
mov dword [ebp - 0xab4], 1
jmp 0x1002e86e
and dword [ebp - 0xab4], 0
cmp dword [ebp - 0xab4], 0xeb382e58
jb 0x1002e886
mov dword [ebp - 0x524], 1
jmp 0x1002e88d
and dword [ebp - 0x524], 0
cmp dword [ebp - 0x524], 0x740826f3
je 0x1002ea6c
mov dword [ebp - 0x10dc], 1
mov dword [ebp - 0xd6c], 0xffffffff
push 3
lea ecx, [ebp - 0xf40]
call fcn.10024e73
mov byte [ebp - 4], 3
mov dword [ebp - 0xd28], 4
mov dword [ebp - 0x864], 0xfffffffb
mov dword [ebp - 0xd74], 0xffffffff
mov dword [ebp - 0x378], 0
jmp 0x1002e8f9
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 3
jge 0x1002e918
push dword [ebp - 0x378]
lea ecx, [ebp - 0xf40]
call fcn.10024ee0
or dword [eax], 0xffffffff
jmp 0x1002e8ec
mov eax, dword [ebp - 0x864]
inc eax
mov dword [ebp - 0x864], eax
mov eax, dword [ebp - 0xd20]
neg eax
imul eax, dword [ebp - 0x544]
cmp eax, 0xfffa
jbe 0x1002e947
mov dword [ebp - 0x52c], 1
jmp 0x1002e94e
and dword [ebp - 0x52c], 0
cmp dword [ebp - 0x52c], 0x55a5481
jl 0x1002e968
or eax, 0xffffffff
jne 0x1002e968
and dword [ebp - 0xa04], 0
jmp 0x1002e972
mov dword [ebp - 0xa04], 1
mov eax, dword [ebp - 0xa04]
mov dword [ebp - 0xd28], eax
push 2
lea ecx, [ebp - 0xf40]
call fcn.10024ee0
mov esi, eax
push 2
lea ecx, [ebp - 0xf40]
call fcn.10024ee0
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x1002e9ac
mov dword [ebp - 0x534], 1
jmp 0x1002e9b3
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0xd30]
cmp eax, dword [ebp - 0x534]
jne 0x1002e9cd
mov dword [ebp - 0x86c], 1
jmp 0x1002e9d4
and dword [ebp - 0x86c], 0
cmp dword [ebp - 0x86c], 0xb913a86
je 0x1002e9f2
cmp dword [ebp - 0xd5c], 0
jne 0x1002e9f2
and dword [ebp - 0xd64], 0
jmp 0x1002e9fc
mov dword [ebp - 0xd64], 1
mov eax, dword [ebp - 0xd6c]
mov dword [ebp - 0x10e4], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xeec], 0xffffffff
jle 0x1002ea24
mov dword [ebp - 0x53c], 1
jmp 0x1002ea2b
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x498]
cmp dword [ebp - 0x53c], eax
jl 0x1002ea45
mov dword [ebp - 0xb34], 1
jmp 0x1002ea4c
and dword [ebp - 0xb34], 0
mov eax, dword [ebp - 0xb34]
mov dword [ebp - 0xd74], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xf40]
call fcn.10024edb
jmp 0x1002ed1d
mov dword [ebp - 0x4a8], 0xd49a337b
mov byte [ebp - 0x188], 0
movzx eax, byte [ebp - 0x188]
test eax, eax
je 0x1002ea9e
push 1
push 0
push 0xe56
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [ebp - 0xe8], 0
jmp 0x1002eab7
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jg 0x1002ed1d
mov dword [ebp - 0x4a0], 0xfffffff7
push 1
lea ecx, [ebp - 0xfc0]
call fcn.10024e73
mov byte [ebp - 4], 4
mov dword [ebp - 0x2a4], 0
jmp 0x1002eaf8
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 1
jge 0x1002eb1a
push dword [ebp - 0x2a4]
lea ecx, [ebp - 0xfc0]
call fcn.10024ee0
mov dword [eax], 0xfffffff6
jmp 0x1002eaeb
mov dword [ebp - 0x18c], 0
jmp 0x1002eb33
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 3
jg 0x1002ed09
mov dword [ebp - 0xd84], 0xbe7b8bbd
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xc14]
call fcn.10024ee0
cmp dword [eax], 0
jne 0x1002eb67
cmp dword [ebp - 0x544], 0
cmp dword [ebp - 0x4a8], 0xa02d5285
jbe 0x1002eb7f
mov dword [ebp - 0xd7c], 1
jmp 0x1002eb86
and dword [ebp - 0xd7c], 0
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x10ec], eax
cmp dword [ebp - 0x4a8], 1
jb 0x1002eba7
mov dword [ebp - 0x874], 1
jmp 0x1002ebae
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp + eax*4 - 0xeec]
cmp eax, dword [ebp - 0x874]
jle 0x1002ebcf
mov dword [ebp - 0x54c], 1
jmp 0x1002ebd6
and dword [ebp - 0x54c], 0
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xc14]
call fcn.10024ee0
mov esi, dword [eax]
imul esi, dword [ebp - 0x54c]
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xc14]
call fcn.10024ee0
mov dword [eax], esi
cmp dword [ebp - 0x4a0], 0
jne 0x1002ec1e
mov eax, 0xea11
test eax, eax
jne 0x1002ec1e
and dword [ebp - 0xa0c], 0
jmp 0x1002ec28
mov dword [ebp - 0xa0c], 1
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp + eax*4 - 0xeec]
cmp dword [ebp - 0xa0c], eax
jne 0x1002ec49
mov dword [ebp - 0x554], 1
jmp 0x1002ec50
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
sub eax, 0x275a3f77
je 0x1002ec7f
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xc14]
call fcn.10024ee0
cmp dword [eax], 0
je 0x1002ec7f
mov dword [ebp - 0x87c], 1
jmp 0x1002ec86
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x4a0]
cmp dword [ebp - 0x87c], eax
je 0x1002eca0
mov dword [ebp - 0x55c], 1
jmp 0x1002eca7
and dword [ebp - 0x55c], 0
mov esi, dword [ebp - 0x55c]
sub esi, 0x708e63fe
push 0
lea ecx, [ebp - 0xfc0]
call fcn.10024ee0
cmp esi, dword [eax]
jge 0x1002ecd0
mov dword [ebp - 0xabc], 1
jmp 0x1002ecd7
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0x4a8]
cmp dword [ebp - 0xabc], eax
jge 0x1002ecf1
mov dword [ebp - 0x564], 1
jmp 0x1002ecf8
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0xd84], eax
jmp 0x1002eb26
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xfc0]
call fcn.10024edb
jmp 0x1002eaaa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc14]
call fcn.10024edb
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x2ac], 1
mov dword [ebp - 0x494], 0
mov dword [ebp - 0x194], 0xffffffff
mov dword [ebp - 0xda4], 0x1a8f1edd
mov dword [ebp - 0xf8], 0xffffffff
mov dword [ebp - 0x10f4], 0x23cea2ff
mov dword [ebp - 0x8a4], 0
mov dword [ebp - 0xd9c], 0xd437f1bd
mov dword [ebp - 0xd8c], 0xffffffff
push 1
lea ecx, [ebp - 0xc50]
call fcn.10024e73
mov dword [ebp - 4], 5
mov dword [ebp - 0xedc], 0xed967aac
mov dword [ebp - 0xed8], 0xed967aac
mov dword [ebp - 0xed4], 0xed967aac
mov dword [ebp - 0xed0], 0xed967aac
mov dword [ebp - 0x380], 0
jmp 0x1002ede2
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 1
jge 0x1002ee04
push dword [ebp - 0x380]
lea ecx, [ebp - 0xc50]
call fcn.10024ee0
mov dword [eax], 1
jmp 0x1002edd5
mov dword [ebp - 0x6c], 0
jmp 0x1002ee14
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xe
jge 0x1002ee4e
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x1002ee4c
push 0x17b5
push 0x12d8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x1002ee0d
cmp dword [ebp - 0x6c], 0
je 0x1002ef9a
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
neg eax
je 0x1002eefa
cmp dword [ebp - 0x2ac], 0
je 0x1002ee87
cmp dword [ebp - 0x494], 0
je 0x1002ee87
mov dword [ebp - 0x884], 1
jmp 0x1002ee8e
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0
je 0x1002eebe
cmp dword [ebp - 0x6c], 0
je 0x1002eebe
cmp dword [ebp - 0x2ac], 0
je 0x1002eebe
mov dword [ebp - 0x56c], 1
jmp 0x1002eec5
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x56c], eax
jge 0x1002eedc
mov dword [ebp - 0xa14], 1
jmp 0x1002eee3
and dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0xa14], eax
jge 0x1002eefa
mov dword [ebp - 0x574], 1
jmp 0x1002ef01
and dword [ebp - 0x574], 0
cmp dword [ebp - 0x574], 0
jne 0x1002ef1c
mov eax, 0xe92e
test eax, eax
jne 0x1002ef1c
and dword [ebp - 0x88c], 0
jmp 0x1002ef26
mov dword [ebp - 0x88c], 1
cmp dword [ebp - 0x88c], 1
je 0x1002ef3b
mov dword [ebp - 0x57c], 1
jmp 0x1002ef42
and dword [ebp - 0x57c], 0
cmp dword [ebp - 0x57c], 0xdfe4
je 0x1002ef5a
mov dword [ebp - 0xb28], 1
jmp 0x1002ef61
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0x494]
cmp dword [ebp - 0xb28], eax
jl 0x1002ef7b
mov dword [ebp - 0x584], 1
jmp 0x1002ef82
and dword [ebp - 0x584], 0
cmp dword [ebp - 0x584], 0xeb382e58
jb 0x1002ef9a
mov dword [ebp - 0x894], 1
jmp 0x1002efa1
and dword [ebp - 0x894], 0
cmp dword [ebp - 0x894], 0x740826f3
je 0x1002f180
mov dword [ebp - 0x10fc], 1
mov dword [ebp - 0xdb4], 0xffffffff
push 3
lea ecx, [ebp - 0xf34]
call fcn.10024e73
mov byte [ebp - 4], 6
mov dword [ebp - 0xd94], 4
mov dword [ebp - 0x58c], 0xfffffffb
mov dword [ebp - 0xdbc], 0xffffffff
mov dword [ebp - 0x388], 0
jmp 0x1002f00d
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 3
jge 0x1002f02c
push dword [ebp - 0x388]
lea ecx, [ebp - 0xf34]
call fcn.10024ee0
or dword [eax], 0xffffffff
jmp 0x1002f000
mov eax, dword [ebp - 0x58c]
inc eax
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp - 0xd8c]
neg eax
imul eax, dword [ebp - 0x8a4]
cmp eax, 0xfffa
jbe 0x1002f05b
mov dword [ebp - 0xa1c], 1
jmp 0x1002f062
and dword [ebp - 0xa1c], 0
cmp dword [ebp - 0xa1c], 0x55a5481
jl 0x1002f07c
or eax, 0xffffffff
jne 0x1002f07c
and dword [ebp - 0x594], 0
jmp 0x1002f086
mov dword [ebp - 0x594], 1
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0xd94], eax
push 2
lea ecx, [ebp - 0xf34]
call fcn.10024ee0
mov esi, eax
push 2
lea ecx, [ebp - 0xf34]
call fcn.10024ee0
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x1002f0c0
mov dword [ebp - 0x89c], 1
jmp 0x1002f0c7
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0xd9c]
cmp eax, dword [ebp - 0x89c]
jne 0x1002f0e1
mov dword [ebp - 0x59c], 1
jmp 0x1002f0e8
and dword [ebp - 0x59c], 0
cmp dword [ebp - 0x59c], 0xb913a86
je 0x1002f106
cmp dword [ebp - 0xda4], 0
jne 0x1002f106
and dword [ebp - 0xdac], 0
jmp 0x1002f110
mov dword [ebp - 0xdac], 1
mov eax, dword [ebp - 0xdb4]
mov dword [ebp - 0x1104], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xedc], 0xffffffff
jle 0x1002f138
mov dword [ebp - 0xac4], 1
jmp 0x1002f13f
and dword [ebp - 0xac4], 0
mov eax, dword [ebp - 0x494]
cmp dword [ebp - 0xac4], eax
jl 0x1002f159
mov dword [ebp - 0x5a4], 1
jmp 0x1002f160
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0xdbc], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xf34]
call fcn.10024edb
jmp 0x1002f431
mov dword [ebp - 0x404], 0xd49a337b
mov byte [ebp - 0x177], 0
movzx eax, byte [ebp - 0x177]
test eax, eax
je 0x1002f1b2
push 1
push 0
push 0xe56
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [ebp - 0xf8], 0
jmp 0x1002f1cb
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jg 0x1002f431
mov dword [ebp - 0x49c], 0xfffffff7
push 1
lea ecx, [ebp - 0xfd8]
call fcn.10024e73
mov byte [ebp - 4], 7
mov dword [ebp - 0x2b4], 0
jmp 0x1002f20c
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 1
jge 0x1002f22e
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0xfd8]
call fcn.10024ee0
mov dword [eax], 0xfffffff6
jmp 0x1002f1ff
mov dword [ebp - 0x194], 0
jmp 0x1002f247
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 3
jg 0x1002f41d
mov dword [ebp - 0xe04], 0xbe7b8bbd
push dword [ebp - 0xf8]
lea ecx, [ebp - 0xc50]
call fcn.10024ee0
cmp dword [eax], 0
jne 0x1002f27b
cmp dword [ebp - 0x8a4], 0
cmp dword [ebp - 0x404], 0xa02d5285
jbe 0x1002f293
mov dword [ebp - 0xdfc], 1
jmp 0x1002f29a
and dword [ebp - 0xdfc], 0
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x110c], eax
cmp dword [ebp - 0x404], 1
jb 0x1002f2bb
mov dword [ebp - 0x5ac], 1
jmp 0x1002f2c2
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp + eax*4 - 0xedc]
cmp eax, dword [ebp - 0x5ac]
jle 0x1002f2e3
mov dword [ebp - 0xa24], 1
jmp 0x1002f2ea
and dword [ebp - 0xa24], 0
push dword [ebp - 0xf8]
lea ecx, [ebp - 0xc50]
call fcn.10024ee0
mov esi, dword [eax]
imul esi, dword [ebp - 0xa24]
push dword [ebp - 0xf8]
lea ecx, [ebp - 0xc50]
call fcn.10024ee0
mov dword [eax], esi
cmp dword [ebp - 0x49c], 0
jne 0x1002f332
mov eax, 0xea11
test eax, eax
jne 0x1002f332
and dword [ebp - 0x5b4], 0
jmp 0x1002f33c
mov dword [ebp - 0x5b4], 1
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp + eax*4 - 0xedc]
cmp dword [ebp - 0x5b4], eax
jne 0x1002f35d
mov dword [ebp - 0x8ac], 1
jmp 0x1002f364
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x8ac]
sub eax, 0x275a3f77
je 0x1002f393
push dword [ebp - 0xf8]
lea ecx, [ebp - 0xc50]
call fcn.10024ee0
cmp dword [eax], 0
je 0x1002f393
mov dword [ebp - 0x5bc], 1
jmp 0x1002f39a
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x49c]
cmp dword [ebp - 0x5bc], eax
je 0x1002f3b4
mov dword [ebp - 0xb48], 1
jmp 0x1002f3bb
and dword [ebp - 0xb48], 0
mov esi, dword [ebp - 0xb48]
sub esi, 0x708e63fe
push 0
lea ecx, [ebp - 0xfd8]
call fcn.10024ee0
cmp esi, dword [eax]
jge 0x1002f3e4
mov dword [ebp - 0x5c4], 1
jmp 0x1002f3eb
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x404]
cmp dword [ebp - 0x5c4], eax
jge 0x1002f405
mov dword [ebp - 0x8b4], 1
jmp 0x1002f40c
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0xe04], eax
jmp 0x1002f23a
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xfd8]
call fcn.10024edb
jmp 0x1002f1be
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc50]
call fcn.10024edb
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0x2bc], 1
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x1d4], 0xffffffff
mov dword [ebp - 0xe24], 0x1a8f1edd
mov dword [ebp - 0xdc], 0xffffffff
mov dword [ebp - 0x1114], 0x23cea2ff
mov dword [ebp - 0x60c], 0
mov dword [ebp - 0xe1c], 0xd437f1bd
mov dword [ebp - 0xe0c], 0xffffffff
push 1
lea ecx, [ebp - 0xc2c]
call fcn.10024e73
mov dword [ebp - 4], 8
mov dword [ebp - 0xecc], 0xed967aac
mov dword [ebp - 0xec8], 0xed967aac
mov dword [ebp - 0xec4], 0xed967aac
mov dword [ebp - 0xec0], 0xed967aac
mov dword [ebp - 0x390], 0
jmp 0x1002f4f6
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 1
jge 0x1002f518
push dword [ebp - 0x390]
lea ecx, [ebp - 0xc2c]
call fcn.10024ee0
mov dword [eax], 1
jmp 0x1002f4e9
mov dword [ebp - 0x60], 0
jmp 0x1002f528
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xe
jge 0x1002f562
mov byte [ebp - 0x123], 0
movzx eax, byte [ebp - 0x123]
test eax, eax
je 0x1002f560
push 0x17b5
push 0x12d8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x1002f521
cmp dword [ebp - 0x60], 0
je 0x1002f6ae
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
neg eax
je 0x1002f60e
cmp dword [ebp - 0x2bc], 0
je 0x1002f59b
cmp dword [ebp - 0x464], 0
je 0x1002f59b
mov dword [ebp - 0x5cc], 1
jmp 0x1002f5a2
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0
je 0x1002f5d2
cmp dword [ebp - 0x60], 0
je 0x1002f5d2
cmp dword [ebp - 0x2bc], 0
je 0x1002f5d2
mov dword [ebp - 0xa2c], 1
jmp 0x1002f5d9
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0xa2c], eax
jge 0x1002f5f0
mov dword [ebp - 0x5d4], 1
jmp 0x1002f5f7
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x5d4], eax
jge 0x1002f60e
mov dword [ebp - 0x8bc], 1
jmp 0x1002f615
and dword [ebp - 0x8bc], 0
cmp dword [ebp - 0x8bc], 0
jne 0x1002f630
mov eax, 0xe92e
test eax, eax
jne 0x1002f630
and dword [ebp - 0x5dc], 0
jmp 0x1002f63a
mov dword [ebp - 0x5dc], 1
cmp dword [ebp - 0x5dc], 1
je 0x1002f64f
mov dword [ebp - 0xacc], 1
jmp 0x1002f656
and dword [ebp - 0xacc], 0
cmp dword [ebp - 0xacc], 0xdfe4
je 0x1002f66e
mov dword [ebp - 0x5e4], 1
jmp 0x1002f675
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x464]
cmp dword [ebp - 0x5e4], eax
jl 0x1002f68f
mov dword [ebp - 0x8c4], 1
jmp 0x1002f696
and dword [ebp - 0x8c4], 0
cmp dword [ebp - 0x8c4], 0xeb382e58
jb 0x1002f6ae
mov dword [ebp - 0x5ec], 1
jmp 0x1002f6b5
and dword [ebp - 0x5ec], 0
cmp dword [ebp - 0x5ec], 0x740826f3
je 0x1002f894
mov dword [ebp - 0x111c], 1
mov dword [ebp - 0xe34], 0xffffffff
push 3
lea ecx, [ebp - 0xf58]
call fcn.10024e73
mov byte [ebp - 4], 9
mov dword [ebp - 0xe14], 4
mov dword [ebp - 0xa34], 0xfffffffb
mov dword [ebp - 0xe3c], 0xffffffff
mov dword [ebp - 0x398], 0
jmp 0x1002f721
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 3
jge 0x1002f740
push dword [ebp - 0x398]
lea ecx, [ebp - 0xf58]
call fcn.10024ee0
or dword [eax], 0xffffffff
jmp 0x1002f714
mov eax, dword [ebp - 0xa34]
inc eax
mov dword [ebp - 0xa34], eax
mov eax, dword [ebp - 0xe0c]
neg eax
imul eax, dword [ebp - 0x60c]
cmp eax, 0xfffa
jbe 0x1002f76f
mov dword [ebp - 0x5f4], 1
jmp 0x1002f776
and dword [ebp - 0x5f4], 0
cmp dword [ebp - 0x5f4], 0x55a5481
jl 0x1002f790
or eax, 0xffffffff
jne 0x1002f790
and dword [ebp - 0x8cc], 0
jmp 0x1002f79a
mov dword [ebp - 0x8cc], 1
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0xe14], eax
push 2
lea ecx, [ebp - 0xf58]
call fcn.10024ee0
mov esi, eax
push 2
lea ecx, [ebp - 0xf58]
call fcn.10024ee0
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x1002f7d4
mov dword [ebp - 0x5fc], 1
jmp 0x1002f7db
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0xe1c]
cmp eax, dword [ebp - 0x5fc]
jne 0x1002f7f5
mov dword [ebp - 0xb30], 1
jmp 0x1002f7fc
and dword [ebp - 0xb30], 0
cmp dword [ebp - 0xb30], 0xb913a86
je 0x1002f81a
cmp dword [ebp - 0xe24], 0
jne 0x1002f81a
and dword [ebp - 0xe2c], 0
jmp 0x1002f824
mov dword [ebp - 0xe2c], 1
mov eax, dword [ebp - 0xe34]
mov dword [ebp - 0x1124], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xecc], 0xffffffff
jle 0x1002f84c
mov dword [ebp - 0x604], 1
jmp 0x1002f853
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x464]
cmp dword [ebp - 0x604], eax
jl 0x1002f86d
mov dword [ebp - 0x8d4], 1
jmp 0x1002f874
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0xe3c], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xf58]
call fcn.10024edb
jmp 0x1002fb45
mov dword [ebp - 0x46c], 0xd49a337b
mov byte [ebp - 0x187], 0
movzx eax, byte [ebp - 0x187]
test eax, eax
je 0x1002f8c6
push 1
push 0
push 0xe56
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [ebp - 0xdc], 0
jmp 0x1002f8df
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jg 0x1002fb45
mov dword [ebp - 0x40c], 0xfffffff7
push 1
lea ecx, [ebp - 0xff0]
call fcn.10024e73
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x2c4], 0
jmp 0x1002f920
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 1
jge 0x1002f942
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0xff0]
call fcn.10024ee0
mov dword [eax], 0xfffffff6
jmp 0x1002f913
mov dword [ebp - 0x1d4], 0
jmp 0x1002f95b
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 3
jg 0x1002fb31
mov dword [ebp - 0xe4c], 0xbe7b8bbd
push dword [ebp - 0xdc]
lea ecx, [ebp - 0xc2c]
call fcn.10024ee0
cmp dword [eax], 0
jne 0x1002f98f
cmp dword [ebp - 0x60c], 0
cmp dword [ebp - 0x46c], 0xa02d5285
jbe 0x1002f9a7
mov dword [ebp - 0xe44], 1
jmp 0x1002f9ae
and dword [ebp - 0xe44], 0
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x112c], eax
cmp dword [ebp - 0x46c], 1
jb 0x1002f9cf
mov dword [ebp - 0xa3c], 1
jmp 0x1002f9d6
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp + eax*4 - 0xecc]
cmp eax, dword [ebp - 0xa3c]
jle 0x1002f9f7
mov dword [ebp - 0x614], 1
jmp 0x1002f9fe
and dword [ebp - 0x614], 0
push dword [ebp - 0xdc]
lea ecx, [ebp - 0xc2c]
call fcn.10024ee0
mov esi, dword [eax]
imul esi, dword [ebp - 0x614]
push dword [ebp - 0xdc]
lea ecx, [ebp - 0xc2c]
call fcn.10024ee0
mov dword [eax], esi
cmp dword [ebp - 0x40c], 0
jne 0x1002fa46
mov eax, 0xea11
test eax, eax
jne 0x1002fa46
and dword [ebp - 0x8dc], 0
jmp 0x1002fa50
mov dword [ebp - 0x8dc], 1
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp + eax*4 - 0xecc]
cmp dword [ebp - 0x8dc], eax
jne 0x1002fa71
mov dword [ebp - 0x61c], 1
jmp 0x1002fa78
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x61c]
sub eax, 0x275a3f77
je 0x1002faa7
push dword [ebp - 0xdc]
lea ecx, [ebp - 0xc2c]
call fcn.10024ee0
cmp dword [eax], 0
je 0x1002faa7
mov dword [ebp - 0xad4], 1
jmp 0x1002faae
and dword [ebp - 0xad4], 0
mov eax, dword [ebp - 0x40c]
cmp dword [ebp - 0xad4], eax
je 0x1002fac8
mov dword [ebp - 0x624], 1
jmp 0x1002facf
and dword [ebp - 0x624], 0
mov esi, dword [ebp - 0x624]
sub esi, 0x708e63fe
push 0
lea ecx, [ebp - 0xff0]
call fcn.10024ee0
cmp esi, dword [eax]
jge 0x1002faf8
mov dword [ebp - 0x8e4], 1
jmp 0x1002faff
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x46c]
cmp dword [ebp - 0x8e4], eax
jge 0x1002fb19
mov dword [ebp - 0x62c], 1
jmp 0x1002fb20
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0xe4c], eax
jmp 0x1002f94e
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xff0]
call fcn.10024edb
jmp 0x1002f8d2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc2c]
call fcn.10024edb
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x68], 0xffffffff
push 2
lea ecx, [ebp - 0x4d8]
call fcn.10024e73
mov dword [ebp - 4], 0xb
push 4
lea ecx, [ebp - 0xb88]
call fcn.10024e73
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x88], 0xfffffffa
mov dword [ebp - 0x19c], 0xfffffff6
mov dword [ebp - 0xc64], 0
mov dword [ebp - 0xc0], 0
jmp 0x1002fbbe
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jge 0x1002fbe0
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x4d8]
call fcn.10024ee0
mov dword [eax], 0xecbe92e3
jmp 0x1002fbb1
mov dword [ebp - 0xc0], 0
jmp 0x1002fbf9
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 4
jge 0x1002fc1b
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xb88]
call fcn.10024ee0
mov dword [eax], 0x3de4
jmp 0x1002fbec
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1134], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x54], eax
jl 0x1002fc38
mov dword [ebp - 0xebc], 1
jmp 0x1002fc3f
and dword [ebp - 0xebc], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x113c], eax
cmp dword [ebp - 0x54], 0
jne 0x1002fc5d
cmp dword [ebp - 0x68], 0
jne 0x1002fc5d
and dword [ebp - 0xa44], 0
jmp 0x1002fc67
mov dword [ebp - 0xa44], 1
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xa44], eax
jne 0x1002fc7e
mov dword [ebp - 0x634], 1
jmp 0x1002fc85
and dword [ebp - 0x634], 0
push 0
lea ecx, [ebp - 0x4d8]
call fcn.10024ee0
mov ecx, dword [ebp - 0x634]
imul ecx, dword [eax]
cmp ecx, 8
jge 0x1002fcac
mov dword [ebp - 0x8ec], 1
jmp 0x1002fcb3
and dword [ebp - 0x8ec], 0
push 0
lea ecx, [ebp - 0x4d8]
call fcn.10024ee0
mov ecx, dword [ebp - 0x8ec]
cmp ecx, dword [eax]
jg 0x1002fcd6
mov dword [ebp - 0x63c], 1
jmp 0x1002fcdd
and dword [ebp - 0x63c], 0
mov esi, dword [ebp - 0x63c]
neg esi
sub esi, dword [ebp - 0x68]
push 0
lea ecx, [ebp - 0x4d8]
call fcn.10024ee0
cmp esi, dword [eax]
je 0x1002fd05
mov dword [ebp - 0xb58], 1
jmp 0x1002fd0c
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0xb58]
imul esi, eax, 0x810d
push 1
lea ecx, [ebp - 0x4d8]
call fcn.10024ee0
cmp esi, dword [eax]
jge 0x1002fd38
mov dword [ebp - 0x644], 1
jmp 0x1002fd3f
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x644], eax
jne 0x1002fd56
mov dword [ebp - 0x8f4], 1
jmp 0x1002fd5d
and dword [ebp - 0x8f4], 0
mov esi, dword [ebp - 0x68]
add esi, dword [ebp - 0x8f4]
push 3
lea ecx, [ebp - 0xb88]
call fcn.10024ee0
cmp esi, dword [eax]
jl 0x1002fd83
mov dword [ebp - 0xe98], 1
jmp 0x1002fd8a
and dword [ebp - 0xe98], 0
mov dword [ebp - 0x88], 0xd1edb6b7
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x54], 0
jmp 0x1002fdb0
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x29
jne 0x10030017
mov dword [ebp - 0x414], 0xffffffff
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1002fde3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
mov dword [ebp - 0x88], 1
jmp 0x1002fdfc
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x10030012
mov dword [ebp - 0x654], 0xfffffffc
mov dword [ebp - 0x19c], 0
jmp 0x1002fe2c
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 3
jg 0x1003000d
mov dword [ebp - 0xc60], 0xfffffff6
mov dword [ebp - 0x68], 1
jmp 0x1002fe53
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x10030008
mov eax, dword [ebp - 0x88]
inc eax
inc eax
push eax
lea ecx, [ebp - 0xb88]
call fcn.10024ee0
push dword [ebp - 0x19c]
lea ecx, [ebp - 0xb88]
call fcn.10024ee0
mov dword [ebp - 0xcd8], eax
mov eax, dword [ebp - 0x88]
inc eax
inc eax
push eax
lea ecx, [ebp - 0xb88]
call fcn.10024ee0
mov ecx, dword [ebp - 0xcd8]
mov eax, dword [eax]
mov dword [ecx], eax
mov esi, dword [ebp - 0x654]
sub esi, 6
push dword [ebp - 0x68]
lea ecx, [ebp - 0x4d8]
call fcn.10024ee0
cmp esi, dword [eax]
jle 0x1002fed3
cmp dword [ebp - 0x414], 0
jne 0x1002fed3
and dword [ebp - 0x64c], 0
jmp 0x1002fedd
mov dword [ebp - 0x64c], 1
cmp dword [ebp - 0x64c], 2
jge 0x1002fef2
mov dword [ebp - 0xa4c], 1
jmp 0x1002fef9
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xa4c], eax
jg 0x1002ff10
mov dword [ebp - 0x8fc], 1
jmp 0x1002ff17
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x654]
cmp dword [ebp - 0x8fc], eax
je 0x1002ff31
mov dword [ebp - 0x65c], 1
jmp 0x1002ff38
and dword [ebp - 0x65c], 0
push dword [ebp - 0x68]
lea ecx, [ebp - 0x4d8]
call fcn.10024ee0
mov eax, dword [eax]
cmp eax, dword [ebp - 0x65c]
jne 0x1002ff5c
mov dword [ebp - 0xae0], 1
jmp 0x1002ff63
and dword [ebp - 0xae0], 0
cmp dword [ebp - 0xae0], 0xaa9c
jge 0x1002ff7b
mov dword [ebp - 0x664], 1
jmp 0x1002ff82
and dword [ebp - 0x664], 0
push dword [ebp - 0x68]
lea ecx, [ebp - 0x4d8]
call fcn.10024ee0
mov ecx, dword [ebp - 0x664]
cmp ecx, dword [eax]
jl 0x1002ffa1
cmp dword [ebp - 0x414], 0
mov eax, dword [ebp - 0xc60]
mov dword [ebp - 0x1144], eax
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x114c], eax
mov eax, 0x5094191
cmp eax, 0x6007675e
je 0x1002ffd1
mov dword [ebp - 0x904], 1
jmp 0x1002ffd8
and dword [ebp - 0x904], 0
imul eax, dword [ebp - 0x904], 0xfff9
mov dword [ebp - 0xc64], eax
mov eax, dword [ebp - 0x88]
inc eax
inc eax
push eax
lea ecx, [ebp - 0xb88]
call fcn.10024ee0
cmp dword [eax], 0
je 0x10030003
jmp 0x10030008
jmp 0x1002fe4c
jmp 0x1002fe1f
jmp 0x1002fdef
jmp 0x1002fda9
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xb88]
call fcn.10024edb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d8]
call fcn.10024edb
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x70], 0xffffffff
push 2
lea ecx, [ebp - 0x4e4]
call fcn.10024e73
mov dword [ebp - 4], 0xd
push 4
lea ecx, [ebp - 0xba0]
call fcn.10024e73
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x90], 0xfffffffa
mov dword [ebp - 0x1bc], 0xfffffff6
mov dword [ebp - 0xe84], 0
mov dword [ebp - 0x74], 0
jmp 0x10030096
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x100300b2
push dword [ebp - 0x74]
lea ecx, [ebp - 0x4e4]
call fcn.10024ee0
mov dword [eax], 0xecbe92e3
jmp 0x1003008f
mov dword [ebp - 0x74], 0
jmp 0x100300c2
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x100300de
push dword [ebp - 0x74]
lea ecx, [ebp - 0xba0]
call fcn.10024ee0
mov dword [eax], 0x3de4
jmp 0x100300bb
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x1154], eax
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x58], eax
jl 0x100300fb
mov dword [ebp - 0xdf4], 1
jmp 0x10030102
and dword [ebp - 0xdf4], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x115c], eax
cmp dword [ebp - 0x58], 0
jne 0x10030120
cmp dword [ebp - 0x70], 0
jne 0x10030120
and dword [ebp - 0x66c], 0
jmp 0x1003012a
mov dword [ebp - 0x66c], 1
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x66c], eax
jne 0x10030141
mov dword [ebp - 0xa54], 1
jmp 0x10030148
and dword [ebp - 0xa54], 0
push 0
lea ecx, [ebp - 0x4e4]
call fcn.10024ee0
mov ecx, dword [ebp - 0xa54]
imul ecx, dword [eax]
cmp ecx, 8
jge 0x1003016f
mov dword [ebp - 0x674], 1
jmp 0x10030176
and dword [ebp - 0x674], 0
push 0
lea ecx, [ebp - 0x4e4]
call fcn.10024ee0
mov ecx, dword [ebp - 0x674]
cmp ecx, dword [eax]
jg 0x10030199
mov dword [ebp - 0x90c], 1
jmp 0x100301a0
and dword [ebp - 0x90c], 0
mov esi, dword [ebp - 0x90c]
neg esi
sub esi, dword [ebp - 0x70]
push 0
lea ecx, [ebp - 0x4e4]
call fcn.10024ee0
cmp esi, dword [eax]
je 0x100301c8
mov dword [ebp - 0x67c], 1
jmp 0x100301cf
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x67c]
imul esi, eax, 0x810d
push 1
lea ecx, [ebp - 0x4e4]
call fcn.10024ee0
cmp esi, dword [eax]
jge 0x100301fb
mov dword [ebp - 0xb38], 1
jmp 0x10030202
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0xb38], eax
jne 0x10030219
mov dword [ebp - 0x684], 1
jmp 0x10030220
and dword [ebp - 0x684], 0
mov esi, dword [ebp - 0x70]
add esi, dword [ebp - 0x684]
push 3
lea ecx, [ebp - 0xba0]
call fcn.10024ee0
cmp esi, dword [eax]
jl 0x10030246
mov dword [ebp - 0xc6c], 1
jmp 0x1003024d
and dword [ebp - 0xc6c], 0
mov dword [ebp - 0x90], 0xd1edb6b7
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x58], 0
jmp 0x10030273
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0x29
jne 0x100304da
mov dword [ebp - 0x474], 0xffffffff
mov byte [ebp - 0x179], 0
movzx eax, byte [ebp - 0x179]
test eax, eax
je 0x100302a6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
mov dword [ebp - 0x90], 1
jmp 0x100302bf
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x100304d5
mov dword [ebp - 0xa5c], 0xfffffffc
mov dword [ebp - 0x1bc], 0
jmp 0x100302ef
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jg 0x100304d0
mov dword [ebp - 0xc74], 0xfffffff6
mov dword [ebp - 0x70], 1
jmp 0x10030316
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x100304cb
mov eax, dword [ebp - 0x90]
inc eax
inc eax
push eax
lea ecx, [ebp - 0xba0]
call fcn.10024ee0
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0xba0]
call fcn.10024ee0
mov dword [ebp - 0xdc8], eax
mov eax, dword [ebp - 0x90]
inc eax
inc eax
push eax
lea ecx, [ebp - 0xba0]
call fcn.10024ee0
mov ecx, dword [ebp - 0xdc8]
mov eax, dword [eax]
mov dword [ecx], eax
mov esi, dword [ebp - 0xa5c]
sub esi, 6
push dword [ebp - 0x70]
lea ecx, [ebp - 0x4e4]
call fcn.10024ee0
cmp esi, dword [eax]
jle 0x10030396
cmp dword [ebp - 0x474], 0
jne 0x10030396
and dword [ebp - 0x914], 0
jmp 0x100303a0
mov dword [ebp - 0x914], 1
cmp dword [ebp - 0x914], 2
jge 0x100303b5
mov dword [ebp - 0x68c], 1
jmp 0x100303bc
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x68c], eax
jg 0x100303d3
mov dword [ebp - 0x694], 1
jmp 0x100303da
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0xa5c]
cmp dword [ebp - 0x694], eax
je 0x100303f4
mov dword [ebp - 0x91c], 1
jmp 0x100303fb
and dword [ebp - 0x91c], 0
push dword [ebp - 0x70]
lea ecx, [ebp - 0x4e4]
call fcn.10024ee0
mov eax, dword [eax]
cmp eax, dword [ebp - 0x91c]
jne 0x1003041f
mov dword [ebp - 0x69c], 1
jmp 0x10030426
and dword [ebp - 0x69c], 0
cmp dword [ebp - 0x69c], 0xaa9c
jge 0x1003043e
mov dword [ebp - 0xaec], 1
jmp 0x10030445
and dword [ebp - 0xaec], 0
push dword [ebp - 0x70]
lea ecx, [ebp - 0x4e4]
call fcn.10024ee0
mov ecx, dword [ebp - 0xaec]
cmp ecx, dword [eax]
jl 0x10030464
cmp dword [ebp - 0x474], 0
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0x1164], eax
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x116c], eax
mov eax, 0x5094191
cmp eax, 0x6007675e
je 0x10030494
mov dword [ebp - 0x6a4], 1
jmp 0x1003049b
and dword [ebp - 0x6a4], 0
imul eax, dword [ebp - 0x6a4], 0xfff9
mov dword [ebp - 0xe84], eax
mov eax, dword [ebp - 0x90]
inc eax
inc eax
push eax
lea ecx, [ebp - 0xba0]
call fcn.10024ee0
cmp dword [eax], 0
je 0x100304c6
jmp 0x100304cb
jmp 0x1003030f
jmp 0x100302e2
jmp 0x100302b2
jmp 0x1003026c
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xba0]
call fcn.10024edb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4e4]
call fcn.10024edb
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x64], 0xffffffff
push 2
lea ecx, [ebp - 0x4cc]
call fcn.10024e73
mov dword [ebp - 4], 0xf
push 4
lea ecx, [ebp - 0xb7c]
call fcn.10024e73
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x98], 0xfffffffa
mov dword [ebp - 0x1a4], 0xfffffff6
mov dword [ebp - 0xc8c], 0
mov dword [ebp - 0xd0], 0
jmp 0x10030562
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x10030584
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x4cc]
call fcn.10024ee0
mov dword [eax], 0xecbe92e3
jmp 0x10030555
mov dword [ebp - 0xd0], 0
jmp 0x1003059d
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 4
jge 0x100305bf
push dword [ebp - 0xd0]
lea ecx, [ebp - 0xb7c]
call fcn.10024ee0
mov dword [eax], 0x3de4
jmp 0x10030590
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1174], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jl 0x100305dc
mov dword [ebp - 0xc7c], 1
jmp 0x100305e3
and dword [ebp - 0xc7c], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x117c], eax
cmp dword [ebp - 0x50], 0
jne 0x10030601
cmp dword [ebp - 0x64], 0
jne 0x10030601
and dword [ebp - 0x924], 0
jmp 0x1003060b
mov dword [ebp - 0x924], 1
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x924], eax
jne 0x10030622
mov dword [ebp - 0x6ac], 1
jmp 0x10030629
and dword [ebp - 0x6ac], 0
push 0
lea ecx, [ebp - 0x4cc]
call fcn.10024ee0
mov ecx, dword [ebp - 0x6ac]
imul ecx, dword [eax]
cmp ecx, 8
jge 0x10030650
mov dword [ebp - 0xa64], 1
jmp 0x10030657
and dword [ebp - 0xa64], 0
push 0
lea ecx, [ebp - 0x4cc]
call fcn.10024ee0
mov ecx, dword [ebp - 0xa64]
cmp ecx, dword [eax]
jg 0x1003067a
mov dword [ebp - 0x6b4], 1
jmp 0x10030681
and dword [ebp - 0x6b4], 0
mov esi, dword [ebp - 0x6b4]
neg esi
sub esi, dword [ebp - 0x64]
push 0
lea ecx, [ebp - 0x4cc]
call fcn.10024ee0
cmp esi, dword [eax]
je 0x100306a9
mov dword [ebp - 0x92c], 1
jmp 0x100306b0
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x92c]
imul esi, eax, 0x810d
push 1
lea ecx, [ebp - 0x4cc]
call fcn.10024ee0
cmp esi, dword [eax]
jge 0x100306dc
mov dword [ebp - 0x6bc], 1
jmp 0x100306e3
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x6bc], eax
jne 0x100306fa
mov dword [ebp - 0xb50], 1
jmp 0x10030701
and dword [ebp - 0xb50], 0
mov esi, dword [ebp - 0x64]
add esi, dword [ebp - 0xb50]
push 3
lea ecx, [ebp - 0xb7c]
call fcn.10024ee0
cmp esi, dword [eax]
jl 0x10030727
mov dword [ebp - 0xdd0], 1
jmp 0x1003072e
and dword [ebp - 0xdd0], 0
mov dword [ebp - 0x98], 0xd1edb6b7
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x50], 0
jmp 0x10030754
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x29
jne 0x100309bb
mov dword [ebp - 0x41c], 0xffffffff
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x10030787
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
mov dword [ebp - 0x98], 1
jmp 0x100307a0
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jl 0x100309b6
mov dword [ebp - 0x6cc], 0xfffffffc
mov dword [ebp - 0x1a4], 0
jmp 0x100307d0
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jg 0x100309b1
mov dword [ebp - 0xe58], 0xfffffff6
mov dword [ebp - 0x64], 1
jmp 0x100307f7
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x100309ac
mov eax, dword [ebp - 0x98]
inc eax
inc eax
push eax
lea ecx, [ebp - 0xb7c]
call fcn.10024ee0
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0xb7c]
call fcn.10024ee0
mov dword [ebp - 0xc84], eax
mov eax, dword [ebp - 0x98]
inc eax
inc eax
push eax
lea ecx, [ebp - 0xb7c]
call fcn.10024ee0
mov ecx, dword [ebp - 0xc84]
mov eax, dword [eax]
mov dword [ecx], eax
mov esi, dword [ebp - 0x6cc]
sub esi, 6
push dword [ebp - 0x64]
lea ecx, [ebp - 0x4cc]
call fcn.10024ee0
cmp esi, dword [eax]
jle 0x10030877
cmp dword [ebp - 0x41c], 0
jne 0x10030877
and dword [ebp - 0x6c4], 0
jmp 0x10030881
mov dword [ebp - 0x6c4], 1
cmp dword [ebp - 0x6c4], 2
jge 0x10030896
mov dword [ebp - 0x934], 1
jmp 0x1003089d
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x934], eax
jg 0x100308b4
mov dword [ebp - 0xa6c], 1
jmp 0x100308bb
and dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0x6cc]
cmp dword [ebp - 0xa6c], eax
je 0x100308d5
mov dword [ebp - 0x6d4], 1
jmp 0x100308dc
and dword [ebp - 0x6d4], 0
push dword [ebp - 0x64]
lea ecx, [ebp - 0x4cc]
call fcn.10024ee0
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6d4]
jne 0x10030900
mov dword [ebp - 0x93c], 1
jmp 0x10030907
and dword [ebp - 0x93c], 0
cmp dword [ebp - 0x93c], 0xaa9c
jge 0x1003091f
mov dword [ebp - 0x6dc], 1
jmp 0x10030926
and dword [ebp - 0x6dc], 0
push dword [ebp - 0x64]
lea ecx, [ebp - 0x4cc]
call fcn.10024ee0
mov ecx, dword [ebp - 0x6dc]
cmp ecx, dword [eax]
jl 0x10030945
cmp dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0xe58]
mov dword [ebp - 0x1184], eax
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x118c], eax
mov eax, 0x5094191
cmp eax, 0x6007675e
je 0x10030975
mov dword [ebp - 0xaf8], 1
jmp 0x1003097c
and dword [ebp - 0xaf8], 0
imul eax, dword [ebp - 0xaf8], 0xfff9
mov dword [ebp - 0xc8c], eax
mov eax, dword [ebp - 0x98]
inc eax
inc eax
push eax
lea ecx, [ebp - 0xb7c]
call fcn.10024ee0
cmp dword [eax], 0
je 0x100309a7
jmp 0x100309ac
jmp 0x100307f0
jmp 0x100307c3
jmp 0x10030793
jmp 0x1003074d
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xb7c]
call fcn.10024edb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4cc]
call fcn.10024edb
mov dword [ebp - 0x1f0], 0x34ab462a
mov dword [ebp - 0x48], 0x9b98
mov dword [ebp - 0x3a0], 0
jmp 0x10030a03
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 2
jge 0x10030a1f
mov eax, dword [ebp - 0x3a0]
mov dword [ebp + eax*4 - 0xae8], 0xac204e2d
jmp 0x100309f6
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xae8], 7
jmp 0x10030a4d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xae8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xae8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xae8], 0xfffffffc
jl 0x10030ea4
mov dword [ebp - 0x144], 0xa0029bf3
mov dword [ebp - 0x1cc], 0xc93e3288
mov dword [ebp - 0x95c], 0x497ea9b9
mov dword [ebp - 0x3a8], 0x7819afca
push 4
lea ecx, [ebp - 0xf70]
call fcn.10024e73
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x2cc], 0
jmp 0x10030ab6
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 4
jge 0x10030ad8
push dword [ebp - 0x2cc]
lea ecx, [ebp - 0xf70]
call fcn.10024ee0
mov dword [eax], 7
jmp 0x10030aa9
mov dword [ebp - 0x144], 0
jmp 0x10030af1
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffe2
je 0x10030e56
mov dword [ebp - 0xb40], 0xd0811fc8
mov dword [ebp - 0x1ac], 0x3268dd2a
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1194], eax
mov eax, 0xd6b22149
test eax, eax
je 0x10030c21
mov dword [ebp - 0xdd8], 0xf3adcfec
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x119c], eax
cmp dword [ebp - 0x1ac], 0x31ec
jge 0x10030b59
mov dword [ebp - 0x6e4], 1
jmp 0x10030b60
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x1ac]
cmp eax, dword [ebp - 0x6e4]
jne 0x10030b7a
mov dword [ebp - 0x944], 1
jmp 0x10030b81
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0x1cc]
cmp eax, dword [ebp - 0x944]
jl 0x10030b9b
mov dword [ebp - 0x6ec], 1
jmp 0x10030ba2
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x6ec]
add eax, 5
cmp eax, 0x26fbc79a
jge 0x10030bc7
cmp dword [ebp - 0x144], 0
je 0x10030bc7
mov dword [ebp - 0xa74], 1
jmp 0x10030bce
and dword [ebp - 0xa74], 0
mov eax, dword [ebp - 0x1f0]
cmp eax, dword [ebp - 0xa74]
jle 0x10030be8
mov dword [ebp - 0x6f4], 1
jmp 0x10030bef
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0xdd8]
cmp dword [ebp - 0x6f4], eax
jne 0x10030c09
mov dword [ebp - 0x94c], 1
jmp 0x10030c10
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0x1ac], eax
jmp 0x10030e51
mov dword [ebp - 0xe80], 0x4b5ad8ed
mov dword [ebp - 0x470], 8
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x11a4], eax
mov eax, 0x8319b20e
test eax, eax
je 0x10030d48
mov eax, dword [ebp - 0xb40]
cmp dword [ebp - 0x470], eax
je 0x10030c68
mov dword [ebp - 0x6fc], 1
jmp 0x10030c6f
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x470]
cmp dword [ebp - 0x6fc], eax
jg 0x10030c92
cmp dword [ebp - 0xb40], 0
je 0x10030c92
mov dword [ebp - 0x704], 1
jmp 0x10030c99
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x704], eax
jle 0x10030cb3
mov dword [ebp - 0x954], 1
jmp 0x10030cba
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x954]
jle 0x10030cd8
mov dword [ebp - 0xc94], 1
jmp 0x10030cdf
and dword [ebp - 0xc94], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x11ac], eax
mov eax, dword [ebp - 0xe80]
mov dword [ebp - 0x11b4], eax
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x11bc], eax
cmp dword [ebp - 0x470], 0
jne 0x10030d1e
cmp dword [ebp - 0x3a8], 0
jne 0x10030d1e
and dword [ebp - 0x70c], 0
jmp 0x10030d28
mov dword [ebp - 0x70c], 1
mov eax, dword [ebp - 0x144]
sub eax, dword [ebp - 0x70c]
cmp eax, dword [ebp - 0x1cc]
je 0x10030d48
mov dword [ebp - 0xc9c], 1
jmp 0x10030d4f
and dword [ebp - 0xc9c], 0
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x11c4], eax
mov eax, dword [ebp - 0x95c]
mov dword [ebp - 0x11cc], eax
cmp dword [ebp - 0x1cc], 0
je 0x10030d81
or eax, 0xffffffff
je 0x10030d81
mov dword [ebp - 0xa7c], 1
jmp 0x10030d88
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0x3a8]
cmp dword [ebp - 0xa7c], eax
jge 0x10030da2
mov dword [ebp - 0x714], 1
jmp 0x10030da9
and dword [ebp - 0x714], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xae8]
cmp dword [ebp - 0x714], eax
je 0x10030dca
mov dword [ebp - 0x71c], 1
jmp 0x10030dd1
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x95c]
cmp dword [ebp - 0x71c], eax
jge 0x10030deb
mov dword [ebp - 0xb04], 1
jmp 0x10030df2
and dword [ebp - 0xb04], 0
mov eax, dword [ebp - 0xb04]
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
jg 0x10030e13
mov dword [ebp - 0x724], 1
jmp 0x10030e1a
and dword [ebp - 0x724], 0
cmp dword [ebp - 0x724], 0xfb917de4
jbe 0x10030e32
mov dword [ebp - 0x964], 1
jmp 0x10030e39
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x964]
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x1ac], eax
jmp 0x10030ae4
mov dword [ebp - 0x48], 0
jmp 0x10030e66
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jg 0x10030e90
push dword [ebp - 0x48]
lea ecx, [ebp - 0xf70]
call fcn.10024ee0
mov esi, eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0xf70]
call fcn.10024ee0
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10030e5f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf70]
call fcn.10024edb
jmp 0x10030a32
mov dword [ebp - 0x48], 0
jmp 0x10030eb4
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xe
jg 0x10030ef3
mov dword [ebp - 0xde0], 0x8474
mov byte [ebp - 0x181], 0
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x10030ee5
push 0x2048
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov eax, dword [ebp - 0xde0]
mov dword [ebp - 0x1f0], eax
jmp 0x10030ead
mov dword [ebp - 0x250], 0
push 3
lea ecx, [ebp - 0x1008]
call fcn.10024e73
mov dword [ebp - 4], 0x12
mov dword [ebp - 0xc8], 0
jmp 0x10030f2a
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x10030f46
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x4b0], 0xb57f
jmp 0x10030f1d
mov dword [ebp - 0xc8], 0
jmp 0x10030f5f
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x10030f81
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x1008]
call fcn.10024ee0
mov dword [eax], 1
jmp 0x10030f52
mov dword [ebp - 0x250], 0
jmp 0x10030f9a
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 1
jg 0x100314c7
mov dword [ebp - 0x228], 0xfffffff9
mov dword [ebp - 0x2d4], 0
jmp 0x10030fca
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 3
jge 0x10030fe6
mov eax, dword [ebp - 0x2d4]
mov dword [ebp + eax*4 - 0xbf0], 0x1c2a2c7c
jmp 0x10030fbd
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xbf0], 0
jmp 0x10031014
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbf0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xbf0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbf0], 1
jg 0x100314c2
push 2
lea ecx, [ebp - 0x3ec]
call fcn.10024e73
mov byte [ebp - 4], 0x13
mov dword [ebp - 0xde8], 9
mov dword [ebp - 0xa0], 0
jmp 0x1003105c
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1003107e
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x3ec]
call fcn.10024ee0
mov dword [eax], 0x25fa5fef
jmp 0x1003104f
mov dword [ebp - 0xa0], 0
jmp 0x10031097
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 4
jge 0x100310b3
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x138c], 0xc41bbbbf
jmp 0x1003108a
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x10031116
push 0x247d
push 0x20ea
push 0x666
push 0
push 0x1ea4
push 0x17ce
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x61e
push 0x4fc
push 0xdff
push 0x1901
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
push 0
lea ecx, [ebp - 0x3ec]
call fcn.10024ee0
mov dword [eax], 1
jmp 0x1003114f
push 0
lea ecx, [ebp - 0x3ec]
call fcn.10024ee0
cmp dword [eax], 0
jl 0x100314ae
mov dword [ebp - 0x3b0], 0
jmp 0x1003117e
cmp dword [ebp - 0x3b0], 3
jge 0x1003119a
mov eax, dword [ebp - 0x3b0]
mov dword [ebp + eax*4 - 0xb94], 0x878abc10
jmp 0x10031171
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xb94], 1
jmp 0x100311c5
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x3ec]
call fcn.10024edb
jmp 0x10030ff9
jmp 0x10030f8d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1008]
call fcn.10024edb
mov dword [ebp - 0x200], 0x34ab462a
mov dword [ebp - 0x44], 0x9b98
mov dword [ebp - 0x2e4], 0
jmp 0x10031500
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 2
jge 0x1003151c
mov eax, dword [ebp - 0x2e4]
mov dword [ebp + eax*4 - 0xaf4], 0xac204e2d
jmp 0x100314f3
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xaf4], 7
jmp 0x1003154a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xaf4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xaf4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xaf4], 0xfffffffc
jl 0x100319a1
mov dword [ebp - 0x14c], 0xa0029bf3
mov dword [ebp - 0x1c4], 0xc93e3288
mov dword [ebp - 0xb24], 0x497ea9b9
mov dword [ebp - 0x2e8], 0x7819afca
push 4
lea ecx, [ebp - 0xf64]
call fcn.10024e73
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x2f0], 0
jmp 0x100315b3
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 4
jge 0x100315d5
push dword [ebp - 0x2f0]
lea ecx, [ebp - 0xf64]
call fcn.10024ee0
mov dword [eax], 7
jmp 0x100315a6
mov dword [ebp - 0x14c], 0
jmp 0x100315ee
cmp dword [ebp - 0x14c], 0xffffffe2
je 0x10031953
mov dword [ebp - 0x984], 0xd0811fc8
mov dword [ebp - 0x1b4], 0x3268dd2a
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x11fc], eax
mov eax, 0xd6b22149
test eax, eax
je 0x1003171e
mov dword [ebp - 0xeb8], 0xf3adcfec
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1204], eax
cmp dword [ebp - 0x1b4], 0x31ec
jge 0x10031656
mov dword [ebp - 0x74c], 1
jmp 0x1003165d
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x1b4]
cmp eax, dword [ebp - 0x74c]
jne 0x10031677
mov dword [ebp - 0xa8c], 1
jmp 0x1003167e
and dword [ebp - 0xa8c], 0
mov eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0xa8c]
jl 0x10031698
mov dword [ebp - 0x754], 1
jmp 0x1003169f
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x754]
add eax, 5
cmp eax, 0x26fbc79a
jge 0x100316c4
cmp dword [ebp - 0x14c], 0
je 0x100316c4
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x200]
cmp eax, dword [ebp - 0x97c]
jle 0x100316e5
mov dword [ebp - 0xdf0], 0x4b5ad8ed
mov dword [ebp - 0x424], 8
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x120c], eax
mov eax, 0x8319b20e
test eax, eax
je 0x10031845
mov eax, dword [ebp - 0x984]
cmp dword [ebp - 0x424], eax
je 0x10031765
mov dword [ebp - 0x764], 1
jmp 0x1003176c
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x424]
cmp dword [ebp - 0x764], eax
jg 0x1003178f
cmp dword [ebp - 0x984], 0
je 0x1003178f
mov dword [ebp - 0x76c], 1
jmp 0x10031796
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x76c], eax
jle 0x100317b0
mov dword [ebp - 0xa94], 1
jmp 0x100317b7
and dword [ebp - 0xa94], 0
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0xa94]
jle 0x100317d5
and dword [ebp - 0xcc4], 0
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x122c], eax
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0x1234], eax
cmp dword [ebp - 0x1c4], 0
je 0x1003187e
or eax, 0xffffffff
je 0x1003187e
mov dword [ebp - 0x98c], 1
jmp 0x10031885
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x98c], eax
jge 0x1003189f
mov dword [ebp - 0x77c], 1
jmp 0x100318a6
and dword [ebp - 0x77c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xaf4]
cmp dword [ebp - 0x77c], eax
je 0x100318c7
mov dword [ebp - 0x784], 1
jmp 0x100318ce
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0xb24]
cmp dword [ebp - 0x784], eax
jge 0x100318e8
mov dword [ebp - 0x44], 0
jmp 0x10031963
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x1003198d
push dword [ebp - 0x44]
lea ecx, [ebp - 0xf64]
call fcn.10024ee0
mov esi, eax
push dword [ebp - 0x44]
lea ecx, [ebp - 0xf64]
call fcn.10024ee0
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1003195c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf64]
call fcn.10024edb
jmp 0x1003152f
mov dword [ebp - 0x44], 0
jmp 0x100319b1
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xe
jg 0x100319f0
mov dword [ebp - 0xe68], 0x8474
mov byte [ebp - 0x12b], 0
movzx eax, byte [ebp - 0x12b]
test eax, eax
je 0x100319e2
push 0x2048
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov eax, dword [ebp - 0xe68]
mov dword [ebp - 0x200], eax
jmp 0x100319aa
mov dword [ebp - 0x230], 0x34ab462a
mov dword [ebp - 0x4c], 0x9b98
mov dword [ebp - 0x34c], 0
jmp 0x10031a1a
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 2
jge 0x10031a36
mov eax, dword [ebp - 0x34c]
mov dword [ebp + eax*4 - 0xb00], 0xac204e2d
jmp 0x10031a0d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb00], 7
jmp 0x10031a64
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb00], 0xfffffffc
jl 0x10031ebb
mov dword [ebp - 0x154], 0xa0029bf3
mov dword [ebp - 0x190], 0xc93e3288
mov dword [ebp - 0x9b4], 0x497ea9b9
mov dword [ebp - 0x3a4], 0x7819afca
push 4
lea ecx, [ebp - 0xf1c]
call fcn.10024e73
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x2ec], 0
jmp 0x10031acd
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 4
jge 0x10031aef
push dword [ebp - 0x2ec]
lea ecx, [ebp - 0xf1c]
call fcn.10024ee0
mov dword [eax], 7
jmp 0x10031ac0
mov dword [ebp - 0x154], 0
jmp 0x10031b08
cmp dword [ebp - 0x154], 0xffffffe2
je 0x10031e6d
mov dword [ebp - 0x4c], 0
jmp 0x10031ecb
cmp dword [ebp - 0x4c], 0xe
jg 0x10031f0a
mov dword [ebp - 0xcdc], 0x8474
mov byte [ebp - 0x185], 0
movzx eax, byte [ebp - 0x185]
test eax, eax
je 0x10031efc
push 0x2048
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov eax, dword [ebp - 0xcdc]
mov dword [ebp - 0x230], eax
jmp 0x10031ec4
mov dword [ebp - 0xe4], 0xffffffff
mov dword [ebp - 0x42c], 0xffffffff
mov dword [ebp - 0x127c], 1
mov dword [ebp - 0x804], 0
mov dword [ebp - 0x1284], 0xa41637c1
mov dword [ebp - 0x9dc], 0x288586fd
mov dword [ebp - 0xe70], 0xfd66c4a8
mov dword [ebp - 0x82c], 0x2f144811
mov dword [ebp - 0xcec], 0x6d8bc0d1
mov dword [ebp - 0x478], 0x80f885bd
push 4
lea ecx, [ebp - 0xc44]
call fcn.10024e73
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x208], 0x55c59c3f
mov dword [ebp - 0x2f4], 0x8d36fbc6
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x9d4], 0xfffffff6
mov dword [ebp - 0x128c], 0xfffffffe
push 2
lea ecx, [ebp - 0xe94]
call fcn.10024e73
mov byte [ebp - 4], 0x17
mov dword [ebp - 0xce4], 0x21785a3f
mov dword [ebp - 0xcf4], 0x46cb947f
mov dword [ebp - 0x2c], 0
jmp 0x10031fe9
cmp dword [ebp - 0x2c], 4
jge 0x10032005