Function at 0x1002df6f
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Delete registry value
Get keyboard layout
Get session user name

Disassembly:
mov eax, 0x10074609
call fcn.10074390
mov eax, 0x12b0
call fcn.10070c50
push ebx
push esi
push edi
mov dword [ebp - 0x24], 0x1a36
push 2
pop esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x60], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x44c], esi
mov dword [ebp - 0x448], esi
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x440], esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push 1
pop edi
mov dword [ebp - 0x3c], eax
xor eax, eax
push 3
mov byte [ebp - 0x7d], dl
mov dword [ebp - 0x20], eax
pop ebx
jmp 0x1002e09a
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x24], eax
jmp 0x1002e00d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002e002
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x500], 0x622a149c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002dfea
xor eax, eax
cmp dword [ebp - 0x500], eax
jne 0x1002e013
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffa
jle 0x1002dfe2
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1002e097
mov dword [ebp - 0x44], 0xfffffff8
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x444]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002e03b
mov eax, dword [ebp - 0x448]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x44c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x44c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
cmp ecx, 0x13a6
mov eax, dword [ebp - 0x24]
setle dl
inc edx
mov dword [ebp + eax*4 - 0x44c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x44]
mov dword [ebp - 0x44], ecx
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x24]
jns 0x1002e01b
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff2
jne 0x1002dfd3
mov dword [ebp - 0x20], 0xb036
mov dword [ebp - 0x30], 0xbc99
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], 0xfffffff8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002e0d8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf38], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002e0c4
xor eax, eax
push 4
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x1002e0f1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11ec], 0x740826f3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002e0e0
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002e102
mov eax, edi
xor edx, edx
cmp eax, 0x107
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp eax, edx
setle cl
cmp ecx, 0xb000cd9d
sbb edx, edx
neg edx
sub edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
sub ecx, 0x1f78
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setl al
cmp eax, dword [ebp - 0x20]
je 0x1002e140
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
xor eax, eax
dec dword [ebp - 0x44]
mov dword [ebp - 0x20], 0xb9f9b319
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1002e180
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4c4], 0x5b676bd7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002e168
xor eax, eax
mov dword [ebp - 0x20], eax
mov edx, 0xfd52a42b
cmp dword [ebp - 0x20], 0x10
mov esi, 0xa3205f5a
jne 0x1002e2ab
mov dword [ebp - 0x28], 0xffff
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002e1c3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcac], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002e1af
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002e1df
push 0x40b
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor eax, eax
mov edx, 0xfd52a42b
cmp dword [ebp - 0x28], eax
jne 0x1002e275
mov eax, dword [ebp - 0x20]
cmp edx, eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x28]
cmp esi, eax
sbb eax, eax
neg eax
imul eax, eax, 7
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
add edx, 0x4d8a3075
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, 0x907865e1
setl cl
cmp eax, ecx
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x44], eax
imul ecx, dword [ebp - 0x44], 0xa0ce
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
sub ecx, dword [ebp - 0x28]
lea eax, [ecx + 0xffff]
or ecx, 0xffffffff
cmp eax, ecx
mov dword [ebp - 0x4c4], eax
sete dl
xor ecx, ecx
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xca8]
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0xca8]
jge 0x1002e275
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x4c0], eax
jne 0x1002e28c
mov ecx, eax
cmp dword [ebp - 0x4c4], eax
je 0x1002e28e
mov ecx, edi
mov eax, dword [ebp - 0x30]
mov edx, 0xfd52a42b
sub ecx, eax
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x10
push 0
pop eax
je 0x1002e197
mov dword [ebp - 0x20], 0x544d1878
push 5
mov dword [ebp - 0x3c], 0x6896e60b
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002e2df
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x124], 0x4b5f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002e2c7
xor eax, eax
mov esi, 0x9cc25fa
push 0xfffffffffffffffb
pop edx
cmp dword [ebp - 0x124], eax
je 0x1002e34d
mov dword [ebp - 0x10], 0xd444182b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jl 0x1002e4bd
mov dword [ebp - 0xa14], esi
mov dword [ebp - 0xa10], esi
mov dword [ebp - 0xa0c], esi
mov dword [ebp - 0xa08], esi
mov eax, dword [ebp - 0xa0c]
mov dword [ebp - 0x20], eax
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002e340
push 0x11b5
push 0x19a0
call dword [sym.imp.USER32.dll_SetCaretPos]
push 5
pop ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jge 0x1002e302
jmp 0x1002e4bb
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0x90f5f2fe
mov dword [ebp - 0x40], 0x6d56
mov dword [ebp - 0x54], 0x7742
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002e385
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb58], 0xf0d6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002e36d
xor eax, eax
mov dword [ebp - 0x20], 0xe
cmp dword [ebp - 0x20], 0xfffffffc
jne 0x1002e450
or esi, 0xffffffff
jmp 0x1002e39d
xor eax, eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x30], 0x446b7d86
mov dword [ebp - 0x10], eax
jmp 0x1002e3bc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x288], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002e3af
mov eax, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
cmp eax, 0x5a7d
setne dl
xor ecx, ecx
neg edx
cmp edx, esi
setge cl
xor eax, eax
cmp ecx, esi
setge al
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x18], 0xf95e
jg 0x1002e3f9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
xor ecx, ecx
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
test eax, eax
sets cl
mov dword [ebp - 0x30], ecx
mov ecx, 0x5769e8a2
mov eax, dword [ebp - 0x18]
sub ecx, eax
jne 0x1002e438
mov eax, dword [ebp - 0x18]
neg eax
mov dword [ebp - 0x288], eax
jne 0x1002e438
xor eax, eax
jmp 0x1002e43a
mov eax, edi
push 5
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffc
pop ecx
push 0xfffffffffffffffb
pop edx
je 0x1002e39b
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x124], eax
jne 0x1002e480
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xb50]
mov eax, dword [ebp - 0x54]
cmp eax, ecx
setne dl
neg edx
jne 0x1002e480
xor eax, eax
mov ecx, eax
jmp 0x1002e482
mov ecx, edi
xor eax, eax
cmp ecx, 0x39428f8a
setg al
sub eax, ebx
neg eax
sbb eax, eax
inc eax
cmp eax, 0xc8d67996
jae 0x1002e4a5
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x1002e4a5
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x3c]
sub ecx, eax
mov eax, dword [ebp - 0xb50]
sub ecx, eax
mov dword [ebp - 0x20], ecx
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002e4dc
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd0], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002e4c8
xor eax, eax
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002e503
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x30c], 0xac8b13ec
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002e4eb
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002e528
push 0x2572
push 0xb16
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x1002e54b
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x30c]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x30c], ecx
dec dword [ebp - 0x28]
jns 0x1002e530
xor eax, eax
mov esi, dword [sym.imp.GDI32.dll_PatBlt]
mov dword [ebp - 0xd0], eax
jmp 0x1002e58f
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002e589
push 0x47a
push 0xdc2
push 0x1547
push 0x17de
push 0x1e52
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
xor eax, eax
inc dword [ebp - 0xd0]
cmp dword [ebp - 0xd0], 0x1c
jge 0x1002e559
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002e5b7
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd8], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002e5a3
xor eax, eax
mov dword [ebp - 0xd8], eax
jmp 0x1002e5f5
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002e5ef
push 0x47a
push 0xdc2
push 0x1547
push 0x17de
push 0x1e52
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
xor eax, eax
inc dword [ebp - 0xd8]
cmp dword [ebp - 0xd8], 0x1c
jge 0x1002e5bf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002e61d
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe0], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002e609
xor eax, eax
mov dword [ebp - 0xe0], eax
jmp 0x1002e65b
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002e655
push 0x47a
push 0xdc2
push 0x1547
push 0x17de
push 0x1e52
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
xor eax, eax
inc dword [ebp - 0xe0]
cmp dword [ebp - 0xe0], 0x1c
jge 0x1002e625
mov dword [ebp - 0x50], 0xfffffff6
or ecx, 0xffffffff
mov dword [ebp - 0x54], 0x58d32ffa
mov dword [ebp - 0x5c], 5
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x2c], 0xa835a23e
push 0xfffffffffffffffb
mov dword [ebp - 0x1c], ecx
pop edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x40], ecx
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002e6bf
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1128], 0x76f5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002e6a7
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002e6d5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd7c], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002e6c4
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x30]
sub eax, 0x1078b534
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xd74], eax
je 0x1002e6f9
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edi
setg cl
cmp ecx, 9
mov ecx, dword [ebp - 0x5c]
sbb eax, eax
inc eax
sub ecx, eax
mov eax, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x50]
sub edx, 0x67df2ddf
sub edx, dword [ebp - 0x54]
neg edx
sbb edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002e75b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x26c], 0xac8b13ec
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002e743
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002e77a
push 0x2572
push 0xb16
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x1002e79b
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x26c]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x26c], ecx
dec dword [ebp - 0x28]
jns 0x1002e782
mov dword [ebp - 0x24], 0x1a36
or ecx, 0xffffffff
push 2
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 0x3e4], eax
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002e8a7
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x24], eax
jmp 0x1002e816
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002e80b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x50c], 0x622a149c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002e7f3
xor eax, eax
cmp dword [ebp - 0x50c], eax
jne 0x1002e81c
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffa
jle 0x1002e7eb
mov dword [ebp - 0x24], 3
cmp dword [ebp - 0x24], eax
jl 0x1002e8a4
mov dword [ebp - 0x44], 0xfffffff8
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3e4]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002e848
mov eax, dword [ebp - 0x3e8]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x3ec]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x3ec]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
cmp ecx, 0x13a6
mov eax, dword [ebp - 0x24]
setle dl
inc edx
mov dword [ebp + eax*4 - 0x3ec], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x44]
mov dword [ebp - 0x44], ecx
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x24]
jns 0x1002e828
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff2
jne 0x1002e7dc
mov dword [ebp - 0x20], 0x632667a8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002e8d8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x268], 0x99ff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002e8c0
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002e8fa
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe54], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002e8e1
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1002e9ce
push 2
pop esi
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x2c], 0x15aa961
mov dword [ebp - 0x2c], 0xdf6f9781
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x2c], 0xc33c017f
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x1002e99f
push 4
pop edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], 0xe9378f1e
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x10], eax
jmp 0x1002e973
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xac4], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002e966
mov eax, dword [ebp - 0x28]
xor ecx, ecx
push 0xffffffffffffffff
mov eax, dword [ebp + eax*4 - 0x268]
cmp eax, edi
sete cl
xor eax, eax
mov dword [ebp - 0xe54], ecx
dec dword [ebp - 0x44]
inc dword [ebp - 0x28]
pop ecx
cmp dword [ebp - 0x28], eax
jle 0x1002e941
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002e9bc
push 0xdc3
push eax
push eax
push 0x7d5
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor eax, eax
dec dword [ebp - 0x20]
push 0xffffffffffffffff
pop ecx
jns 0x1002e909
mov esi, dword [sym.imp.GDI32.dll_PatBlt]
mov dword [ebp - 0x20], edi
jmp 0x1002e9f9
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x1002e9f6
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x268], 0xfd8f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1002e9de
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1002e9d3
mov dword [ebp - 0x20], 0xb9f9b319
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x30], 0xfffffffc
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002ea36
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4e4], 0x5b676bd7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002ea1e
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x10
jne 0x1002eb5d
or esi, 0xffffffff
mov dword [ebp - 0x28], 0xffff
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002ea72
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc4c], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002ea5e
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002ea89
push 0x40b
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002eb26
mov eax, dword [ebp - 0x20]
mov ecx, 0xfd52a42b
cmp ecx, eax
mov ecx, 0xa3205f5a
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x28]
cmp ecx, eax
sbb eax, eax
neg eax
imul eax, eax, 7
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
add edx, 0x4d8a3075
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, 0x907865e1
setl cl
cmp eax, ecx
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x44], eax
imul ecx, dword [ebp - 0x44], 0xa0ce
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
sub ecx, dword [ebp - 0x28]
lea eax, [ecx + 0xffff]
cmp eax, esi
mov dword [ebp - 0x4e4], eax
sete dl
xor ecx, ecx
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc48]
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0xc48]
jge 0x1002eb26
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x4e0], eax
jne 0x1002eb3d
mov ecx, eax
cmp dword [ebp - 0x4e4], eax
je 0x1002eb3f
mov ecx, edi
mov eax, dword [ebp - 0x30]
sub ecx, eax
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x10
push 0
pop eax
je 0x1002ea46
mov esi, dword [sym.imp.GDI32.dll_PatBlt]
push 3
pop ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], 0xeec5
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x5c], 0x4ddb84c6
mov dword [ebp - 0x54], 0x4426
mov dword [ebp - 0x3c], 0xde72
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002eba8
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x57c], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002eb90
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1002ebc4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x11c4], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002ebb0
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002ebda
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd94], 0x560277ed
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002ebc9
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x57c], ecx
mov dword [ebp - 0xd8c], ecx
mov eax, dword [ebp - 0x40]
sub eax, 0xfffffffa
neg eax
sbb eax, eax
inc ecx
add eax, ecx
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x50]
inc dword [ebp - 0x3c]
cmp ecx, eax
jne 0x1002ec1b
mov eax, edi
jmp 0x1002ec1d
xor eax, eax
mov edx, 0x46d68740
xor ecx, ecx
sub edx, eax
sub edx, dword [ebp - 0x54]
add edx, dword [ebp - 0x54]
add edx, dword [ebp - 0x5c]
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
push 2
cmp edx, eax
pop eax
setle cl
mov dword [ebp - 0x5c], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x24], 0x1a36
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x484], eax
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002ed4a
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x24], eax
jmp 0x1002ecb9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002ecae
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4e8], 0x622a149c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002ec96
xor eax, eax
cmp dword [ebp - 0x4e8], eax
jne 0x1002ecbf
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffa
jle 0x1002ec8e
mov dword [ebp - 0x24], 3
cmp dword [ebp - 0x24], eax
jl 0x1002ed47
mov dword [ebp - 0x44], 0xfffffff8
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x484]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002eceb
mov eax, dword [ebp - 0x488]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x48c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x48c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
cmp ecx, 0x13a6
mov eax, dword [ebp - 0x24]
setle dl
inc edx
mov dword [ebp + eax*4 - 0x48c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x44]
mov dword [ebp - 0x44], ecx
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x24]
jns 0x1002eccb
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff2
jne 0x1002ec7f
mov dword [ebp - 0x20], 0x544d1878
push 5
mov dword [ebp - 0x3c], 0x6896e60b
pop edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002ed88
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13c], 0x4b5f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002ed70
xor eax, eax
cmp dword [ebp - 0x13c], eax
je 0x1002edf3
mov dword [ebp - 0x10], 0xd444182b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jl 0x1002ef6f
mov eax, 0x9cc25fa
mov dword [ebp - 0x914], eax
mov dword [ebp - 0x910], eax
mov dword [ebp - 0x90c], eax
mov dword [ebp - 0x908], eax
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x20], eax
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002ede6
push 0x11b5
push 0x19a0
call dword [sym.imp.USER32.dll_SetCaretPos]
push 5
pop edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jge 0x1002eda3
jmp 0x1002ef6d
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], 0x90f5f2fe
mov dword [ebp - 0x40], 0x6d56
mov dword [ebp - 0x54], 0x7742
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002ee2d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb68], 0xf0d6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002ee14
xor eax, eax
mov dword [ebp - 0x20], 0xe
cmp dword [ebp - 0x20], 0xfffffffc
jne 0x1002ef01
jmp 0x1002ee45
xor eax, eax
or ecx, 0xffffffff
push 0xfffffffffffffffb
pop esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x30], 0x446b7d86
mov dword [ebp - 0x10], eax
jmp 0x1002ee67
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2d4], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002ee5a
mov eax, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
cmp eax, 0x5a7d
setne dl
xor ecx, ecx
neg edx
or esi, 0xffffffff
cmp edx, esi
setge cl
xor eax, eax
cmp ecx, esi
setge al
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x18], 0xf95e
jg 0x1002eea7
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
xor ecx, ecx
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
test eax, eax
sets cl
mov dword [ebp - 0x30], ecx
mov ecx, 0x5769e8a2
mov eax, dword [ebp - 0x18]
sub ecx, eax
jne 0x1002eee6
mov eax, dword [ebp - 0x18]
neg eax
mov dword [ebp - 0x2d4], eax
jne 0x1002eee6
xor eax, eax
jmp 0x1002eee8
mov eax, edi
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffc
push 5
pop edx
je 0x1002ee40
mov esi, dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x13c], eax
jne 0x1002ef31
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xb60]
mov eax, dword [ebp - 0x54]
cmp eax, ecx
setne dl
neg edx
jne 0x1002ef31
xor eax, eax
mov ecx, eax
jmp 0x1002ef33
mov ecx, edi
xor eax, eax
cmp ecx, 0x39428f8a
setg al
sub eax, 3
neg eax
sbb eax, eax
inc eax
cmp eax, 0xc8d67996
jae 0x1002ef57
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x1002ef57
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x3c]
sub ecx, eax
mov eax, dword [ebp - 0xb60]
sub ecx, eax
mov dword [ebp - 0x20], ecx
xor eax, eax
mov dword [ebp - 0x20], 0xb9f9b319
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x30], 0xfffffffc
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002efa7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x55c], 0x5b676bd7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002ef8f
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x10
jne 0x1002f0ce
or esi, 0xffffffff
mov dword [ebp - 0x28], 0xffff
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002efe3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcec], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002efcf
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002effa
push 0x40b
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1002f097
mov eax, dword [ebp - 0x20]
mov ecx, 0xfd52a42b
cmp ecx, eax
mov ecx, 0xa3205f5a
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x28]
cmp ecx, eax
sbb eax, eax
neg eax
imul eax, eax, 7
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
add edx, 0x4d8a3075
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, 0x907865e1
setl cl
cmp eax, ecx
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x44], eax
imul ecx, dword [ebp - 0x44], 0xa0ce
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
sub ecx, dword [ebp - 0x28]
lea eax, [ecx + 0xffff]
cmp eax, esi
mov dword [ebp - 0x55c], eax
sete dl
xor ecx, ecx
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xce8]
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0xce8]
jge 0x1002f097
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x558], eax
jne 0x1002f0ae
mov ecx, eax
cmp dword [ebp - 0x55c], eax
je 0x1002f0b0
mov ecx, edi
mov eax, dword [ebp - 0x30]
sub ecx, eax
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x10
push 0
pop eax
je 0x1002efb7
mov esi, dword [sym.imp.GDI32.dll_PatBlt]
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002f0f5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x270], 0xac8b13ec
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002f0dd
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002f114
push 0x2572
push 0xb16
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x1002f137
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x270]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x270], ecx
dec dword [ebp - 0x28]
jns 0x1002f11c
xor eax, eax
mov dword [ebp - 0x10], eax
or ecx, 0xffffffff
cmp dword [ebp - 0x10], edi
jge 0x1002f156
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe8], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002f142
xor eax, eax
mov dword [ebp - 0x20], 0x544d1878
push 5
mov dword [ebp - 0x3c], 0x6896e60b
pop edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002f18a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x110], 0x4b5f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002f172
xor eax, eax
cmp dword [ebp - 0x110], eax
je 0x1002f1f5
mov dword [ebp - 0x10], 0xd444182b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jl 0x1002f371
mov eax, 0x9cc25fa
mov dword [ebp - 0x9b4], eax
mov dword [ebp - 0x9b0], eax
mov dword [ebp - 0x9ac], eax
mov dword [ebp - 0x9a8], eax
mov eax, dword [ebp - 0x9ac]
mov dword [ebp - 0x20], eax
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002f1e8
push 0x11b5
push 0x19a0
call dword [sym.imp.USER32.dll_SetCaretPos]
push 5
pop edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jge 0x1002f1a5
jmp 0x1002f36f
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], 0x90f5f2fe
mov dword [ebp - 0x40], 0x6d56
mov dword [ebp - 0x54], 0x7742
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002f22f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb7c], 0xf0d6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002f216
xor eax, eax
mov dword [ebp - 0x20], 0xe
cmp dword [ebp - 0x20], 0xfffffffc
jne 0x1002f303
jmp 0x1002f244
xor eax, eax
push 0xfffffffffffffffb
pop esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x30], 0x446b7d86
mov dword [ebp - 0x10], eax
jmp 0x1002f266
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2f4], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002f259
mov eax, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
cmp eax, 0x5a7d
setne dl
xor ecx, ecx
neg edx
or esi, 0xffffffff
cmp edx, esi
setge cl
xor eax, eax
cmp ecx, esi
setge al
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x18], 0xf95e
jg 0x1002f2a6
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
xor ecx, ecx
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
test eax, eax
sets cl
mov dword [ebp - 0x30], ecx
mov ecx, 0x5769e8a2
mov eax, dword [ebp - 0x18]
sub ecx, eax
jne 0x1002f2e5
mov eax, dword [ebp - 0x18]
neg eax
mov dword [ebp - 0x2f4], eax
jne 0x1002f2e5
xor eax, eax
jmp 0x1002f2e7
mov eax, edi
push 0xffffffffffffffff
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffc
pop ecx
push 5
pop edx
je 0x1002f242
mov esi, dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x110], eax
jne 0x1002f333
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0xb74]
cmp ecx, eax
setne dl
neg edx
jne 0x1002f333
xor eax, eax
mov ecx, eax
jmp 0x1002f335
mov ecx, edi
xor eax, eax
cmp ecx, 0x39428f8a
setg al
sub eax, 3
neg eax
sbb eax, eax
inc eax
cmp eax, 0xc8d67996
jae 0x1002f359
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x1002f359
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x3c]
sub ecx, eax
mov eax, dword [ebp - 0xb74]
sub ecx, eax
mov dword [ebp - 0x20], ecx
xor eax, eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x1c
jl 0x1002f739
mov dword [ebp - 0x24], 0x82eac453
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x44], 0x831966c4
mov dword [ebp - 0x30], eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002f3bf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xaf8], 0xf4cc511e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002f3a7
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002f3e2
push 0xed
push 0x1c13
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffe8
jle 0x1002f5b4
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x934], 0xec7a429a
mov dword [ebp - 0x930], 0xec7a429a
mov dword [ebp - 0x92c], 0xec7a429a
mov dword [ebp - 0x928], 0xec7a429a
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x1002f4ba
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], edi
jle 0x1002f48e
mov edx, edi
cmp dword [ebp - 0x18], eax
jne 0x1002f490
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
cmp edx, eax
setg cl
xor eax, eax
imul ecx, dword [ebp - 0x24]
neg ecx
je 0x1002f4b1
mov ecx, edi
cmp dword [ebp - 0x18], eax
jne 0x1002f4b3
mov ecx, eax
mov eax, dword [ebp - 0x34]
add eax, ecx
je 0x1002f4bc
mov eax, edi
add eax, 3
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002f580
mov dword [ebp - 0x44], 0x11c25c53
mov dword [ebp - 0x20], eax
jmp 0x1002f574
mov dword [ebp - 0x3c], 0xe0f61949
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xa
je 0x1002f56c
mov dword [ebp - 0x30], 0x4d14b718
mov dword [ebp - 0x24], 0xffffffec
jmp 0x1002f558
mov dword [ebp - 0x40], 0xfff9
xor edx, edx
imul ecx, dword [ebp - 0x30], 0xadc7
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x44]
cmp eax, 0xd0f1
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
setge cl
sub edx, ecx
xor ebx, ebx
cmp edx, eax
setg bl
xor ecx, ecx
sub ebx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
cmp ebx, eax
setge cl
lea eax, [ecx + 1]
mov dword [ebp - 0x934], eax
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff2
jg 0x1002f505
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xa
jne 0x1002f4f5
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1002f59f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x10
jne 0x1002f4e5
jmp 0x1002f59f
mov dword [ebp - 0x24], eax
jmp 0x1002f599
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002f596
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x1002f585
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe8
jg 0x1002f43d
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002f5ca
push 0x97
call dword [sym.imp.USER32.dll_GetQueueStatus]
xor eax, eax
mov byte [ebp - 0x11], al
mov dword [ebp - 0x44], 0x267e6aa1
mov dword [ebp - 0x30], 0xaf8716b5
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002f604
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6cc], 0xdb22
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002f5eb
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1002f627
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x29c], 0x969a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002f60f
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002f646
push 4
pop ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x4f4], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002f632
xor eax, eax
cmp dword [ebp - 0x6cc], eax
je 0x1002f650
mov eax, edi
push 9
pop edx
sub edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x6cc]
cmp edx, eax
setge cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x298]
mov eax, dword [ebp - 0x298]
mov eax, dword [ebp - 0x298]
mov eax, dword [ebp - 0x6cc]
mov eax, dword [ebp - 0x298]
mov eax, dword [ebp - 0x298]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4f4], eax
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002f6ac
push 0x2225
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp byte [ebp - 0x11], 0
je 0x1002f723
mov dword [ebp - 0x2c], 0x5720e83c
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002f6eb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1140], 0x2d8cb4c2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002f6d2
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f6fb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
dec dword [ebp - 0x44]
push 0x47a
push 0xdc2
push 0x1547
push 0x17de
push 0x1e52
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
inc dword [ebp - 0xe8]
cmp dword [ebp - 0xe8], 0x1c
push 0
pop eax
jge 0x1002f384
mov dword [ebp - 0x50], 0xfffffff6
or ecx, 0xffffffff
mov dword [ebp - 0x54], 0x58d32ffa
mov dword [ebp - 0x5c], 5
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x2c], 0xa835a23e
push 0xfffffffffffffffb
mov dword [ebp - 0x1c], ecx
pop edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x40], ecx
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002f794
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11dc], 0x76f5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f77c
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002f7aa
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf14], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f799
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x30]
sub eax, 0x1078b534
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xf0c], eax
je 0x1002f7ce
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edi
setg cl
cmp ecx, 9
mov ecx, dword [ebp - 0x5c]
sbb eax, eax
inc eax
sub ecx, eax
mov eax, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x50]
sub edx, 0x67df2ddf
sub edx, dword [ebp - 0x54]
neg edx
sbb edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002f82b
push 4
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf0], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002f817
xor eax, eax
mov ebx, dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1002f852
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f84d
push 0x22d7
push eax
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x24]
jns 0x1002f839
mov esi, dword [sym.imp.GDI32.dll_GetPaletteEntries]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1002f923
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xf0]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xf0]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xf0]
xor eax, eax
mov dword [ebp - 0xf0], edi
cmp dword [ebp - 0x24], eax
je 0x1002f8a1
mov dword [ebp - 0x30], 0xc7153413
cmp dword [ebp - 0x30], eax
jne 0x1002f921
jmp 0x1002f908
mov dword [ebp - 0x10], 7
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002f8cb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb70], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002f8b3
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1b
jl 0x1002f8ef
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xf0]
mov dword [ebp - 0xb6c], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1b
jge 0x1002f8d4
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f908
push eax
push 0x10de
push 0x36d
push eax
call esi
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002f918
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
dec dword [ebp - 0x24]
jns 0x1002f864
xor eax, eax
mov dword [ebp - 0x50], 0xfffffff6
or ecx, 0xffffffff
mov dword [ebp - 0x54], 0x58d32ffa
mov dword [ebp - 0x5c], 5
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x2c], 0xa835a23e
push 0xfffffffffffffffb
mov dword [ebp - 0x1c], ecx
pop edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x40], ecx
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1002f97e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1158], 0x76f5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f966
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002f994
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdac], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002f983
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x30]
sub eax, 0x1078b534
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xda4], eax
je 0x1002f9b8
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edi
push 0xfffffffffffffffb
setg cl
cmp ecx, 9
mov ecx, dword [ebp - 0x5c]
sbb eax, eax
inc eax
sub ecx, eax
mov eax, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
pop ecx
setne dl
imul edx, dword [ebp - 0x50]
sub edx, 0x67df2ddf
sub edx, dword [ebp - 0x54]
neg edx
sbb edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], 0x507e6732
mov dword [ebp - 0x2c], 0x2006887e
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x44], 0x41e4f1f1
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x1c], 0x765e4b
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002fa4c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x278], 0x6444696a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002fa34
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002fa6c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2fc], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002fa54
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1002fa7d
mov eax, dword [ebp - 0x278]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
neg eax
push 2
sbb eax, eax
neg eax
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2fc]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov edx, dword [ebp - 0x278]
mov eax, dword [ebp - 0x2fc]
setge cl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
add eax, edx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0x3fcb50bf
pop eax
mov dword [ebp - 0x1c], 0x4157736
mov dword [ebp - 0x44], eax
xor eax, eax
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002fafb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x40c], 0xa8eac8b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002fae3
xor eax, eax
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], eax
jl 0x1002fc48
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x1002fbd2
jmp 0x1002fb1f
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x31e1
mov dword [ebp - 0x30], 0x589fe57f
cmp dword [ebp - 0x38], eax
jne 0x1002fb46
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x40c], 0
jne 0x1002fb46
xor eax, eax
jmp 0x1002fb48
mov eax, edi
mov dword [ebp - 0x1c], eax
xor edx, edx
mov eax, dword [ebp - 0x38]
push 0xfffffffffffffffb
mov ecx, dword [ebp + eax*4 - 0x40c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
sub edx, dword [ebp + eax*4 - 0x40c]
cmp edx, 0x3735b263
setg cl
sub ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
pop ecx
setne dl
imul edx, dword [ebp + eax*4 - 0x40c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x40c]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
mov eax, dword [ebp - 0x20]
setle cl
add eax, 0xffffbc34
add ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x404]
cmp ecx, eax
setne dl
mov dword [ebp - 0x30], edx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jle 0x1002fb1d
mov eax, dword [ebp - 0x40c]
xor ecx, ecx
cmp eax, 0x1efe0c23
setne cl
xor eax, eax
mov dword [ebp - 0x404], ecx
test ecx, ecx
je 0x1002fc04
cmp dword [ebp - 0x38], eax
jne 0x1002fc00
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002fc04
mov edx, edi
jmp 0x1002fc06
mov edx, eax
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
setg cl
xor edx, edx
cmp eax, ecx
setle dl
sub edx, dword [ebp - 0x38]
neg edx
sbb edx, edx
inc edx
sub edx, 0x8e18
jne 0x1002fc37
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002fc39
mov eax, edi
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x1002fb0b
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002fc67
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
xor eax, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002fc89
push 4
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf8], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002fc75
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1002fcaa
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002fca5
push 0x22d7
push eax
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x24]
jns 0x1002fc91
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1002fd75
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xf8]
xor eax, eax
mov dword [ebp - 0xf8], edi
cmp dword [ebp - 0x24], eax
je 0x1002fcf3
mov dword [ebp - 0x30], 0xc7153413
cmp dword [ebp - 0x30], eax
jne 0x1002fd73
jmp 0x1002fd5a
mov dword [ebp - 0x10], 7
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002fd1d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb08], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002fd05
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1b
jl 0x1002fd41
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xf8]
mov dword [ebp - 0xb04], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1b
jge 0x1002fd26
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002fd5a
push eax
push 0x10de
push 0x36d
push eax
call esi
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002fd6a
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
dec dword [ebp - 0x24]
jns 0x1002fcb6
xor eax, eax
mov dword [ebp - 0x20], 0x68ec0ae9
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x28], 0xffff
mov dword [ebp - 0x44], 0xd5943e2f
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002fdba
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe6c], 0x779a7b44
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002fda1
xor eax, eax
push 4
mov dword [ebp - 0x18], eax
pop edx
cmp dword [ebp - 0x18], edx
jge 0x1002fddd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x120c], 0xa4f0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002fdc5
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x13
jle 0x1002fe05
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002fdf9
push eax
push eax
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x13
jg 0x1002fde6
push 4
pop edx
cmp dword [ebp - 0x1c], eax
je 0x1002fe2d
mov eax, dword [ebp - 0x28]
xor ecx, ecx
test eax, eax
mov dword [ebp - 0xe6c], eax
sete cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
je 0x1002fe2b
mov eax, edi
jmp 0x1002fe2d
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], edi
xor eax, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002fe6f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x100], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002fe5b
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1002fe90
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1002fe8b
push 0x22d7
push eax
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x24]
jns 0x1002fe77
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1002ff5b
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x100]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x100]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x100]
xor eax, eax
mov dword [ebp - 0x100], edi
cmp dword [ebp - 0x24], eax
je 0x1002fed9
mov dword [ebp - 0x30], 0xc7153413
cmp dword [ebp - 0x30], eax
jne 0x1002ff59
mov dword [ebp - 0x10], 7
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002ff03
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], 0x507e6732
mov dword [ebp - 0x2c], 0x2006887e
mov dword [ebp - 0x2c], 0xfffffff7
push 0xfffffffffffffffb
mov dword [ebp - 0x44], 0x41e4f1f1
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x3c], edi
push 0xfffffffffffffff8
pop ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], 0x765e4b
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002ffb3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x280], 0x6444696a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002ff9b
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002ffd3