Function at 0x1002bc91
Capabilities:
Allocate thread local storage
Clear file content
Connect pipe
Create pipe
Delete file
Get file attributes
Get geographical location
Log keystrokes via polling
Query environment variable
Set thread local storage value

Disassembly:
mov eax, 0x1007bda9
call fcn.1007b760
mov eax, 0x1130
call fcn.10077cb0
push ebx
push esi
push edi
push 4
pop edi
xor eax, eax
mov byte [ebp - 0x71], dl
mov dword [ebp - 0x3c], eax
push 0xffffffffffffffff
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x40], 0xcc099843
pop esi
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xa
push 1
mov dword [ebp - 0x58], ecx
pop ebx
jne 0x1002bdeb
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], 0xbedfa90e
mov dword [ebp - 0x20], eax
jmp 0x1002bcef
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x37c], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002bce2
mov ecx, dword [ebp - 0x378]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x37c]
setne dl
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 0x13
cmp dword [ebp - 0x10], 0xfffffff6
jl 0x1002bddb
xor eax, eax
mov dword [ebp - 0x24], 0x905b8b78
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x1002bdbc
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x37c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x10]
jge 0x1002bd9d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x37c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x37c], ecx
test ecx, ecx
jne 0x1002bd92
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002bd7c
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x24], 0xfff7
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jle 0x1002bd92
xor eax, eax
jmp 0x1002bd94
mov eax, ebx
cmp eax, dword [ebp - 0x24]
jg 0x1002bd9d
mov eax, ebx
jmp 0x1002bd9f
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x24], eax
jne 0x1002bdba
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1002bd3c
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002bdce
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff6
jge 0x1002bd29
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xa
push 0
pop eax
je 0x1002bcd3
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002be10
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x22c], 0x69fdf99f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002bdf7
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x224], 0xffffffef
cmp dword [ebp - 0x224], 0x1d
jne 0x1002bfef
jmp 0x1002be31
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002be56
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc8], 0xfffffffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002be3d
xor eax, eax
mov dword [ebp - 0xc8], 0xfffffffe
cmp dword [ebp - 0xc8], 8
je 0x1002bfdc
jmp 0x1002be71
xor eax, eax
mov dword [ebp - 0x30], 0x400765e4
mov dword [ebp - 0x988], 0x1137
mov dword [ebp - 0x984], 0x1137
mov dword [ebp - 0x980], 0x1137
mov dword [ebp - 0x97c], 0x1137
cmp dword [ebp - 0x224], eax
jne 0x1002bf59
mov eax, dword [ebp - 0xc4]
xor ecx, ecx
cmp eax, 0x42b622b6
mov eax, dword [ebp - 0x224]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x224]
setg bl
xor ecx, ecx
cmp eax, ebx
mov eax, dword [ebp - 0x224]
setge cl
xor edx, edx
cmp ecx, 0x88ca
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x988]
jg 0x1002bf11
cmp dword [ebp - 0xc8], eax
je 0x1002bf11
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x1002bf16
xor ebx, ebx
mov edx, eax
inc ebx
mov eax, dword [ebp - 0x224]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x224]
sete cl
imul eax, ecx
xor ecx, ecx
cmp eax, 0x8968
mov eax, dword [ebp - 0xc8]
setle cl
add ecx, eax
mov eax, dword [ebp - 0xc8]
add eax, ecx
mov ecx, dword [ebp - 0xc4]
imul ecx, eax
test ecx, ecx
jne 0x1002bf59
xor eax, eax
mov ecx, eax
jmp 0x1002bf5b
mov ecx, ebx
mov eax, dword [ebp - 0xc8]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0xc8]
add ecx, eax
mov eax, dword [ebp - 0xc4]
cmp ecx, eax
mov eax, dword [ebp - 0x228]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xc8]
setne cl
sub ecx, eax
cmp ecx, dword [ebp - 0x224]
je 0x1002bf9f
xor eax, eax
cmp dword [ebp - 0x22c], eax
je 0x1002bfa4
mov eax, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], eax
jmp 0x1002bfc3
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002bfc0
call esi
push eax
call dword [sym.imp.USER32.dll_SetCapture]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x32
jl 0x1002bfac
inc dword [ebp - 0xc8]
cmp dword [ebp - 0xc8], 8
jne 0x1002be6f
inc dword [ebp - 0x224]
cmp dword [ebp - 0x224], 0x1d
je 0x1002be2f
xor eax, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1002c010
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xfe8], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1002bffc
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002c030
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xfe8], 0xfe7d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002c018
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002c04d
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], 0xfffffffa
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002c078
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa8c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002c063
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002c09a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd4c], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002c081
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002c0b2
push 0x1ddd
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002c105
cmp dword [ebp - 0x10], eax
jne 0x1002c0e3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
sub eax, 7
jne 0x1002c0e3
mov edx, eax
jmp 0x1002c0e5
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x10]
je 0x1002c0f8
mov eax, ebx
jmp 0x1002c0fa
xor eax, eax
cmp eax, dword [ebp - 0x10]
jl 0x1002c103
mov eax, ebx
jmp 0x1002c105
xor eax, eax
mov dword [ebp - 0xa88], eax
mov dword [ebp - 0xd48], eax
or eax, 0xffffffff
mov dword [ebp - 0x2c], 0xa420452a
mov dword [ebp - 0x3c], 0xf69f7fd1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002c140
push eax
push 0xc87
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1002c158
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002c15a
mov eax, ebx
mov ecx, dword [ebp - 0x3c]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x3c]
mov dword [ebp - 0x10], edx
je 0x1002c1aa
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002c189
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x558], 0x392f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002c178
mov eax, dword [ebp - 0x24]
xor ecx, ecx
add eax, dword [ebp - 0x10]
cmp eax, 0x5206
setle cl
imul ecx, dword [ebp - 0x558]
mov dword [ebp - 0x10], ecx
jmp 0x1002c208
mov dword [ebp - 0x30], 0xc5540fff
xor eax, eax
mov dword [ebp - 0x48], 0xfffffff9
mov dword [ebp - 0x10], 0xcadd635
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xb
jg 0x1002c20a
mov dword [ebp - 0x3c], 0xffffffec
jmp 0x1002c1f9
mov dword [ebp - 0x10], 0xfffffff6
jmp 0x1002c1f0
mov edx, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
inc edx
cmp eax, edx
setne cl
mov dword [ebp - 0x48], ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe6
jl 0x1002c1dc
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x16
jne 0x1002c1d3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xb
jle 0x1002c1ca
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x1c], 0x97a4a12b
mov dword [ebp - 0x30], ecx
push 2
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1002c23a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x7c4], 0xe2799ac7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002c222
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002c25a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7c4], 0xe8b72fd4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002c242
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffa
jmp 0x1002c28b
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002c27c
push eax
push eax
push 0x1989
call esi
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov eax, dword [ebp - 0x7c0]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x1c]
push 0
pop eax
cmp dword [ebp - 0x1c], 7
je 0x1002c263
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002c2b5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a0], 0xc64a6847
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002c29c
xor eax, eax
mov dword [ebp - 0x24], 0x2961
push 3
pop ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], 0xde9a
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002c2e9
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x588], 0xf1860ec0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002c2d1
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002c2ff
push 0x1279
call dword [sym.imp.GDI32.dll_GetStockObject]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002c343
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x588]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x584]
setne dl
sub eax, 0xfffffff6
neg eax
sbb eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x24]
add ecx, edx
xor edx, edx
cmp ecx, eax
setl dl
add edx, 0x38390e03
cmp edx, dword [ebp - 0x30]
jne 0x1002c349
mov eax, dword [ebp - 0x588]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002c356
mov eax, dword [ebp - 0x588]
mov eax, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x588], 0xfffffff8
push 4
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x1002c388
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x160], 0xfffffffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002c370
xor eax, eax
mov dword [ebp - 0x50], 0xfffffff9
or ecx, 0xffffffff
mov dword [ebp - 0x3c], 0xba028ea3
mov dword [ebp - 0x14], 0x3e45bbbd
mov dword [ebp - 0x40], 0x6b719d87
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], 0x268dd2ac
mov dword [ebp - 0x28], 0xbecc33ba
mov dword [ebp - 0x28], 0x6660b256
mov dword [ebp - 0x28], 0xc8c6dcff
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 0x9fa1
mov dword [ebp - 0x28], 0xd978029
mov dword [ebp - 0x28], 0xd700d1a0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], eax
jmp 0x1002c3f7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x108c], 0x7f20bab1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002c3e6
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x14]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
xor eax, eax
inc dword [ebp - 0x38]
mov dword [ebp - 0x154], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
cmp dword [ebp - 0x154], eax
jl 0x1002c91e
mov dword [ebp - 0x44], 0x27b1aa43
mov dword [ebp - 0x30], 0xfffffffb
mov eax, dword [ebp - 0x154]
cmp dword [ebp + eax*4 - 0x1a0], 0
je 0x1002c4b1
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp + eax*4 - 0x1a0]
cmp eax, dword [ebp - 0x194]
jl 0x1002c767
push 4
mov dword [ebp - 0x1c], 0xfffffff9
xor eax, eax
pop edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jge 0x1002c505
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf28], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002c4f1
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jge 0x1002c525
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf28], 0xfe7d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1002c50d
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002c53c
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
xor eax, eax
xor edx, edx
inc edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x10], 0xfffffffa
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1002c56a
or ecx, 0xffffffff
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xc00], ecx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jl 0x1002c555
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x1002c58c
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xca4], 0xfffffffc
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 3
jl 0x1002c573
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002c5a7
push 0x1ddd
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
xor eax, eax
inc edx
cmp dword [ebp - 0x20], eax
je 0x1002c5fc
cmp dword [ebp - 0x10], eax
jne 0x1002c5d6
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
sub eax, 7
jne 0x1002c5d6
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x10]
je 0x1002c5ec
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x1002c5f1
xor ecx, ecx
xor eax, eax
inc ecx
cmp eax, dword [ebp - 0x10]
jl 0x1002c5fa
mov eax, ecx
jmp 0x1002c5fc
xor eax, eax
mov dword [ebp - 0xbfc], eax
mov dword [ebp - 0xca0], eax
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002c620
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa9c], 0xb1ad
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002c60f
mov eax, dword [ebp - 0x19c]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov eax, dword [ebp - 0x154]
cmp ecx, 0x13b2
setne dl
mov dword [ebp + eax*4 - 0x1a0], edx
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002c75b
mov dword [ebp - 0x50], 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1002c758
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x1c]
je 0x1002c683
xor eax, eax
cmp dword [ebp - 0x50], eax
jne 0x1002c683
mov edx, eax
jmp 0x1002c688
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1a0]
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x154]
mov eax, dword [ebp - 0x154]
neg ecx
sbb ecx, ecx
inc ecx
mov eax, dword [ebp + eax*4 - 0x1a0]
imul eax, ecx
test eax, eax
je 0x1002c6c5
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov dword [ebp - 0x44], 0x1552b9cb
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
neg eax
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setle cl
cmp ecx, dword [ebp + eax*4 - 0x1a0]
jg 0x1002c70a
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x1002c70c
inc eax
jmp 0x1002c70c
xor eax, eax
xor ecx, ecx
cmp eax, 0x1d70
mov eax, dword [ebp - 0x160]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x154]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1a0]
add edx, eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1a0]
cmp eax, edx
setle cl
mov dword [ebp - 0xa98], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1002c667
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x1f
jne 0x1002c653
jmp 0x1002c787
xor eax, eax
cmp dword [ebp - 0x194], eax
jne 0x1002c91c
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002c789
push 0x339
push eax
push eax
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x40], 0xcc099843
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xa
jne 0x1002c8d4
jmp 0x1002c7ab
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], 0xbedfa90e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002c7d4
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x3b0], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002c7c1
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x3ac]
cmp eax, ecx
mov eax, dword [ebp - 0x3b0]
setne dl
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 0x13
cmp dword [ebp - 0x10], 0xfffffff6
jl 0x1002c8c7
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x24], 0x905b8b78
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jg 0x1002c8a5
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x3b0]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x10]
jge 0x1002c882
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x3b0]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3b0], ecx
test ecx, ecx
jne 0x1002c877
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002c861
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x24], 0xfff7
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jle 0x1002c877
xor eax, eax
jmp 0x1002c879
mov eax, edx
cmp eax, dword [ebp - 0x24]
jg 0x1002c882
mov eax, edx
jmp 0x1002c884
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x24], eax
jne 0x1002c8a3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1002c81e
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002c8ba
push edx
call dword [sym.imp.USER32.dll_ShowCursor]
xor edx, edx
xor eax, eax
inc edx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff6
jge 0x1002c80b
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xa
je 0x1002c7a9
mov eax, dword [ebp - 0x154]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp - 0x44]
test eax, eax
setns cl
mov dword [ebp - 0x1a0], ecx
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x154]
jns 0x1002c469
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_DestroyCursor]
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002c932
push eax
call edi
xor eax, eax
mov dword [ebp - 0x10], 0xa420452a
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002c95c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x178], 0xc64a6847
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002c944
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002c97c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x190], 0xfffffffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002c964
xor eax, eax
push 3
pop esi
mov dword [ebp - 0x184], esi
cmp dword [ebp - 0x184], eax
jl 0x1002cbcd
mov dword [ebp - 0x44], 0x27b1aa43
mov dword [ebp - 0x30], 0xfffffffb
mov eax, dword [ebp - 0x184]
cmp dword [ebp + eax*4 - 0x178], 0
je 0x1002c9d9
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp + eax*4 - 0x178]
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp + eax*4 - 0x178]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp + eax*4 - 0x178]
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp + eax*4 - 0x178]
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp + eax*4 - 0x178]
cmp eax, dword [ebp - 0x16c]
jl 0x1002cb67
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x20], eax
jmp 0x1002ca1e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb74], 0xb1ad
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002ca0d
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
sub eax, dword [ebp - 0x174]
cmp eax, 0x13b2
mov eax, dword [ebp - 0x184]
setne cl
mov dword [ebp + eax*4 - 0x178], ecx
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002cb5b
mov dword [ebp - 0x50], 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1002cb58
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x1c]
je 0x1002ca80
xor eax, eax
cmp dword [ebp - 0x50], eax
jne 0x1002ca80
xor esi, esi
mov edx, eax
inc esi
jmp 0x1002ca85
xor esi, esi
inc esi
mov edx, esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x178]
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x184]
neg ecx
sbb ecx, ecx
inc ecx
mov eax, dword [ebp + eax*4 - 0x178]
imul eax, ecx
test eax, eax
je 0x1002cac2
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp + eax*4 - 0x178]
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp + eax*4 - 0x178]
mov dword [ebp - 0x44], 0x1552b9cb
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + eax*4 - 0x178]
mov eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
neg eax
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setle cl
cmp ecx, dword [ebp + eax*4 - 0x178]
jg 0x1002cb08
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x1002cb0a
mov eax, esi
jmp 0x1002cb0a
xor eax, eax
xor ecx, ecx
cmp eax, 0x1d70
mov eax, dword [ebp - 0x190]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x184]
push 3
setl dl
xor ecx, ecx
pop esi
mov eax, dword [ebp + eax*4 - 0x178]
add edx, eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x178]
cmp eax, edx
setle cl
mov dword [ebp - 0xb70], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002ca61
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1f
jne 0x1002ca4e
jmp 0x1002cb83
xor eax, eax
cmp dword [ebp - 0x16c], eax
jne 0x1002cbcb
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002cb83
push 0x339
push eax
push eax
push eax
call ebx
mov eax, dword [ebp - 0x184]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x178]
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp + eax*4 - 0x178]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp - 0x44]
test eax, eax
setns cl
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x184]
jns 0x1002c991
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002cbdb
push eax
call edi
xor eax, eax
mov dword [ebp - 0x10], 0xa420452a
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002cc05
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1c0], 0xc64a6847
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002cbed
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002cc25
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1e0], 0xfffffffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002cc0d
xor eax, eax
mov dword [ebp - 0x1d4], esi
cmp dword [ebp - 0x1d4], eax
jl 0x1002ce73
mov dword [ebp - 0x44], 0x27b1aa43
mov dword [ebp - 0x30], 0xfffffffb
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp + eax*4 - 0x1c0], 0
je 0x1002cc7f
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp + eax*4 - 0x1c0]
cmp eax, dword [ebp - 0x1b4]
jl 0x1002ce0d
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x20], eax
jmp 0x1002ccc4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xaac], 0xb1ad
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002ccb3
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
sub eax, dword [ebp - 0x1bc]
cmp eax, 0x13b2
mov eax, dword [ebp - 0x1d4]
setne cl
mov dword [ebp + eax*4 - 0x1c0], ecx
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002ce01
mov dword [ebp - 0x50], 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1002cdfe
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x1c]
je 0x1002cd26
xor eax, eax
cmp dword [ebp - 0x50], eax
jne 0x1002cd26
xor esi, esi
mov edx, eax
inc esi
jmp 0x1002cd2b
xor esi, esi
inc esi
mov edx, esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1c0]
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x1d4]
neg ecx
sbb ecx, ecx
inc ecx
mov eax, dword [ebp + eax*4 - 0x1c0]
imul eax, ecx
test eax, eax
je 0x1002cd68
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp + eax*4 - 0x1c0]
mov dword [ebp - 0x44], 0x1552b9cb
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
neg eax
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setle cl
cmp ecx, dword [ebp + eax*4 - 0x1c0]
jg 0x1002cdae
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x1002cdb0
mov eax, esi
jmp 0x1002cdb0
xor eax, eax
xor ecx, ecx
cmp eax, 0x1d70
mov eax, dword [ebp - 0x1e0]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1d4]
push 3
setl dl
xor ecx, ecx
pop esi
mov eax, dword [ebp + eax*4 - 0x1c0]
add edx, eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1c0]
cmp eax, edx
setle cl
mov dword [ebp - 0xaa8], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002cd07
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1f
jne 0x1002ccf4
jmp 0x1002ce29
xor eax, eax
cmp dword [ebp - 0x1b4], eax
jne 0x1002ce71
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002ce29
push 0x339
push eax
push eax
push eax
call ebx
mov eax, dword [ebp - 0x1d4]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x44]
test eax, eax
setns cl
mov dword [ebp - 0x1c0], ecx
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x1d4]
jns 0x1002cc37
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002ce81
push eax
call edi
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002cea1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x644], 0x540d7f82
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002ce89
xor eax, eax
mov esi, dword [sym.imp.GDI32.dll_Polygon]
mov dword [ebp - 0x63c], 0x19
jmp 0x1002ceda
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002ced4
push 0xfd3
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
xor eax, eax
dec dword [ebp - 0x63c]
cmp dword [ebp - 0x63c], 0x14
jne 0x1002ceb3
mov dword [ebp - 0x1c], 0x97a4a12b
or ecx, 0xffffffff
mov dword [ebp - 0x30], ecx
push 2
mov dword [ebp - 0x20], eax
pop ebx
cmp dword [ebp - 0x20], ebx
jge 0x1002cf13
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x834], 0xe2799ac7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002cefb
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002cf33
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x834], 0xe8b72fd4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002cf1b
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffa
jmp 0x1002cf68
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002cf59
push eax
push eax
push 0x1989
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x1c]
push 0
pop eax
cmp dword [ebp - 0x1c], 7
je 0x1002cf3c
mov dword [ebp - 0x24], 0x2961
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], 0xde9a
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002cfa4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x598], 0xf1860ec0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002cf8c
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002cfba
push 0x1279
call dword [sym.imp.GDI32.dll_GetStockObject]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002cffe
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x598]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x594]
setne dl
sub eax, 0xfffffff6
neg eax
sbb eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x24]
add ecx, edx
xor edx, edx
cmp ecx, eax
setl dl
add edx, 0x38390e03
cmp edx, dword [ebp - 0x30]
jne 0x1002d004
mov eax, dword [ebp - 0x598]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002d011
mov eax, dword [ebp - 0x598]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x598], 0xfffffff8
or eax, 0xffffffff
mov dword [ebp - 0x50], 0xfffffff9
mov dword [ebp - 0x3c], 0xba028ea3
mov dword [ebp - 0x14], 0x3e45bbbd
mov dword [ebp - 0x40], 0x6b719d87
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0x268dd2ac
mov dword [ebp - 0x28], 0xbecc33ba
mov dword [ebp - 0x28], 0x6660b256
mov dword [ebp - 0x28], 0xc8c6dcff
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x28], 0x9fa1
mov dword [ebp - 0x28], 0xd978029
mov dword [ebp - 0x28], 0xd700d1a0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], eax
jmp 0x1002d08f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x10ac], 0x7f20bab1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002d07e
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
push 4
setg dl
imul edx, dword [ebp - 0x14]
pop ecx
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
xor eax, eax
inc dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x40], 0xcc099843
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xa
jne 0x1002d230
or esi, 0xffffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], 0xbedfa90e
mov dword [ebp - 0x20], eax
jmp 0x1002d126
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x38c], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002d119
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x388]
cmp eax, ecx
mov eax, dword [ebp - 0x38c]
setne dl
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 0x13
cmp dword [ebp - 0x10], 0xfffffff6
jl 0x1002d217
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x24], 0x905b8b78
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jg 0x1002d1f5
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x38c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x10]
jge 0x1002d1d6
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x38c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x38c], ecx
test ecx, ecx
jne 0x1002d1cb
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002d1b5
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x24], 0xfff7
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jle 0x1002d1cb
xor eax, eax
jmp 0x1002d1cd
mov eax, edx
cmp eax, dword [ebp - 0x24]
jg 0x1002d1d6
mov eax, edx
jmp 0x1002d1d8
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x24], eax
jne 0x1002d1f3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1002d175
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002d20a
push edx
call dword [sym.imp.USER32.dll_ShowCursor]
xor edx, edx
xor eax, eax
inc edx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff6
jge 0x1002d162
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xa
push 0
pop eax
je 0x1002d10a
mov esi, dword [sym.imp.GDI32.dll_Polygon]
push 4
pop ecx
mov dword [ebp - 0x24], 0xa420452a
xor ebx, ebx
mov dword [ebp - 0x10], ecx
inc ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1002d259
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf98], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002d245
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1002d279
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf98], 0xfe7d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002d261
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002d298
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], 0xfffffffa
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002d2c3
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbf0], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002d2ae
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002d2e5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xddc], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002d2cc
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002d2fd
push 0x1ddd
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002d350
cmp dword [ebp - 0x10], eax
jne 0x1002d32e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
sub eax, 7
jne 0x1002d32e
mov edx, eax
jmp 0x1002d330
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x10]
je 0x1002d343
mov eax, ebx
jmp 0x1002d345
xor eax, eax
cmp eax, dword [ebp - 0x10]
jl 0x1002d34e
mov eax, ebx
jmp 0x1002d350
xor eax, eax
mov dword [ebp - 0xbec], eax
mov dword [ebp - 0xdd8], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002d380
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x200], 0xc64a6847
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002d367
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], 0x65e790e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], 0x451f1e28
mov dword [ebp - 0x50], 0xf196
mov dword [ebp - 0x30], 0x3a7ef23e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002d3c4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x5a0], 0x9fe57f6c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1002d3ab
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002d3da
push 0x1ddd
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
inc dword [ebp - 0x50]
xor ecx, ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x59c]
cmp eax, 0x4e58
setl cl
xor ebx, ebx
cmp ecx, 0xd7c3b7c3
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
setne bl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x40]
setge cl
add eax, ebx
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x30]
add edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x5a0]
mov eax, dword [ebp - 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
jne 0x1002d45d
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002d45d
xor ebx, ebx
inc ebx
jmp 0x1002d462
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x59c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002d48c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1b0], 0xfffffffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002d473
xor eax, eax
mov dword [ebp - 0x28], 0xfffffffb
or ecx, 0xffffffff
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x48], 0xad95e17c
mov dword [ebp - 0x28], 0xf390197f
mov dword [ebp - 0x10], 0xd8530de9
push 6
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], eax
pop edx
jmp 0x1002d4c6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb50], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002d4b9
inc dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x14
jg 0x1002d501
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002d4f5
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x14
jle 0x1002d4d7
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x1a4], 3
cmp dword [ebp - 0x1a4], eax
jl 0x1002e885
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 2
pop esi
jmp 0x1002d527
or ecx, 0xffffffff
mov dword [ebp - 0x10], 0xd06c
mov dword [ebp - 0x28], 0x9aa810d2
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x44], 0xee327439
mov dword [ebp - 0x40], 0xfc1da7bc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1002d56c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x112c], 0xdb856137
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002d553
cmp dword [ebp - 0x10], eax
je 0x1002d58b
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x10], eax
jmp 0x1002d583
mov dword [ebp - 0x30], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x2a
jge 0x1002d579
jmp 0x1002d5b1
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002d5ae
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf08], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002d59a
xor eax, eax
inc dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
jmp 0x1002d60f
mov dword [ebp - 0x20], eax
jmp 0x1002d5c9
cmp byte [ebp - 0x31], 0
je 0x1002d5c6
push eax
call edi
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
mov byte [ebp - 0x31], al
jle 0x1002d5bb
cmp byte [ebp - 0x31], 0
je 0x1002d60c
push 0x16da
push 0x714
push 0x5df
push 0x1d5
push 0x215e
push 0xfc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
xor eax, eax
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xfffffff7
jl 0x1002d5b6
mov dword [ebp - 0x14], 0x27b1aa43
or ecx, 0xffffffff
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x4dc], ecx
mov dword [ebp - 0x4d8], ecx
mov dword [ebp - 0x4d4], ecx
mov dword [ebp - 0x4d0], ecx
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x28], 0x1ad67a4b
mov dword [ebp - 0x28], 0xe64e6dc6
mov dword [ebp - 0x40], 0x308f4727
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002d67a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xabc], 0xcacff8ee
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002d662
xor eax, eax
mov dword [ebp - 0x4dc], eax
jmp 0x1002d7c7
mov dword [ebp - 0x20], 0xa35f394
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x4c], 0x2189f42c
mov dword [ebp - 0x44], 0xfffffffd
mov dword [ebp - 0x30], 0xbed85728
mov dword [ebp - 0x48], 0x2095d7c1
mov dword [ebp - 0x20], 0x1c
cmp dword [ebp - 0x20], 0xffffffec
jge 0x1002d799
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x38], 0xf5ef889a
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x54], 0xfffe
cmp dword [ebp - 0x30], eax
je 0x1002d71b
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0xab8]
sub ecx, 0xfffffff6
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x50]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 7
setle al
add eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x40]
jg 0x1002d719
mov eax, ebx
jmp 0x1002d71b
xor eax, eax
dec dword [ebp - 0x44]
add eax, 0xd49a
xor ecx, ecx
imul eax, eax, 0x85bb
cmp eax, 0x6a1241a5
setg cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x50]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x44]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x54], ecx
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002d789
push 0x94c
push 0x53e
push 0x33a
push 0x3f9
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffec
push 0
pop eax
jl 0x1002d6bc
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002d7c1
push eax
push 0xe15
push 0x748
push eax
push 0x1dfe
push 0x5f5
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor eax, eax
inc dword [ebp - 0x4dc]
cmp dword [ebp - 0x4dc], 0x16
jne 0x1002d685
mov dword [ebp - 0x20], 0x8470ed99
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0x2a19820b
mov dword [ebp - 0x40], 0xfffffff8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002d80c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x220], 0xfffffffa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002d7f4
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002d822
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb88], 0x885b3d92
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002d811
mov eax, dword [ebp - 0x21c]
xor edx, edx
mov eax, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x220]
mov eax, dword [ebp - 0x21c]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x136dc992
setne al
xor ecx, ecx
cmp eax, 0x4365dea3
setl cl
xor eax, eax
test ecx, ecx
setns al
cmp eax, ebx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xd4aa41a8
setne cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x21c]
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x220]
mov eax, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002d8c2
mov ecx, ebx
cmp dword [ebp - 0x20], eax
jne 0x1002d8c4
mov ecx, eax
xor eax, eax
cmp ecx, 0xbf2b
setg al
neg eax
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp + eax*4 - 0x200], 0
je 0x1002d911
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp + eax*4 - 0x200]
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp + eax*4 - 0x200]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp + eax*4 - 0x200]
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp + eax*4 - 0x200]
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp + eax*4 - 0x200]
cmp eax, dword [ebp - 0x1f4]
jl 0x1002e1bc
mov dword [ebp - 0x24], 0xd06c
xor eax, eax
mov dword [ebp - 0x28], 0x9aa810d2
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x44], 0xee327439
mov dword [ebp - 0x40], 0xfc1da7bc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1002d97e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x10cc], 0xdb856137
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002d965
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002d9a0
or ecx, 0xffffffff
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], eax
jmp 0x1002d998
mov dword [ebp - 0x30], 0xfffffffb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x2a
jge 0x1002d98e
jmp 0x1002d9c9
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002d9c6
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe80], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002d9b2
xor eax, eax
inc dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
jmp 0x1002da27
mov dword [ebp - 0x20], eax
jmp 0x1002d9e1
cmp byte [ebp - 0x31], 0
je 0x1002d9de
push eax
call edi
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
mov byte [ebp - 0x31], al
jle 0x1002d9d3
cmp byte [ebp - 0x31], 0
je 0x1002da24
push 0x16da
push 0x714
push 0x5df
push 0x1d5
push 0x215e
push 0xfc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
xor eax, eax
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xfffffff7
jl 0x1002d9ce
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], 0xfffffffa
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], esi
jge 0x1002da5d
or ecx, 0xffffffff
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xacc], ecx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jl 0x1002da49
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x1002da7f
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xdd0], 0xfffffffc
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 3
jl 0x1002da66
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002da97
push 0x1ddd
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002daea
cmp dword [ebp - 0x10], eax
jne 0x1002dac8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
sub eax, 7
jne 0x1002dac8
mov edx, eax
jmp 0x1002daca
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x10]
je 0x1002dadd
mov eax, ebx
jmp 0x1002dadf
xor eax, eax
cmp eax, dword [ebp - 0x10]
jl 0x1002dae8
mov eax, ebx
jmp 0x1002daea
xor eax, eax
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xdcc], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1002db18
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb9c], 0xb1ad
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002db00
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffff9
or ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x40], 0xd6f1860e
mov dword [ebp - 0x30], 0x3cbfb41c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002db4f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x370], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002db3b
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002db69
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002db67
cmp dword [ebp - 0x40], eax
jne 0x1002db67
mov eax, ebx
jmp 0x1002db69
xor eax, eax
mov dword [ebp - 0x3c], esi
xor ecx, ecx
mov edx, dword [ebp - 0x10]
imul edx, eax
mov eax, dword [ebp - 0x3c]
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jg 0x1002dc4b
or edi, 0xffffffff
jmp 0x1002db94
xor eax, eax
mov dword [ebp - 0x44], 0xfff9
mov dword [ebp - 0x38], 0x4dde9ab5
mov dword [ebp - 0x20], eax
jmp 0x1002dbb8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xbdc], 0x7826243a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002dba7
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x44]
cmp eax, 0xa9e
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
setg cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x370]
cmp ecx, ebx
sbb edx, edx
xor ecx, ecx
neg edx
mov dword [ebp - 0xbd8], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
mov eax, dword [ebp - 0x38]
setne cl
xor edx, edx
cmp eax, ecx
setl dl
xor eax, eax
neg edx
cmp edx, edi
setg al
xor ecx, ecx
cmp eax, 0xd660
mov eax, dword [ebp - 0x44]
setg cl
xor edx, edx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x370]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x30]
inc dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jle 0x1002db92
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x1fc]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov eax, dword [ebp - 0x1a4]
cmp ecx, 0x13b2
setne dl
mov dword [ebp + eax*4 - 0x200], edx
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0xffffffe9
jmp 0x1002dcac
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x16
jmp 0x1002dca3
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002dca0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff6
jle 0x1002dc88
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x11
jle 0x1002dc7c
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1f
je 0x1002e729
or edi, 0xffffffff
mov dword [ebp - 0x1c], 0x75b57fd5
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1002dce6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x64], 0xdf29855e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1002dcd1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x10
jge 0x1002dedf
xor eax, eax
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x10]
cmp eax, 0x8dc2
jge 0x1002e1ff
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002e230
push 0xdd9
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x1002e22e
mov dword [ebp - 0x40], ebx
xor eax, eax
mov dword [ebp - 0x30], 0xfffffffd
cmp dword [ebp - 0x40], eax
jne 0x1002e22b
cmp dword [ebp - 0x50], eax
je 0x1002e22b
mov eax, dword [ebp - 0x10]
neg eax
jne 0x1002e21f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], ebx
xor eax, eax
cmp dword [ebp - 0x1f4], eax
jne 0x1002e877
mov dword [ebp - 0x20], 0xa32b1cec
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002e265
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x110c], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002e24c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002e287
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xea0], 9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002e26e
xor eax, eax
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], eax
jl 0x1002e2bc
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002e2a4
call dword [sym.imp.USER32.dll_GetMessageTime]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002e2b7
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommState]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002e293
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], 0x825e
cmp dword [ebp - 0x10], eax
je 0x1002e307
mov dword [ebp - 0x30], 0x13dc
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002e443
push eax
push 0xa34
push 0x11f0
call dword [sym.imp.GDI32.dll_CreatePen]
jmp 0x1002e443
mov dword [ebp - 0x30], 0xa9cea445
mov dword [ebp - 0x10], 0xc
jmp 0x1002e429
mov dword [ebp - 0x1c], 0x17059141
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002e341
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2ec], 0x272a7275
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002e329
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002e361
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x58c], 0xa0f0f5eb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002e349
xor eax, eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 4
jne 0x1002e3ca
mov ecx, 0x4e677b56
mov dword [ebp - 0x928], ecx
mov dword [ebp - 0x924], ecx
mov dword [ebp - 0x920], ecx
mov dword [ebp - 0x91c], ecx
cmp dword [ebp - 0x924], eax
jne 0x1002e3ca
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002e3bb
push 0x2369
push eax
push 0x1f83
push 0xbd0
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
xor eax, eax
mov ecx, 0x4e677b56
inc dword [ebp - 0x2ec]
cmp dword [ebp - 0x2ec], 4
je 0x1002e375
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe3
jne 0x1002e426
mov dword [ebp - 0x40], 0xca6c
xor edx, edx
mov dword [ebp - 0x38], 0x93c86992
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2ec], eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, ebx
push 0
setg cl
sub eax, ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe3
pop eax
je 0x1002e3d3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xe
jle 0x1002e31a
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1002e445
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
xor eax, eax
mov byte [ebp - 0x15], al
mov dword [ebp - 0x2c], 0x17f7
push 0xfffffffffffffff6
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x10], 0xed40a165
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x50], 0x5d580090
mov dword [ebp - 0x28], 0x9e1d6210
mov dword [ebp - 0x54], 0x74c89aed
mov dword [ebp - 0x40], 0x12cb5dc
mov dword [ebp - 0x20], eax
jmp 0x1002e491
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x180], 0x7e815f84
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002e480
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002e4a5
mov eax, ebx
cmp eax, 0xc9cd49fc
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setne dl
mov dword [ebp - 0x10], edx
xor edx, edx
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x17c], eax
mov ecx, dword [ebp - 0x2c]
imul ecx, eax
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setne dl
imul edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
jl 0x1002e713
mov dword [ebp - 0x1c], 0x1361131e
or ecx, 0xffffffff
mov dword [ebp - 0x38], 0x7f5175d1
mov dword [ebp - 0x28], 0xe78de611
mov dword [ebp - 0x28], 0xb28543b5
mov dword [ebp - 0x28], 0x674dcce6
mov dword [ebp - 0x28], 0x79b6842a
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], eax
jmp 0x1002e559
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xaec], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1002e54c
mov eax, dword [ebp - 0x3c]
xor edi, edi
cmp dword [ebp + eax*4 - 0x180], edi
jne 0x1002e5bd
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x180]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + eax*4 - 0x180]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
add eax, 0x3bba
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x180], edi
jne 0x1002e5bd
xor eax, eax
mov edx, eax
jmp 0x1002e5bf
mov edx, ebx
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov esi, dword [ebp + eax*4 - 0x180]
mov eax, dword [ebp - 0x10]
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setl cl
xor edx, edx
cmp esi, ecx
sete dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x17c]
setge bl
xor ecx, ecx
cmp ebx, eax
setge cl
xor eax, eax
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x17c], eax
cmp eax, 0xfffb
je 0x1002e6d2
xor eax, eax
mov dword [ebp - 0x30], 0x21f5
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002e634
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8d4], 0xfc5c2da5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002e61b
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x1002e696
inc dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + eax*4 - 0x180]
mov eax, dword [ebp - 0x54]
cmp ecx, eax
mov eax, dword [ebp - 0x8cc]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x8cc]
setne cl
add ecx, 2
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
test eax, eax
jne 0x1002e67f
cmp dword [ebp - 0x1c], eax
jne 0x1002e67f
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x38]
test eax, eax
jne 0x1002e699
xor ebx, ebx
inc ebx
mov edx, ebx
mov eax, dword [ebp - 0x8d0]
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + eax*4 - 0x180]
mov eax, dword [ebp - 0x54]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, 0x3394210a
setg al
mov dword [ebp - 0xaec], eax
jmp 0x1002e6fe
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1002e6fb
push eax
push 0x2263
push 0x12ed
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
xor ebx, ebx
inc ebx
dec dword [ebp - 0x3c]
push 0
pop eax
push 2
pop esi
jns 0x1002e517
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp byte [ebp - 0x15], 0
je 0x1002e727
push 0x339
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
mov dword [ebp - 0x20], 0x8470ed99
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0x2a19820b
mov dword [ebp - 0x40], 0xfffffff8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002e761
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x214], 0xfffffffa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002e749
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002e777
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbe8], 0x885b3d92
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002e766
mov eax, dword [ebp - 0x210]
xor edx, edx
mov eax, dword [ebp - 0x210]
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x214]
mov eax, dword [ebp - 0x210]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x136dc992
setne al
xor ecx, ecx
cmp eax, 0x4365dea3
setl cl
xor eax, eax
test ecx, ecx
setns al
cmp eax, ebx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xd4aa41a8
setne cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x210]
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x214]
mov eax, dword [ebp - 0x210]
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002e817
mov ecx, ebx
cmp dword [ebp - 0x20], eax
jne 0x1002e819
mov ecx, eax
xor eax, eax
cmp ecx, 0xbf2b
push 0
setg al
xor ecx, ecx
neg eax
mov dword [ebp - 0xbe8], eax
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp + eax*4 - 0x200]
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp + eax*4 - 0x200]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x14]
test eax, eax
setns cl
mov dword [ebp - 0x200], ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x1a4]
pop eax
jns 0x1002d524
mov esi, dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_DestroyCursor]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002e8a8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3d8], 0x2799ac78
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002e890
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x1002e928
jmp 0x1002e8b4
xor eax, eax
mov dword [ebp - 0x54], 0x62c9cc14
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002e8e3
push eax
push 0x561
push 0x1e22
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x10]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x10]
jle 0x1002e905
mov edx, ebx
cmp dword [ebp - 0x54], eax
jne 0x1002e907
mov edx, eax
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x10]
setne cl
sub ecx, 7
mov dword [ebp + eax*4 - 0x3d8], ecx
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x1002e8b2
mov eax, dword [ebp - 0x3d8]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002e95b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xec], 0x3ae35568
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002e943
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002e97a
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x98], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002e966
xor eax, eax
mov dword [ebp - 0xec], 0x12
mov ecx, 0x8b3d385e
cmp dword [ebp - 0xec], 0xffffffe3
mov edx, 0xffff
mov dword [ebp - 0x48], 0xd
jne 0x1002ec0d
mov esi, edx
mov dword [ebp - 0x10], 0x11738ab6
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x6b4], ecx
mov dword [ebp - 0x6b0], ecx
mov dword [ebp - 0x6ac], ecx
mov dword [ebp - 0x6a8], ecx
mov dword [ebp - 0x4c], 9
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002e9f8
push 0x2003
push 0x23c2
push eax
push eax
push 0x4c5
push 0xc12
call dword [sym.imp.USER32.dll_ToUnicode]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002ebe1
mov dword [ebp - 0x2c], 0xd0d3f7bf
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x1002eb1e
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x3c], 0xac89d73a
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x98], 0
je 0x1002ea55
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x98]
cmp dword [ebp - 0x3c], eax
je 0x1002ea4d
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002ea4f
mov eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x98]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x24]
cmp esi, eax
mov eax, dword [ebp - 0x2c]
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 0x2c]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x6ac], ecx
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x3c], 0xfffffff7
cmp dword [ebp - 0x3c], ecx
jle 0x1002eb10
xor eax, eax
cmp dword [ebp - 0xec], eax
jne 0x1002eb10
mov dword [ebp - 0x1c], 0xb
jmp 0x1002eb02
mov dword [ebp - 0x24], ecx
jmp 0x1002eaf9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002eaec
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe78], 0x45d4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002ead3
xor eax, eax
mov dword [ebp - 0xe6c], 0x133ecb40
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffa
jl 0x1002eaca
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff5
jg 0x1002eac5
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ecx
jg 0x1002eab4
inc dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jle 0x1002ea1a
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1002ebde
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], eax
jmp 0x1002eb46
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6f0], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002eb39
dec dword [ebp - 0x6f0]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x98]
cmp eax, dword [ebp - 0x6f0]
jg 0x1002ebad
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002eb75
mov ecx, eax
cmp dword [ebp - 0x6ac], eax
je 0x1002eb77
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x4c]
sub ecx, eax
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x6f0]
setg dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x1002ebaf
mov eax, ebx
jmp 0x1002ebaf
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x6b0]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
push 0
mov ecx, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x98], ecx
dec dword [ebp - 0x2c]
pop eax
jns 0x1002eb2a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x1002ea00
dec dword [ebp - 0xec]
mov ecx, 0x8b3d385e
cmp dword [ebp - 0xec], 0xffffffe3
je 0x1002e9a4
mov esi, dword [sym.imp.GDI32.dll_Polygon]
mov edx, 0xffff
mov byte [ebp - 0x31], al
mov eax, 0x49968cb6
mov dword [ebp - 0x24], 0x27f7b6fe
mov dword [ebp - 0x30], 0x80643b8a
mov dword [ebp - 0xa28], eax
mov dword [ebp - 0xa24], eax
mov dword [ebp - 0xa20], eax
mov dword [ebp - 0xa1c], eax
xor eax, eax
mov dword [ebp - 0x40], 0x6a0b5978
mov dword [ebp - 0x30], eax
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sbb edx, edx
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
inc edx
sub edx, eax
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x1cfd
setg cl
xor edx, edx
add ecx, 0x1bbebd47
cmp ecx, eax
setge dl
xor eax, eax
add edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x24]
cmp edx, 0xc0f8
setg al
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0xbd00
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x29478c9d
setle al
mov dword [ebp - 0xa28], eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1002ecd7
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
xor eax, eax
cmp byte [ebp - 0x31], 0
je 0x1002ed5c
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002ed06
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa48], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002eced
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x24], eax
inc ecx
cmp dword [ebp - 0x24], ecx
jg 0x1002ed59
xor esi, esi
inc esi
mov dword [ebp - 0x14], 0x358bd4df
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa48]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setge dl
mov dword [ebp - 0x40], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1002ed14
mov esi, dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
push eax
call edi
mov edi, 0x110c93b4
xor eax, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x54], 0xe815
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x17
jle 0x1002ede4
mov esi, 0x87a7525d
mov dword [ebp - 0x38], 0xfffffffd
xor edx, edx
mov dword [ebp - 0x40], 0x672ca3c0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp eax, 0xb2bc
mov eax, dword [ebp - 0x40]
push 0
setge cl
add edx, ecx
xor ecx, ecx
cmp eax, edx
setne cl
cmp esi, ecx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 1
pop eax
setg cl
add ecx, dword [ebp - 0x38]
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x17
jg 0x1002ed82
mov esi, dword [sym.imp.GDI32.dll_Polygon]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002ee31
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x618], 0x540d7f82
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002ee18
xor eax, eax
mov dword [ebp - 0x610], 0x19
jmp 0x1002ee60
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002ee5a
push 0xfd3
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
xor eax, eax
dec dword [ebp - 0x610]
cmp dword [ebp - 0x610], 0x14
jne 0x1002ee3d
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002ee8b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5ac], 0x540d7f82
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002ee72
xor eax, eax
mov dword [ebp - 0x5a4], 0x19
jmp 0x1002eeba
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002eeb4
push 0xfd3
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
xor eax, eax
dec dword [ebp - 0x5a4]
cmp dword [ebp - 0x5a4], 0x14
jne 0x1002ee97
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], 0xd65f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002eef0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5b0], 0xd3df75dc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002eed8
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002ef12
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xeb8], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002eef9
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x1002ef87
or esi, 0xffffffff
mov dword [ebp - 0x28], 0x11c1
mov dword [ebp - 0x28], 0x4ad72d76
push 9
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], 0x711e7bff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0xfffffffa
dec dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x5b0], 0
jne 0x1002ef75
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1002ef77
mov dword [ebp - 0x30], 0xffff
cmp dword [ebp - 0x30], eax
jne 0x1002ef77
dec dword [ebp - 0x14]
jns 0x1002ef62
jmp 0x1002ef77
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1002ef1d
mov esi, dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x54], 0xe815
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x17
jle 0x1002f008
mov esi, 0x87a7525d
mov dword [ebp - 0x38], 0xfffffffd
xor edx, edx
mov dword [ebp - 0x40], 0x672ca3c0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp eax, 0xb2bc
mov eax, dword [ebp - 0x40]
push 0
setge cl
add edx, ecx
xor ecx, ecx
cmp eax, edx
setne cl
cmp esi, ecx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 1
pop eax
setg cl
add ecx, dword [ebp - 0x38]
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x17
jg 0x1002efa6
mov esi, dword [sym.imp.GDI32.dll_Polygon]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setle cl
or eax, 0xffffffff
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov dword [ebp - 0x24], 0xfffffff8
inc ecx
mov dword [ebp - 0x28], 0x5d7249aa
mov dword [ebp - 0x40], 0x5720b963
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], 0x66d210ec
mov dword [ebp - 0x40], 0xd6525681
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x54], 0xd270c173
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], 0xffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002f093
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x12c], 0xd49598aa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f07b
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002f0a9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x334], 2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f098
dec dword [ebp - 0x54]
mov eax, dword [ebp - 0x334]
mov ecx, dword [ebp - 0x32c]
neg eax
sub ecx, eax
mov eax, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
inc ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ecx
mov eax, dword [ebp - 0x54]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], eax
je 0x1002f0f3
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x12c]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x12c]
imul ecx, eax, 0xf6d7
mov eax, dword [ebp - 0x32c]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x14]
jg 0x1002f1e3
push 3
pop ecx
mov dword [ebp - 0x30], ecx
xor eax, eax
mov dword [ebp - 0x14], 0x988ed9e8
cmp dword [ebp - 0x24], eax
je 0x1002f18b
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1002f171
push eax
push 0xd10
push eax
push eax
push 0x1f50
push 0x263b
push 0xa21
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov edx, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x14], ecx
jmp 0x1002f1d3
mov dword [ebp - 0x40], 0x104f36cc
mov dword [ebp - 0x10], eax
jmp 0x1002f1a8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x334], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002f197
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
cmp eax, 0x4f612466
mov eax, dword [ebp - 0x48]
setg cl
sub ecx, 0xc97d
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x334]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002f2cb
mov dword [ebp - 0x54], 0xe26160d4
xor eax, eax
mov dword [ebp - 0x40], 0x6105796d
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002f215
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x948], 0xfffffffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002f1fc
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002f22b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa50], 0x475996e2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002f21a
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002f267
cmp dword [ebp - 0x32c], eax
jne 0x1002f25b
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x93c]
mov eax, dword [ebp - 0x93c]
mov eax, dword [ebp - 0x944]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x93c]
mov eax, dword [ebp - 0x32c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xa4c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x40], 0xfff6
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x330]
test eax, eax
je 0x1002f2c4
or eax, 0xffffffff
cmp dword [ebp - 0x10], eax
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x54]
sub ecx, eax
mov eax, dword [ebp - 0x334]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
cmp eax, 0xfffb
jne 0x1002f2c4
xor eax, eax
inc eax
jmp 0x1002f2c6
xor eax, eax
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x10], edi
xor edi, edi
mov dword [ebp - 0x24], 0xfffffffe
inc edi
mov dword [ebp - 0x54], 0xe815
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x17
jle 0x1002f34e
mov esi, 0x87a7525d
mov dword [ebp - 0x38], 0xfffffffd
xor edx, edx
mov dword [ebp - 0x40], 0x672ca3c0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp eax, 0xb2bc
mov eax, dword [ebp - 0x40]
push 0
setge cl
add edx, ecx
xor ecx, ecx
cmp eax, edx
setne cl
cmp esi, ecx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edi
pop eax
setg cl
add ecx, dword [ebp - 0x38]
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x17
jg 0x1002f2ed
mov esi, dword [sym.imp.GDI32.dll_Polygon]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], 0xd65f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002f3a3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x510], 0xd3df75dc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002f38b
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002f3c6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xfc8], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f3ae
xor eax, eax
mov dword [ebp - 0x24], eax
or edx, 0xffffffff
cmp dword [ebp - 0x24], eax
jg 0x1002f435
mov dword [ebp - 0x28], 0x11c1
mov dword [ebp - 0x28], 0x4ad72d76
push 9
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x28], 0x711e7bff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0xfffffffa
dec dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x510], 0
jne 0x1002f429
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1002f42b
mov dword [ebp - 0x30], 0xffff
cmp dword [ebp - 0x30], eax
jne 0x1002f42b
dec dword [ebp - 0x14]
jns 0x1002f416
jmp 0x1002f42b
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1002f3d1
xor eax, eax
mov dword [ebp - 0x4bc], edx
mov dword [ebp - 0x4b8], edx
mov dword [ebp - 0x4b4], edx
mov dword [ebp - 0x4b0], edx
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x28], 0x1ad67a4b
mov dword [ebp - 0x28], 0xe64e6dc6
mov dword [ebp - 0x40], 0x308f4727
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002f489
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xafc], 0xcacff8ee
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002f471
xor eax, eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 0x16
je 0x1002f5ee
mov dword [ebp - 0x14], 0xa35f394
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x4c], 0x2189f42c
mov dword [ebp - 0x50], 0xfffffffd
mov dword [ebp - 0x30], 0xbed85728
mov dword [ebp - 0x48], 0x2095d7c1
mov dword [ebp - 0x14], 0x1c
cmp dword [ebp - 0x14], 0xffffffec
jge 0x1002f5b0
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x38], 0xf5ef889a
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0xfffe
cmp dword [ebp - 0x30], eax
je 0x1002f532
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0xaf8]
sub ecx, 0xfffffff6
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 7
setle al
add eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x40]
jg 0x1002f530
mov eax, edi
jmp 0x1002f532
xor eax, eax
dec dword [ebp - 0x50]
add eax, 0xd49a
xor ecx, ecx
imul eax, eax, 0x85bb
cmp eax, 0x6a1241a5
setg cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x54]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x50]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1002f5a0
push 0x94c
push 0x53e
push 0x33a
push 0x3f9
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffec
push 0
pop eax
jl 0x1002f4d3
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002f5d8
push eax
push 0xe15
push 0x748
push eax
push 0x1dfe
push 0x5f5
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor eax, eax
inc dword [ebp - 0x4bc]
cmp dword [ebp - 0x4bc], 0x16
jne 0x1002f49c
push 2
pop ecx
mov dword [ebp - 0x24], 9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002f615
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2e4], 0x5540d7f8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002f5fd
xor eax, eax
mov edi, dword [sym.imp.GDI32.dll_Arc]
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0xfffffff8
je 0x1002f678
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002f666
push 0x252d
push 0x4f
push 0x1c1e
push 0x1609
push 0x91
push 0x1418
push 0x181f
push 0x1eae
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
dec dword [ebp - 0x2e4]
cmp dword [ebp - 0x2e4], 0xfffffff8
jne 0x1002f62a
push 2
pop ecx
xor ebx, ebx
mov dword [ebp - 0x24], eax
inc ebx
cmp dword [ebp - 0x24], ecx
jge 0x1002f697
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2e4], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002f683
xor eax, eax
mov dword [ebp - 0x20], 0x38bea122
mov dword [ebp - 0x24], 0x80ae7b1b
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], 0x6de6b933
mov dword [ebp - 0x44], 0x6c65b0b5
mov dword [ebp - 0x54], 0xe7bf5cbf
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x40], 0xadcfec76
mov dword [ebp - 0x14], eax
jmp 0x1002f6dd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x470], 0xf6872920
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002f6cc
mov eax, dword [ebp - 0x20]
xor edx, edx
inc dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x46c]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, ebx
setl al
xor ecx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add eax, 0x33ba
cmp eax, 0x2157
setl cl
xor eax, eax
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x470], eax
jg 0x1002f72f
cmp dword [ebp - 0x20], eax
je 0x1002f731
mov eax, ebx
mov ecx, dword [ebp - 0x24]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setl dl
xor eax, eax
cmp edx, 7
setg al
xor ecx, ecx
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0xffff0005
mov eax, dword [ebp - 0x10]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ebx, ebx
cmp edx, eax
setl bl
xor ecx, ecx
add ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ebx, eax
setge cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
inc ebx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], ebx
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1002f7b9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x46c], eax
jmp 0x1002f7cc
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1002f7ce
push 0x235f
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1002f7e6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002f7fc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x654], 0x540d7f82
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002f7eb
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 0xfffffff2
cmp dword [ebp - 0x1c], 0x1b
je 0x1002f862