Function at 0x1002c007
Capabilities:
Check os version
Extract resource via kernel32 functions
Get disk information
Get disk size
Get file system object information
Get system information on windows
Parse pe header
Set registry value
Start service

Disassembly:
mov eax, 0x10074c63
call fcn.10073260
mov eax, 0x165c
call fcn.1006fa10
push ebx
push esi
push edi
mov dword [ebp - 0x18], 0xfffffffd
xor eax, eax
push 1
mov dword [ebp - 0x48], 0x9d73ae4c
mov byte [ebp - 0x6d], dl
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x18], eax
pop ebx
jmp 0x1002c103
mov dword [ebp - 0x3c], 0x6de713a4
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x34], 0x6dbc1c23
mov dword [ebp - 0x30], 0xfffd
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], 0x18
jl 0x1002c100
mov dword [ebp - 0x44], 0xffaf0720
mov dword [ebp - 0x50], 0x1c3d076c
cmp dword [ebp - 0x18], eax
jne 0x1002c0da
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002c08b
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
cmp eax, ebx
setl dl
sub edx, 4
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x48]
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x3c]
jg 0x1002c0da
xor eax, eax
jmp 0x1002c0dc
mov eax, ebx
mov dword [ebp - 0x50], eax
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002c0f0
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x18
push 0
pop eax
jge 0x1002c068
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1c
jl 0x1002c03f
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002c132
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10b4], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002c119
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002c151
push 0x7e3
call ebx
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jg 0x1002c17a
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x10b4]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10b4], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002c15c
xor eax, eax
xor edi, edi
mov dword [ebp - 0x10], eax
inc edi
cmp dword [ebp - 0x10], edi
jge 0x1002c19d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcc], 0xfffffff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002c185
xor eax, eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xf
jne 0x1002c5a1
mov dword [ebp - 0x48], 0xd4e7937
lea ecx, [ebp - 0x6e4]
mov dword [ebp - 0x10], 0xa93826a0
push edi
call fcn.100154f1
xor eax, eax
lea ecx, [ebp - 0xa58]
mov dword [ebp - 4], eax
or edi, 0xffffffff
mov dword [ebp - 0x34], edi
push 3
call fcn.100154f1
xor ecx, ecx
xor eax, eax
inc ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x1002c20d
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x5e0], 0xfffffffe
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002c1f5
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jge 0x1002c236
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x6e4]
call fcn.1001557f
xor ecx, ecx
inc ecx
mov dword [eax], 0xf63069be
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002c215
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jge 0x1002c256
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x688], 0x60fc
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002c23e
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002c281
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xa58]
call fcn.1001557f
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1002c25f
xor ecx, ecx
xor eax, eax
inc ecx
cmp dword [ebp - 0x48], eax
je 0x1002c2ce
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x10], ecx
xor eax, eax
push eax
lea ecx, [ebp - 0x6e4]
call fcn.1001557f
mov ecx, dword [ebp - 0x10]
mov edx, 0x7d8ca64f
sub edx, ecx
xor ecx, ecx
cmp edx, dword [eax]
setge cl
xor eax, eax
cmp ecx, 0x84cbed56
setne al
cmp eax, 0x994b748a
je 0x1002c2cc
xor edi, edi
inc edi
xor eax, eax
mov esi, edi
jmp 0x1002c2d3
xor eax, eax
xor edi, edi
mov esi, eax
inc edi
push eax
lea ecx, [ebp - 0x6e4]
call fcn.1001557f
sub esi, dword [eax]
je 0x1002c3c0
or eax, 0xffffffff
mov dword [ebp - 0x378], eax
mov dword [ebp - 0x374], eax
mov dword [ebp - 0x370], eax
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x30], 4
imul eax, dword [ebp - 0x34], 5
mov ecx, dword [ebp - 0x378]
sub ecx, eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x5e0]
cmp dword [ebp - 0x10], eax
jle 0x1002c331
xor eax, eax
cmp dword [ebp - 0x688], eax
je 0x1002c333
mov edx, edi
jmp 0x1002c335
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x378]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x378]
mov esi, dword [ebp - 0x34]
setne cl
sub esi, eax
imul esi, ecx
lea ecx, [ebp - 0xa58]
push edi
call fcn.1001557f
mov dword [eax], esi
xor eax, eax
test esi, esi
jne 0x1002c36e
mov esi, eax
cmp dword [ebp - 0x378], eax
je 0x1002c370
mov esi, edi
push eax
lea ecx, [ebp - 0x6e4]
call fcn.1001557f
xor ecx, ecx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x5e0]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x374]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x378]
setle cl
cmp ecx, 0xffff
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setge cl
xor eax, eax
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
jmp 0x1002c3e5
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002c3e5
push eax
push 0x22da
push 0x4ac
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
lea ecx, [ebp - 0xa58]
call fcn.1001557a
or eax, 0xffffffff
lea ecx, [ebp - 0x6e4]
mov dword [ebp - 4], eax
call fcn.1001557a
xor eax, eax
mov dword [ebp - 0x10], 0x7c203980
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], eax
jmp 0x1002c581
mov dword [ebp - 0x30], 0xfffffffd
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x24], 0xb4e94f93
push edi
call fcn.100154f1
push 2
pop esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0xc14]
mov dword [ebp - 0x44], 0x5f432603
push esi
call fcn.100154f1
xor eax, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1002c46e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x204], 0xa8f90a3c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1002c456
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1002c493
push dword [ebp - 0x20]
lea ecx, [ebp - 0x44c]
call fcn.1001557f
push 0xfffffffffffffffa
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1002c476
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002c4af
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc14]
call fcn.1001557f
mov dword [eax], 0x920b2455
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002c498
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x44c]
mov eax, dword [ebp - 0x24]
xor edi, edi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x204], eax
mov esi, dword [ebp - 0x204]
mov dword [ebp - 0x204], esi
push edi
call fcn.1001557f
push edi
lea ecx, [ebp - 0x44c]
mov dword [eax], esi
call fcn.1001557f
imul eax, dword [ebp - 0x24], 0xa760
sub eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jne 0x1002c4fd
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x44c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
push edi
call fcn.1001557f
mov ecx, dword [ebp - 0x24]
cmp dword [eax], ecx
je 0x1002c532
push edi
lea ecx, [ebp - 0x44c]
call fcn.1001557f
cmp dword [eax], edi
jne 0x1002c532
xor eax, eax
xor edi, edi
mov ecx, eax
inc edi
jmp 0x1002c537
xor edi, edi
inc edi
mov ecx, edi
xor eax, eax
cmp ecx, 0xfffd
push edi
sete al
lea ecx, [ebp - 0xc14]
mov dword [ebp - 0x44], eax
mov esi, dword [ebp - 0x44]
neg esi
sbb esi, esi
neg esi
call fcn.1001557f
lea ecx, [ebp - 0xc14]
mov dword [eax], esi
call fcn.1001557a
or eax, 0xffffffff
lea ecx, [ebp - 0x44c]
mov dword [ebp - 4], eax
call fcn.1001557a
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x16
jl 0x1002c415
inc dword [ebp - 0xcc]
cmp dword [ebp - 0xcc], 0xf
push 2
pop esi
je 0x1002c1b0
push 4
lea ecx, [ebp - 0x920]
call fcn.100154f1
push 4
pop ecx
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [ebp - 0x24], 0xe1e87df2
mov dword [ebp - 0x48], 9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002c5e8
push dword [ebp - 0x10]
lea ecx, [ebp - 0x920]
call fcn.1001557f
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002c5cc
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002c839
push esi
lea ecx, [ebp - 0x198]
call fcn.100154f1
push esi
lea ecx, [ebp - 0xa64]
mov byte [ebp - 4], 5
call fcn.100154f1
mov byte [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x50], 0x29c214f1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002c63f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x198]
call fcn.1001557f
mov dword [eax], 0x72d4ea68
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002c621
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002c65b
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa64]
call fcn.1001557f
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002c644
push edi
lea ecx, [ebp - 0x198]
call fcn.1001557f
mov dword [eax], 3
jmp 0x1002c7a9
push 3
lea ecx, [ebp - 0x74c]
call fcn.100154f1
or eax, 0xffffffff
mov byte [ebp - 4], 7
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002c6a8
push dword [ebp - 0x10]
lea ecx, [ebp - 0x74c]
call fcn.1001557f
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002c695
push edi
lea ecx, [ebp - 0x198]
call fcn.1001557f
lea ecx, [ebp - 0x920]
push dword [eax]
call fcn.1001557f
lea ecx, [ebp - 0x74c]
cmp dword [eax], 0
jne 0x1002c7c0
push esi
call fcn.1001557f
mov dword [eax], 0x6b779c63
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002c768
push eax
lea ecx, [ebp - 0x920]
call fcn.1001557f
mov ecx, dword [ebp - 0x24]
inc ecx
cmp ecx, 0xffff
sbb ecx, ecx
inc ecx
cmp ecx, dword [eax]
jge 0x1002c71d
push edi
lea ecx, [ebp - 0x198]
call fcn.1001557f
cmp dword [eax], 0
jne 0x1002c71d
xor eax, eax
mov edi, eax
jmp 0x1002c71f
xor eax, eax
push eax
lea ecx, [ebp - 0xa64]
call fcn.1001557f
lea ecx, [edi - 0xfffc]
mov esi, eax
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xf7bdd484
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor edi, edi
inc edi
mov dword [esi], ecx
push edi
lea ecx, [ebp - 0x198]
call fcn.1001557f
push 2
pop esi
push edi
lea ecx, [ebp - 0x198]
call fcn.1001557f
imul ecx, dword [ebp - 0x24], 0x6ec1
xor edx, edx
test ecx, ecx
setle dl
xor ecx, ecx
cmp dword [eax], edx
setl cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x74c]
mov byte [ebp - 4], 6
call fcn.1001557a
push edi
lea ecx, [ebp - 0x198]
call fcn.1001557f
dec dword [eax]
push edi
lea ecx, [ebp - 0x198]
call fcn.1001557f
cmp dword [eax], 0
jge 0x1002c677
jmp 0x1002c7c9
mov byte [ebp - 4], 6
call fcn.1001557a
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
je 0x1002c7f0
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002c81c
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x1002c81c
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002c80b
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
push edi
lea ecx, [ebp - 0x198]
call fcn.1001557f
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
lea ecx, [ebp - 0xa64]
call fcn.1001557a
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 4
call fcn.1001557a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x1002c5f0
or eax, 0xffffffff
lea ecx, [ebp - 0x920]
mov dword [ebp - 4], eax
call fcn.1001557a
push 4
lea ecx, [ebp - 0x4ac]
call fcn.100154f1
push 3
lea ecx, [ebp - 0xee0]
mov dword [ebp - 4], 8
call fcn.100154f1
xor eax, eax
mov byte [ebp - 4], 9
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002c8a3
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4ac]
call fcn.1001557f
mov dword [eax], 0xac204e2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002c884
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002c8cb
push dword [ebp - 0x18]
lea ecx, [ebp - 0xee0]
call fcn.1001557f
mov dword [eax], 0x390197f0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002c8ac
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002c8e7
push eax
push eax
push 0x25d0
push 0x2f6
push eax
call dword [sym.imp.USER32.dll_InsertMenuW]
push esi
lea ecx, [ebp - 0x4ac]
call fcn.1001557f
mov dword [eax], 0xfffffffc
jmp 0x1002c927
xor eax, eax
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002c916
push 0x22ec
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
dec dword [ebp - 0x48]
lea ecx, [ebp - 0x4ac]
push esi
call fcn.1001557f
dec dword [eax]
push esi
lea ecx, [ebp - 0x4ac]
call fcn.1001557f
cmp dword [eax], 0xffffffe3
je 0x1002c8fb
lea ecx, [ebp - 0xee0]
call fcn.1001557a
or eax, 0xffffffff
lea ecx, [ebp - 0x4ac]
mov dword [ebp - 4], eax
call fcn.1001557a
mov dword [ebp - 0x10], 0xfffffff6
xor ecx, ecx
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x40], 0x1c946b43
mov dword [ebp - 0x48], 0x1d25bb08
push 0xfffffffffffffff9
pop edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x48], 0xfff6
mov eax, dword [ebp - 0x48]
cmp eax, edx
setne cl
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x10], 0xffffffeb
cmp dword [ebp - 0x10], 0x1c
jge 0x1002c9b4
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002c9ab
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1c
jl 0x1002c999
mov dword [ebp - 0x18], 0xfffffffd
xor eax, eax
mov dword [ebp - 0x48], 0x9d73ae4c
mov dword [ebp - 0x18], eax
jmp 0x1002ca90
mov dword [ebp - 0x3c], 0x6de713a4
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x34], 0x6dbc1c23
mov dword [ebp - 0x30], 0xfffd
mov dword [ebp - 0x3c], edi
cmp dword [ebp - 0x3c], 0x18
jl 0x1002ca8d
mov dword [ebp - 0x44], 0xffaf0720
mov dword [ebp - 0x50], 0x1c3d076c
cmp dword [ebp - 0x18], eax
jne 0x1002ca67
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1002ca18
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
cmp eax, edi
setl dl
sub edx, 4
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x48]
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x3c]
jg 0x1002ca67
xor eax, eax
jmp 0x1002ca69
mov eax, edi
mov dword [ebp - 0x50], eax
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002ca7d
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x18
push 0
pop eax
jge 0x1002c9f5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1c
jl 0x1002c9cc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002caba
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd0], 0xfffffff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002caa2
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002cadf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x103c], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002cac6
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002caf8
push 0x7e3
call ebx
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1002cb1e
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x103c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x103c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002cb00
xor eax, eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xf
jne 0x1002d271
mov dword [ebp - 0x48], 0xd4e7937
lea ecx, [ebp - 0x648]
mov dword [ebp - 0x10], 0xa93826a0
push edi
call fcn.100154f1
or eax, 0xffffffff
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0xd64]
push 3
call fcn.100154f1
or eax, 0xffffffff
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x1002cb91
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x6d4], 0xfffffffe
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002cb79
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x1002cbb7
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x648]
call fcn.1001557f
mov dword [eax], 0xf63069be
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1002cb99
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x1002cbd7
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x5bc], 0x60fc
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1002cbbf
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002cbff
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xd64]
call fcn.1001557f
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1002cbe0
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1002cc49
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x648]
mov eax, dword [ebp - 0x6d0]
xor eax, eax
mov dword [ebp - 0x10], edi
push eax
call fcn.1001557f
mov ecx, dword [ebp - 0x10]
mov edx, 0x7d8ca64f
sub edx, ecx
xor ecx, ecx
cmp edx, dword [eax]
setge cl
xor eax, eax
cmp ecx, 0x84cbed56
setne al
cmp eax, 0x994b748a
je 0x1002cc47
mov esi, edi
xor eax, eax
jmp 0x1002cc4b
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x648]
call fcn.1001557f
sub esi, dword [eax]
je 0x1002cd38
or eax, 0xffffffff
mov dword [ebp - 0x398], eax
mov dword [ebp - 0x394], eax
mov dword [ebp - 0x390], eax
mov dword [ebp - 0x38c], eax
mov dword [ebp - 0x30], 4
imul eax, dword [ebp - 0x34], 5
mov ecx, dword [ebp - 0x398]
sub ecx, eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x6d4]
cmp dword [ebp - 0x10], eax
jle 0x1002cca9
xor eax, eax
cmp dword [ebp - 0x5bc], eax
je 0x1002ccab
mov edx, edi
jmp 0x1002ccad
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x398]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x398]
mov esi, dword [ebp - 0x34]
setne cl
sub esi, eax
imul esi, ecx
lea ecx, [ebp - 0xd64]
push edi
call fcn.1001557f
mov dword [eax], esi
xor eax, eax
test esi, esi
jne 0x1002cce6
mov esi, eax
cmp dword [ebp - 0x398], eax
je 0x1002cce8
mov esi, edi
push eax
lea ecx, [ebp - 0x648]
call fcn.1001557f
xor ecx, ecx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x6d4]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x394]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x398]
setle cl
cmp ecx, 0xffff
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setge cl
xor eax, eax
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
jmp 0x1002cd5d
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002cd5d
push eax
push 0x22da
push 0x4ac
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
lea ecx, [ebp - 0xd64]
call fcn.1001557a
or eax, 0xffffffff
lea ecx, [ebp - 0x648]
mov dword [ebp - 4], eax
call fcn.1001557a
mov dword [ebp - 0x28], 0x7c203980
lea ecx, [ebp - 0x4c4]
mov dword [ebp - 0x24], 0xb4e94f93
push edi
call fcn.100154f1
mov dword [ebp - 4], 0xc
lea ecx, [ebp - 0xa7c]
mov dword [ebp - 0x44], 0x5f432603
push 2
call fcn.100154f1
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1002cdd4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x260], 0xa8f90a3c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1002cdbc
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1002cdf9
push dword [ebp - 0x20]
lea ecx, [ebp - 0x4c4]
call fcn.1001557f
push 0xfffffffffffffffa
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1002cddc
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002ce15
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa7c]
call fcn.1001557f
mov dword [eax], 0x920b2455
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002cdfe
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x4c4]
mov eax, dword [ebp - 0x24]
xor edi, edi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x260], eax
mov esi, dword [ebp - 0x260]
mov dword [ebp - 0x260], esi
push edi
call fcn.1001557f
push edi
lea ecx, [ebp - 0x4c4]
mov dword [eax], esi
call fcn.1001557f
imul eax, dword [ebp - 0x24], 0xa760
sub eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jne 0x1002ce64
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x4c4]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
push edi
call fcn.1001557f
mov ecx, dword [ebp - 0x24]
cmp dword [eax], ecx
je 0x1002ce98
push edi
lea ecx, [ebp - 0x4c4]
call fcn.1001557f
cmp dword [eax], edi
jne 0x1002ce98
xor eax, eax
xor edi, edi
mov ecx, eax
jmp 0x1002ce9d
xor eax, eax
lea ecx, [eax + 1]
xor eax, eax
cmp ecx, 0xfffd
lea ecx, [ebp - 0xa7c]
sete al
mov dword [ebp - 0x44], eax
mov esi, dword [ebp - 0x44]
neg esi
sbb esi, esi
xor eax, eax
inc eax
neg esi
push eax
call fcn.1001557f
lea ecx, [ebp - 0xa7c]
mov dword [eax], esi
call fcn.1001557a
or eax, 0xffffffff
lea ecx, [ebp - 0x4c4]
mov dword [ebp - 4], eax
call fcn.1001557a
push 2
pop esi
mov dword [ebp - 0x30], edi
lea ecx, [ebp - 0x90]
push esi
call fcn.100154f1
mov dword [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x2c], 0xc08901f2
mov dword [ebp - 0x48], 0x47cafdf1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002cf2d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x90]
call fcn.1001557f
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002cf12
xor eax, eax
xor edi, edi
mov dword [ebp - 0x2c], eax
inc edi
cmp dword [ebp - 0x2c], edi
jg 0x1002d186
xor ebx, ebx
mov dword [ebp - 0x10], 0xe6c0b333
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x48], edi
push dword [ebp - 0x2c]
call fcn.1001557f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x90]
call fcn.1001557f
cmp dword [eax], ebx
je 0x1002cfb5
push edi
lea ecx, [ebp - 0x90]
call fcn.1001557f
or ecx, 0xffffffff
imul eax, dword [eax], 0x8e48
cmp eax, ecx
jb 0x1002cf99
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x90]
call fcn.1001557f
cmp dword [eax], ebx
jne 0x1002cf99
xor eax, eax
mov esi, eax
jmp 0x1002cf9d
mov esi, edi
xor eax, eax
push eax
lea ecx, [ebp - 0x90]
call fcn.1001557f
xor ecx, ecx
cmp dword [eax], esi
sete cl
cmp ecx, dword [ebp - 0x2c]
jne 0x1002cfb9
xor eax, eax
mov edi, eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x90]
call fcn.1001557f
lea ecx, [ebp - 0x90]
mov esi, dword [eax]
imul esi, edi
xor edi, edi
inc edi
push edi
call fcn.1001557f
push dword [ebp - 0x2c]
xor ebx, ebx
lea ecx, [ebp - 0x90]
cmp esi, dword [eax]
setg bl
call fcn.1001557f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x90]
mov esi, dword [eax]
add esi, ebx
call fcn.1001557f
xor ecx, ecx
cmp esi, dword [eax]
setg cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x90]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x2c]
call fcn.1001557f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x90]
call fcn.1001557f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x90]
call fcn.1001557f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x90]
call fcn.1001557f
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x90]
push dword [ebp - 0x2c]
imul esi, dword [eax]
call fcn.1001557f
mov eax, dword [eax]
sub eax, esi
cmp eax, 0x6899
jne 0x1002d147
mov dword [ebp - 0x24], 0xcc73ee49
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x48], edi
push edi
call fcn.1001557f
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x90]
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x2c]
call fcn.1001557f
mov ecx, dword [ebp - 0x24]
xor ebx, ebx
add ecx, 0x1d0d9
imul edx, ecx, 5
mov ecx, dword [ebp - 0x24]
mov eax, dword [eax]
cmp edx, ecx
setl bl
sub eax, ebx
jne 0x1002d0c1
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x90]
call fcn.1001557f
xor ebx, ebx
lea ecx, [ebp - 0x90]
push ebx
call fcn.1001557f
push edi
lea ecx, [ebp - 0x90]
call fcn.1001557f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x90]
call fcn.1001557f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x90]
mov esi, eax
call fcn.1001557f
mov ecx, dword [eax]
add ecx, dword [esi]
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], edi
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
test eax, eax
sets cl
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x90]
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.1001557f
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x8e49ed22
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
jmp 0x1002d15e
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002d159
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov eax, dword [ebp - 0x2c]
xor ebx, ebx
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x90]
push dword [ebp - 0x2c]
call fcn.1001557f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x1002cf3e
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x2c], 6
cmp dword [ebp - 0x2c], 0x1b
je 0x1002d1a7
or ecx, 0xffffffff
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jne 0x1002d1a7
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x1b
jne 0x1002d196
or eax, 0xffffffff
lea ecx, [ebp - 0x90]
mov dword [ebp - 4], eax
call fcn.1001557a
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002d252
push esi
lea ecx, [ebp - 0xc2c]
call fcn.100154f1
mov dword [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x30], 0x7eede0b4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002d204
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc2c]
call fcn.1001557f
mov dword [eax], 0xf43b7c7c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002d1e6
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002d220
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
xor eax, eax
push eax
lea ecx, [ebp - 0xc2c]
call fcn.1001557f
lea ecx, [ebp - 0xc2c]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1001557a
mov dword [ebp - 0x30], 0xfffffffd
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x16
jl 0x1002d1c2
inc dword [ebp - 0xd0]
cmp dword [ebp - 0xd0], 0xf
je 0x1002cb31
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], eax
inc ebx
cmp dword [ebp - 0x10], ebx
jge 0x1002d294
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd8], 0xfffffff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d27c
xor eax, eax
mov dword [ebp - 0xd8], eax
jmp 0x1002d2cd
mov dword [ebp - 0x10], 0x7c203980
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x16
jge 0x1002d2c7
mov dword [ebp - 0x30], 0xfffffffd
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x16
jl 0x1002d2af
xor eax, eax
inc dword [ebp - 0xd8]
cmp dword [ebp - 0xd8], 0xf
je 0x1002d29c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002d2f6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc8], 0xfffffff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d2de
xor eax, eax
mov dword [ebp - 0xc8], eax
jmp 0x1002d32f
mov dword [ebp - 0x10], 0x7c203980
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x16
jge 0x1002d329
mov dword [ebp - 0x30], 0xfffffffd
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x16
jl 0x1002d311
xor eax, eax
inc dword [ebp - 0xc8]
cmp dword [ebp - 0xc8], 0xf
je 0x1002d2fe
movdqa xmm0, xmmword [0x10007ad0]
lea eax, [ebp - 0x124c]
push eax
lea eax, [ebp - 0x125c]
push eax
lea ecx, [ebp - 0x145c]
movdqu xmmword [ebp - 0x125c], xmm0
call fcn.1001558e
lea ecx, [ebp - 0x1f4]
mov esi, eax
call fcn.10008a63
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xa94]
push dword [esi]
call fcn.10015550
xor eax, eax
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x10], eax
mov edi, 0xfc558bac
jmp 0x1002d39f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1068], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d392
push 2
lea ecx, [ebp - 0xa94]
call fcn.1001557f
push 2
lea ecx, [ebp - 0xa94]
mov esi, eax
call fcn.1001557f
mov ecx, dword [esi]
mov ebx, dword [sym.imp.GDI32.dll_CreatePen]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002d3e1
push eax
push 0x12c
push 0x1e86
call ebx
or eax, 0xffffffff
lea ecx, [ebp - 0xa94]
mov dword [ebp - 4], eax
call fcn.1001557a
movdqa xmm0, xmmword [0x10007ad0]
lea eax, [ebp - 0x116c]
push eax
lea eax, [ebp - 0x117c]
push eax
lea ecx, [ebp - 0x13d4]
movdqu xmmword [ebp - 0x117c], xmm0
call fcn.1001558e
lea ecx, [ebp - 0x229]
mov esi, eax
call fcn.10008a63
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xd04]
push dword [esi]
call fcn.10015550
xor eax, eax
mov dword [ebp - 4], 0x11
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
jmp 0x1002d457
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe84], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d44a
push 2
lea ecx, [ebp - 0xd04]
call fcn.1001557f
push 2
lea ecx, [ebp - 0xd04]
mov esi, eax
call fcn.1001557f
mov ecx, dword [esi]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002d493
push eax
push 0x12c
push 0x1e86
call ebx
or eax, 0xffffffff
lea ecx, [ebp - 0xd04]
mov dword [ebp - 4], eax
call fcn.1001557a
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002d4cb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xef8], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002d4b2
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002d4ea
push 0x7e3
call edi
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002d506
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0xef8]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xef8], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1002d4ef
movdqa xmm0, xmmword [0x10007ad0]
lea eax, [ebp - 0x120c]
push eax
lea eax, [ebp - 0x121c]
push eax
lea ecx, [ebp - 0x150c]
movdqu xmmword [ebp - 0x121c], xmm0
call fcn.1001558e
lea ecx, [ebp - 0x259]
mov esi, eax
call fcn.10008a63
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xaac]
push dword [esi]
call fcn.10015550
xor eax, eax
mov dword [ebp - 4], 0x12
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
jmp 0x1002d575
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10a4], 0xfc558bac
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d564
push 2
lea ecx, [ebp - 0xaac]
call fcn.1001557f
push 2
lea ecx, [ebp - 0xaac]
mov esi, eax
call fcn.1001557f
mov ecx, dword [esi]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002d5b1
push eax
push 0x12c
push 0x1e86
call ebx
or ebx, 0xffffffff
lea ecx, [ebp - 0xaac]
mov dword [ebp - 4], ebx
call fcn.1001557a
push 4
lea ecx, [ebp - 0xf10]
call fcn.100154f1
mov dword [ebp - 4], 0x13
lea ecx, [ebp - 0x10f4]
mov dword [ebp - 0x10], 0x532fe223
mov dword [ebp - 0x40], 0xfffffff8
push 4
call fcn.100154f1
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x40], ebx
xor ebx, ebx
inc ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002d628
push dword [ebp - 0x18]
lea ecx, [ebp - 0xf10]
call fcn.1001557f
mov dword [eax], 0xb9b5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002d609
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002d650
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10f4]
call fcn.1001557f
mov dword [eax], 0xbd4dfbd6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002d631
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], 3
jg 0x1002d6ce
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], 0xfe5e81a7
mov dword [ebp - 0x40], 0xb50f6b34
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002d694
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1404], 0x8795
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002d67c
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002d6b0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1584], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002d69c
xor eax, eax
dec dword [ebp - 0x48]
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002d6c9
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
xor eax, eax
inc dword [ebp - 0x10]
jmp 0x1002d656
lea ecx, [ebp - 0x10f4]
call fcn.1001557a
or eax, 0xffffffff
lea ecx, [ebp - 0xf10]
mov dword [ebp - 4], eax
call fcn.1001557a
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002d711
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1050], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002d6f8
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002d72a
push 0x7e3
call edi
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1002d750
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x1050]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1050], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002d732
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002d775
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe0c], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002d75c
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002d78e
push 0x7e3
call edi
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1002d7b4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0xe0c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe0c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002d796
xor eax, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002d7d6
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe94], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002d7c2
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002d7f0
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002d7ed
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x1002d7db
push esi
lea ecx, [ebp - 0x354]
call fcn.100154f1
mov dword [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x48], 0xdee21afa
xor ebx, ebx
mov dword [ebp - 0x3c], 0x713e19f2
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x354]
cmp dword [ebp - 0x10], esi
jge 0x1002d837
push dword [ebp - 0x10]
call fcn.1001557f
mov dword [eax], ebx
inc dword [ebp - 0x10]
jmp 0x1002d81d
xor esi, esi
inc esi
push esi
call fcn.1001557f
push esi
lea ecx, [ebp - 0x354]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
call fcn.1001557f
mov ecx, dword [ebp - 0x48]
push ebx
mov esi, dword [eax]
sub esi, ecx
lea ecx, [ebp - 0x354]
call fcn.1001557f
push ebx
lea ecx, [ebp - 0x354]
mov edi, dword [eax]
add edi, esi
neg edi
sbb edi, edi
neg edi
call fcn.1001557f
xor edx, edx
cmp edi, 0x70a3267e
setne dl
xor ecx, ecx
cmp edx, 0xcd50
setne cl
xor ebx, ebx
imul ecx, ecx, 0x6542
cmp ecx, dword [eax]
lea ecx, [ebp - 0x354]
setle bl
sub ebx, 0x8d9dcee3
neg ebx
sbb ebx, ebx
xor eax, eax
push eax
inc ebx
call fcn.1001557f
push 0xfffffffffffffffa
mov eax, dword [eax]
sub eax, ebx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 7
pop ebx
cmp dword [ebp - 0x3c], ebx
jl 0x1002d8ee
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002d8e6
push eax
push 0x8a6
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
xor eax, eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jge 0x1002d8ce
or eax, 0xffffffff
lea ecx, [ebp - 0x354]
mov dword [ebp - 4], eax
call fcn.1001557a
movdqa xmm0, xmmword [0x10007ad0]
lea eax, [ebp - 0x118c]
push eax
lea eax, [ebp - 0x119c]
push eax
lea ecx, [ebp - 0x14cc]
movdqu xmmword [ebp - 0x119c], xmm0
call fcn.1001558e
lea ecx, [ebp - 0x171]
mov esi, eax
call fcn.10008a63
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xac4]
push dword [esi]
call fcn.10015550
push 4
lea ecx, [ebp - 0x878]
mov dword [ebp - 4], 0x16
call fcn.100154f1
mov byte [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x24], 0xe1e87df2
mov dword [ebp - 0x48], 9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002d993
push dword [ebp - 0x10]
lea ecx, [ebp - 0x878]
call fcn.1001557f
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002d977
xor eax, eax
xor esi, esi
mov dword [ebp - 0x24], eax
inc esi
cmp dword [ebp - 0x24], 3
jg 0x1002dc05
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 2
pop edi
push edi
lea ecx, [ebp - 0x1a8]
call fcn.100154f1
push edi
lea ecx, [ebp - 0xc44]
mov byte [ebp - 4], 0x18
call fcn.100154f1
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x50], 0x29c214f1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002d9fb
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1a8]
call fcn.1001557f
mov dword [eax], 0x72d4ea68
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002d9dd
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002da17
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc44]
call fcn.1001557f
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002da00
push esi
lea ecx, [ebp - 0x1a8]
call fcn.1001557f
mov dword [eax], 3
jmp 0x1002db6b
push 3
lea ecx, [ebp - 0x788]
call fcn.100154f1
or eax, 0xffffffff
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002da64
push dword [ebp - 0x10]
lea ecx, [ebp - 0x788]
call fcn.1001557f
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002da51
push esi
lea ecx, [ebp - 0x1a8]
call fcn.1001557f
lea ecx, [ebp - 0x878]
push dword [eax]
call fcn.1001557f
lea ecx, [ebp - 0x788]
cmp dword [eax], 0
jne 0x1002db82
push edi
call fcn.1001557f
mov dword [eax], 0x6b779c63
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002db2a
push eax
lea ecx, [ebp - 0x878]
call fcn.1001557f
mov ecx, dword [ebp - 0x24]
inc ecx
cmp ecx, 0xffff
sbb ecx, ecx
inc ecx
cmp ecx, dword [eax]
jge 0x1002dadd
push esi
lea ecx, [ebp - 0x1a8]
call fcn.1001557f
cmp dword [eax], 0
jne 0x1002dadd
xor eax, eax
mov edi, eax
jmp 0x1002dae1
mov edi, esi
xor eax, eax
push eax
lea ecx, [ebp - 0xc44]
call fcn.1001557f
lea ecx, [edi - 0xfffc]
mov esi, eax
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xf7bdd484
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [esi], ecx
xor esi, esi
inc esi
lea ecx, [ebp - 0x1a8]
push esi
call fcn.1001557f
push 2
pop edi
push esi
lea ecx, [ebp - 0x1a8]
call fcn.1001557f
imul ecx, dword [ebp - 0x24], 0x6ec1
xor edx, edx
test ecx, ecx
setle dl
xor ecx, ecx
cmp dword [eax], edx
setl cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x788]
mov byte [ebp - 4], 0x19
call fcn.1001557a
push esi
lea ecx, [ebp - 0x1a8]
call fcn.1001557f
dec dword [eax]
push esi
lea ecx, [ebp - 0x1a8]
call fcn.1001557f
cmp dword [eax], 0
jge 0x1002da33
jmp 0x1002db8b
mov byte [ebp - 4], 0x19
call fcn.1001557a
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
je 0x1002dbb2
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002dbde
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x1002dbde
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002dbcd
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
push esi
lea ecx, [ebp - 0x1a8]
call fcn.1001557f
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
lea ecx, [ebp - 0xc44]
call fcn.1001557a
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 0x17
call fcn.1001557a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x1002d9ac
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0x16
call fcn.1001557a
xor eax, eax
mov dword [ebp - 0x30], 0xa23e86f8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002dc3f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9a4], 0xc85f70ad
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002dc26
xor eax, eax
mov edi, dword [sym.imp.GDI32.dll_IntersectClipRect]
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002dc74
push 0xf7c
push 0x1ac3
push 0xfe8
push 0x17d4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_DrawEdge]
mov dword [ebp - 0x99c], 0xffffffe4
jmp 0x1002dcf5
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x3c], 0x16
jmp 0x1002dce9
mov dword [ebp - 0x10], 6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff1
jne 0x1002dcdf
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002dccd
push 0x1a0a
push 0x1220
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff1
push 0
pop eax
je 0x1002dca9
mov dword [ebp - 0x30], 0xfffffffd
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xe
jne 0x1002dc99
inc dword [ebp - 0x99c]
cmp dword [ebp - 0x99c], 5
jge 0x1002dc86
mov dword [ebp - 0x48], 0xfffffffc
or ecx, 0xffffffff
mov dword [ebp - 0x3c], 0x9ad59e57
mov dword [ebp - 0x34], 0x29bf390
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x5c], 0xc844
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002dd48
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4dc], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002dd2f
xor eax, eax
inc dword [ebp - 0x44]
je 0x1002dda7
cmp dword [ebp - 0x3c], eax
je 0x1002dd85
mov ecx, dword [ebp - 0x4d4]
xor edx, edx
mov eax, dword [ebp - 0x48]
add ecx, eax
mov eax, dword [ebp - 0x48]
cmp ecx, eax
setle dl
xor eax, eax
imul edx, dword [ebp - 0x3c]
cmp edx, esi
setle al
sub eax, 0x4ccb090a
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4dc]
mov eax, dword [ebp - 0x4d8]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4dc]
xor eax, eax
cmp dword [ebp - 0x4dc], eax
je 0x1002dda7
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, dword [ebp - 0x50]
jge 0x1002ddc5
cmp dword [ebp - 0x5c], eax
je 0x1002ddc5
mov eax, esi
mov dword [ebp - 0x4dc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002dde3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1014], 0xfc558bac
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002ddd2
push 2
lea ecx, [ebp - 0xac4]
call fcn.1001557f
push 2
lea ecx, [ebp - 0xac4]
mov esi, eax
call fcn.1001557f
mov ecx, dword [esi]
xor esi, esi
inc esi
push esi
mov dword [eax], ecx
lea ecx, [ebp - 0xf28]
call fcn.100154f1
mov byte [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x24], 0x8e56f9b2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002de4a
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf28]
call fcn.1001557f
mov dword [eax], 0xdde0bcd8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002de2c
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002dea9
mov dword [ebp - 0x10], 0xb999fb0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x1002dea6
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002de7d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002dea1
push 0x21a2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x1002de5e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1002de4f
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x24], ecx
jmp 0x1002def1
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002deee
push 0x1d5c
push 0xd75
push 0x214f
push 0x230f
push 0x5b7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff7
jl 0x1002deb6
lea ecx, [ebp - 0xf28]
call fcn.1001557a
xor eax, eax
mov dword [ebp - 0x30], 0xa23e86f8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002df2d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9bc], 0xc85f70ad
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002df14
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002df5e
push 0xf7c
push 0x1ac3
push 0xfe8
push 0x17d4
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x9b4], 0xffffffe4
jmp 0x1002dfd5
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x3c], 0x16
jmp 0x1002dfc9
mov dword [ebp - 0x10], 6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff1
jne 0x1002dfbf
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002dfad
push 0x1a0a
push 0x1220
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff1
push 0
pop eax
je 0x1002df8d
mov dword [ebp - 0x30], 0xfffffffd
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xe
jne 0x1002df7d
inc dword [ebp - 0x9b4]
cmp dword [ebp - 0x9b4], 5
jge 0x1002df6a
mov byte [ebp - 0x35], al
xor ebx, ebx
mov dword [ebp - 0x28], eax
inc ebx
mov dword [ebp - 0x48], 0x7b5c6eff
mov dword [ebp - 0x10], 0xe19e95d1
mov dword [ebp - 0x48], 0xfffffff8
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002e023
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6ec], 0x770a77c8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002e00b
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002e039
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5cc], 0xd4309642
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002e028
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002e059
mov dword [ebp - 0x10], 0xfadf6285
mov ecx, eax
cmp dword [ebp - 0x10], eax
je 0x1002e05b
mov ecx, ebx
mov dword [ebp - 0x6ec], ebx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp ecx, 0xcc4b
sete al
xor ecx, ecx
cmp eax, 0x8b15e3
setl cl
xor eax, eax
cmp ecx, 0xfffffff6
mov ecx, dword [ebp - 0x48]
setle al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x5cc], ecx
mov dword [ebp - 0x48], ecx
mov ecx, ebx
mov eax, dword [ebp - 0x48]
sub ecx, eax
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [ebp - 0x30], ecx
cmp byte [ebp - 0x35], 0
je 0x1002e18a
mov dword [ebp - 0x3c], 0x9b3198a8
xor eax, eax
mov dword [ebp - 0x30], 0xcef0
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffef
je 0x1002e179
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x3c], eax
je 0x1002e11b
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002e113
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002e130
push eax
push 0x12c
push 0x1e86
call dword [sym.imp.GDI32.dll_CreatePen]
or eax, 0xffffffff
lea ecx, [ebp - 0xac4]
mov dword [ebp - 4], eax
call fcn.1001557a
mov edi, dword [sym.imp.USER32.dll_SetRect]
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], eax
jmp 0x1002e1d5
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002e1cd
cmp dword [ebp - 0x3c], 0x13
jle 0x1002e1ab
push 4
lea ecx, [ebp - 0xf40]
call fcn.100154f1
mov dword [ebp - 4], 0x1c
lea ecx, [ebp - 0x10c4]
mov dword [ebp - 0x10], 0x532fe223
mov dword [ebp - 0x40], 0xfffffff8
push 4
call fcn.100154f1
mov byte [ebp - 4], 0x1d
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002e241