Function at 0x1002ea5f
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Compare security identifiers
Enumerate files on windows
Get common file path
Get geographical location
Get memory capacity
Get session user name
Log keystrokes via polling
Query environment variable
Set environment variable
Terminate process

Disassembly:
mov eax, 0x10080ee0
call fcn.10080868
mov eax, 0x1060
call fcn.1007cc90
push ebx
push esi
push edi
push 8
pop eax
mov esi, 0xd9ed
mov byte [ebp - 0x79], dl
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x784], eax
mov dword [ebp - 0x780], eax
mov dword [ebp - 0x77c], eax
mov dword [ebp - 0x778], eax
xor eax, eax
push 2
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x18], eax
pop edi
jmp 0x1002eaba
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4ac], 0xd9e2a8d3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002eaa9
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x4ac], 0xfffffff9
jg 0x1002eace
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4ac]
add edx, 2
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor ebx, ebx
inc ebx
mov dword [ebp - 0x77c], ecx
mov dword [ebp - 0x24], ebx
xor eax, eax
cmp dword [ebp - 0x24], eax
jl 0x1002eb5e
mov dword [ebp - 0x4c], 0x3c5ad058
mov dword [ebp - 0x38], 0xffffffff
cmp dword [ebp - 0x4ac], eax
jne 0x1002eb26
cmp dword [ebp - 0x24], eax
jne 0x1002eb22
mov eax, dword [ebp - 0x4ac]
mov eax, dword [ebp - 0x778]
xor eax, eax
mov ecx, eax
jmp 0x1002eb28
mov ecx, ebx
mov eax, dword [ebp - 0x4c]
add eax, ecx
xor ecx, ecx
cmp eax, 0xe58e
setne cl
xor eax, eax
cmp ecx, 4
setge al
cmp eax, 0x20225168
je 0x1002eb51
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1002eb53
mov eax, ebx
jmp 0x1002eb53
xor eax, eax
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x24]
push 0
pop eax
jns 0x1002eaf9
mov dword [ebp - 0x24], esi
push 8
pop ecx
mov dword [ebp - 0x70c], ecx
mov dword [ebp - 0x708], ecx
mov dword [ebp - 0x704], ecx
mov dword [ebp - 0x700], ecx
mov dword [ebp - 0x18], eax
jmp 0x1002eb92
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4bc], 0xd9e2a8d3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002eb81
mov eax, dword [ebp - 0x24]
push 0xfffffffffffffff9
pop esi
cmp dword [ebp - 0x4bc], esi
jg 0x1002eba8
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4bc]
add edx, 2
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x704], ecx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1002ec35
mov dword [ebp - 0x4c], 0x3c5ad058
mov dword [ebp - 0x38], 0xffffffff
cmp dword [ebp - 0x4bc], eax
jne 0x1002ebfd
cmp dword [ebp - 0x24], eax
jne 0x1002ebf9
mov eax, dword [ebp - 0x4bc]
mov eax, dword [ebp - 0x700]
xor eax, eax
mov ecx, eax
jmp 0x1002ebff
mov ecx, ebx
mov eax, dword [ebp - 0x4c]
add eax, ecx
xor ecx, ecx
cmp eax, 0xe58e
setne cl
xor eax, eax
cmp ecx, 4
setge al
cmp eax, 0x20225168
je 0x1002ec28
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1002ec2a
mov eax, ebx
jmp 0x1002ec2a
xor eax, eax
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x24]
push 0
pop eax
jns 0x1002ebd0
mov dword [ebp - 0x24], 0x5c8094a1
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002ec62
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7cc], 0xf9b3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002ec4a
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1002ecc0
mov dword [ebp - 0x2c], 0xb0ceafd9
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x1002ecbb
cmp dword [ebp - 0x24], eax
je 0x1002ec8e
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x7cc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x7cc]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002ecb3
call esi
dec dword [ebp - 0x2c]
push 0
pop eax
jns 0x1002ec7f
dec dword [ebp - 0x24]
jns 0x1002ec70
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x34], 0x8987f2fb
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xa3dbc56e
mov dword [ebp - 0x34], 0x5251c607
mov dword [ebp - 0x34], 0xa83d87e3
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x4c], 0x433a
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002ed21
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf64], 0x313dd33a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002ed09
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002ed41
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc10], 0x51efdb7b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002ed29
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002edaa
mov dword [ebp - 0x34], 0xdae8c9f3
mov dword [ebp - 0x34], 0x735e4b78
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0xeeda5852
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x34], 0xa5dec4f3
mov dword [ebp - 0x34], 0x6c382506
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002eda4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbe4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002ed8c
xor eax, eax
dec dword [ebp - 0x4c]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x1002ed46
mov dword [ebp - 0x24], 0xd9ed
push 8
pop ecx
mov dword [ebp - 0x724], ecx
mov dword [ebp - 0x720], ecx
mov dword [ebp - 0x71c], ecx
mov dword [ebp - 0x718], ecx
mov dword [ebp - 0x1c], 0xfe0a8eac
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002edf4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x560], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002ede0
xor eax, eax
mov dword [ebp - 0x1c], 0x15
jmp 0x1002ee19
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002ee16
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe3
jge 0x1002edfd
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp ecx, ebx
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x560]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, 0x9753589f
setne dl
cmp eax, edx
sbb eax, eax
neg eax
neg eax
je 0x1002ee90
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002ee83
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6fc], 0x91b4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002ee72
dec dword [ebp - 0x6f8]
jmp 0x1002ee96
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002eeae
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3fc], 0xd9e2a8d3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002ee9d
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x3fc], 0xfffffff9
jg 0x1002eec2
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3fc]
add edx, 2
neg edx
push 0xfffffffffffffff6
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x71c], ecx
mov dword [ebp - 0x24], ebx
pop ecx
cmp dword [ebp - 0x24], eax
jl 0x1002f11f
mov dword [ebp - 0x58], 0xfffffff8
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002ef1b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x49c], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002ef03
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002ef31
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x194], 0x11d7feae
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002ef20
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
cmp ecx, ebx
sbb edx, edx
xor ecx, ecx
add edx, 0x19f23e53
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x58]
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setg dl
xor ecx, ecx
sub edx, 0x716b
cmp edx, eax
mov eax, dword [ebp - 0x58]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setge dl
xor ebx, ebx
cmp edx, eax
setle bl
xor ecx, ecx
mov dword [ebp - 0x498], ebx
mov eax, dword [ebp - 0x58]
cmp ebx, eax
mov eax, dword [ebp - 0x194]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x194]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor ebx, ebx
mov dword [ebp - 0x194], ecx
mov dword [ebp - 0x58], 0x14
cmp dword [ebp - 0x58], 0xd
je 0x1002f0b0
xor eax, eax
inc ebx
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002f0a1
mov dword [ebp - 0x18], 0x5243b9c3
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1002f086
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x194]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x49c], 0
je 0x1002f044
mov eax, dword [ebp - 0x1c]
mov ecx, ebx
mov eax, dword [ebp + eax*4 - 0x194]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x194]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
jmp 0x1002f048
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x498]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x498]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
mov ecx, dword [ebp + eax*4 - 0x194]
mov eax, dword [ebp - 0x4c]
imul ecx, edx
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x194], edx
dec dword [ebp - 0x18]
jns 0x1002f00f
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x194], 0
jne 0x1002f09f
dec dword [ebp - 0x1c]
push 0
pop eax
jns 0x1002effd
xor eax, eax
dec dword [ebp - 0x58]
cmp dword [ebp - 0x58], 0xd
jne 0x1002efea
jmp 0x1002f0b1
inc ebx
mov dword [ebp - 0x4c], 0x3c5ad058
xor eax, eax
mov dword [ebp - 0x38], 0xffffffff
cmp dword [ebp - 0x3fc], eax
jne 0x1002f0e0
cmp dword [ebp - 0x24], eax
jne 0x1002f0dc
mov eax, dword [ebp - 0x3fc]
mov eax, dword [ebp - 0x718]
xor eax, eax
mov ecx, eax
jmp 0x1002f0e2
mov ecx, ebx
mov eax, dword [ebp - 0x4c]
add eax, ecx
xor ecx, ecx
cmp eax, 0xe58e
setne cl
xor eax, eax
cmp ecx, 4
setge al
cmp eax, 0x20225168
je 0x1002f10b
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1002f10d
mov eax, ebx
jmp 0x1002f10d
xor eax, eax
push 0
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x24]
pop eax
push 0xfffffffffffffff6
pop ecx
jns 0x1002eef1
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x20], eax
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002f14c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x37c], 0xc6a53d06
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f134
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002f16c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5c4], 0x3629aa81
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002f154
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_SetPropA]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f188
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
push 2
pop ecx
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jl 0x1002f2de
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002f1c0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xfec], 0x5732aa6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002f1a7
xor eax, eax
mov dword [ebp - 0x5c0], 0xfffffff7
inc dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x1002f2cc
mov dword [ebp - 0x14], 0x28a0
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0x8711
mov dword [ebp - 0x34], 0xaa8e55a4
inc dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jl 0x1002f2c9
mov dword [ebp - 0x4c], 0x592404e5
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x37c], 0
jne 0x1002f2c7
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002f2b5
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x37c], 0
jne 0x1002f2be
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
push 2
mov eax, dword [ebp + eax*4 - 0x37c]
mov eax, dword [ebp - 0x5c0]
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x4b83
mov eax, dword [ebp - 0x1c]
setl dl
mov eax, dword [ebp + eax*4 - 0x37c]
cmp eax, edx
sete cl
xor edx, edx
imul ecx, ecx, 0x3644
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x37c]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
inc edx
mov eax, dword [ebp + eax*4 - 0x37c]
cmp eax, edx
setl cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
pop ecx
mov eax, dword [ebp + eax*4 - 0x37c]
xor eax, eax
mov dword [ebp - 0x5c0], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jle 0x1002f229
dec dword [ebp - 0x14]
jns 0x1002f207
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x1002f1d5
dec dword [ebp - 0x2c]
jns 0x1002f197
mov dword [ebp - 0x24], 0x5c8094a1
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002f30f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x79c], 0xf9b3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f2f7
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1002f36a
mov dword [ebp - 0x2c], 0xb0ceafd9
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x1002f362
cmp dword [ebp - 0x24], eax
je 0x1002f335
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x79c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x79c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002f35a
call esi
dec dword [ebp - 0x2c]
push 0
pop eax
jns 0x1002f326
dec dword [ebp - 0x24]
jns 0x1002f317
push 2
pop ecx
mov dword [ebp - 0x20], eax
mov edx, 0x703026d8
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xc
mov dword [ebp - 0x58], 0xffff
jne 0x1002f4a2
mov dword [ebp - 0x51c], edx
mov dword [ebp - 0x518], edx
mov dword [ebp - 0x514], edx
mov dword [ebp - 0x510], edx
push 0xfffffffffffffff6
mov dword [ebp - 0x3c], 0x65969a22
pop edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002f3d2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9bc], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f3ba
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x1002f3eb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcbc], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f3da
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002f427
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x48], eax
jge 0x1002f425
xor eax, eax
cmp dword [ebp - 0x510], eax
je 0x1002f41c
cmp dword [ebp - 0x20], eax
je 0x1002f41c
mov eax, ebx
cmp eax, dword [ebp - 0x48]
je 0x1002f425
mov edx, ebx
jmp 0x1002f429
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x518]
push 0
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x518]
setl dl
xor ecx, ecx
cmp edx, eax
sete cl
xor ebx, ebx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x51c]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, 0x703026d8
setle cl
cmp dword [ebp - 0x58], ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x9b8], eax
mov dword [ebp - 0xcbc], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xc
pop eax
push 1
pop ebx
push 2
pop ecx
je 0x1002f38d
mov dword [ebp - 0x38], 0xffffffff
push 3
mov dword [ebp - 0x18], eax
pop edx
cmp dword [ebp - 0x18], edx
jge 0x1002f4cc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd04], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002f4b4
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f4f1
push 0x17e8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
push 3
pop edx
mov eax, dword [ebp - 0xd04]
mov dword [ebp - 0x38], 0x3638ecf5
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x34], 0x8987f2fb
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xa3dbc56e
mov dword [ebp - 0x34], 0x5251c607
mov dword [ebp - 0x34], 0xa83d87e3
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x4c], 0x433a
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1002f55d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf1c], 0x313dd33a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002f545
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002f57d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbec], 0x51efdb7b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002f565
xor eax, eax
push 2
mov dword [ebp - 0x2c], eax
pop ecx
jmp 0x1002f5e9
mov dword [ebp - 0x34], 0xdae8c9f3
mov dword [ebp - 0x34], 0x735e4b78
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], 0xeeda5852
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x34], 0xa5dec4f3
mov dword [ebp - 0x34], 0x6c382506
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002f5e3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbf8], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002f5cb
xor eax, eax
dec dword [ebp - 0x4c]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jle 0x1002f585
mov dword [ebp - 0x44], 0xd9ed
mov dword [ebp - 0x1c], 0xfe0a8eac
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002f618
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x570], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002f604
xor eax, eax
mov dword [ebp - 0x1c], 0x15
jmp 0x1002f63d
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f63a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe3
jge 0x1002f621
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp ecx, ebx
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x570]
setne bl
xor ecx, ecx
cmp ebx, eax
mov eax, 0x9753589f
setne cl
cmp eax, ecx
sbb eax, eax
neg eax
neg eax
je 0x1002f6b5
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002f6a7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7fc], 0x91b4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002f696
dec dword [ebp - 0x7f8]
jmp 0x1002f6bb
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
push 0xfffffffffffffff6
mov dword [ebp - 0x30], 0xfffffff8
pop eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002f6ec
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x484], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002f6d3
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002f702
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a0], 0x11d7feae
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002f6f1
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
sub ecx, dword [ebp - 0x30]
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0x30]
sbb edx, edx
xor ecx, ecx
add edx, 0x19f23e53
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
sub edx, 0x716b
cmp edx, eax
mov eax, dword [ebp - 0x30]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
xor ebx, ebx
cmp edx, eax
setle bl
xor ecx, ecx
mov dword [ebp - 0x480], ebx
mov eax, dword [ebp - 0x30]
cmp ebx, eax
mov eax, dword [ebp - 0x1a0]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1a0]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor ebx, ebx
mov dword [ebp - 0x1a0], ecx
mov dword [ebp - 0x30], 0x14
cmp dword [ebp - 0x30], 0xd
je 0x1002f885
xor eax, eax
inc ebx
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x1002f876
mov dword [ebp - 0x18], 0x5243b9c3
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1002f85b
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x484], 0
je 0x1002f819
mov eax, dword [ebp - 0x1c]
mov ecx, ebx
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
jmp 0x1002f81d
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x480]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x480]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
mov ecx, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x4c]
imul ecx, edx
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a0], edx
dec dword [ebp - 0x18]
jns 0x1002f7e4
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1a0], 0
jne 0x1002f874
dec dword [ebp - 0x1c]
push 0
pop eax
jns 0x1002f7d2
xor eax, eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xd
jne 0x1002f7bf
jmp 0x1002f886
inc ebx
push 8
pop eax
mov dword [ebp - 0x73c], eax
mov dword [ebp - 0x738], eax
mov dword [ebp - 0x734], eax
mov dword [ebp - 0x730], eax
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002f8c6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3e4], 0xd9e2a8d3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f8ae
xor eax, eax
mov dword [ebp - 0x24], 0xca4f833f
mov dword [ebp - 0x4c], 0x6f65e790
mov dword [ebp - 0x34], 0xf0dfbc43
push 3
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x1002f8fe
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa10], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002f8e6
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002f91a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x94c], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002f906
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002f955
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jl 0x1002f952
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f94a
push 0x13d6
push 0x247f
push 0xc42
call dword [sym.imp.KERNEL32.dll_MulDiv]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1002f92a
push 2
pop ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x1002f91f
push 9
pop eax
cmp dword [ebp - 0x24], eax
jb 0x1002f97e
mov eax, dword [ebp - 0xa08]
neg eax
jne 0x1002f972
mov eax, dword [ebp - 0xa10]
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002f9a0
push eax
push 0x24c
push eax
push eax
push 0x288
push 0x1332
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x3e4], 0xfffffff9
jg 0x1002f9af
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3e4]
add edx, 2
neg edx
push 3
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop edx
setne cl
xor eax, eax
mov dword [ebp - 0x734], ecx
mov dword [ebp - 0x34], 0x845d811f
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0x4006310f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1002fa07
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x618], 0xa61928c1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002f9ef
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002fa29
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x103c], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002fa10
xor eax, eax
push 0xfffffffffffffff6
mov dword [ebp - 0x610], 0x15
pop ecx
jmp 0x1002faac
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x4c], 0x718bd850
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1002fa70
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xfc4], 0xd193e05
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002fa58
xor eax, eax
mov dword [ebp - 0x18], 0xffffffee
cmp dword [ebp - 0x18], 0xffffffee
jl 0x1002faa3
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002fa94
push eax
push 0x27d
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffee
jge 0x1002fa7d
push 3
pop edx
push 0xfffffffffffffff6
pop ecx
inc dword [ebp - 0x4c]
dec dword [ebp - 0x610]
cmp dword [ebp - 0x610], ecx
jge 0x1002fa38
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], eax
jl 0x1002fe0f
mov dword [ebp - 0x14], 0xe1d925b0
mov dword [ebp - 0x18], 0x9ba87a5e
mov dword [ebp - 0x48], 0xea0a9f4f
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002fafb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x78], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002faea
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002fb67
mov edx, dword [ebp - 0x78]
xor ecx, ecx
mov eax, dword [ebp - 0x78]
sub edx, eax
mov eax, dword [ebp - 0x78]
cmp edx, eax
sete cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
jne 0x1002fb22
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x14]
cmp eax, 0xbda9
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp ecx, 0x72737ae9
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0x42c7
je 0x1002fb65
mov eax, ebx
jmp 0x1002fb67
xor eax, eax
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov dword [ebp - 0x4c], 0xad0d7276
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x48]
cmp eax, ebx
mov eax, dword [ebp - 0x78]
setge cl
sub eax, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x3c], 0x3c5ad058
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x14], 0x23cb8e00
mov dword [ebp - 0x4c], 0x2cf3e4c9
push 3
mov dword [ebp - 0x38], 0xffffffff
pop eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002fbdb
push 0xfffffffffffffffd
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x318], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002fbc7
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1002fc23
jmp 0x1002fbe7
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002fc03
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x318]
test eax, eax
mov eax, dword [ebp - 0x24]
setns cl
mov dword [ebp + eax*4 - 0x318], ecx
dec dword [ebp - 0x24]
jns 0x1002fbe5
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
test eax, eax
mov eax, dword [ebp - 0x14]
setns dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 5
setl al
xor ecx, ecx
cmp eax, 0x1131
setg cl
imul ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x1002fc5b
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002fc5d
mov eax, ebx
xor edx, edx
cmp eax, 0x3bba
mov eax, dword [ebp - 0x48]
setge dl
xor ecx, ecx
cmp edx, eax
push 4
setle cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x30], eax
pop ecx
cmp dword [ebp - 0x30], ecx
jge 0x1002fccf
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xeb0], 0xecb4
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x1002fcb7
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
push 3
pop edx
jge 0x1002fcf0
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xe90], edx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1002fcdb
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x1002fd10
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x2d4], 0x24b6
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1002fcf8
xor eax, eax
cmp dword [ebp - 0xea8], 0xc692
jg 0x1002fd88
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x34], 0x3843046b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002fd46
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xad8], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002fd2e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1002fd66
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb3c], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002fd4e
xor eax, eax
push 8
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x1002fd7b
mov dword [ebp - 0x4c], 0xbbf9acf2
dec dword [ebp - 0x4c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jne 0x1002fd6e
inc dword [ebp - 0xb38]
jmp 0x1002fdae
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002fda8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe60], 0x3439
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002fd90
xor eax, eax
mov dword [ebp - 0xe5c], ebx
inc dword [ebp - 0x2d4]
cmp dword [ebp - 0x3e4], eax
jne 0x1002fdd3
cmp dword [ebp - 0x44], eax
jne 0x1002fdcf
mov eax, dword [ebp - 0x3e4]
mov eax, dword [ebp - 0x730]
xor eax, eax
mov ecx, eax
jmp 0x1002fdd5
mov ecx, ebx
mov eax, dword [ebp - 0x3c]
add eax, ecx
xor ecx, ecx
cmp eax, 0xe58e
setne cl
xor eax, eax
cmp ecx, 4
setge al
cmp eax, 0x20225168
je 0x1002fdfe
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002fe00
mov eax, ebx
jmp 0x1002fe00
xor eax, eax
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x44]
push 0
pop eax
jns 0x1002fac0
push 5
pop ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x18], 0xe5ccc90a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jg 0x1002fe66
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002fe5b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 3
xor eax, eax
pop edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x1002fe39
push 5
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1002fe8c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x388], 0xc6a53d06
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002fe74
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002feaf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5d0], 0x3629aa81
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002fe97
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002fec8
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jl 0x1003001b
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002fefd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x101c], 0x5732aa6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002fee4
xor eax, eax
mov dword [ebp - 0x5cc], 0xfffffff7
inc dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x10030009
mov dword [ebp - 0x14], 0x28a0
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0x8711
mov dword [ebp - 0x34], 0xaa8e55a4
inc dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jl 0x10030006
mov dword [ebp - 0x4c], 0x592404e5
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x388], 0
jne 0x10030004
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002fff2
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x388], 0
jne 0x1002fffb
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
push 2
mov eax, dword [ebp + eax*4 - 0x388]
mov eax, dword [ebp - 0x5cc]
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x4b83
mov eax, dword [ebp - 0x1c]
setl dl
mov eax, dword [ebp + eax*4 - 0x388]
cmp eax, edx
sete cl
xor edx, edx
imul ecx, ecx, 0x3644
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x388]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
inc edx
mov eax, dword [ebp + eax*4 - 0x388]
cmp eax, edx
setl cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
pop ecx
mov eax, dword [ebp + eax*4 - 0x388]
xor eax, eax
mov dword [ebp - 0x5cc], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jle 0x1002ff66
dec dword [ebp - 0x14]
jns 0x1002ff44
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x1002ff12
dec dword [ebp - 0x2c]
jns 0x1002fed4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003003b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x140], 0x17571177
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030023
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003005b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x958], 0x1dbe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030043
xor eax, eax
mov dword [ebp - 0x140], 0xffffffeb
cmp dword [ebp - 0x140], 5
jne 0x100300a2
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x10030090
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003008b
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x10030079
inc dword [ebp - 0x140]
cmp dword [ebp - 0x140], 5
je 0x1003006e
push 2
pop ecx
mov dword [ebp - 0x24], 0x5c8094a1
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x100300d3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7ac], 0xf9b3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100300bb
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1003012b
mov dword [ebp - 0x2c], 0xb0ceafd9
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x10030126
cmp dword [ebp - 0x24], eax
je 0x100300f9
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x7ac]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x7ac]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1003011e
call esi
dec dword [ebp - 0x2c]
push 0
pop eax
jns 0x100300ea
dec dword [ebp - 0x24]
jns 0x100300db
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xc
push 2
pop esi
jne 0x10030258
jmp 0x10030149
xor eax, eax
mov ecx, 0x703026d8
mov dword [ebp - 0x4fc], ecx
mov dword [ebp - 0x4f8], ecx
mov dword [ebp - 0x4f4], ecx
mov dword [ebp - 0x4f0], ecx
push 0xfffffffffffffff6
mov dword [ebp - 0x3c], 0x65969a22
pop ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10030193
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbd0], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003017b
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x100301ac
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd88], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003019b
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x100301e8
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x48], eax
jge 0x100301e6
xor eax, eax
cmp dword [ebp - 0x4f0], eax
je 0x100301dd
cmp dword [ebp - 0x20], eax
je 0x100301dd
mov eax, ebx
cmp eax, dword [ebp - 0x48]
je 0x100301e6
mov edx, ebx
jmp 0x100301ea
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4f8]
push 1
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x4f8]
setl dl
xor ecx, ecx
cmp edx, eax
sete cl
xor ebx, ebx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4fc]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x3c]
pop ebx
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp dword [ebp - 0x58], ecx
sbb eax, eax
neg eax
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xd88], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xc
je 0x10030147
mov dword [ebp - 0x2c], 0xb02971c1
xor ecx, ecx
mov dword [ebp - 0x18], 5
mov eax, dword [ebp - 0x2c]
cmp eax, 0xffffffff
setge cl
xor eax, eax
cmp dword [ebp - 0x2c], ecx
jl 0x100302e9
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100302a8
push 0x1cf6
push eax
push eax
push 0x10d0
push 0x916
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100302bf
push 0x2115
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
push 5
pop ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x88], ecx
push 3
mov dword [ebp - 0x18], 0xe5ccc90a
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10030367
mov dword [ebp - 0x48], 0x5cc25bfc
mov dword [ebp - 0x18], eax
jmp 0x10030306
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9cc], 0x8dee
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100302f5
mov dword [ebp - 0x2c], 0xfffffff8
cmp dword [ebp - 0x2c], 0xffffffe5
jg 0x100302bd
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1003033d
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x9cc], 0
jne 0x1003033d
dec dword [ebp - 0x18]
jns 0x1003032b
dec dword [ebp - 0x2c]
jmp 0x10030312
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030364
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 3
xor eax, eax
pop ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x10030342
mov dword [ebp - 0x2c], eax
push 8
pop edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x18], 0xb9c5c935
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x100303a3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x838], 0x7571177e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003038b
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x100303bf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa24], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100303ab
xor eax, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], eax
jl 0x100304b2
mov dword [ebp - 0x24], 0xce1e2c0d
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100303f1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb18], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100303dd
xor eax, eax
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jl 0x10030463
mov dword [ebp - 0x48], 0xf9beab1d
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0xba5616d2
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0x250042
mov dword [ebp - 0x34], 0x1eb7e595
cmp dword [ebp - 0x834], eax
je 0x10030443
mov eax, dword [ebp - 0x834]
mov ecx, dword [ebp - 0x48]
sub ecx, eax
je 0x1003043b
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1003043d
mov eax, ebx
jmp 0x1003043d
xor eax, eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x830]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xb18], eax
inc dword [ebp - 0xa24]
dec dword [ebp - 0x24]
push 0
pop eax
jns 0x100303f9
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x100304a6
mov dword [ebp - 0x24], eax
jmp 0x10030483
cmp byte [ebp - 0xd], 0
je 0x10030480
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
mov byte [ebp - 0xd], al
jle 0x10030470
cmp byte [ebp - 0xd], 0
je 0x1003049b
push eax
push eax
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1003046b
push 8
pop edx
dec dword [ebp - 0x2c]
jns 0x100303cb
push 3
pop ecx
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x100304dc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x370], 0xc6a53d06
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100304c4
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x100304fc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5dc], 0x3629aa81
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100304e4
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030514
push eax
push eax
call ebx
push eax
call edi
xor eax, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], eax
jl 0x10030664
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10030549
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x105c], 0x5732aa6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10030530
xor eax, eax
mov dword [ebp - 0x5d8], 0xfffffff7
inc dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x10030652
mov dword [ebp - 0x14], 0x28a0
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0x8711
mov dword [ebp - 0x34], 0xaa8e55a4
inc dword [ebp - 0x20]
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x1003064f
mov dword [ebp - 0x4c], 0x592404e5
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x370], 0
jne 0x1003064d
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1003063b
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x370], 0
jne 0x10030644
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x370]
mov eax, dword [ebp - 0x5d8]
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x4b83
mov eax, dword [ebp - 0x1c]
setl dl
mov eax, dword [ebp + eax*4 - 0x370]
cmp eax, edx
sete cl
xor edx, edx
imul ecx, ecx, 0x3644
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x370]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
inc edx
mov eax, dword [ebp + eax*4 - 0x370]
cmp eax, edx
setl cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x370]
xor eax, eax
mov dword [ebp - 0x5d8], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x100305b2
dec dword [ebp - 0x14]
jns 0x10030590
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1003055e
dec dword [ebp - 0x2c]
jns 0x10030520
xor esi, esi
mov dword [ebp - 0x1c], eax
inc esi
cmp dword [ebp - 0x1c], esi
jge 0x10030687
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x11c], 0x17571177
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003066f
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x100306a7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbac], 0x1dbe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003068f
xor eax, eax
push 5
mov dword [ebp - 0x11c], 0xffffffeb
pop edi
jmp 0x100306de
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x100306d8
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100306d3
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x100306c1
inc dword [ebp - 0x11c]
cmp dword [ebp - 0x11c], edi
je 0x100306b6
mov dword [ebp - 0x94], edi
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x8c], edi
mov dword [ebp - 0x88], edi
push 3
mov dword [ebp - 0x18], 0xe5ccc90a
mov dword [ebp - 0x18], eax
pop edi
jmp 0x1003072b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030728
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x1003070d
mov dword [ebp - 0x14], 0xf0ed1ad6
mov dword [ebp - 0x4c], 0x4e3f1571
mov dword [ebp - 0x48], 0x199314e7
mov dword [ebp - 0x18], 0x89c089ce
mov dword [ebp - 0x38], 0xa0e40209
mov dword [ebp - 0x4c], 0xaf1ba137
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10030781
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x220], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10030769
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10030797
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9dc], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10030786
mov eax, dword [ebp - 0x220]
xor eax, eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x220]
neg ecx
push 8
sbb ecx, ecx
xor eax, eax
neg ecx
pop edx
cmp ecx, edx
setge al
xor edx, edx
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x48]
cmp eax, 0xe86ff18f
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
inc dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x58]
jae 0x100307f5
mov edx, esi
jmp 0x100307f9
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x9dc]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x40], 0xf4f46db5
mov dword [ebp - 0x18], 0xdb39523d
mov dword [ebp - 0x44], 0xa8551b32
mov dword [ebp - 0x3c], 0x3e7a3298
mov dword [ebp - 0x50], 0x53ebff78
mov dword [ebp - 0x34], 0xc489
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x10030887
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x300], 0xf665
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1003086f
xor eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], eax
jl 0x10030a1a
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x4c], 0x8eb16e2c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x10030a11
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x100309d8
jmp 0x100308d3
xor eax, eax
push 8
mov dword [ebp - 0x38], 0xffffffff
pop ecx
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
jne 0x100308f8
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x300], 0
jne 0x100308f8
xor eax, eax
mov esi, eax
jmp 0x100308fa
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10030953
cmp dword [ebp - 0x2c], eax
jne 0x10030929
mov dword [ebp - 0x24], 0x5f7919ad
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0x47941ce3
setg cl
cmp ecx, 0xc8b166c1
jne 0x10030929
xor eax, eax
xor edx, edx
mov ecx, eax
inc edx
jmp 0x1003092e
xor edx, edx
inc edx
mov ecx, edx
xor eax, eax
test ecx, ecx
sete al
sub eax, dword [ebp - 0x18]
jne 0x10030941
mov ecx, eax
cmp dword [ebp - 0x44], eax
je 0x10030943
mov ecx, edx
mov eax, dword [ebp - 0x2c]
imul eax, ecx
test eax, eax
je 0x10030951
mov eax, edx
jmp 0x10030953
xor eax, eax
xor edx, edx
cmp esi, eax
mov eax, dword [ebp - 0x4c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], eax
jl 0x100309cc
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030986
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100309c2
mov dword [ebp - 0x18], eax
jmp 0x100309ba
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100309a6
cmp dword [ebp - 0x18], eax
jle 0x10030990
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1003098b
dec dword [ebp - 0x44]
jns 0x10030971
dec dword [ebp - 0x2c]
push 1
pop esi
jns 0x100308d1
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x300]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x100309f4
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x50]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x100308bc
dec dword [ebp - 0x40]
jns 0x1003089c
mov dword [ebp - 0x2c], 0x5c8094a1
mov dword [ebp - 0x24], 0xcf5720e
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x48], 0x3b372ba2
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030a51
call ebx
push eax
call dword [sym.imp.USER32.dll_SetCapture]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10030a8e
mov dword [ebp - 0x24], eax
jmp 0x10030a86
mov dword [ebp - 0x18], eax
jmp 0x10030a71
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbf4], 0x86e5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10030a60
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xbf0], eax
inc dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], 0x15
jne 0x10030a5b
jmp 0x10030ad5
mov dword [ebp - 0x14], 0x1d8b
mov dword [ebp - 0x34], 0x2ca8cda2
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10030abc
mov edx, eax
cmp dword [ebp - 0x50], eax
je 0x10030abe
mov edx, esi
dec dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x48]
cmp eax, edx
setg cl
imul ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], esi
mov eax, 0xf8b8ae50
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x18], 9
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10030b10
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x208], eax
xor eax, eax
cmp dword [ebp - 0x204], eax
je 0x10030b65
mov eax, dword [ebp - 0x208]
add eax, 0x68ced46c
jne 0x10030b47
cmp dword [ebp - 0x18], eax
jne 0x10030b47
mov eax, dword [ebp - 0x208]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x204]
mov eax, dword [ebp - 0x204]
cmp eax, dword [ebp - 0x30]
jg 0x10030b65
xor eax, eax
cmp dword [ebp - 0x208], eax
je 0x10030b67
mov eax, esi
xor edx, edx
add eax, 0xdcd3d5b2
cmp eax, esi
mov eax, dword [ebp - 0x200]
setl dl
xor ecx, ecx
sub edx, 0xcf71
cmp edx, eax
mov eax, dword [ebp - 0x208]
setg cl
xor edx, edx
cmp eax, ecx
mov ecx, dword [ebp - 0x200]
mov eax, dword [ebp - 0x30]
setl dl
imul ecx, edx
xor edx, edx
cmp eax, ecx
setle dl
imul edx, dword [ebp - 0x208]
neg edx
je 0x10030c06
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10030bd8
push eax
push 0x1bb5
push 0x1150
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
xor eax, eax
push 3
mov dword [ebp - 0x30], eax
pop ecx
jmp 0x10030bfc
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030bf9
push 0x973
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
push 3
xor eax, eax
pop ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jle 0x10030be0
jmp 0x10030cd2
push 3
pop eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x18], 0x10
cmp dword [ebp - 0x18], eax
jg 0x10030cd2
push eax
pop edi
mov dword [ebp - 0x14], 0xf4f2d89
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0xc132d45a
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10030c56
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x9ec], 0xf116e8cf
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10030c3d
xor eax, eax
cmp dword [ebp - 0x208], eax
jne 0x10030cbb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10030ca5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x9e8], eax
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10030c85
mov ecx, eax
cmp dword [ebp - 0x50], eax
je 0x10030c87
mov ecx, esi
mov eax, dword [ebp - 0x3c]
sub ecx, eax
mov eax, dword [ebp - 0x14]
add ecx, 0xffffa545
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setg dl
cmp dword [ebp - 0x14], edx
je 0x10030cbb
xor eax, eax
jmp 0x10030cbd
mov eax, esi
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x10030c1e
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x34], 0xfffffff9
xor eax, eax
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x44], 0xf07c70ab
mov dword [ebp - 0x24], 0xb5411457
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10030d0f
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
mov esi, dword [ebp - 0x18]
imul esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
neg esi
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
setl dl
mov dword [ebp - 0x44], edx
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
setne dl
sub edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp esi, eax
setge cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
xor eax, eax
cmp dword [ebp - 0x18], ecx
je 0x10030e02
mov dword [ebp - 0x38], 0x93f0
push 2
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jge 0x10030da1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x454], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10030d89
xor eax, eax
cmp dword [ebp - 0x454], eax
jne 0x10030daf
mov eax, dword [ebp - 0x454]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x454]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov ecx, dword [ebp - 0x24]
setne dl
sub ecx, 0x6add
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
setl al
imul eax, dword [ebp - 0x44]
test eax, eax
je 0x10030deb
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10030e16
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030e2d
push eax
push 0x27d
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
xor eax, eax
push 2
pop ebx
mov dword [ebp - 0x14], 0xffffffff
xor esi, esi
inc esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x48], 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x4c], 0x658d83f7
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x50], 0xd127
mov dword [ebp - 0x18], eax
jmp 0x10030e78