Function at 0x1002f2cf
Capabilities:
Check for time delay via queryperformancecounter
Create a process with modified i/o handles and window
Create process on windows
Create thread
Delete file
Delete registry value
Get common file path
Get geographical location
Get graphical window text
Get memory capacity
Get thread local storage value
Parse pe header
Query environment variable

Disassembly:
mov eax, 0x1008773f
call fcn.100860f4
mov eax, 0x1544
call fcn.10070240
xor eax, eax
mov dword [ebp - 0x2c], 0xac8b13ec
push ebx
mov byte [ebp - 0x3d], al
push esi
push edi
mov byte [ebp - 0x7d], dl
mov dword [ebp - 0x5c], ecx
cmp byte [ebp - 0x3d], al
je 0x1002f30a
push 0x1fa0
call dword [sym.imp.KERNEL32.dll_TlsFree]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002f327
push 0x262a
push eax
push 0x1941
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
xor eax, eax
mov dword [ebp - 0x30], 0xfffffffd
xor edi, edi
mov dword [ebp - 0x30], 0xcd453606
inc edi
push 8
pop ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002f363
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1328], 3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f34a
xor eax, eax
push 2
pop edx
mov dword [ebp - 0x30], edx
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x30], eax
jl 0x1002f46b
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002f398
push 0x377
push 0x1fdb
push eax
call dword [sym.imp.USER32.dll_InflateRect]
push 2
pop edx
or ecx, 0xffffffff
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x1328], 0
je 0x1002f451
xor eax, eax
mov dword [ebp - 0x2c], 0xcaa7
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002f3d4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd60], 0xd568d526
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002f3bb
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002f3f6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x8ec], 0xbf48c443
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002f3dd
xor eax, eax
cmp dword [ebp - 0xd5c], eax
jne 0x1002f469
mov dword [ebp - 0x8e4], eax
jmp 0x1002f447
mov dword [ebp - 0x1c], 0x1c71bc7d
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x1002f441
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xd60]
sub eax, 0x5d3e9973
cmp eax, 0x62a04f77
setg cl
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x14], edi
dec dword [ebp - 0x1c]
jns 0x1002f418
xor eax, eax
or ecx, 0xffffffff
inc dword [ebp - 0x8e4]
cmp dword [ebp - 0x8e4], edx
jle 0x1002f406
jmp 0x1002f45d
mov eax, dword [ebp - 0x14]
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x30]
push 0
pop eax
jns 0x1002f375
xor eax, eax
movdqa xmm0, xmmword [0x1000ae10]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], 0x9e63a5be
push 6
pop edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x2c], 0x4f6b903c
mov dword [ebp - 0x2c], 0x1ee01e6e
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x2c], 0x9f71d691
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0xfdc]
push eax
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0xfec]
push eax
lea ecx, [ebp - 0x1498]
movdqu xmmword [ebp - 0xfec], xmm0
call fcn.10018805
lea ecx, [ebp - 0x1ed]
mov esi, eax
call fcn.1000c103
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1310]
push dword [esi]
call fcn.100187b4
xor eax, eax
mov dword [ebp - 4], eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002f4ff
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
xor eax, eax
mov edi, dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0x30], eax
push 7
pop eax
cmp dword [ebp - 0x30], eax
jg 0x1002f5bc
or esi, 0xffffffff
xor eax, eax
lea ecx, [ebp - 0xf7c]
inc eax
push eax
call fcn.10018755
xor ecx, ecx
xor eax, eax
inc ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x2c], 0x87a912e7
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002f585
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xf7c]
call fcn.100187f6
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002f567
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002f59d
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
lea ecx, [ebp - 0xf7c]
mov byte [ebp - 4], al
call fcn.100187da
inc dword [ebp - 0x30]
push 7
pop eax
cmp dword [ebp - 0x30], eax
jle 0x1002f517
jmp 0x1002f5bf
or esi, 0xffffffff
lea ecx, [ebp - 0x1310]
mov dword [ebp - 4], esi
call fcn.100187da
movdqa xmm0, xmmword [0x1000ae10]
lea ecx, [ebp - 0x13f0]
mov dword [ebp - 0x30], 0xfffffffd
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0x9e63a5be
push 6
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0x4f6b903c
mov dword [ebp - 0x2c], 0x1ee01e6e
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x9f71d691
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x111c]
push eax
lea eax, [ebp - 0x112c]
mov dword [ebp - 0x2c], esi
push eax
movdqu xmmword [ebp - 0x112c], xmm0
call fcn.10018805
lea ecx, [ebp - 0x19f]
mov esi, eax
call fcn.1000c103
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1268]
push dword [esi]
call fcn.100187b4
xor eax, eax
mov dword [ebp - 4], 4
xor esi, esi
mov byte [ebp - 0x3d], al
inc esi
cmp byte [ebp - 0x3d], al
je 0x1002f66e
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002f707
push esi
lea ecx, [ebp - 0xd78]
call fcn.10018755
mov byte [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x2c], 0x87a912e7
or ecx, 0xffffffff
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002f6df
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xd78]
call fcn.100187f6
and dword [eax], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002f6c4
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002f6f5
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
lea ecx, [ebp - 0xd78]
mov byte [ebp - 4], 4
call fcn.100187da
inc dword [ebp - 0x30]
push 7
pop eax
cmp dword [ebp - 0x30], eax
jle 0x1002f676
or eax, 0xffffffff
lea ecx, [ebp - 0x1268]
mov dword [ebp - 4], eax
call fcn.100187da
movdqa xmm0, xmmword [0x1000ae10]
lea ecx, [ebp - 0x1468]
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0x9e63a5be
push 6
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0x4f6b903c
mov dword [ebp - 0x2c], 0x1ee01e6e
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x9f71d691
mov dword [ebp - 0x2c], eax
or eax, 0xffffffff
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0xffc]
push eax
lea eax, [ebp - 0x100c]
push eax
movdqu xmmword [ebp - 0x100c], xmm0
call fcn.10018805
lea ecx, [ebp - 0x24d]
mov esi, eax
call fcn.1000c103
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1340]
push dword [esi]
call fcn.100187b4
push 8
pop eax
mov dword [ebp - 4], eax
xor esi, esi
xor eax, eax
inc esi
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002f7c4
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1002f85d
push esi
lea ecx, [ebp - 0xeb0]
call fcn.10018755
push 9
pop ecx
mov byte [ebp - 4], cl
xor eax, eax
mov dword [ebp - 0x2c], 0x87a912e7
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002f833
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xeb0]
call fcn.100187f6
and dword [eax], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002f818
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002f849
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
push 8
pop eax
lea ecx, [ebp - 0xeb0]
mov byte [ebp - 4], al
call fcn.100187da
inc dword [ebp - 0x30]
push 7
pop eax
cmp dword [ebp - 0x30], eax
jle 0x1002f7cc
or edi, 0xffffffff
lea ecx, [ebp - 0x1340]
mov dword [ebp - 4], edi
call fcn.100187da
push 4
lea ecx, [ebp - 0x95c]
call fcn.10018755
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002f8b7
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x95c]
call fcn.100187f6
mov dword [eax], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002f89c
xor eax, eax
push 3
pop edi
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x1002f8da
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x95c]
call fcn.100187f6
cmp dword [eax], 0
jne 0x1002f8da
dec dword [ebp - 0x1c]
jns 0x1002f8c2
or eax, 0xffffffff
lea ecx, [ebp - 0x95c]
mov dword [ebp - 4], eax
call fcn.100187da
mov dword [ebp - 0x1c], 0x324ec2e0
mov dword [ebp - 0x1c], 0xfffffff1
cmp dword [ebp - 0x1c], 0xffffffe7
je 0x1002f91f
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002f916
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe7
jne 0x1002f901
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002f92f
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push edi
lea ecx, [ebp - 0x1cc]
call fcn.10018755
mov dword [ebp - 4], 0xd
or eax, 0xffffffff
mov dword [ebp - 0x20], 0xba9a9843
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002f977
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1cc]
call fcn.100187f6
mov dword [eax], 0x540d7f82
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002f959
xor eax, eax
push eax
lea ecx, [ebp - 0x1cc]
call fcn.100187f6
and dword [eax], 0
jmp 0x1002fa61
mov dword [ebp - 0x24], 0x5ba77230
xor eax, eax
mov dword [ebp - 0x38], 0xbbc254e7
mov dword [ebp - 0x50], 0xfffffff6
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 9
jle 0x1002fa53
mov dword [ebp - 0x14], 0xa4d91f06
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002f9dc
push eax
push 0x1070
push 0xd90
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002f9e8
xor eax, eax
lea edi, [eax + 1]
jmp 0x1002f9ea
mov edi, eax
push 2
lea ecx, [ebp - 0x1cc]
call fcn.100187f6
lea ecx, [ebp - 0x1cc]
mov esi, dword [eax]
xor eax, eax
push eax
sub esi, edi
call fcn.100187f6
xor ecx, ecx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
cmp ecx, 0x433c
setne dl
imul eax, edx
test eax, eax
je 0x1002fa33
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x1002fa35
xor esi, esi
inc esi
mov eax, esi
jmp 0x1002fa38
xor eax, eax
xor esi, esi
inc esi
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x24]
push 9
pop eax
cmp dword [ebp - 0x24], eax
push 0
pop eax
jg 0x1002f9af
push eax
lea ecx, [ebp - 0x1cc]
call fcn.100187f6
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x1cc]
push eax
call fcn.100187f6
cmp dword [eax], 5
jg 0x1002f98b
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002fa96
push dword [ebp - 0x20]
call fcn.100187f6
mov ecx, dword [ebp - 0x20]
xor edx, edx
test ecx, ecx
sets dl
mov dword [eax], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
lea ecx, [ebp - 0x1cc]
jle 0x1002fa7f
or edi, 0xffffffff
mov dword [ebp - 4], edi
call fcn.100187da
mov dword [ebp - 0x28], 0xfffffffd
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0x66c4a87f
mov dword [ebp - 0x34], 0x5610a143
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1002fadf
push 0x2203
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xc
jge 0x1002fb75
mov dword [ebp - 0x1c], edi
xor edx, edx
mov dword [ebp - 0x3c], 0x284868fd
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x1c]
jge 0x1002fb25
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002fb27
mov edx, esi
jmp 0x1002fb29
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, esi
setne al
imul eax, eax, 0xffff3723
test eax, eax
je 0x1002fb4f
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002fb51
mov edx, esi
jmp 0x1002fb53
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xc
jl 0x1002faec
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0xac8b13ec
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002fb95
push 0x1fa0
call dword [sym.imp.KERNEL32.dll_TlsFree]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002fbb2
push 0x262a
push eax
push 0x1941
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
xor eax, eax
mov dword [ebp - 0x2c], 0x9e63a5be
mov dword [ebp - 0x30], 0xcd453606
push 8
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002fbeb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1358], 3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002fbd2
xor eax, eax
push 2
pop edx
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], eax
jl 0x1002fcec
jmp 0x1002fbfe
xor eax, eax
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002fc1e
push 0x377
push 0x1fdb
push eax
call dword [sym.imp.USER32.dll_InflateRect]
push 2
pop edx
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x1358], 0
je 0x1002fcd4
xor eax, eax
mov dword [ebp - 0x2c], 0xcaa7
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002fc5a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd90], 0xd568d526
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002fc41
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002fc7c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x8fc], 0xbf48c443
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002fc63
xor eax, eax
cmp dword [ebp - 0xd8c], eax
jne 0x1002fcec
mov dword [ebp - 0x8f4], eax
jmp 0x1002fcca
mov dword [ebp - 0x1c], 0x1c71bc7d
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x1002fcc4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xd90]
sub eax, 0x5d3e9973
cmp eax, 0x62a04f77
setg cl
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x14], esi
dec dword [ebp - 0x1c]
jns 0x1002fc9e
xor eax, eax
inc dword [ebp - 0x8f4]
cmp dword [ebp - 0x8f4], edx
jle 0x1002fc8c
jmp 0x1002fce0
mov eax, dword [ebp - 0x14]
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x30]
push 8
pop ecx
jns 0x1002fbfc
mov dword [ebp - 0x2c], 6
lea ecx, [ebp - 0xb0c]
mov dword [ebp - 0x20], esi
push 4
call fcn.10018755
xor eax, eax
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002fd30
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xb0c]
call fcn.100187f6
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002fd15
xor eax, eax
mov dword [ebp - 0x20], 0xffffffe2
jmp 0x1002fd9c
mov dword [ebp - 0x30], 0x5ba77230
mov dword [ebp - 0x30], 3
cmp dword [ebp - 0x30], eax
jl 0x1002fd7f
mov dword [ebp - 0x1c], 0xfc0272a
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1002fd7a
push dword [ebp - 0x30]
lea ecx, [ebp - 0xb0c]
call fcn.100187f6
cmp dword [eax], 0
jne 0x1002fd78
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1002fd5c
xor eax, eax
dec dword [ebp - 0x30]
jns 0x1002fd4c
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002fd99
push 0x415
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x12
jge 0x1002fd39
lea ecx, [ebp - 0xb0c]
mov dword [ebp - 4], edi
call fcn.100187da
push 2
pop edi
mov dword [ebp - 0x2c], 0x4f6b903c
lea ecx, [ebp - 0xda8]
push edi
call fcn.10018755
push edi
lea ecx, [ebp - 0xf44]
mov dword [ebp - 4], 0xf
call fcn.10018755
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x974]
push 9
pop eax
mov dword [ebp - 0x2c], 0xf3b8c105
mov dword [ebp - 0x2c], eax
or eax, 0xffffffff
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x117a540f
mov dword [ebp - 0x2c], eax
push esi
call fcn.10018755
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002fe36
or esi, 0xffffffff
push dword [ebp - 0x18]
lea ecx, [ebp - 0xda8]
call fcn.100187f6
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002fe19
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002fe5c
push dword [ebp - 0x18]
lea ecx, [ebp - 0xf44]
call fcn.100187f6
mov dword [eax], 0xba2afe01
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002fe3e
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002fe82
push dword [ebp - 0x18]
lea ecx, [ebp - 0x974]
call fcn.100187f6
mov dword [eax], 0xc9db
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002fe64
xor eax, eax
push eax
lea ecx, [ebp - 0x974]
call fcn.100187f6
lea ecx, [ebp - 0x974]
dec dword [eax]
call fcn.100187da
lea ecx, [ebp - 0xf44]
call fcn.100187da
or eax, 0xffffffff
lea ecx, [ebp - 0xda8]
mov dword [ebp - 4], eax
call fcn.100187da
mov dword [ebp - 0x2c], 0x1ee01e6e
xor eax, eax
mov dword [ebp - 0x1c], 0xd490c4d8
mov dword [ebp - 0x1c], eax
push 0xfffffffffffffff7
pop ecx
cmp dword [ebp - 0x1c], esi
jge 0x1002fee6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x64c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002fed2
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002fefb
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002ff17
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x64c], 0
jne 0x1002ff15
dec dword [ebp - 0x1c]
jns 0x1002ff03
xor eax, eax
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x1c], 0x713a473e
mov dword [ebp - 0x2c], 0xb659
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002ff4e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xfa8], 0x56834504
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002ff35
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002ff5f
call dword [sym.imp.GDI32.dll_GdiFlush]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1002ff7e
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xfa8], 0
jne 0x1002ff7c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1002ff67
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov dword [ebp - 0x2c], 0x9f71d691
mov dword [ebp - 0x1c], 0xb26bdde0
mov dword [ebp - 0x1c], 0xfffffffe
jmp 0x1002ffb0
cmp dword [ebp - 0x1c], eax
jne 0x1002ffb6
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1002ffad
call edi
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
jl 0x1002ff9b
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x508]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x34], 0x167c28ca
push 3
call fcn.10018755
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0x8cc]
mov dword [ebp - 0x3c], 0x4ac0198a
push 3
call fcn.10018755
mov byte [ebp - 4], 0x13
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x30], 0x5659cde3
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10030027
push dword [ebp - 0x18]
lea ecx, [ebp - 0x508]
call fcn.100187f6
push 3
pop ecx
mov dword [eax], 0xffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10030006
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10030047
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x58c], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003002f
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1003006c
push dword [ebp - 0x18]
lea ecx, [ebp - 0x8cc]
call fcn.100187f6
mov dword [eax], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003004f
push esi
lea ecx, [ebp - 0x508]
call fcn.100187f6
mov edx, dword [ebp - 0x34]
neg edx
push esi
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, dword [eax]
setge cl
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x508]
call fcn.100187f6
mov eax, dword [ebp - 0x58c]
lea ecx, [ebp - 0x508]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x58c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x588]
push esi
call fcn.100187f6
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x508]
push esi
call fcn.100187f6
push 2
lea ecx, [ebp - 0x8cc]
call fcn.100187f6
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x58c], eax
jne 0x100300e7
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x58c]
xor ecx, ecx
cmp eax, esi
setl cl
xor eax, eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], eax
jmp 0x1003010f
push dword [ebp - 0x30]
call fcn.100187f6
mov dword [eax], 0x786f
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
lea ecx, [ebp - 0x8cc]
jl 0x100300fe
call fcn.100187da
or esi, 0xffffffff
lea ecx, [ebp - 0x508]
mov dword [ebp - 4], esi
call fcn.100187da
mov dword [ebp - 0x2c], esi
xor eax, eax
mov dword [ebp - 0x1c], 0xac64a684
mov dword [ebp - 0x34], 0x5043c4ab
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1b
jg 0x10030165
mov dword [ebp - 0x34], 0x4325
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1b
jle 0x1003014d
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10030185
push eax
push 0x1d0c
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
movdqa xmm0, xmmword [0x1000ae10]
lea eax, [ebp - 0x11bc]
push eax
lea eax, [ebp - 0x11cc]
push eax
lea ecx, [ebp - 0x1400]
movdqu xmmword [ebp - 0x11cc], xmm0
call fcn.10018805
lea ecx, [ebp - 0x20d]
mov esi, eax
call fcn.1000c103
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1370]
push dword [esi]
call fcn.100187b4
xor esi, esi
mov dword [ebp - 4], 0x14
inc esi
lea ecx, [ebp - 0x538]
push esi
call fcn.10018755
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1003020e
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x538]
call fcn.100187f6
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100301f0
xor eax, eax
push eax
lea ecx, [ebp - 0x538]
call fcn.100187f6
mov dword [eax], 0x11
jmp 0x1003024c
xor eax, eax
mov dword [ebp - 0x1c], 0xeede0b40
mov dword [ebp - 0x1c], eax
jmp 0x10030238
cmp dword [ebp - 0x1c], eax
jne 0x1003023e
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe2
jne 0x10030230
push eax
lea ecx, [ebp - 0x538]
call fcn.100187f6
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x538]
push eax
call fcn.100187f6
cmp dword [eax], 0xffffffee
jle 0x10030222
lea ecx, [ebp - 0x538]
mov byte [ebp - 4], 0x14
call fcn.100187da
or eax, 0xffffffff
lea ecx, [ebp - 0x740]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x44], 0xb22124f8
push 4
call fcn.10018755
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x48], 0x1b05
mov dword [ebp - 0x34], 0x67e6aa16
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x100302d0
or esi, 0xffffffff
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x740]
call fcn.100187f6
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100302b2
xor esi, esi
xor eax, eax
inc esi
cmp dword [ebp - 0x3c], eax
je 0x100302d7
mov eax, esi
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x740]
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
shl eax, 3
mov dword [ebp - 0x34], eax
push 2
call fcn.100187f6
mov ecx, dword [ebp - 0x44]
imul ecx, dword [eax]
cmp ecx, 0xfffffffc
jbe 0x10030307
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x10030307
mov esi, eax
xor eax, eax
lea ecx, [ebp - 0x740]
inc eax
push eax
call fcn.100187f6
xor ecx, ecx
mov byte [ebp - 4], 0x14
cmp esi, 7
setne cl
xor edx, edx
cmp ecx, 0x37f4a7d2
setl dl
xor ecx, ecx
cmp edx, 0x857b
setne cl
mov dword [eax], ecx
lea ecx, [ebp - 0x740]
call fcn.100187da
push 3
lea ecx, [ebp - 0x478]
call fcn.10018755
mov byte [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x3c], 0x58331c58
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1003038b
push dword [ebp - 0x24]
lea ecx, [ebp - 0x478]
call fcn.100187f6
and dword [eax], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1003036f
xor eax, eax
mov dword [ebp - 0x24], eax
or esi, 0xffffffff
cmp dword [ebp - 0x24], 3
jge 0x100303a6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xec8], esi
inc dword [ebp - 0x24]
jmp 0x10030391
push 2
lea ecx, [ebp - 0x478]
call fcn.100187f6
push 2
lea ecx, [ebp - 0x478]
and dword [eax], 0
call fcn.100187f6
cmp dword [eax], 0x17
jge 0x100304dc
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
jmp 0x100304a5
mov dword [ebp - 0x44], 0xa956
lea ecx, [ebp - 0x74c]
mov dword [ebp - 0x3c], 0x80d68f98
call fcn.10018755
xor eax, eax
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x1c], eax
jmp 0x1003040e
push dword [ebp - 0x1c]
call fcn.100187f6
mov dword [eax], 0xb168f928
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
lea ecx, [ebp - 0x74c]
jl 0x100303fd
mov eax, dword [ebp - 0x3c]
xor ebx, ebx
add eax, dword [ebp - 0xec4]
inc ebx
neg eax
mov dword [ebp - 0x3c], eax
push ebx
call fcn.100187f6
mov ecx, dword [ebp - 0x30]
xor edx, edx
add ecx, dword [ebp - 0x3c]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x478]
setne dl
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.100187f6
xor ecx, ecx
push ebx
cmp dword [eax], 0x8c9a
setg cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x74c]
call fcn.100187f6
mov ecx, dword [ebp - 0xec4]
xor ebx, ebx
cmp ecx, dword [ebp - 0x34]
setg bl
xor edx, edx
sub ebx, dword [eax]
mov eax, dword [ebp - 0x44]
cmp eax, ebx
mov eax, dword [ebp - 0x44]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x74c]
mov byte [ebp - 4], 0x17
call fcn.100187da
inc dword [ebp - 0x30]
push 7
pop eax
push 2
cmp dword [ebp - 0x30], eax
je 0x100303d9
lea ecx, [ebp - 0x478]
call fcn.100187f6
push 2
lea ecx, [ebp - 0x478]
inc dword [eax]
call fcn.100187f6
cmp dword [eax], 0x17
jl 0x100303cc
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x478]
mov byte [ebp - 4], 0x14
call fcn.100187da
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0x20], 0xd7b1
mov dword [ebp - 0x50], esi
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x20], eax
jg 0x10030610
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], 0xf9481f34
mov dword [ebp - 0x38], 0xf219a6fd
mov dword [ebp - 0x20], 0xfffffff3
cmp dword [ebp - 0x20], 0x24
jg 0x10030624
jmp 0x10030533
xor eax, eax
mov dword [ebp - 0x34], 0x6fec1b16
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1003055c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4b4], 0xfffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10030543
xor eax, eax
mov dword [ebp - 0x50], 0xae49
cmp dword [ebp - 0x14], eax
jne 0x10030579
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10030579
mov esi, eax
jmp 0x1003057e
xor eax, eax
lea esi, [eax + 1]
mov eax, dword [ebp - 0x4b0]
xor edx, edx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x4b0]
sub ecx, eax
mov eax, dword [ebp - 0x38]
cmp ecx, esi
setge dl
sub edx, eax
xor eax, eax
add edx, 0x47310047
cmp edx, 0xe7790660
jne 0x100305b3
cmp dword [ebp - 0x20], eax
je 0x100305b8
cmp dword [ebp - 0x34], eax
jne 0x100305be
mov eax, dword [ebp - 0x4b0]
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x20]
jl 0x100305ed
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x100305fe
push 0x678
push eax
push eax
push 0x716
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
jmp 0x100305fe
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x100305fe
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x24
jle 0x10030531
or esi, 0xffffffff
jmp 0x10030624
mov dword [ebp - 0x34], 0x5c3421ad
mov dword [ebp - 0x50], 0x8b474307
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x34], eax
cmp byte [ebp - 0xd], 0
je 0x10030786
push 8
pop eax
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0xbe4]
push 4
call fcn.10018755
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x34], 0x20f30385
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10030676
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbe4]
call fcn.100187f6
mov dword [eax], 0xfba2522a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10030657
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jle 0x1003076a
mov dword [ebp - 0x24], 0x53aa9ac7
mov dword [ebp - 0x3c], 0xcb314b81
mov dword [ebp - 0x24], 0x16
jmp 0x1003074e
xor ecx, ecx
mov dword [ebp - 0x3c], 0xaa05
mov dword [ebp - 0x34], 0xea5d840d
mov eax, dword [ebp - 0x3c]
cmp eax, 0x53a38d06
push 2
setg cl
xor eax, eax
cmp ecx, 0x657e3b6f
setle al
xor edx, edx
cmp eax, 3
sete dl
xor ecx, ecx
sub edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
sub edx, 4
cmp edx, 0x626a
setne cl
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0xbe4]
setge bl
call fcn.100187f6
mov dword [eax], ebx
cmp ebx, dword [ebp - 0x24]
jl 0x10030707
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10030707
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x1003070c
xor ebx, ebx
inc ebx
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor eax, eax
cmp dword [ebp - 0x24], ecx
jge 0x1003073c
mov edx, ebx
cmp dword [ebp - 0x20], eax
jne 0x1003073e
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffd
jg 0x1003069c
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jg 0x10030682
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0xbe4]
mov byte [ebp - 4], 0x14
call fcn.100187da
xor eax, eax
inc eax
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x3c], 0x8f928d9b
mov dword [ebp - 0x14], 0x18c9
mov dword [ebp - 0x1c], 0x9b3
mov dword [ebp - 0x1c], eax
jmp 0x100307b9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x98], 0x13638ecf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100307a8
mov eax, dword [ebp - 0x98]
xor eax, eax
cmp dword [ebp - 0x98], eax
jne 0x100307fd
mov eax, dword [ebp - 0x98]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x34]
cmp eax, ebx
mov eax, dword [ebp - 0x98]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x98]
cmp eax, ecx
setl dl
xor eax, eax
cmp edx, dword [ebp - 0x98]
je 0x10030831
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x34], eax
jmp 0x1003084f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030851
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x98], 0x44f4cc51
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030839
xor eax, eax
mov dword [ebp - 0x28], eax
push 7
pop eax
cmp dword [ebp - 0x28], eax
jg 0x10031a2e
jmp 0x10030865
lea eax, [ebp - 0x101c]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x102c]
push eax
lea ecx, [ebp - 0x14b8]
movdqu xmmword [ebp - 0x102c], xmm0
call fcn.10018805
lea ecx, [ebp - 0x253]
mov esi, eax
call fcn.1000c103
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x13c]
push dword [esi]
call fcn.100187b4
mov byte [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x24], 0x5ccc90a3
mov dword [ebp - 0x24], eax
jmp 0x10030bfe
mov dword [ebp - 0x18], 0x32937a3a
lea ecx, [ebp - 0x98c]
mov dword [ebp - 0x44], 0xfffffffd
push 3
call fcn.10018755
mov byte [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x54], 0xa6df
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1003090c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x98c]
call fcn.100187f6
mov dword [eax], 0x85bb31cf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100308ed
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x10030bec
or esi, 0xffffffff
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x71c]
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x30], 0x55073046
push 2
call fcn.10018755
xor eax, eax
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10030968
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x71c]
call fcn.100187f6
mov dword [eax], 0x6156
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10030949
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x10030bb6
jmp 0x10030979
xor eax, eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x1c], 0xb91ee328
mov esi, dword [ebp - 0x20]
push dword [ebp - 0x18]
neg esi
sbb esi, esi
neg esi
call fcn.100187f6
xor ecx, ecx
cmp esi, dword [eax]
setne cl
sub ecx, 0xd2eb
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
lea ecx, [ebp - 0x13c]
setl dl
mov dword [ebp - 0x30], edx
push dword [ebp - 0x18]
call fcn.100187f6
push dword [ebp - 0x18]
lea ecx, [ebp - 0x13c]
mov esi, eax
call fcn.100187f6
mov ecx, dword [esi]
xor ebx, ebx
push dword [ebp - 0x24]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x13c]
setle bl
call fcn.100187f6
mov ecx, dword [ebp - 0x30]
push dword [ebp - 0x18]
add ecx, dword [eax]
xor eax, eax
cmp ebx, ecx
lea ecx, [ebp - 0x13c]
setle al
sub eax, 0x3196
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
call fcn.100187f6
mov edx, dword [ebp - 0x24]
xor ebx, ebx
mov ecx, dword [ebp - 0x20]
add edx, dword [ebp - 0x34]
cmp edx, ecx
setl bl
xor ecx, ecx
add ebx, dword [eax]
mov eax, dword [ebp - 0x18]
cmp ebx, eax
setle cl
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x13c]
push dword [ebp - 0x24]
call fcn.100187f6
cmp dword [eax], 0
je 0x10030b27
mov dword [ebp - 0x3c], 0x8ebcce3f
xor eax, eax
mov dword [ebp - 0x38], 0xfffffffd
cmp dword [ebp - 0x14], eax
jne 0x10030ac0
dec dword [ebp - 0x3c]
je 0x10030a8b
push dword [ebp - 0x24]
lea ecx, [ebp - 0x13c]
call fcn.100187f6
xor ebx, ebx
cmp dword [eax], ebx
je 0x10030a89
xor eax, eax
lea esi, [eax + 1]
jmp 0x10030a8f
xor eax, eax
mov esi, eax
xor ebx, ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x13c]
call fcn.100187f6
mov ecx, dword [ebp - 0x44]
xor edx, edx
cmp ecx, dword [eax]
setne dl
sub edx, esi
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x54]
jle 0x10030ac0
mov eax, ebx
xor ebx, ebx
inc ebx
jmp 0x10030ac5
xor ebx, ebx
inc ebx
mov eax, ebx
cmp eax, ebx
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
jne 0x10030ad3
mov eax, dword [ebp - 0x54]
push 3
lea ecx, [ebp - 0x13c]
call fcn.100187f6
push 2
lea ecx, [ebp - 0x13c]
call fcn.100187f6
mov edx, dword [ebp - 0x3c]
sub edx, 0xb5c1
neg edx
push ebx
sbb edx, edx
xor ecx, ecx
inc edx
cmp dword [eax], edx
sete cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x98c]
mov esi, dword [ebp - 0x38]
call fcn.100187f6
mov dword [eax], esi
mov dword [ebp - 0x1c], esi
or esi, 0xffffffff
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
jmp 0x10030ba9
or esi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x10030ba6
mov dword [ebp - 0x48], 0x3a8461a
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jg 0x10030ba1
push 8
pop ecx
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030b64
push eax
push 0x1b5b
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x13c]
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x20]
call fcn.100187f6
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x71c]
setge bl
xor eax, eax
push eax
call fcn.100187f6
push 0
mov dword [eax], ebx
mov dword [ebp - 0x48], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
pop eax
jle 0x10030b48
inc dword [ebp - 0x1c]
jmp 0x10030b32
xor ebx, ebx
inc ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x10030977
push dword [ebp - 0x24]
lea ecx, [ebp - 0x13c]
call fcn.100187f6
lea ecx, [ebp - 0x71c]
cmp dword [eax], 0
jne 0x10030be7
mov byte [ebp - 4], 0x1b
call fcn.100187da
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x1003091c
jmp 0x10030bec
call fcn.100187da
lea ecx, [ebp - 0x98c]
mov byte [ebp - 4], 0x1a
call fcn.100187da
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x100308bc
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x14
call fcn.100187da
push ebx
lea ecx, [ebp - 0xf9c]
call fcn.10018755
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x1c], 0xb26bdde0
mov dword [ebp - 0x1c], 0xfffffffe
cmp dword [ebp - 0x1c], 0xf
jge 0x10030c58
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10030c58
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030c4f
call edi
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
jl 0x10030c3d
mov dword [ebp - 0x2c], 0x87a912e7
lea ecx, [ebp - 0x764]
mov dword [ebp - 0x18], 0xd59e57ad
mov dword [ebp - 0x3c], 0x5fdc8dfb
push 2
call fcn.10018755
xor eax, eax
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10030ca2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x4c4], 0x6e3e45bb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10030c89
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10030cba
push dword [ebp - 0x24]
lea ecx, [ebp - 0x764]
call fcn.100187f6
mov dword [eax], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10030ca7
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x3c], 0xea38
mov eax, dword [ebp - 0x18]
cmp eax, 0xfffffff8
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x3c]
imul edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x4c0], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
setne cl
xor eax, eax
neg ecx
cmp ecx, 0x5bc42206
setne al
cmp dword [ebp - 0x18], eax
je 0x10030d1f
xor eax, eax
cmp dword [ebp - 0x4c0], eax
je 0x10030d21
mov esi, ebx
jmp 0x10030d23
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x764]
call fcn.100187f6
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c0]
cmp ecx, eax
lea ecx, [ebp - 0x764]
setl dl
xor eax, eax
mov dword [ebp - 0x18], edx
push eax
call fcn.100187f6
lea ecx, [ebp - 0x764]
mov eax, dword [eax]
mov dword [ebp - 0x4c0], eax
mov byte [ebp - 4], 0x1d
call fcn.100187da
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030d9b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x59c], 0x39924432
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030d83
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10030daf
mov dword [ebp - 0x34], 0xa2cb
cmp dword [ebp - 0x34], eax
jne 0x10030db5
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff2
jl 0x10030da0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10030dd5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x59c], 7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10030dbd
xor eax, eax
push 9
pop edx
mov dword [ebp - 0x2c], edx
push 2
pop ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0x2c4df8e3
mov dword [ebp - 0x18], 0x19
jmp 0x10030e0f
mov dword [ebp - 0x34], 0xc69aed23
cmp dword [ebp - 0x18], eax
jne 0x10030e15
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], 0x16
jg 0x10030df7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10030e24
mov eax, ebx
neg eax
mov dword [ebp - 0x1c], eax
je 0x10030e68
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10030e40
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10030e6a
cmp dword [ebp - 0x18], eax
je 0x10030e6a
mov eax, ebx
jmp 0x10030e6a
xor eax, eax
mov dword [ebp - 0x34], eax
or esi, 0xffffffff
mov dword [ebp - 0x2c], 3
xor eax, eax
mov dword [ebp - 0x30], 0xac64a684
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x3c], edx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10030ea1
push 0x1eaf
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x30], esi
jmp 0x10030eda
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x10030ed4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1410], 0xc4ab274b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10030ebc
xor eax, eax
dec dword [ebp - 0x3c]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jg 0x10030ea6
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], 0x24ec2e0c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030f10
push 0x1256
push 0x15b5
push eax
push eax
push 0x14a6
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp - 0x30], 0xffffffe7
jmp 0x10030fac
push 3
lea ecx, [ebp - 0x6f8]
call fcn.10018755
mov byte [ebp - 4], 0x1f
xor eax, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10030f5a
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x6f8]
call fcn.100187f6
mov dword [eax], 0x2bb11acc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10030f3b
xor eax, eax
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x10030f9a
mov dword [ebp - 0x34], 0x374c7af5
lea ecx, [ebp - 0x6f8]
push dword [ebp - 0x1c]
call fcn.100187f6
mov esi, eax
lea ecx, [ebp - 0x6f8]
xor eax, eax
push eax
call fcn.100187f6
mov ecx, dword [eax]
mov dword [esi], ecx
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x1c]
jns 0x10030f66
or esi, 0xffffffff
lea ecx, [ebp - 0x6f8]
mov byte [ebp - 4], 0x1d
call fcn.100187da
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe9
je 0x10030f1c
mov dword [ebp - 0x70], ebx
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x4c], 0x32bb11ac
push ebx
call fcn.10018755
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xb24]
mov dword [ebp - 0x20], 0xbf495e3b
mov dword [ebp - 0x24], 0x1c25c539
mov dword [ebp - 0x44], ebx
push 2
call fcn.10018755
xor eax, eax
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003101f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x198]
call fcn.100187f6
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10031005
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10031041
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa4], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10031028
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003105d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9c], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10031049
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10031078
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb24]
call fcn.100187f6
push 8
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10031062
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x198]
xor ebx, ebx
push ebx
call fcn.100187f6
cmp dword [eax], ebx
je 0x100310bb
push ebx
lea ecx, [ebp - 0x198]
call fcn.100187f6
push ebx
lea ecx, [ebp - 0x198]
call fcn.100187f6
mov ecx, dword [ebp - 0x4c]
add ecx, dword [eax]
neg ecx
jne 0x100310bb
xor esi, esi
inc esi
mov ecx, esi
jmp 0x100310c4
xor eax, eax
xor esi, esi
xor ebx, ebx
mov ecx, eax
inc esi
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x4c]
cmp eax, ecx
je 0x100310e0
push ebx
lea ecx, [ebp - 0x198]
call fcn.100187f6
cmp dword [eax], ebx
mov eax, ebx
je 0x100310e2
mov eax, esi
mov dword [ebp - 0xa0], eax
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x20], eax
push ebx
call fcn.100187f6
mov ecx, dword [ebp - 0xa0]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x20]
jg 0x1003110a
mov eax, dword [ebp - 0xa0]
push ebx
lea ecx, [ebp - 0x198]
call fcn.100187f6
mov ecx, dword [ebp - 0x9c]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x198]
setl bl
xor eax, eax
push eax
call fcn.100187f6
mov ecx, dword [ebp - 0x9c]
xor edx, edx
cmp ecx, ebx
setne dl
xor ebx, ebx
xor ecx, ecx
inc ebx
cmp edx, ebx
setle cl
imul ecx, dword [eax]
xor eax, eax
test ecx, ecx
jne 0x1003115b
mov esi, eax
cmp dword [ebp - 0xa0], eax
je 0x1003115d
mov esi, ebx
push eax
lea ecx, [ebp - 0x198]
call fcn.100187f6
xor ecx, ecx
cmp esi, 0xb718
setl cl
imul ecx, dword [ebp - 0xa0]
mov edx, dword [eax]
mov eax, dword [ebp - 0x9c]
imul ecx, ecx, 0x705b
sub edx, ecx
sub edx, eax
mov eax, dword [ebp - 0x9c]
imul eax, edx
cmp eax, dword [ebp - 0x20]
je 0x100312ff
or esi, 0xffffffff
lea ecx, [ebp - 0x1370]
mov dword [ebp - 4], esi
call fcn.100187da
mov ebx, dword [sym.imp.ADVAPI32.dll_GetLengthSid]
xor eax, eax
push 3
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
pop edi
jmp 0x10031ad1
movdqa xmm0, xmmword [0x1000ad90]
lea eax, [ebp - 0x103c]
push eax
lea eax, [ebp - 0x104c]
push eax
lea ecx, [ebp - 0x1420]
movdqu xmmword [ebp - 0x104c], xmm0
call fcn.10018805
lea ecx, [ebp - 0x255]
mov esi, eax
call fcn.1000c103
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xdd8]
push dword [esi]
call fcn.100187b4
xor eax, eax
mov dword [ebp - 4], 0x2e
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10031aaf
push eax
call ebx
xor eax, eax
push eax
lea ecx, [ebp - 0xdd8]
call fcn.100187f6
or esi, 0xffffffff
lea ecx, [ebp - 0xdd8]
inc dword [eax]
mov dword [ebp - 4], esi
call fcn.100187da
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x10031a52
push 4
lea ecx, [ebp - 0x9bc]
call fcn.10018755
xor eax, eax
mov dword [ebp - 4], 0x2f
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10031b17
push dword [ebp - 0x28]
lea ecx, [ebp - 0x9bc]
call fcn.100187f6
mov dword [eax], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10031afc
xor eax, eax
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], eax
jl 0x10031b37
push dword [ebp - 0x28]
lea ecx, [ebp - 0x9bc]
call fcn.100187f6
cmp dword [eax], 0
jne 0x10031b37
dec dword [ebp - 0x28]
jns 0x10031b1f
lea ecx, [ebp - 0x9bc]
mov dword [ebp - 4], esi
call fcn.100187da
mov dword [ebp - 0x1c], 0x6b0f
mov dword [ebp - 0x2c], 0xd089
inc dword [ebp - 0x1c]
mov dword [ebp - 0x1c], 0xfffffff3
cmp dword [ebp - 0x1c], 0x1d
jl 0x10031d10
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0xee0]
push esi
call fcn.10018755
xor eax, eax
mov dword [ebp - 4], 0x30
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10031ba8
push dword [ebp - 0x28]
lea ecx, [ebp - 0xee0]
call fcn.100187f6
mov dword [eax], 0xfc39
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10031b8a
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffed
jle 0x10031cef
or ecx, 0xffffffff
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 6
cmp dword [ebp - 0x30], 0xf
je 0x10031ce2
mov dword [ebp - 0x4c], 0x74006310
mov dword [ebp - 0x4c], eax
jmp 0x10031caa
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10031bfd
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x31c], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x10031be4
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031c0f
push eax
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
mov dword [ebp - 0x31c], eax
jmp 0x10031c9b
mov dword [ebp - 0x14], 0xbaef6e22
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x10031c81
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031c7c
push eax
push 0x26ac
push 0x1741
push 0x17a3
push 0x2129
push 0x1346
push 0x5d3
push 0xfcc
push 0x1ab5
push 0x1499
push 0xd4e
push 0x2a0
push 0x65a
push 0xc1b
call dword [sym.imp.GDI32.dll_CreateFontA]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x10031c29
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031c95
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
xor eax, eax
inc dword [ebp - 0x31c]
cmp dword [ebp - 0x31c], eax
jle 0x10031c1a
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
jle 0x10031bdb
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031cd2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xf
jne 0x10031bcc
or ecx, 0xffffffff
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffed
jg 0x10031bb8
or eax, 0xffffffff
lea ecx, [ebp - 0xee0]
mov dword [ebp - 4], eax
call fcn.100187da
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1d
jge 0x10031b6a
or esi, 0xffffffff
push 4
lea ecx, [ebp - 0xb3c]
call fcn.10018755
xor eax, eax
mov dword [ebp - 4], 0x31
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10031d4d
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb3c]
call fcn.100187f6
mov dword [eax], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10031d32
xor eax, eax
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], eax
jl 0x10031d6d
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb3c]
call fcn.100187f6
cmp dword [eax], 0
jne 0x10031d6d
dec dword [ebp - 0x28]
jns 0x10031d55
lea ecx, [ebp - 0xb3c]
mov dword [ebp - 4], esi
call fcn.100187da
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
jmp 0x10031e04
movdqa xmm0, xmmword [0x1000ad90]
lea eax, [ebp - 0x123c]
push eax
lea eax, [ebp - 0x124c]
push eax
lea ecx, [ebp - 0x14a8]
movdqu xmmword [ebp - 0x124c], xmm0
call fcn.10018805
lea ecx, [ebp - 0x22d]
mov esi, eax
call fcn.1000c103
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xdf0]
push dword [esi]
call fcn.100187b4
xor eax, eax
mov dword [ebp - 4], 0x32
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10031de2
push eax
call ebx
xor eax, eax
push eax
lea ecx, [ebp - 0xdf0]
call fcn.100187f6
or esi, 0xffffffff
lea ecx, [ebp - 0xdf0]
inc dword [eax]
mov dword [ebp - 4], esi
call fcn.100187da
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x10031d85
mov dword [ebp - 0x3c], esi
lea ecx, [ebp - 0x9d4]
push 7
pop eax
mov dword [ebp - 0x14], 0xad5befa1
xor ebx, ebx
mov dword [ebp - 0x54], 0xfffffff9
inc ebx
mov dword [ebp - 0x2c], eax
push 8
pop eax
mov dword [ebp - 0x44], 0x6193fe69
push 2
mov dword [ebp - 0x38], 0x2d50fa8f
pop esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x28], esi
push 4
call fcn.10018755
xor eax, eax
mov dword [ebp - 4], 0x33
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10031e7a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x3a8], 0xd7f19125
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10031e62
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10031ea2
push dword [ebp - 0x24]
lea ecx, [ebp - 0x9d4]
call fcn.100187f6
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10031e83
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031eb2
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp eax, 0xa3a6
setge cl
mov dword [ebp - 0x3a8], ecx
test ecx, ecx
jne 0x10031ecc
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
xor edx, edx
dec dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x3a8]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x54]
setle cl
xor edx, edx
cmp ecx, eax
setl dl
imul edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x6f2b
jg 0x10031f24
cmp dword [ebp - 0x14], eax
je 0x10031f24
mov eax, ebx
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x9d4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x28]
push esi
call fcn.100187f6
or edi, 0xffffffff
lea ecx, [ebp - 0x9d4]
and dword [eax], 0
mov dword [ebp - 4], edi
call fcn.100187da
push esi
lea ecx, [ebp - 0x4fc]
call fcn.10018755
mov dword [ebp - 4], 0x34
lea ecx, [ebp - 0x36c]
mov dword [ebp - 0x44], 0x41449c9f
mov dword [ebp - 0x38], 0x800f
mov dword [ebp - 0x3c], 0x5fcc58a0
push ebx
call fcn.10018755
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x9ec]
mov dword [ebp - 0x54], 0x3d783989
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x3c], 0xfffffff9
push 4
call fcn.10018755
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0xbfc]
mov dword [ebp - 0x50], 0x387c7a50
push 4
call fcn.10018755
xor eax, eax
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10031fe6
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4fc]
call fcn.100187f6
mov dword [eax], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10031fcc
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10032009
push dword [ebp - 0x18]
lea ecx, [ebp - 0x36c]
call fcn.100187f6
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10031fee
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10032031
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9ec]
call fcn.100187f6
mov dword [eax], 0xc10b42b8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10032012
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10032053
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1334], 0x80d0e101
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003203a
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1003206f
push dword [ebp - 0x18]
lea ecx, [ebp - 0xbfc]
call fcn.100187f6
mov dword [eax], 0x52ee
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10032058
push ebx
lea ecx, [ebp - 0x4fc]
call fcn.100187f6
cmp dword [eax], 0
jne 0x10032094
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
test eax, eax
jne 0x10032094
mov edi, eax
jmp 0x10032096
mov edi, ebx
push ebx
lea ecx, [ebp - 0x4fc]
call fcn.100187f6
xor ebx, ebx
lea ecx, [ebp - 0x36c]
cmp dword [eax], 0xdf47
setge bl
xor eax, eax
push eax
call fcn.100187f6
mov eax, dword [eax]
imul eax, ebx
test eax, eax
je 0x100320ce
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x100320d0
inc eax
jmp 0x100320d0
xor eax, eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x36c]
mov eax, dword [ebp - 0x3c]
xor ebx, ebx
mov dword [ebp - 0x44], eax
push ebx
call fcn.100187f6
push ebx
lea ecx, [ebp - 0x36c]
mov esi, eax
call fcn.100187f6
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x4fc]
setge dl
xor eax, eax
inc eax
mov dword [ebp - 0x54], edx
push eax
call fcn.100187f6
imul esi, dword [ebp - 0x38], 0xadf8
lea ecx, [ebp - 0x9ec]
push 2
add esi, dword [eax]
call fcn.100187f6
push ebx
lea ecx, [ebp - 0x36c]
mov dword [eax], esi
call fcn.100187f6
mov eax, dword [eax]
imul eax, esi
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x38]
je 0x10032152
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x10032154
xor ecx, ecx
lea esi, [ecx + 1]
jmp 0x10032156
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x36c]
call fcn.100187f6
xor ebx, ebx
mov dword [ebp - 0x132c], esi
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x36c]
push ebx
call fcn.100187f6
push ebx
lea ecx, [ebp - 0xbfc]
call fcn.100187f6
inc ebx
lea ecx, [ebp - 0x4fc]
push ebx
call fcn.100187f6
xor eax, eax
lea ecx, [ebp - 0xbfc]
test edi, edi
setns al
imul eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
call fcn.100187da
lea ecx, [ebp - 0x9ec]
call fcn.100187da
lea ecx, [ebp - 0x36c]
call fcn.100187da
or esi, 0xffffffff
lea ecx, [ebp - 0x4fc]
mov dword [ebp - 4], esi
call fcn.100187da
mov edi, 0x6b0f
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x2c], 0xd089
inc dword [ebp - 0x1c]
mov dword [ebp - 0x1c], 0xfffffff3
jmp 0x10032376
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0xf5c]
push ebx
call fcn.10018755
xor eax, eax
mov dword [ebp - 4], 0x38
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1003222e
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf5c]
call fcn.100187f6
mov dword [eax], 0xfc39
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10032210
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1003235b
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 6
jmp 0x1003234e
mov dword [ebp - 0x4c], 0x74006310
mov dword [ebp - 0x4c], eax
jmp 0x10032323
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10032276
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x384], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1003225d
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032288
push eax
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
mov dword [ebp - 0x384], eax
jmp 0x10032314
mov dword [ebp - 0x14], 0xbaef6e22
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x100322fa
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100322f5
push eax
push 0x26ac
push 0x1741
push 0x17a3
push 0x2129
push 0x1346
push 0x5d3
push 0xfcc
push 0x1ab5
push 0x1499
push 0xd4e
push 0x2a0
push 0x65a
push 0xc1b
call dword [sym.imp.GDI32.dll_CreateFontA]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x100322a2
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003230e
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
xor eax, eax
inc dword [ebp - 0x384]
cmp dword [ebp - 0x384], eax
jle 0x10032293
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
jle 0x10032254
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003234b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xf
jne 0x10032245
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffed
jg 0x10032236
lea ecx, [ebp - 0xf5c]
mov dword [ebp - 4], esi
call fcn.100187da
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1d
jge 0x100321f0
mov dword [ebp - 0x2c], 0x39b642c7
xor eax, eax
mov dword [ebp - 0x34], 0xd837bc75
mov dword [ebp - 0x2c], 0xc0f8067e
mov dword [ebp - 0x3c], 0xbe39e3cf
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], eax
jmp 0x100323b7
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x14e4], 0x1d976ff5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x100323a6
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x10032467
movdqa xmm0, xmmword [0x1000ad90]
lea eax, [ebp - 0x105c]
push eax
lea eax, [ebp - 0x106c]
push eax
lea ecx, [ebp - 0x1390]
movdqu xmmword [ebp - 0x106c], xmm0
call fcn.10018805
lea ecx, [ebp - 0x199]
mov esi, eax
call fcn.1000c103
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xe08]
push dword [esi]
call fcn.100187b4
xor eax, eax
mov dword [ebp - 4], 0x39
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10032439
push eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
xor eax, eax
push eax
lea ecx, [ebp - 0xe08]
call fcn.100187f6
or esi, 0xffffffff
lea ecx, [ebp - 0xe08]
inc dword [eax]
mov dword [ebp - 4], esi
call fcn.100187da
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jle 0x100323d8
xor eax, eax
mov dword [ebp - 0x3c], 0xb7d8cf4c
mov dword [ebp - 0x2c], 0xe46c2e7c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x2c], 0x46b8d963
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x2c], 0x725245f5
mov dword [ebp - 0x2c], 0x43ddca27
mov dword [ebp - 0x2c], 0xf12f3ccd
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x58], 0xd5493e6
mov dword [ebp - 0x2c], 0x9ba87a5
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x44], 0x3f5e3d1a
mov dword [ebp - 0x14], 0xffff
mov dword [ebp - 0x2c], 0xe2095e04
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x100324ed
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x4dc], 0xb34e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x100324d4
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1003250e
push 8
pop ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x153c], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x100324f9
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032527