Function at 0x10025509
Capabilities:
Accept command line arguments
Allocate thread local storage
Check http status code
Connect pipe
Get common file path
Get geographical location
Log keystrokes via polling
Query environment variable
Set environment variable
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf38
push ebx
mov dword [ebp - 0x2c], 0x7cefa9d1
push esi
push edi
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x3c], 0xe011b55e
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov edi, dword [sym.imp.GDI32.dll_Polygon]
mov esi, dword [sym.imp.GDI32.dll_StretchDIBits]
mov byte [ebp - 0x55], dl
xor edx, edx
mov dword [ebp - 0x5c], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ebx, ebx
cmp eax, 0x57e8
mov eax, dword [ebp - 0x2c]
setge bl
xor ecx, ecx
sub ebx, edx
test eax, eax
setle cl
xor edx, edx
inc edx
cmp ebx, ecx
mov ebx, dword [sym.imp.USER32.dll_GetDC]
jne 0x100255e4
mov dword [ebp - 0x20], 0xb44a
xor eax, eax
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], 0xfffffff4
jmp 0x100255c9
mov dword [ebp - 0x24], 0x2ba75a59
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
jmp 0x100255c0
mov dword [ebp - 0x34], edx
dec dword [ebp - 0x34]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffee
jl 0x100255b7
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x17
jne 0x100255a8
mov dword [ebp - 0x34], 0xffffffff
mov eax, dword [ebp - 0x34]
push 3
mov dword [ebp - 0x3c], eax
pop ecx
jmp 0x100256c6
xor eax, eax
push 3
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jg 0x100256c8
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x14], eax
jmp 0x100256ab
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jge 0x10025624
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x148], 0x80bfe737
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1002560c
xor eax, eax
mov dword [ebp - 0x148], ecx
cmp dword [ebp - 0x148], eax
jl 0x100256a8
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002564f
push 0x135
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call edi
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002569a
push 0x2465
push 0xd36
push eax
push eax
push 0xe21
push 0xefc
push 0x21c8
push 0x1bb7
push 0x617
push 0x169a
push 0x442
push 0x17e2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call esi
xor eax, eax
dec dword [ebp - 0x148]
jns 0x10025632
xor edx, edx
push 3
inc edx
pop ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x10025604
mov eax, dword [ebp - 0x3c]
inc dword [ebp - 0x2c]
push 0
pop eax
cmp dword [ebp - 0x2c], ecx
jle 0x100255f5
xor eax, eax
mov dword [ebp - 0x2c], 0x7cefa9d1
push 0xfffffffffffffffd
pop edx
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0xac], edx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0x40], 0xe011b55e
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x34], 0xe08cccdd
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ecx
jge 0x1002571b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb6c], 0x52cb1363
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10025703
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x10025731
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xda0], 0xc4530722
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10025720
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov dword [ebp - 0xb64], eax
dec dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ebx, ebx
cmp eax, 0x57e8
mov eax, dword [ebp - 0x2c]
setge bl
xor ecx, ecx
sub ebx, edx
test eax, eax
setle cl
xor eax, eax
cmp ebx, ecx
jne 0x100259a1
mov dword [ebp - 8], 0x622ba394
xor ebx, ebx
mov dword [ebp - 0x18], 0x8e92eda8
inc ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x100257aa
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x750], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10025795
xor eax, eax
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], eax
jl 0x100258ac
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x100257db
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x234], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x100257c6
xor eax, eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], ebx
jg 0x1002587a
mov dword [ebp - 0x14], 0xd49f
mov ecx, eax
mov dword [ebp - 0x14], 0x1509cf13
cmp dword [ebp - 0x14], eax
je 0x10025804
mov ecx, ebx
mov eax, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x750]
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x234]
cmp ecx, eax
setle dl
cmp dword [ebp - 0x34], 0xfffa
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setg cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
jmp 0x10025860
mov dword [ebp - 0x18], 0
jmp 0x10025857
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x750], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10025846
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1002583d
inc dword [ebp - 0x230]
push 0
pop eax
cmp dword [ebp - 0x230], ebx
jle 0x100257ed
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100258a3
push 0x37d
push 0x1e49
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
dec dword [ebp - 8]
jns 0x100257b6
mov dword [ebp - 0x20], 0xb44a
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x3c], 0x3bc6e5c7
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100258d7
push 0xcab
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x24], 0xfffffff9
cmp dword [ebp - 0x24], 0xffffffff
jle 0x100258f9
mov dword [ebp - 0x3c], 0xffffffff
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jg 0x100258e4
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0xffffffed
cmp dword [ebp - 0x24], 0x17
je 0x1002593f
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10025924
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10025936
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x17
jne 0x10025912
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10025959
push 0x1682
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], 0xfffffff4
jmp 0x10025986
mov dword [ebp - 0x24], 0x2ba75a59
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
jmp 0x1002597d
mov dword [ebp - 0x34], ebx
dec dword [ebp - 0x34]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffee
jl 0x10025974
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x17
jne 0x10025965
mov dword [ebp - 0x34], 0xffffffff
mov eax, dword [ebp - 0x34]
push 3
mov dword [ebp - 0x3c], eax
pop ebx
jmp 0x10025a8d
push 3
mov dword [ebp - 0x2c], eax
pop ebx
cmp dword [ebp - 0x2c], ebx
jg 0x10025a8f
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x10025a7b
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x100259e6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x154], 0x80bfe737
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x100259ce
xor eax, eax
mov dword [ebp - 0x154], ebx
cmp dword [ebp - 0x154], eax
jl 0x10025a6f
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10025a15
push 0x135
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10025a64
push 0x2465
push 0xd36
push eax
push eax
push 0xe21
push 0xefc
push 0x21c8
push 0x1bb7
push 0x617
push 0x169a
push 0x442
push 0x17e2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
xor eax, eax
dec dword [ebp - 0x154]
jns 0x100259f4
xor ecx, ecx
inc ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x100259c6
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x2c]
push 0
pop eax
cmp dword [ebp - 0x2c], ebx
jle 0x100259b0
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10025aaf
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x480], 8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10025a97
xor eax, eax
push 0xfffffffffffffff7
mov dword [ebp - 0x47c], 0x17
pop ecx
jmp 0x10025b1f
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10025adc
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x288], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10025ac7
xor eax, eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 2
jge 0x10025b19
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10025b07
push 0xb11
push 0x1f8e
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
inc dword [ebp - 0x288]
cmp dword [ebp - 0x288], 2
jl 0x10025aeb
push 0xfffffffffffffff7
pop ecx
dec dword [ebp - 0x47c]
cmp dword [ebp - 0x47c], 0xffffffe9
jne 0x10025abe
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10025b40
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
xor eax, eax
mov dword [ebp - 0x2c], 0x7cefa9d1
mov dword [ebp - 0x18], 0x6b0f
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x40], 0xb6917ab6
mov dword [ebp - 0x3c], 0xffffffff
push 4
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x10025b86
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd24], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10025b6e
xor eax, eax
dec dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x10025bfe
mov dword [ebp - 0x5f4], eax
mov dword [ebp - 0x5f0], eax
mov dword [ebp - 0x5ec], eax
mov dword [ebp - 0x5e8], eax
mov dword [ebp - 0x20], 0x70f9e3d3
mov edx, dword [ebp - 0x5e8]
mov eax, dword [ebp - 0x18]
neg edx
push 0
sbb edx, edx
neg edx
mov ecx, dword [ebp + eax*4 - 0xd24]
lea eax, [edx + 8]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x5f4], ecx
mov ecx, dword [ebp - 0x5f4]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
pop eax
setg dl
mov dword [ebp - 0x40], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10025b91
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0x40], 0xe011b55e
mov dword [ebp - 0x24], 0xaeef20fe
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10025c47
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb9c], 0x177e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10025c2f
xor eax, eax
mov dword [ebp - 0x24], 2
cmp dword [ebp - 0x24], eax
jl 0x10025c6c
mov dword [ebp - 0x3c], 0xcb36
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb9c], ecx
dec dword [ebp - 0x24]
jns 0x10025c53
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ebx, ebx
cmp eax, 0x57e8
mov eax, dword [ebp - 0x2c]
setge bl
xor ecx, ecx
sub ebx, edx
test eax, eax
setle cl
xor eax, eax
cmp ebx, ecx
jne 0x10025f3a
mov dword [ebp - 0xc], 0xd07ddbf4
xor esi, esi
mov dword [ebp - 0x38], eax
inc esi
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x3c], 0xc1477a14
mov dword [ebp - 0x3c], 0xc298c245
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jge 0x10025ce4
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x68], 0x477862f
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x10025ccf
xor eax, eax
push 4
mov dword [ebp - 8], eax
pop ecx
cmp dword [ebp - 8], ecx
jge 0x10025d07
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x398], 0x96960f57
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10025cef
xor eax, eax
mov dword [ebp - 0x398], eax
jmp 0x10025d23
mov eax, dword [ebp - 0x398]
mov dword [ebp + eax*4 - 0x68], 0xfffffffe
inc dword [ebp - 0x398]
cmp dword [ebp - 0x398], esi
jl 0x10025d0f
mov dword [ebp - 0xc], 0xffffffff
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x68]
setne cl
imul eax, ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x68]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x68]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x68]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor eax, eax
cmp ecx, 0x4c638299
setge al
dec eax
mov dword [ebp - 0x3c], eax
jne 0x10025d95
cmp dword [ebp - 0x38], 0
jne 0x10025d95
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x3c], esi
xor eax, eax
push 0xfffffffffffffffb
mov dword [ebp - 0x20], 0xb44a
pop ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0xffffffea
cmp dword [ebp - 0x14], 0xffffffe3
jg 0x10025df1
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10025de7
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10025df1
dec dword [ebp - 0x14]
jmp 0x10025dc3
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10025e22
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x4e4], 0x949dfcf0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10025e0a
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10025e92
mov dword [ebp - 0x14], 0x4182bd7b
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffffa
jne 0x10025e8f
mov dword [ebp - 0x24], 0xfef9d786
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x10025e80
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10025e6b
push 0x165
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x4e4], 0
jne 0x10025e80
dec dword [ebp - 0x24]
push 0
pop eax
jns 0x10025e49
mov eax, dword [ebp - 0x3c]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffa
push 0
pop eax
je 0x10025e3a
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jne 0x10025e27
mov dword [ebp - 0x2c], 0xfffffff4
jmp 0x10025f1c
mov dword [ebp - 0x24], 0x2ba75a59
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffee
jge 0x10025f19
push 3
pop ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x34], 0xe08cccdd
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ecx
jge 0x10025ee0
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb48], 0x52cb1363
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10025ec8
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x10025ef6
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xdb8], 0xc4530722
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10025ee5
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xb40], eax
dec dword [ebp - 0x34]
mov dword [ebp - 0x34], esi
dec dword [ebp - 0x34]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffee
push 0
pop eax
jl 0x10025eb6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x17
jne 0x10025ea0
mov dword [ebp - 0x34], 0xffffffff
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
xor eax, eax
jmp 0x100261f3
mov dword [ebp - 8], 0x622ba394
xor ebx, ebx
mov dword [ebp - 0x18], 0x8e92eda8
inc ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10025f69
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x650], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10025f54
xor eax, eax
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], eax
jl 0x1002606b
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10025f9a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x21c], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10025f85
xor eax, eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], ebx
jg 0x10026039
mov dword [ebp - 0x14], 0xd49f
mov ecx, eax
mov dword [ebp - 0x14], 0x1509cf13
cmp dword [ebp - 0x14], eax
je 0x10025fc3
mov ecx, ebx
mov eax, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x650]
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x21c]
cmp ecx, eax
setle dl
cmp dword [ebp - 0x34], 0xfffa
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setg cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
jmp 0x1002601f
mov dword [ebp - 0x18], 0
jmp 0x10026016
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x650], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10026005
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10025ffc
inc dword [ebp - 0x218]
push 0
pop eax
cmp dword [ebp - 0x218], ebx
jle 0x10025fac
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10026062
push 0x37d
push 0x1e49
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
dec dword [ebp - 8]
jns 0x10025f75
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x100261f0
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x3c], 0x3bc6e5c7
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002609c
push 0xcab
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x24], 0xfffffff9
cmp dword [ebp - 0x24], 0xffffffff
jle 0x100260be
mov dword [ebp - 0x3c], 0xffffffff
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jg 0x100260a9
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0xffffffed
cmp dword [ebp - 0x24], 0x17
je 0x10026104
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100260e9
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100260fb
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x17
jne 0x100260d7
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1002611e
push 0x1682
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100261d3
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10026146
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x124], 0x80bfe737
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002612e
xor eax, eax
mov dword [ebp - 0x124], 3
cmp dword [ebp - 0x124], eax
jl 0x100261d0
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10026179
push 0x135
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100261c8
push 0x2465
push 0xd36
push eax
push eax
push 0xe21
push 0xefc
push 0x21c8
push 0x1bb7
push 0x617
push 0x169a
push 0x442
push 0x17e2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
xor eax, eax
dec dword [ebp - 0x124]
jns 0x10026158
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x10026126
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
push 0
pop eax
jle 0x10026078
xor esi, esi
inc esi
mov dword [ebp - 0x18], 0x6b0f
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x40], 0xb6917ab6
mov dword [ebp - 0x3c], 0xffffffff
push 4
mov dword [ebp - 0x24], eax
pop edx
cmp dword [ebp - 0x24], edx
jge 0x10026232
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc74], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1002621a
xor eax, eax
dec dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x100262af
mov dword [ebp - 0x5d4], eax
mov dword [ebp - 0x5d0], eax
mov dword [ebp - 0x5cc], eax
mov dword [ebp - 0x5c8], eax
mov dword [ebp - 0x20], 0x70f9e3d3
mov edx, dword [ebp - 0x5c8]
mov eax, dword [ebp - 0x18]
neg edx
push 0
sbb edx, edx
neg edx
mov ecx, dword [ebp + eax*4 - 0xc74]
lea eax, [edx + 8]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x5d4], ecx
mov ecx, dword [ebp - 0x5d4]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
pop eax
setg dl
mov dword [ebp - 0x40], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x1002623e
push 4
pop edx
mov dword [ebp - 0x24], 0xaeef20fe
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x100262d8
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa58], 0x177e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x100262bf
xor eax, eax
mov dword [ebp - 0x24], 2
cmp dword [ebp - 0x24], eax
jl 0x100262ff
mov dword [ebp - 0x3c], 0xcb36
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa58], ecx
dec dword [ebp - 0x24]
jns 0x100262e4
xor eax, eax
mov dword [ebp - 0x1c], 0x7cefa9d1
mov dword [ebp - 0xc], 0xd07ddbf4
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x3c], 0xc1477a14
mov dword [ebp - 0x3c], 0xc298c245
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jge 0x10026342
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x54], 0x477862f
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x1002632d
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edx
jge 0x10026362
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x3d8], 0x96960f57
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x1002634a
xor eax, eax
mov dword [ebp - 0x3d8], eax
jmp 0x1002637e
mov eax, dword [ebp - 0x3d8]
mov dword [ebp + eax*4 - 0x54], 0xfffffffe
inc dword [ebp - 0x3d8]
cmp dword [ebp - 0x3d8], esi
jl 0x1002636a
mov dword [ebp - 0xc], 0xffffffff
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x54]
setne cl
imul eax, ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x54]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x54]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor eax, eax
cmp ecx, 0x4c638299
setge al
dec eax
mov dword [ebp - 0x3c], eax
jne 0x100263f0
cmp dword [ebp - 0x38], 0
jne 0x100263f0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], esi
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
push 0xfffffffffffffffb
mov dword [ebp - 0xa4], eax
xor eax, eax
pop ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0xffffffea
cmp dword [ebp - 0x14], 0xffffffe3
jg 0x10026460
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10026456
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10026460
dec dword [ebp - 0x14]
jmp 0x10026432
mov dword [ebp - 0x20], 0xe011b55e
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002648e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x46c], 0x949dfcf0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10026476
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100264fe
mov dword [ebp - 0x14], 0x4182bd7b
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffffa
jne 0x100264fb
mov dword [ebp - 0x24], 0xfef9d786
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x100264ec
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100264d7
push 0x165
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x46c], 0
jne 0x100264ec
dec dword [ebp - 0x24]
push 0
pop eax
jns 0x100264b5
mov eax, dword [ebp - 0x3c]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffa
push 0
pop eax
je 0x100264a6
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jne 0x10026493
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ebx, ebx
cmp eax, 0x57e8
mov eax, dword [ebp - 0x1c]
setge bl
xor ecx, ecx
sub ebx, edx
test eax, eax
setle cl
cmp ebx, ecx
jne 0x10026c9d
push 3
pop edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], 0xe08cccdd
mov dword [ebp - 8], 0
jmp 0x10026561
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb00], 0x52cb1363
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x10026550
mov dword [ebp - 8], 0
jmp 0x10026580
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xdd0], 0xc4530722
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1002656f
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xaf8], eax
xor eax, eax
dec dword [ebp - 0x34]
mov dword [ebp - 0x20], 0xb44a
mov dword [ebp - 8], 0x622ba394
mov dword [ebp - 0x18], 0x8e92eda8
push 2
mov dword [ebp - 0x24], eax
pop ebx
cmp dword [ebp - 0x24], ebx
jge 0x100265c7
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6c8], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x100265b3
xor eax, eax
mov dword [ebp - 8], esi
cmp dword [ebp - 8], eax
jl 0x100266c6
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x100265f6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x254], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x100265e2
xor eax, eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], esi
jg 0x10026694
mov dword [ebp - 0x14], 0xd49f
mov ecx, eax
mov dword [ebp - 0x14], 0x1509cf13
cmp dword [ebp - 0x14], eax
je 0x1002661f
mov ecx, esi
mov eax, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x6c8]
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x254]
cmp ecx, eax
setle dl
cmp dword [ebp - 0x34], 0xfffa
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setg cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
jmp 0x1002667a
mov dword [ebp - 0x18], 0
jmp 0x10026672
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6c8], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10026661
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10026658
inc dword [ebp - 0x250]
push 0
pop eax
cmp dword [ebp - 0x250], esi
jle 0x10026608
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100266bd
push 0x37d
push 0x1e49
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
dec dword [ebp - 8]
jns 0x100265d3
or ebx, 0xffffffff
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x3c], 0x3bc6e5c7
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100266ec
push 0xcab
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x24], 0xfffffff9
jmp 0x10026701
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jg 0x100266f5
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0xffffffed
jmp 0x1002673b
cmp byte [ebp - 0x25], 0
je 0x10026726
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10026738
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x17
mov byte [ebp - 0x25], al
jne 0x10026717
cmp byte [ebp - 0x25], 0
je 0x1002675a
push 0x1682
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffff4
cmp dword [ebp - 0x1c], 0x17
push 9
pop ebx
je 0x10026b6c
jmp 0x10026772
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002678e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x9ec], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002677a
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100267b8
push 0x1fc4
push 0x163e
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100267cf
push 0x14de
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor eax, eax
mov dword [ebp - 0x18], 0x2ba75a59
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x10], 0xa50b5f0
mov dword [ebp - 0x34], esi
mov dword [ebp - 0xc], 0xfffffffa
mov dword [ebp - 0x14], 0x5b0bb8b
mov dword [ebp - 0xc], 0xf9c71042
mov dword [ebp - 0x24], eax
jmp 0x10026812
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2e4], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10026801
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0xc]
cmp eax, ecx
jg 0x1002682e
mov edx, esi
jmp 0x10026830
xor edx, edx
mov ecx, dword [ebp - 0x2e4]
mov dword [ebp - 0x2e4], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, ecx
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], eax
je 0x1002685a
mov eax, esi
mov dword [ebp - 0x34], eax
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setl dl
imul eax, edx, 6
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffffa
jle 0x100268a7
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10026898
push eax
push eax
push 0x22e0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov eax, dword [ebp - 0xc]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffa
push 0
pop eax
jg 0x1002687b
mov dword [ebp - 0x20], eax
push 7
mov dword [ebp - 8], 0xffffffff
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], eax
jmp 0x100268cd
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x4b4], 0xf9986e3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100268bc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
add eax, ebx
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 8]
jge 0x100268ef
xor eax, eax
mov ecx, eax
cmp dword [ebp - 8], eax
je 0x100268f1
mov ecx, esi
xor eax, eax
cmp ecx, 5
setg al
imul edx, eax, 0x55ad
sub edx, dword [ebp - 8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp edx, eax
mov eax, dword [ebp - 8]
setle cl
xor edx, edx
cmp ecx, 0x22e974a5
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], 0xfffffff2
cmp dword [ebp - 0x14], edi
jle 0x1002697e
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10026956
push 0x24cf
push 0x234
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jg 0x10026976
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x4b4], 0
jne 0x10026974
inc dword [ebp - 8]
cmp dword [ebp - 8], 0
jle 0x1002695e
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jg 0x1002693a
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffee
jge 0x10026b5f
jmp 0x10026991
xor eax, eax
mov ecx, 0x5baf
mov dword [ebp - 0x7fc], ecx
mov dword [ebp - 0x7f8], ecx
mov dword [ebp - 0x7f4], ecx
mov dword [ebp - 0x7f0], ecx
mov dword [ebp - 0x14], 0xda8e97ee
mov dword [ebp - 0x14], eax
jmp 0x10026a05
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x100269da
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd0], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100269c2
xor eax, eax
mov dword [ebp - 0xd0], edi
cmp dword [ebp - 0xd0], eax
jl 0x10026a02
mov eax, dword [ebp - 0xd0]
cmp dword [ebp + eax*4 - 0x7fc], 0
jne 0x10026a00
dec dword [ebp - 0xd0]
jns 0x100269e8
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x100269ba
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10026a22
push eax
push 0x1be3
push eax
call dword [sym.imp.GDI32.dll_GetBitmapBits]
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], 0x3152c58f
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jge 0x10026a56
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1bc], 0x6158d32f
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x10026a3e
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jge 0x10026a76
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x870], 0x58bdfadf
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x10026a5e
xor eax, eax
cmp dword [ebp - 0x1bc], eax
jne 0x10026aa3
mov ecx, dword [ebp - 0x1b4]
xor edx, edx
mov eax, dword [ebp - 0x1b4]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, dword [ebp - 0x1b4]
je 0x10026aa3
cmp dword [ebp - 0x1b4], eax
je 0x10026aad
mov ecx, esi
cmp dword [ebp - 0x870], eax
jne 0x10026aaf
mov ecx, eax
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x1b4]
mov eax, dword [ebp - 8]
sub edx, ecx
xor ecx, ecx
cmp eax, edx
setl cl
add ecx, 0x7533b484
mov dword [ebp - 0x38], ecx
mov dword [ebp - 8], 2
cmp dword [ebp - 8], 0
jl 0x10026b4f
mov dword [ebp - 0xc], 0xd17017a6
xor edx, edx
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1bc]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x870]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1b4]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1bc]
cmp edx, eax
mov eax, dword [ebp - 8]
setg cl
imul ecx, dword [ebp + eax*4 - 0x1bc]
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1bc], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], esi
dec dword [ebp - 8]
jns 0x10026ae0
dec dword [ebp - 0x10]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffee
jl 0x1002698f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
jne 0x10026770
mov dword [ebp - 0xc], 0x9ef4a042
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x2c], 0
jmp 0x10026b94
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x120], 5
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10026b83
mov dword [ebp - 0x2c], 0
cmp dword [ebp - 0x2c], edi
jge 0x10026bbb
push 7
pop ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xa70], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10026ba9
mov dword [ebp - 0x2c], 0
jmp 0x10026bd5
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x4b8], 0xffffffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x10026bc4
mov eax, dword [ebp - 0x11c]
xor ecx, ecx
cmp eax, esi
mov eax, dword [ebp - 0x120]
setg cl
imul eax, ecx
test eax, eax
je 0x10026c01
cmp dword [ebp - 0x11c], 0
je 0x10026c01
mov eax, esi
jmp 0x10026c03
xor eax, eax
mov dword [ebp - 0xc], eax
xor edx, edx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0xc]
test eax, eax
mov eax, dword [ebp - 0x11c]
setle dl
xor ecx, ecx
add edx, 0x4705b758
cmp edx, eax
mov eax, 0x8e1b8814
setle cl
cmp eax, ecx
mov eax, dword [ebp - 0xa68]
sbb ecx, ecx
xor edx, edx
inc ecx
imul eax, ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x34]
dec ecx
cmp ecx, eax
mov eax, dword [ebp - 0x11c]
setne dl
sub edx, eax
mov eax, dword [ebp - 0x120]
sub edx, eax
mov dword [ebp - 0x4b8], edx
mov byte [ebp - 0x25], 0
cmp byte [ebp - 0x25], 0
je 0x10026c8b
push 0xa33
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x34], 0xffffffff
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
jmp 0x1002782c
mov dword [ebp - 0x14], 0x70bb
mov eax, 0x1c0f8067
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x6e0], eax
mov dword [ebp - 0x6dc], eax
mov dword [ebp - 0x6d8], eax
push 9
pop ebx
mov dword [ebp - 0x6d4], eax
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
push 3
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 8], 0
pop ecx
jmp 0x10026d00
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x884], 0x60ec01e6
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10026cef
mov dword [ebp - 8], 0
jmp 0x10026d1f
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb78], 0
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10026d0e
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
sub esi, edx
cmp eax, esi
setle cl
mov dword [ebp - 0x6d8], ecx
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x87c], eax
je 0x10026d65
cmp dword [ebp - 0x14], eax
je 0x10026d65
xor esi, esi
inc esi
mov ecx, esi
jmp 0x10026d6a
xor esi, esi
mov ecx, eax
inc esi
mov eax, dword [ebp - 0x87c]
xor edx, edx
imul ecx, ecx, 0x38d9
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x6d8], ecx
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, esi
setle dl
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
inc edx
sub eax, edx
mov dword [ebp - 0xb70], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1002782e
push 3
pop ebx
mov dword [ebp - 0x14], 0xb9f9b319
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffe4
jge 0x10026e57
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], 0xeafd94fe
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0
jmp 0x10026e3f
mov dword [ebp - 8], 0xfc4b03e3
xor ecx, ecx
mov dword [ebp - 0x3c], 0x2b8319b8
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
test eax, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x14]
setg bl
sub ebx, 3
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setg cl
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xc
jne 0x10026dda
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe4
jl 0x10026dc1
push 3
xor eax, eax
pop ebx
mov dword [ebp - 0x10], 0xfffffffc
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], ecx
push 7
pop ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x68876942
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x3c], esi
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jge 0x10026eb6
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xde8], 0xf3d4210e
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x10026e9e
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jge 0x10026ed6
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x898], 0
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x10026ebe
xor eax, eax
dec dword [ebp - 0x890]
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10026eee
push eax
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jg 0x100276f0
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x24], 0xa
jmp 0x10026f39
mov dword [ebp - 0x3c], 0x54c3c69a
cmp dword [ebp - 0x3c], eax
jne 0x10026f3f
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10026f36
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffec
jl 0x10026f0a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jge 0x10026f5f
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x570], 0x5b9b55bb
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x10026f47
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jge 0x10026f7f
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x364], 0xfffffffc
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x10026f67
xor eax, eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], esi
jge 0x10026fae
mov eax, dword [ebp - 0x35c]
mov dword [ebp + eax*4 - 0x570], 0x32a27689
inc dword [ebp - 0x35c]
cmp dword [ebp - 0x35c], esi
jl 0x10026f8d
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10026fce
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x14c], 0x80bfe737
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10026fb6
xor eax, eax
mov dword [ebp - 0x2c], 0xc93b4e1a
mov dword [ebp - 0x34], ebx
push 2
mov dword [ebp - 8], eax
pop ecx
cmp dword [ebp - 8], ecx
jge 0x10026ffb
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x18c], 0
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10026fe3
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ecx
jge 0x1002701b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x940], 0x9d3b
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10027003
xor eax, eax
mov dword [ebp - 0x2c], 0xc
cmp dword [ebp - 0x2c], 0xfffffff0
jle 0x10027115
jmp 0x10027030
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], 0x44cf5927
mov dword [ebp - 0x40], 0x628405ce
mov dword [ebp - 0x30], 0xa81a82e7
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0x18461e70
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xc], 0xa3b
mov dword [ebp - 0x24], eax
jmp 0x1002707c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x9e0], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002706b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x9e0], eax
je 0x100270d8
cmp dword [ebp - 0x2c], 0
je 0x10027096
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18c]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x2c]
jl 0x100270ad
cmp dword [ebp - 0x3c], 0
je 0x100270b0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18c]
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xe717
jl 0x100270d4
mov eax, dword [ebp - 0x30]
mov edx, esi
jmp 0x100270da
xor edx, edx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
push 2
setne cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x940], eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff0
pop ecx
jg 0x1002702e
mov dword [ebp - 0x2c], esi
xor eax, eax
cmp dword [ebp - 0x2c], eax
jl 0x10027194
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x18c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp + eax*4 - 0x18c]
mov eax, dword [ebp - 0x34]
cmp eax, 0xffffffff
setge cl
xor eax, eax
cmp edx, ecx
setg al
cmp eax, 0xffff
mov eax, dword [ebp - 0x2c]
sbb ecx, ecx
neg ecx
mov dword [ebp + eax*4 - 0x18c], ecx
mov byte [ebp - 0x25], 0
cmp byte [ebp - 0x25], 0
je 0x1002718d
push 0x240b
push 0x1506
push 0x1a2a
push 0x1e4d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
dec dword [ebp - 0x2c]
jns 0x1002711f
xor eax, eax
mov dword [ebp - 0x14c], ebx
cmp dword [ebp - 0x14c], eax
jl 0x100276e1
push 6
pop ecx
mov dword [ebp - 0x738], ecx
mov dword [ebp - 0x734], ecx
mov dword [ebp - 0x730], ecx
mov dword [ebp - 0x72c], ecx
mov dword [ebp - 0x18], 0xf34fda0e
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x1002721b
mov dword [ebp - 0x24], 0x942a1e94
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100271ea
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommState]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jg 0x10027210
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x738]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x738], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x100271f2
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x100271d0
push 6
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
xor eax, eax
mov byte [ebp - 0x25], al
mov dword [ebp - 0x14], 0x65683c8f
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x3c], 0xdb39523d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x10027255
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x40c], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10027240
xor eax, eax
push 4
mov dword [ebp - 8], eax
pop ecx
jmp 0x1002726e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x9fc], 0xce3cb5af
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x1002725d
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp dword [ebp - 0xc], eax
jne 0x10027292
cmp dword [ebp - 0x408], eax
je 0x10027294
mov eax, esi
xor edx, edx
test eax, eax
mov eax, dword [ebp - 0x40c]
setg dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x40c]
sub edx, eax
mov eax, dword [ebp - 0x14]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x194
setne al
xor edx, edx
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, 0xffff
setle cl
add ecx, eax
mov dword [ebp - 0x9fc], ecx
mov eax, dword [ebp - 0x9fc]
mov dword [ebp - 0x9fc], eax
mov dword [ebp - 0xc], eax
cmp byte [ebp - 0x25], 0
je 0x1002743a
mov dword [ebp - 0x14], 0xb9f9b31
mov dword [ebp - 0x40], 0x1bca9d69
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x6f8], esi
mov dword [ebp - 0x6f4], esi
mov dword [ebp - 0x6f0], esi
mov dword [ebp - 0x6ec], esi
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 2
jle 0x10027423
mov edi, 0xa80d1c1d
mov dword [ebp - 0x3c], 0x458c458a
mov dword [ebp - 0x24], 0
jmp 0x10027358
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x438], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10027347
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0xc]
neg eax
push 7
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xffffffff
setl cl
sub ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x6f4]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x6f4]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
sub edx, 0x5bd442b6
cmp edi, edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
pop edx
setle cl
xor eax, eax
cmp ecx, edx
setle al
add eax, 0xf5a2
jne 0x100273c9
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x438], eax
add eax, 0xffff4d8b
je 0x100273ef
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10027410
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x10027410
mov dword [ebp - 0x81c], edx
mov dword [ebp - 0x818], edx
mov dword [ebp - 0x814], edx
mov dword [ebp - 0x810], edx
cmp dword [ebp - 0x814], 0
jne 0x1002741d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jg 0x10027337
mov edi, dword [sym.imp.GDI32.dll_Polygon]
push 0x135
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
mov dword [ebp - 0x18], 0x22ba3946
mov dword [ebp - 0x3c], 0x9e62b560
mov dword [ebp - 0x3c], 0x13ed
mov dword [ebp - 0x24], 0
jmp 0x10027469
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x9b4], 8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10027458
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], 0xffffffe9
jmp 0x10027528
mov dword [ebp - 0x3c], 0xfffe
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
jmp 0x100274a2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x31c], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10027495
cmp dword [ebp - 0x18], 0xffffffff
je 0x100274c3
mov eax, dword [ebp - 0x318]
mov eax, dword [ebp - 0x31c]
mov eax, dword [ebp - 0x31c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x318]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setge dl
xor ecx, ecx
mov dword [ebp - 0x9b4], edx
mov eax, dword [ebp - 0x14]
cmp edx, eax
setle cl
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x14], 5
jmp 0x1002751f
mov dword [ebp - 0x3c], 8
mov byte [ebp - 0x25], 0
cmp byte [ebp - 0x25], 0
je 0x10027515
push 0x1637
push 0x7f
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
mov dword [ebp - 0x3c], 0x8b15b45b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x19
jg 0x100274f5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1a
jg 0x1002747e
mov dword [ebp - 0x18], 0x14c4
xor eax, eax
mov dword [ebp - 0x770], eax
mov dword [ebp - 0x76c], eax
mov dword [ebp - 0x768], eax
mov dword [ebp - 0x764], eax
mov dword [ebp - 8], 0x7f737a9a
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], 0x80ee91b7
mov dword [ebp - 0x24], eax
jmp 0x1002757a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x8dc], 0xfffffffe
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10027569
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setl dl
cmp edx, dword [ebp - 0x2c]
jl 0x1002759d
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x770], eax
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 8]
push 4
setne cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
add eax, 2
add eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
pop eax
mov dword [ebp - 8], eax
jmp 0x1002763a
mov dword [ebp - 0x24], 0
jmp 0x10027607
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x28c], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100275f6
mov dword [ebp - 0x14], 0
jmp 0x10027632
mov dword [ebp - 0x3c], 0x687fd074
dec dword [ebp - 0x28c]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x770], 0
jne 0x10027637
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10027615
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1c
jne 0x100275ed
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x100276d2
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x14], 0xffffffea
jmp 0x10027684
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002767c
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002768a
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jle 0x1002765e
push 0x2465
push 0xd36
push eax
push eax
push 0xe21
push 0xefc
push 0x21c8
push 0x1bb7
push 0x617
push 0x169a
push 0x442
push 0x17e2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
dec dword [ebp - 0x14c]
push 0
pop eax
jns 0x100271a6
inc dword [ebp - 0x10]
push 0
pop eax
cmp dword [ebp - 0x10], ebx
jle 0x10026efa
mov dword [ebp - 8], 0xfffffff8
mov dword [ebp - 0x18], 0x4210e164
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x3c], 0x7de2e510
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jge 0x1002772c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xd4], 0xf0ae
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x10027714
xor eax, eax
push 4
mov dword [ebp - 8], eax
pop ecx
jmp 0x10027745
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xbb4], 0xad702c91
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10027734
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], esi
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 8], 0
je 0x100277cf
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x10027783
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 0xd4]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 8]
setne dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0xd4]
cmp edx, 0x56bf5ee8
setl cl
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0xd4]
add ecx, eax
mov eax, dword [ebp - 8]
cmp eax, ecx
setne dl
sub edx, 8
imul edx, dword [ebp - 8]
test edx, edx
je 0x100277cf
mov edx, esi
jmp 0x100277d1
xor edx, edx
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp edx, eax
push 0
setne cl
xor eax, eax
sub ecx, 0x4681
cmp ecx, 0xe175
setne al
imul eax, dword [ebp - 0xd4]
add eax, 0x56979f9f
neg eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 8]
cmp ecx, eax
setg dl
mov dword [ebp - 0xba8], edx
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], ebx
jle 0x10026dad
push 9
pop ebx
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_EndDialog]
mov edi, 0x9fdf99ff
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], eax
jmp 0x1002785e
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10027856
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10027864
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xe
jl 0x10027841
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], eax
jmp 0x10027889
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10027881
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002788f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xe
jl 0x1002786c
push 0xfffffffffffffffe
mov dword [ebp - 0x38], eax
xor edx, edx
pop edi
mov dword [ebp - 0x24], 0xfffffff9
inc edx
mov dword [ebp - 0x20], edi
push 4
pop ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x34], 0x1e19e95d
mov dword [ebp - 0x20], 0xdf628589
mov dword [ebp - 0xc], 0x1191
mov dword [ebp - 0x10], eax
jmp 0x100278cf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x98c], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100278c2
mov eax, dword [ebp - 0x20]
or ecx, 0xffffffff
sub ecx, eax
add ecx, dword [ebp - 0xc]
dec dword [ebp - 0xc]
test ecx, ecx
jne 0x100278ea
mov ecx, edx
jmp 0x100278ec
xor ecx, ecx
mov edx, dword [ebp - 0x38]
sub edx, 0xfff9
mov edi, dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp ecx, 5
sete al
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x3c]
cmp dword [ebp - 0x38], ecx
jle 0x10027986
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x10027994
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10027956
push eax
push 0x1808
push eax
push 0x4a5
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1002797f
push 0x1dc7
push 0xd0d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
xor eax, eax
dec dword [ebp - 0x24]
jns 0x10027939
jmp 0x10027994
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10027996
push eax
push eax
call edi
xor eax, eax
mov dword [ebp - 0x14], 0x9fdf99ff
mov dword [ebp - 0x14], eax
jmp 0x100279bf
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100279b7
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x100279c5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xe
jl 0x100279a2
mov dword [ebp - 0x6b8], eax
mov dword [ebp - 0x6b4], eax
mov dword [ebp - 0x6b0], eax
mov dword [ebp - 0x6ac], eax
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x100279fc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4c8], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100279e8
xor eax, eax
push 3
pop ebx
mov dword [ebp - 0x4c8], eax
cmp dword [ebp - 0x4c8], ebx
jg 0x10027a74
push 7
pop esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x10], eax
jmp 0x10027a3e
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10027a3b
push eax
push 0x1714
push 0x12e5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10027a18
mov eax, dword [ebp - 0x4c8]
push 0
mov ecx, dword [ebp + eax*4 - 0x6b8]
mov eax, dword [ebp - 0x4c8]
mov dword [ebp + eax*4 - 0x6b8], ecx
inc dword [ebp - 0x4c8]
pop eax
cmp dword [ebp - 0x4c8], ebx
jle 0x10027a10
mov esi, dword [sym.imp.USER32.dll_EndDialog]
mov dword [ebp - 0x18], 0x9fdf99ff
mov dword [ebp - 0x14], 0xb9f9b319
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffe4
jge 0x10027b2b
xor esi, esi
inc esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], 0xeafd94fe
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0
jmp 0x10027b10
mov dword [ebp - 8], 0xfc4b03e3
xor ecx, ecx
mov dword [ebp - 0x20], 0x2b8319b8
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
test eax, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x14]
setg bl
sub ebx, 3
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setg cl
mov dword [ebp - 0x20], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xc
jne 0x10027aab
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe4
jl 0x10027a92
mov esi, dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xe
jge 0x100281c5
push 2
xor ecx, ecx
pop edx
mov dword [ebp - 0x14], edx
inc ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x3c], 0x4e2095e0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x10027b71
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x85c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10027b59
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10027c5b
mov dword [ebp - 0x20], 0x737ae9f9
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edx
jge 0x10027ba0
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x334], 0xfffb
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x10027b88
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edx
jge 0x10027bc0
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xf4], 0x46df37d4
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x10027ba8
xor eax, eax
mov dword [ebp - 0xf4], ecx
cmp dword [ebp - 0xf4], eax
jl 0x10027c53
mov eax, dword [ebp - 0xf4]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x334]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp + eax*4 - 0x334]
test eax, eax
sete cl
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x10027c2d
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp + eax*4 - 0x334]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x334]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0xf4]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setl dl
mov dword [ebp - 0x85c], edx
dec dword [ebp - 0xf4]
jns 0x10027bd2
xor ecx, ecx
xor eax, eax
push 2
inc ecx
pop edx
cmp dword [ebp - 0x3c], eax
jne 0x10027c65
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffea
je 0x10027b79
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10027c88
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0
push 0xa5a
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
xor eax, eax
mov dword [ebp - 8], 0x3152c58f
push 3
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ecx
jge 0x10027cbc
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x198], 0x6158d32f
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10027ca4
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ecx
jge 0x10027cdc
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x8b4], 0x58bdfadf
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10027cc4
xor eax, eax
cmp dword [ebp - 0x198], eax
jne 0x10027d09
mov ecx, dword [ebp - 0x190]
xor edx, edx
mov eax, dword [ebp - 0x190]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, dword [ebp - 0x190]
je 0x10027d09
cmp dword [ebp - 0x190], eax
je 0x10027d18
cmp dword [ebp - 0x8b4], eax
je 0x10027d18
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10027d1a
mov ecx, eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x190]
mov eax, dword [ebp - 8]
sub edx, ecx
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
add ecx, 0x7533b484
mov dword [ebp - 0x38], ecx
mov dword [ebp - 8], 2
cmp dword [ebp - 8], eax
jl 0x10027dc6
xor esi, esi
inc esi
mov dword [ebp - 0xc], 0xd17017a6
xor edx, edx
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x198]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x8b4]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x190]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x198]
cmp edx, eax
mov eax, dword [ebp - 8]
setg cl
imul ecx, dword [ebp + eax*4 - 0x198]
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x198], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], esi
dec dword [ebp - 8]
jns 0x10027d4f
mov esi, dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
mov byte [ebp - 1], al
mov dword [ebp - 0x24], 0xdc85f70a
mov dword [ebp - 0x24], 0xc
jmp 0x10027e23
mov dword [ebp - 0x10], 0x58d32ffa
mov dword [ebp - 0x10], eax
jmp 0x10027df4
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], eax
jne 0x10027dfa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x16
jg 0x10027de5
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10027e20
push eax
push 0x1648
push 0x1b6
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x19
jg 0x10027dd9
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10027e3c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor eax, eax
cmp byte [ebp - 1], 0
je 0x100280cf
mov dword [ebp - 0x24], 0x985a9576
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x10], 0xb719d872
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x20], 0x11afd208
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x10027e92
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x12c], 0x1b66bafc
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10027e79
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x10027eb4
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x7b0], 0
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x10027e9b
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10027ebf
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x34]
dec ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x10]
setge dl
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x12c]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setge bl
xor ecx, ecx
cmp ebx, eax
sete cl
mov dword [ebp - 8], ecx
xor ecx, ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x12c]
test eax, eax
mov dword [ebp - 0x7b0], eax
setne cl
xor ebx, ebx
imul eax, ecx, 7
inc ebx
cmp eax, ebx
jbe 0x10028007
mov dword [ebp - 0xc], 0xfffd
xor eax, eax
mov dword [ebp - 0x34], 0x60b25631
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], 0x9978
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x14], 0x44fa7555
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x10027f6d
push 0x24cf
push 0x234
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
dec dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10027f87
mov esi, eax
cmp dword [ebp - 0x7a8], eax
je 0x10027f89
mov esi, ebx
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setne cl
cmp ecx, 6
sbb eax, eax
xor edx, edx
inc eax
add eax, dword [ebp - 0x12c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
setne dl
sub ecx, eax
xor eax, eax
cmp edx, ecx
setg al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x24]
je 0x10027fe5
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10027fee
jmp 0x10027fe7
xor eax, eax
mov ecx, ebx
cmp dword [ebp - 0x20], eax
je 0x10027ff0
mov ecx, eax
mov eax, dword [ebp - 0x38]
add eax, ecx
xor ecx, ecx
cmp esi, eax
mov esi, dword [sym.imp.USER32.dll_EndDialog]
setle cl
mov dword [ebp - 0x24], ecx
jmp 0x10028014
mov dword [ebp - 0x20], 8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], 0
jl 0x100280c2
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0xc39b9878
mov ecx, dword [ebp - 0x128]
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x12c], ecx
xor eax, eax
test ecx, ecx
mov dword [ebp - 0xc], 0xffffffff
mov edx, dword [ebp - 0x14]
setne al
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0xc]
cmp eax, edx
setl cl
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x10028085
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + eax*4 - 0x12c]
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x7b0], ecx
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10028087
mov ecx, eax
jmp 0x10028089
xor eax, eax
mov ecx, ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], eax
jl 0x100280b9
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x100280b4
push 0xe14
push 0x1fb1
push eax
call dword [sym.imp.GDI32.dll_OffsetRgn]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x10028098
dec dword [ebp - 8]
jns 0x10028021
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0
call ebx
push eax
call esi
push 7
mov dword [ebp - 8], 0xffffffff
xor edx, edx
pop eax
mov dword [ebp - 0x14], eax
inc edx
mov dword [ebp - 0x10], 0
jmp 0x100280f9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x440], 0xf9986e3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100280e8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
add eax, 9
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 8]
jge 0x1002811c
xor eax, eax
mov ecx, eax
cmp dword [ebp - 8], eax
je 0x1002811e
mov ecx, edx
xor eax, eax
cmp ecx, 5
setg al
imul edx, eax, 0x55ad
sub edx, dword [ebp - 8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp edx, eax
mov eax, dword [ebp - 8]
setle cl
xor edx, edx
cmp ecx, 0x22e974a5
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], 0xfffffff2
cmp dword [ebp - 0x14], 3
jle 0x100281ad
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10028184
push 0x24cf
push 0x234
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jg 0x100281a4
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x440], 0
jne 0x100281a2
inc dword [ebp - 8]
cmp dword [ebp - 8], 0
jle 0x1002818c
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jg 0x10028168
cmp dword [ebp - 0x18], 0
jne 0x100281c3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xe
push 0
pop eax
jl 0x10027b3e
xor eax, eax
push 0xfffffffffffffffe
mov dword [ebp - 0x38], eax
xor edx, edx
pop esi
mov dword [ebp - 0x24], 0xfffffff9
inc edx
mov dword [ebp - 0x20], esi
push 4
pop ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x34], 0x1e19e95d
mov dword [ebp - 0x20], 0xdf628589
mov dword [ebp - 0xc], 0x1191
mov dword [ebp - 0x10], eax
jmp 0x10028205
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8ec], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100281f8
mov eax, dword [ebp - 0x20]
or ecx, 0xffffffff
sub ecx, eax
add ecx, dword [ebp - 0xc]
dec dword [ebp - 0xc]
test ecx, ecx
jne 0x10028220
mov ecx, edx
jmp 0x10028222
xor ecx, ecx
mov edx, dword [ebp - 0x38]
sub edx, 0xfff9
neg edx
push 5
sbb edx, edx
xor eax, eax
inc edx
pop esi
cmp ecx, esi
sete al
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
imul ecx, dword [ebp - 0x3c]
cmp dword [ebp - 0x38], ecx
jle 0x100282b4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x100282c0
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10028288
push eax
push 0x1808
push eax
push 0x4a5
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x100282ad
push 0x1dc7
push 0xd0d
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
xor eax, eax
dec dword [ebp - 0x24]
jns 0x1002826b
jmp 0x100282c0
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x100282c2
push eax
push eax
call edi
xor eax, eax
mov dword [ebp - 0x38], eax
xor edx, edx
mov dword [ebp - 0x24], 0xfffffff9
inc edx
mov dword [ebp - 0x20], 0xfffffffe
push 4
pop ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x34], 0x1e19e95d
mov dword [ebp - 0x20], 0xdf628589
mov dword [ebp - 0xc], 0x1191
mov dword [ebp - 0x10], eax
jmp 0x10028307
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9d0], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100282f6
mov eax, dword [ebp - 0x20]
or ecx, 0xffffffff
sub ecx, eax
add ecx, dword [ebp - 0xc]
dec dword [ebp - 0xc]
test ecx, ecx
jne 0x10028322
mov ecx, edx
jmp 0x10028324
xor ecx, ecx
mov edx, dword [ebp - 0x38]
sub edx, 0xfff9
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp ecx, esi
sete al
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
imul ecx, dword [ebp - 0x3c]
cmp dword [ebp - 0x38], ecx
jle 0x100283b3
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x100283bf
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10028387
push eax
push 0x1808
push eax
push 0x4a5
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x100283ac
push 0x1dc7
push 0xd0d
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
xor eax, eax
dec dword [ebp - 0x24]
jns 0x1002836a
jmp 0x100283bf
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x100283c1
push eax
push eax
call edi
xor eax, eax
mov dword [ebp - 0x34], 0xeec54165
xor edx, edx
mov dword [ebp - 0x34], 0xffffffff
inc edx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edx
jge 0x100283eb
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x80], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x100283da
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edx
jge 0x1002840b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x588], 0xc299e885
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x100283f3
xor eax, eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x1d
je 0x10028488
mov dword [ebp - 0x10], 0xfffffff9
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x80]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
imul eax, ecx, 0x849b
test eax, eax
jne 0x10028445
cmp dword [ebp - 0x10], eax
jne 0x10028445
mov ecx, eax
jmp 0x1002844a
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x80]
lea eax, [ecx + 0xd7d3]
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x34]
sub edx, eax
mov eax, dword [ebp - 0x80]
cmp edx, eax
setge cl
mov dword [ebp - 0x588], ecx
inc dword [ebp - 0x80]
cmp dword [ebp - 0x80], 0x1d
jne 0x10028414
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x34], 0xeec54165
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edx
jge 0x100284b2
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x88], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x1002849e
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edx
jge 0x100284d2
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x448], 0xc299e885
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x100284ba
xor eax, eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x1d
je 0x1002856f
mov dword [ebp - 0x10], 0xfffffff9
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x88]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
imul eax, ecx, 0x849b
test eax, eax
jne 0x10028519
cmp dword [ebp - 0x10], eax
jne 0x10028519
mov ecx, eax
jmp 0x1002851e
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x88]
lea eax, [ecx + 0xd7d3]
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x34]
sub edx, eax
mov eax, dword [ebp - 0x88]
cmp edx, eax
setge cl
mov dword [ebp - 0x448], ecx
inc dword [ebp - 0x88]
cmp dword [ebp - 0x88], 0x1d
jne 0x100284e5
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], 9
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002859c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc8c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10028584
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100285ae
mov dword [ebp - 0x34], 0xcbd94543
inc dword [ebp - 0x34]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x100285a1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x100285d3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xec], 0xc75b57fd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100285bb
xor eax, eax
mov dword [ebp - 0xec], 0xffffffff
jmp 0x10028631
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10028604
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe54], 0x2c7c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100285eb
xor eax, eax
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], eax
jl 0x1002862b
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10028620
call ebx
push eax
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
dec dword [ebp - 0xc]
jns 0x1002860c
xor edx, edx
push 2
inc edx
pop ecx
inc dword [ebp - 0xec]
cmp dword [ebp - 0xec], 0x15
jle 0x100285df
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10028664
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xca4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002864c
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10028676
mov dword [ebp - 0x34], 0xcbd94543
inc dword [ebp - 0x34]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x10028669
mov dword [ebp - 0x34], 0xeec54165
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edx
jge 0x100286a5
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x90], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x10028691
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edx
jge 0x100286c5
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x4f8], 0xc299e885
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x100286ad
xor eax, eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x1d
je 0x10028762
mov dword [ebp - 0x10], 0xfffffff9
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x90]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
imul eax, ecx, 0x849b
test eax, eax
jne 0x1002870c
cmp dword [ebp - 0x10], eax
jne 0x1002870c
mov ecx, eax
jmp 0x10028711
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x90]
lea eax, [ecx + 0xd7d3]
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x34]
sub edx, eax
mov eax, dword [ebp - 0x90]
cmp edx, eax
setge cl
mov dword [ebp - 0x4f8], ecx
inc dword [ebp - 0x90]
cmp dword [ebp - 0x90], 0x1d
jne 0x100286d8
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xa61fc2da
mov dword [ebp - 0x3c], 0xda7bc999
mov dword [ebp - 0x3c], 0xdb696893
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x3c], 0x33563700
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edx
jge 0x100287af
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x450], 0xfffffff9
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x10028797
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x100287d1
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x53c], 0x9740
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x100287b8
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 6
jle 0x1002881c
mov dword [ebp - 0x14], 0xdf251d69
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x100287f8
push 0xb4f
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002880a
cmp dword [ebp - 0x18], eax
jne 0x10028810
cmp dword [ebp - 0x14], eax
jne 0x10028810
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff2
jg 0x100287fd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 6
jg 0x100287da
xor edx, edx
inc edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x534]
dec dword [ebp - 0x534]
test eax, eax
jne 0x1002883e
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x534]
cmp dword [ebp - 0x53c], 0x37d437f1
je 0x10028856
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x450], eax
je 0x10028858
mov ecx, edx
xor eax, eax
cmp ecx, 0x21df
push 3
setg al
mov dword [ebp - 0x3c], eax
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x34], 0xe08cccdd
mov dword [ebp - 8], 0
jmp 0x1002888d
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xa88], 0x52cb1363
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x1002887c
mov dword [ebp - 8], 0
jmp 0x100288ac
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xd64], 0xc4530722
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x1002889b
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa80], eax
xor eax, eax
dec dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0x1febaeef
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x3c], 0xeb7e5950
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x100288fa
mov eax, dword [ebp - 8]
push 4
mov dword [ebp + eax*4 - 0x614], 0x7571
inc dword [ebp - 8]
pop eax
cmp dword [ebp - 8], eax
jl 0x100288df
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ecx
jge 0x1002891a
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb18], 0x77e06985
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10028902
xor eax, eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jl 0x10028a63
jmp 0x1002892b
xor edx, edx
inc edx
mov dword [ebp - 0x20], 0xb082
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x614], 0
jne 0x10028967
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x614]
cmp eax, 0x7979b389
setl cl
xor eax, eax
cmp ecx, 0xa1a4d63a
setne al
cmp eax, 0xfbc7
jg 0x10028967
xor edx, edx
mov eax, dword [ebp - 0x60c]
xor ecx, ecx
cmp edx, eax
push 7
setge cl
xor eax, eax
pop edx
cmp ecx, edx
setge al
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0
jmp 0x10028a50
mov dword [ebp - 0x10], 0
jmp 0x100289a7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x414], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10028996
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x614]
mov eax, dword [ebp - 0x410]
cmp eax, dword [ebp - 0x410]
jne 0x100289d6
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x614], 0
jne 0x100289d6
xor edx, edx
jmp 0x100289db
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
push 4
mov eax, dword [ebp + eax*4 - 0x614]
cmp eax, edx
pop eax
sete cl
xor edx, edx
add ecx, eax
cmp ecx, 0x1cb27f08
setle dl
xor ecx, ecx
mov dword [ebp - 0xb10], edx
mov eax, dword [ebp - 0x410]
cmp edx, eax
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
add ecx, 0xb680c378
cmp ecx, eax
setge dl
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
xor eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10028a4d
push 0xda1
push 0x1479
push 0x1f14
call ebx
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jne 0x1002898d
dec dword [ebp - 0x18]
jns 0x10028928
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x18], 8
mov dword [ebp - 0xc], 0xfffffff8
mov dword [ebp - 0x14], 0x56574b60
mov dword [ebp - 0x20], 0xfff8
mov dword [ebp - 0x3c], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0
jne 0x10028a99
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
je 0x10028ab9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 0xb7e2
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x3c]
jle 0x10028b14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10028af2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xaa0], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10028ad9
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10028b2b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xaa0], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10028afb
jmp 0x10028b29
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x10028b29
push eax
push 0x8bf
push eax
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffe
mov ecx, 0x5baf
mov dword [ebp - 0x7cc], ecx
mov dword [ebp - 0x7c8], ecx
mov dword [ebp - 0x7c4], ecx
mov dword [ebp - 0x7c0], ecx
mov dword [ebp - 0x24], 0xda8e97ee
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x10028bb7
xor ecx, ecx
inc ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10028b82
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdc], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10028b6a
xor eax, eax
mov dword [ebp - 0xdc], 3
cmp dword [ebp - 0xdc], eax
jl 0x10028bae
mov eax, dword [ebp - 0xdc]
cmp dword [ebp + eax*4 - 0x7cc], 0
jne 0x10028bac
dec dword [ebp - 0xdc]
jns 0x10028b94
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x10028b62
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10028bcf
push eax
push 0x1be3
push eax
call dword [sym.imp.GDI32.dll_GetBitmapBits]
xor eax, eax
push 4
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x10028bf7
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x6c0], 0xe2db58e4
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10028bde
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x10028c19
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x490], 0x7ad95e17
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x10028c00
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x10028c31
push eax
push 0x1be3
push eax
call dword [sym.imp.GDI32.dll_GetBitmapBits]
xor eax, eax
xor edx, edx
mov dword [ebp - 0x48c], eax
inc edx
jmp 0x10028cea