Function at 0x1002973c
Capabilities:
Check for time delay via queryperformancecounter
Create process on windows
Get file attributes
Get geographical location
Get thread local storage value
Parse pe header
Query environment variable
Set thread local storage value
Terminate process

Disassembly:
mov eax, 0x100769c7
call fcn.100750ac
mov eax, 0x1654
call fcn.100726f0
xor eax, eax
mov dword [ebp - 0x20], 0x477862f
push ebx
mov byte [ebp - 0x39], al
push esi
push edi
mov byte [ebp - 0x59], dl
mov dword [ebp - 0x54], ecx
cmp byte [ebp - 0x39], al
je 0x10029773
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 3
mov dword [ebp - 0x20], 0x12
pop ebx
jmp 0x100297ab
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100297a3
push 0x19f3
push 0x1e76
call edi
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x100297b0
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jg 0x10029785
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x28], 0xc0aa39ed
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100297d4
push 0x113
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [ebp - 0x1c], 7
jmp 0x100297e7
mov dword [ebp - 0x28], 0x22124f84
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xc
jl 0x100297dd
xor ecx, ecx
mov dword [ebp - 0x14], eax
inc ecx
cmp dword [ebp - 0x14], ecx
jge 0x10029813
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x784], 0x17571177
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x100297f8
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10029833
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4e4], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002981b
xor eax, eax
mov dword [ebp - 0x4e0], eax
jmp 0x10029852
mov eax, dword [ebp - 0x4e0]
mov dword [ebp + eax*4 - 0x784], 4
inc dword [ebp - 0x4e0]
xor eax, eax
inc eax
cmp dword [ebp - 0x4e0], eax
jl 0x1002983b
push 2
pop esi
mov dword [ebp - 0x20], 0x8ade19d2
lea ecx, [ebp - 0x190]
push esi
call fcn.10015404
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0xffb871c7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x100298a5
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x190]
call fcn.100154a2
mov dword [eax], 0xa684
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10029887
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x24], eax
jg 0x10029a89
mov dword [ebp - 0x38], 0x440e708b
lea ecx, [ebp - 0x190]
push dword [ebp - 0x24]
call fcn.100154a2
push dword [ebp - 0x24]
xor ebx, ebx
lea ecx, [ebp - 0x190]
mov eax, dword [eax]
inc eax
cmp eax, 0x145ba13b
setg bl
call fcn.100154a2
cmp dword [eax], ebx
jle 0x1002996d
mov dword [ebp - 0x50], 0xd976
lea ecx, [ebp - 0x190]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
push dword [ebp - 0x24]
call fcn.100154a2
push dword [ebp - 0x24]
lea ecx, [ebp - 0x190]
call fcn.100154a2
xor eax, eax
lea ecx, [ebp - 0x190]
push eax
call fcn.100154a2
xor eax, eax
lea ecx, [ebp - 0x190]
inc eax
push eax
call fcn.100154a2
push dword [ebp - 0x24]
lea ecx, [ebp - 0x190]
call fcn.100154a2
xor eax, eax
lea ecx, [ebp - 0x190]
push eax
call fcn.100154a2
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10029a86
jmp 0x10029a77
xor ebx, ebx
lea ecx, [ebp - 0x64c]
inc ebx
push ebx
call fcn.10015404
mov byte [ebp - 4], bl
xor eax, eax
mov dword [ebp - 0x50], 0x75278539
mov dword [ebp - 0x28], 0xf96354d1
mov dword [ebp - 0x1c], eax
jmp 0x100299ab
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x64c]
call fcn.100154a2
mov dword [eax], 0xad31
inc dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x10029994
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x190]
push dword [ebp - 0x24]
call fcn.100154a2
mov esi, eax
lea ecx, [ebp - 0x64c]
xor eax, eax
push eax
call fcn.100154a2
mov ecx, dword [esi]
sub ecx, dword [eax]
xor eax, eax
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x64c]
push eax
call fcn.100154a2
mov edx, dword [ebp - 0x24]
mov esi, eax
mov ecx, dword [ebp - 0x24]
xor eax, eax
cmp edx, ecx
setge al
xor ecx, ecx
cmp eax, 4
setl cl
xor edx, edx
cmp ecx, dword [esi]
lea ecx, [ebp - 0x190]
setge dl
xor ebx, ebx
cmp edx, 0x4174aa7f
setg bl
xor eax, eax
push eax
call fcn.100154a2
mov ecx, dword [ebp - 0x50]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x64c]
setle dl
sub edx, ebx
neg edx
sbb edx, edx
xor eax, eax
inc edx
push eax
mov dword [ebp - 0x28], edx
call fcn.100154a2
mov edx, dword [ebp - 0x28]
xor ecx, ecx
cmp dword [eax], edx
setge cl
xor eax, eax
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10029a69
push 0x2670
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
lea ecx, [ebp - 0x64c]
mov byte [ebp - 4], al
call fcn.10015486
inc dword [ebp - 0x24]
xor eax, eax
inc eax
cmp dword [ebp - 0x24], eax
jle 0x100298b4
push 2
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0x190]
mov dword [ebp - 4], eax
call fcn.10015486
mov dword [ebp - 0x24], 0x2cb13638
xor eax, eax
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10029aca
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x120], 0x3342eb9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10029ab2
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x10029b09
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x120]
cmp eax, 0x565e
sete cl
xor eax, eax
cmp ecx, 8
setge al
mov dword [ebp - 0x20], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10029b04
call dword [sym.imp.USER32.dll_CreatePopupMenu]
dec dword [ebp - 0x24]
jns 0x10029ad5
mov dword [ebp - 0x20], 0x15
cmp dword [ebp - 0x20], 0x23
jle 0x10029c70
push 3
pop ebx
mov dword [ebp - 0x40], 0xb4ef66b1
lea ecx, [ebp - 0xce0]
push ebx
call fcn.10015404
push esi
lea ecx, [ebp - 0xaac]
mov dword [ebp - 4], esi
call fcn.10015404
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10029b6a
push dword [ebp - 0x14]
lea ecx, [ebp - 0xce0]
call fcn.100154a2
mov dword [eax], 0x82f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10029b4c
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10029b90
push dword [ebp - 0x14]
lea ecx, [ebp - 0xaac]
call fcn.100154a2
mov dword [eax], 0x65835a7a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10029b72
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x24], eax
jg 0x10029c44
mov dword [ebp - 0x40], 0x6c21
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x120]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x120]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x120]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x120]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x120]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x120]
cmp dword [ebp - 0x40], eax
je 0x10029c14
xor eax, eax
lea ecx, [ebp - 0xce0]
inc eax
push eax
call fcn.100154a2
cmp dword [eax], 0
jne 0x10029c14
xor eax, eax
mov esi, eax
inc eax
jmp 0x10029c19
xor eax, eax
inc eax
mov esi, eax
push eax
lea ecx, [ebp - 0xaac]
call fcn.100154a2
xor ecx, ecx
cmp esi, 0xd258
setge cl
mov dword [eax], ecx
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jle 0x10029b9f
push 2
pop esi
lea ecx, [ebp - 0xaac]
call fcn.10015486
or eax, 0xffffffff
lea ecx, [ebp - 0xce0]
mov dword [ebp - 4], eax
call fcn.10015486
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x23
jg 0x10029b1d
xor ebx, ebx
inc ebx
push 3
xor eax, eax
mov dword [ebp - 0x50], 0x2466e9f0
pop ecx
mov dword [ebp - 0x14], eax
push 0xfffffffffffffffe
pop edx
cmp dword [ebp - 0x14], ecx
jge 0x10029c9b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1630], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10029c87
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10029cbb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x163c], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10029ca3
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10029ccf
mov dword [ebp - 0x28], 0x5db3
cmp dword [ebp - 0x28], eax
jne 0x10029cd4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10029cc0
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x10029e1d
push ebx
lea ecx, [ebp - 0x550]
call fcn.10015404
push 4
pop ecx
mov dword [ebp - 4], ecx
xor eax, eax
push ecx
mov dword [ebp - 0x28], 0xfffffff6
lea ecx, [ebp - 0x10e0]
mov dword [ebp - 0x28], eax
call fcn.10015404
push 5
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10029d3b
push dword [ebp - 0x14]
lea ecx, [ebp - 0x550]
call fcn.100154a2
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x10029d1a
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10029d63
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10e0]
call fcn.100154a2
mov dword [eax], 0x9646b8d9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10029d44
xor eax, eax
push eax
lea ecx, [ebp - 0x550]
call fcn.100154a2
mov dword [eax], esi
jmp 0x10029de1
push esi
lea ecx, [ebp - 0xf20]
call fcn.10015404
xor eax, eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10029dab
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xf20]
call fcn.100154a2
mov dword [eax], 3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10029d8d
xor eax, eax
inc dword [ebp - 0x50]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10029dc0
call edi
push eax
call dword [sym.imp.USER32.dll_SetCapture]
push 5
pop eax
lea ecx, [ebp - 0xf20]
mov byte [ebp - 4], al
call fcn.10015486
xor eax, eax
lea ecx, [ebp - 0x550]
push eax
call fcn.100154a2
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x550]
push eax
call fcn.100154a2
cmp dword [eax], 0
jge 0x10029d73
lea ecx, [ebp - 0x10e0]
call fcn.10015486
or eax, 0xffffffff
lea ecx, [ebp - 0x550]
mov dword [ebp - 4], eax
call fcn.10015486
dec dword [ebp - 0x20]
jns 0x10029ce0
mov dword [ebp - 0x20], 0x61928c17
mov dword [ebp - 0x20], 0xfffffffd
jmp 0x10029ec4
push ebx
lea ecx, [ebp - 0x99c]
call fcn.10015404
xor eax, eax
mov dword [ebp - 4], 7
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
jmp 0x10029e61
push dword [ebp - 0x1c]
call fcn.100154a2
mov dword [eax], 0x5d811f07
inc dword [ebp - 0x1c]
xor eax, eax
lea ecx, [ebp - 0x99c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x10029e50
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, eax
push eax
call fcn.100154a2
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x99c]
xor eax, eax
push eax
call fcn.100154a2
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
imul edx, dword [ebp - 0x20], 0xffffbffa
neg edx
sbb edx, edx
imul eax, dword [ebp - 0x50], 0xfffffff9
xor ecx, ecx
inc edx
cmp eax, edx
setne cl
or eax, 0xffffffff
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x99c]
mov dword [ebp - 4], eax
call fcn.10015486
dec dword [ebp - 0x20]
push 1
pop ebx
cmp dword [ebp - 0x20], 0xfffffff2
jge 0x10029e30
mov dword [ebp - 0x20], 0xfe7d8a87
lea ecx, [ebp - 0xac4]
push esi
call fcn.10015404
mov dword [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x1c], 0x4c3f4f88
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10029f13
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1430], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10029efa
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10029f3b
xor esi, esi
inc esi
push dword [ebp - 0x14]
lea ecx, [ebp - 0xac4]
call fcn.100154a2
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10029f1e
xor eax, eax
jmp 0x10029f3e
xor esi, esi
inc esi
mov ebx, dword [sym.imp.USER32.dll_GetDC]
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jg 0x1002a09b
mov dword [ebp - 0x1c], eax
jmp 0x10029f69
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x978], 0x4b25b3b9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10029f58
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x1430], 0
jne 0x1002a099
xor eax, eax
mov dword [ebp - 0x974], ecx
cmp dword [ebp - 0x974], eax
jl 0x1002a08a
mov dword [ebp - 0x40], 0x951ea66e
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], eax
jl 0x1002a05f
push ecx
lea ecx, [ebp - 0x568]
call fcn.10015404
xor eax, eax
mov byte [ebp - 4], 9
mov dword [ebp - 0x1c], eax
jmp 0x10029fce
push dword [ebp - 0x1c]
call fcn.100154a2
mov dword [eax], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
lea ecx, [ebp - 0x568]
jl 0x10029fbd
push esi
call fcn.100154a2
and dword [eax], 0
jmp 0x1002a031
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002a007
push 0x282
push eax
push eax
push 0x46
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002a023
push eax
push eax
push 0x8dc
push 0x18ea
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
push esi
lea ecx, [ebp - 0x568]
call fcn.100154a2
inc dword [eax]
push esi
lea ecx, [ebp - 0x568]
call fcn.100154a2
cmp dword [eax], 3
jle 0x10029fe5
lea ecx, [ebp - 0x568]
mov byte [ebp - 4], 8
call fcn.10015486
dec dword [ebp - 0x40]
push 3
pop ecx
jns 0x10029fa6
xor eax, eax
push eax
lea ecx, [ebp - 0xac4]
call fcn.100154a2
push 0
mov dword [eax], 7
pop eax
mov dword [ebp - 0x1c], 0x131d
dec dword [ebp - 0x974]
push 3
pop ecx
jns 0x10029f93
inc dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], ecx
jle 0x10029f53
xor eax, eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x1002a0c5
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002a0c0
push 0x1603
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1002a0a3
or eax, 0xffffffff
lea ecx, [ebp - 0xac4]
mov dword [ebp - 4], eax
call fcn.10015486
mov dword [ebp - 0x34], 0x8ade19d2
xor eax, eax
mov dword [ebp - 0x20], 0x477862f
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002a0f7
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
xor eax, eax
push 3
mov dword [ebp - 0x20], 0x12
pop ebx
jmp 0x1002a129
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002a121
push 0x19f3
push 0x1e76
call edi
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002a12e
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jg 0x1002a103
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x28], 0xc0aa39ed
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002a152
push 0x113
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [ebp - 0x1c], 7
jmp 0x1002a165
mov dword [ebp - 0x28], 0x22124f84
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xc
jl 0x1002a15b
mov dword [ebp - 0x4c], 0x2466e9f0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002a195
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x798], 0x17571177
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1002a17a
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002a1b5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x580], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002a19d
xor eax, eax
mov dword [ebp - 0x57c], eax
jmp 0x1002a1d4
mov eax, dword [ebp - 0x57c]
mov dword [ebp + eax*4 - 0x798], 4
inc dword [ebp - 0x57c]
xor eax, eax
inc eax
cmp dword [ebp - 0x57c], eax
jl 0x1002a1bd
push 2
pop esi
push esi
lea ecx, [ebp - 0x178]
call fcn.10015404
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x24], 0xffb871c7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002a224
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x178]
call fcn.100154a2
mov dword [eax], 0xa684
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002a206
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x24], eax
jg 0x1002a40b
mov dword [ebp - 0x38], 0x440e708b
lea ecx, [ebp - 0x178]
push dword [ebp - 0x24]
call fcn.100154a2
push dword [ebp - 0x24]
xor ebx, ebx
lea ecx, [ebp - 0x178]
mov eax, dword [eax]
inc eax
cmp eax, 0x145ba13b
setg bl
call fcn.100154a2
cmp dword [eax], ebx
jle 0x1002a2ec
mov dword [ebp - 0x50], 0xd976
lea ecx, [ebp - 0x178]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
push dword [ebp - 0x24]
call fcn.100154a2
push dword [ebp - 0x24]
lea ecx, [ebp - 0x178]
call fcn.100154a2
xor eax, eax
lea ecx, [ebp - 0x178]
push eax
call fcn.100154a2
xor eax, eax
lea ecx, [ebp - 0x178]
inc eax
push eax
call fcn.100154a2
push dword [ebp - 0x24]
lea ecx, [ebp - 0x178]
call fcn.100154a2
xor eax, eax
lea ecx, [ebp - 0x178]
push eax
call fcn.100154a2
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002a405
jmp 0x1002a3f6
xor eax, eax
lea ecx, [ebp - 0x65c]
inc eax
push eax
call fcn.10015404
mov byte [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x50], 0x75278539
mov dword [ebp - 0x28], 0xf96354d1
mov dword [ebp - 0x1c], eax
jmp 0x1002a32b
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x65c]
call fcn.100154a2
mov dword [eax], 0xad31
inc dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002a314
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x178]
push dword [ebp - 0x24]
call fcn.100154a2
mov esi, eax
lea ecx, [ebp - 0x65c]
xor eax, eax
push eax
call fcn.100154a2
mov ecx, dword [esi]
sub ecx, dword [eax]
xor eax, eax
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x65c]
push eax
call fcn.100154a2
mov edx, dword [ebp - 0x24]
mov esi, eax
mov ecx, dword [ebp - 0x24]
xor eax, eax
cmp edx, ecx
setge al
xor ecx, ecx
cmp eax, 4
setl cl
xor edx, edx
cmp ecx, dword [esi]
lea ecx, [ebp - 0x178]
setge dl
xor ebx, ebx
cmp edx, 0x4174aa7f
setg bl
xor eax, eax
push eax
call fcn.100154a2
mov ecx, dword [ebp - 0x50]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x65c]
setle dl
sub edx, ebx
neg edx
sbb edx, edx
xor eax, eax
inc edx
push eax
mov dword [ebp - 0x28], edx
call fcn.100154a2
mov edx, dword [ebp - 0x28]
xor ecx, ecx
cmp dword [eax], edx
setge cl
xor eax, eax
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002a3e7
push 0x2670
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea ecx, [ebp - 0x65c]
mov byte [ebp - 4], 0xa
call fcn.10015486
inc dword [ebp - 0x24]
xor eax, eax
inc eax
cmp dword [ebp - 0x24], eax
jle 0x1002a233
push 2
pop esi
push 3
pop ebx
or eax, 0xffffffff
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], eax
call fcn.10015486
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002a43e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x15a0], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002a426
xor eax, eax
mov dword [ebp - 0x24], 0x2cb13638
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002a46c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x140], 0x3342eb9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002a454
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1002a4ab
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x140]
cmp eax, 0x565e
sete cl
xor eax, eax
cmp ecx, 8
setge al
mov dword [ebp - 0x20], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002a4a6
call dword [sym.imp.USER32.dll_CreatePopupMenu]
dec dword [ebp - 0x24]
jns 0x1002a477
mov dword [ebp - 0x20], 0x15
cmp dword [ebp - 0x20], 0x23
jle 0x1002a617
push 3
pop ebx
mov dword [ebp - 0x40], 0xb4ef66b1
lea ecx, [ebp - 0xadc]
push ebx
call fcn.10015404
push esi
lea ecx, [ebp - 0xc8c]
mov dword [ebp - 4], 0xc
call fcn.10015404
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002a511
push dword [ebp - 0x14]
lea ecx, [ebp - 0xadc]
call fcn.100154a2
mov dword [eax], 0x82f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002a4f3
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002a537
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc8c]
call fcn.100154a2
mov dword [eax], 0x65835a7a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002a519
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x24], eax
jg 0x1002a5eb
mov dword [ebp - 0x40], 0x6c21
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x140]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x140]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x140]
mov eax, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x140]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x140]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x140]
cmp dword [ebp - 0x40], eax
je 0x1002a5bb
xor eax, eax
lea ecx, [ebp - 0xadc]
inc eax
push eax
call fcn.100154a2
cmp dword [eax], 0
jne 0x1002a5bb
xor eax, eax
mov esi, eax
inc eax
jmp 0x1002a5c0
xor eax, eax
inc eax
mov esi, eax
push eax
lea ecx, [ebp - 0xc8c]
call fcn.100154a2
xor ecx, ecx
cmp esi, 0xd258
setge cl
mov dword [eax], ecx
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jle 0x1002a546
push 2
pop esi
lea ecx, [ebp - 0xc8c]
call fcn.10015486
or eax, 0xffffffff
lea ecx, [ebp - 0xadc]
mov dword [ebp - 4], eax
call fcn.10015486
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x23
jg 0x1002a4bf
xor ebx, ebx
inc ebx
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x1002a632
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1600], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002a621
push ecx
lea ecx, [ebp - 0x328]
call fcn.10015404
push ebx
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0xe
call fcn.10015404
push 3
lea ecx, [ebp - 0x66c]
mov byte [ebp - 4], 0xf
call fcn.10015404
or eax, 0xffffffff
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002a69e
push dword [ebp - 0x24]
lea ecx, [ebp - 0x328]
call fcn.100154a2
mov dword [eax], 0x10c93b4e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002a67f
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002a6c9
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1f8]
call fcn.100154a2
or ecx, 0xffffffff
mov dword [eax], ecx
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jl 0x1002a6a6
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002a6f1
push dword [ebp - 0x24]
lea ecx, [ebp - 0x66c]
call fcn.100154a2
mov dword [eax], 0xb0b44cf5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002a6d2
xor eax, eax
push eax
lea ecx, [ebp - 0x1f8]
call fcn.100154a2
lea ecx, [ebp - 0x1f8]
and dword [eax], 0
xor eax, eax
push eax
call fcn.100154a2
cmp dword [eax], esi
jg 0x1002aa11
mov dword [ebp - 0x2c], 0x7e17f759
xor eax, eax
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002a735
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_UnionRect]
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002a7b0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x551da622
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jg 0x1002a7ad
mov dword [ebp - 0x40], 0x47adf1ad
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002a779
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10a8], 0xfffffffb
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002a75b
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x40], eax
jl 0x1002a790
mov dword [ebp - 0x50], 0xfffffffe
inc dword [ebp - 0x50]
dec dword [ebp - 0x40]
jns 0x1002a781
push ebx
lea ecx, [ebp - 0x66c]
call fcn.100154a2
push 0
mov dword [eax], 0xc9cd49fc
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], esi
jle 0x1002a74c
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x1002a73a
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jg 0x1002a9e7
mov dword [ebp - 0x40], 0x4da86284
lea ecx, [ebp - 0x598]
push ebx
call fcn.10015404
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002a806
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x598]
call fcn.100154a2
mov dword [eax], 0xfffffffc
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002a7e2
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x40], eax
jl 0x1002a929
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x44]
sub eax, 0xdf78
je 0x1002a872
xor eax, eax
lea ecx, [ebp - 0x1f8]
push eax
call fcn.100154a2
lea ecx, [ebp - 0x328]
push dword [eax]
call fcn.100154a2
push ebx
lea ecx, [ebp - 0x66c]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0x18]
call fcn.100154a2
mov dword [eax], esi
test esi, esi
je 0x1002a86f
xor eax, eax
lea ecx, [ebp - 0x1f8]
push eax
call fcn.100154a2
lea ecx, [ebp - 0x328]
push dword [eax]
call fcn.100154a2
push 2
pop esi
mov dword [ebp - 0x38], ebx
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1002a894
push eax
lea ecx, [ebp - 0x1f8]
call fcn.100154a2
cmp dword [eax], 0
jne 0x1002a898
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1002a89a
mov ebx, eax
jmp 0x1002a89a
xor eax, eax
push eax
lea ecx, [ebp - 0x1f8]
call fcn.100154a2
lea ecx, [ebp - 0x328]
push dword [eax]
call fcn.100154a2
push esi
lea ecx, [ebp - 0x328]
mov edi, eax
call fcn.100154a2
lea ecx, [ebp - 0x1f8]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, ebx
call fcn.100154a2
xor ecx, ecx
mov edx, dword [eax]
mov eax, dword [ebp - 0x2c]
imul edx, esi
cmp edx, eax
setl cl
xor ebx, ebx
cmp dword [edi], ecx
lea ecx, [ebp - 0x598]
setne bl
xor eax, eax
push eax
call fcn.100154a2
mov ecx, dword [ebp - 0x2c]
xor edx, edx
sub ebx, ecx
mov esi, eax
mov ecx, dword [ebp - 0x44]
sub ebx, 0x1e34f9a3
cmp ebx, ecx
mov ecx, dword [ebp - 0x44]
push 1
setne dl
xor eax, eax
cmp edx, ecx
pop ebx
setne al
mov dword [esi], eax
dec dword [ebp - 0x40]
push 2
pop esi
jns 0x1002a812
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x598]
xor eax, eax
push eax
call fcn.100154a2
push dword [ebp - 0x2c]
xor ebx, ebx
lea ecx, [ebp - 0x328]
cmp dword [eax], ebx
setne bl
call fcn.100154a2
xor ecx, ecx
cmp ebx, 0x8477
setge cl
add ecx, dword [ebp - 0x28]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x598]
push eax
call fcn.100154a2
mov edx, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, dword [eax]
setg cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x328]
push dword [ebp - 0x2c]
call fcn.100154a2
mov esi, eax
lea ecx, [ebp - 0x598]
xor eax, eax
push eax
call fcn.100154a2
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x66c]
setge bl
xor eax, eax
inc eax
push eax
call fcn.100154a2
cmp dword [ebp - 0x18], 0xfffffffe
mov byte [ebp - 4], 0x10
sbb ecx, ecx
neg ecx
sub ebx, ecx
lea ecx, [ebp - 0x598]
mov dword [eax], ebx
call fcn.10015486
inc dword [ebp - 0x2c]
push 2
pop esi
push 1
pop ebx
cmp dword [ebp - 0x2c], esi
jle 0x1002a7c1
xor eax, eax
push eax
lea ecx, [ebp - 0x1f8]
call fcn.100154a2
lea ecx, [ebp - 0x1f8]
inc dword [eax]
xor eax, eax
push eax
call fcn.100154a2
cmp dword [eax], esi
jle 0x1002a716
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x66c]
call fcn.10015486
lea ecx, [ebp - 0x1f8]
call fcn.10015486
or eax, 0xffffffff
lea ecx, [ebp - 0x328]
mov dword [ebp - 4], eax
call fcn.10015486
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jg 0x1002abd1
jmp 0x1002aa4a
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002aa6c
or ecx, 0xffffffff
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x354], ecx
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jl 0x1002aa55
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002aa8e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1448], 0xb1658084
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002aa75
xor eax, eax
push 3
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1002aab1
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x15b8], 0x7b4bc66
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002aa99
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002aace
push 0xc59
push 0x1deb
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
mov ecx, dword [ebp - 0x354]
xor edx, edx
mov eax, dword [ebp - 0x354]
cmp ecx, eax
setge dl
xor eax, eax
mov dword [ebp - 0x1444], edx
mov dword [ebp - 0x30], 0x5db3
mov dword [ebp - 0x14], 0x4039b642
mov dword [ebp - 0x50], 0x78c9dffb
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002ab13
push 0x1ab7
call dword [sym.imp.GDI32.dll_GetStockObject]
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002ab39
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002abbd
push eax
push 0x1c37
call edi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x1002abbb
mov dword [ebp - 0x20], 0x39e3
xor edx, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
imul ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x1002ab6e
cmp dword [ebp - 0x14], eax
je 0x1002ab6e
lea ecx, [eax + 1]
jmp 0x1002ab70
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp eax, ecx
push 0xfffffffffffffffd
setne dl
xor ecx, ecx
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp eax, edx
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setle bl
xor ecx, ecx
cmp ebx, eax
setg cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
pop ecx
sub ecx, eax
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1002abd1
inc dword [ebp - 0x34]
push 1
pop ebx
cmp dword [ebp - 0x34], esi
jle 0x1002aa48
xor ebx, ebx
mov dword [ebp - 0x28], 0xf112
inc ebx
mov dword [ebp - 0x28], 0x901f2c29
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0xf38]
push 4
call fcn.10015404
mov dword [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x50], 0xc326
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002ac2a
push dword [ebp - 0x14]
lea ecx, [ebp - 0xf38]
call fcn.100154a2
mov dword [eax], 0x5a654fdd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002ac0b
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002ac47
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x13c0], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002ac35
dec dword [ebp - 0x50]
lea ecx, [ebp - 0xf38]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10015486
mov dword [ebp - 0x34], esi
xor eax, eax
mov edx, 0xc17c
cmp dword [ebp - 0x34], eax
jl 0x1002be6c
jmp 0x1002ac72
xor eax, eax
mov dword [ebp - 0x20], 0x3606de71
or ecx, 0xffffffff
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x38], 5
mov dword [ebp - 0xe00], edx
mov dword [ebp - 0xdfc], edx
mov dword [ebp - 0xdf8], edx
mov dword [ebp - 0xdf4], edx
mov dword [ebp - 0x28], 0xfbc9fa8b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002acc5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x11e4], 0xae355683
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002acad
xor eax, eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x1002aced
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002ace8
push eax
push 0x767
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x1002accd
mov dword [ebp - 0x50], 0xfffffffe
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xdf8]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov ecx, dword [ebp - 0x11e4]
mov eax, dword [ebp - 0x38]
setg dl
imul ecx, edx
xor edx, edx
push ebx
add ecx, 0x89ce9ea2
cmp ecx, eax
lea ecx, [ebp - 0x5d4]
sete dl
mov dword [ebp - 0x28], edx
call fcn.10015404
push 3
lea ecx, [ebp - 0xf50]
mov dword [ebp - 4], 0x13
call fcn.10015404
push ebx
lea ecx, [ebp - 0x11a0]
mov byte [ebp - 4], 0x14
call fcn.10015404
mov byte [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x28], 0x167fa5c6
mov dword [ebp - 0x28], 0x4b666a75
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x50], 0xfffd
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002ada6
push dword [ebp - 0x24]
lea ecx, [ebp - 0xf50]
call fcn.100154a2
mov dword [eax], 0x2fd4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002ad87
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002add1
push dword [ebp - 0x24]
lea ecx, [ebp - 0x11a0]
call fcn.100154a2
or ecx, 0xffffffff
mov dword [eax], ecx
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jl 0x1002adae
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x24], eax
jmp 0x1002ade7
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x164c], 0x1151c3c3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002add6
inc dword [ebp - 0x50]
lea ecx, [ebp - 0x11a0]
call fcn.10015486
lea ecx, [ebp - 0xf50]
mov byte [ebp - 4], 0x13
call fcn.10015486
mov dword [ebp - 0x28], 0xfffffff6
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xe40], ebx
mov dword [ebp - 0xe3c], ebx
mov dword [ebp - 0xe38], ebx
mov dword [ebp - 0xe34], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002ae53
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x634], ecx
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002ae3c
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002ae74
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
dec eax
add eax, ecx
je 0x1002ae72
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002ae72
lea edx, [eax + 1]
jmp 0x1002ae76
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jne 0x1002ae8d
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x2c]
xor eax, eax
push 3
mov dword [ebp - 0xe38], eax
mov dword [ebp - 0x2c], eax
pop ebx
cmp dword [ebp - 0x2c], eax
jg 0x1002aef3
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002aecf
push eax
push eax
push 0x2674
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002aee9
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002aee6
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1002aed4
inc dword [ebp - 0x2c]
jmp 0x1002aeb0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002af16
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x67c], 0x25b9b55b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002aefe
xor eax, eax
mov dword [ebp - 0x674], 0xb
jmp 0x1002af45
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002af3f
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor eax, eax
inc dword [ebp - 0x674]
cmp dword [ebp - 0x674], 0x11
jl 0x1002af22
push 4
lea ecx, [ebp - 0x1108]
call fcn.10015404
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xd34]
xor ebx, ebx
mov dword [ebp - 0x28], 0xcb457102
or eax, 0xffffffff
mov dword [ebp - 0x30], 0x1afd061a
inc ebx
mov dword [ebp - 0x40], eax
push ebx
call fcn.10015404
xor eax, eax
mov byte [ebp - 4], 0x17
push 3
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1002afab
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1388], 6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002af93
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002afcb
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa6c], 5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002afb3
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002afe7
push dword [ebp - 0x24]
lea ecx, [ebp - 0xd34]
call fcn.100154a2
mov dword [eax], 0xd534a2c9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002afd0
mov dword [ebp - 0x1380], ebx
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], 0x6ff609d7
jg 0x1002b001
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xa68]
lea ecx, [ebp - 0xd34]
mov eax, dword [ebp - 0x40]
mov esi, dword [ebp - 0xa68]
neg esi
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.100154a2
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp ecx, esi
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xd34]
setle dl
mov dword [eax], edx
call fcn.10015486
mov dword [ebp - 0x28], 0x6a53d06c
xor eax, eax
mov dword [ebp - 0x28], 0xdf251d69
mov dword [ebp - 0x50], 7
push 4
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jge 0x1002b078
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x165c], 0x137b1891
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002b060
xor eax, eax
dec dword [ebp - 0x50]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002b097
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002b0ba
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5d4]
call fcn.100154a2
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002b09f
xor eax, eax
mov dword [ebp - 0x14], 0xddd1d8f8
mov dword [ebp - 0x38], 0x93be41b0
mov dword [ebp - 0x50], 0xfffffffa
mov dword [ebp - 0x28], 0xd9d6
mov dword [ebp - 0x30], 0xd29640
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002b0fa
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x58], 0x84bc9c3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002b0e5
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002b112
push 0x498
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor eax, eax
cmp dword [ebp - 0x58], eax
jne 0x1002b17d
mov ecx, dword [ebp - 0x58]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setne dl
sub edx, 0x4b7b
je 0x1002b133
xor eax, eax
cmp dword [ebp - 0x58], eax
jne 0x1002b136
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1002b143
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x58], eax
je 0x1002b15a
cmp eax, dword [ebp - 0x14]
je 0x1002b15f
mov eax, ebx
cmp eax, dword [ebp - 0x14]
jg 0x1002b16a
xor eax, eax
cmp dword [ebp - 0x58], eax
je 0x1002b16c
mov eax, ebx
jmp 0x1002b16c
xor eax, eax
mov dword [ebp - 0x38], eax
or eax, 0xffffffff
cmp dword [ebp - 0x38], eax
jne 0x1002b17a
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x14], eax
jmp 0x1002b1d6
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1108]
call fcn.100154a2
mov dword [eax], 0x9646b8d9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002b1bf
movdqa xmm0, xmmword [0x10009780]
lea ecx, [ebp - 0x13e0]
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x135c]
push eax
lea eax, [ebp - 0x136c]
push eax
movdqu xmmword [ebp - 0x136c], xmm0
call fcn.100154b1
lea ecx, [ebp - 0x1de]
mov esi, eax
call fcn.1000a763
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x100]
push dword [esi]
call fcn.10015460
mov byte [ebp - 4], 0x18
xor edx, edx
mov dword [ebp - 0x50], 0xfffffff8
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x28], 0x361f
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setle bl
xor ecx, ecx
dec ebx
cmp ebx, eax
setle cl
xor eax, eax
inc eax
push eax
lea esi, [ecx - 0x5c2052a5]
lea ecx, [ebp - 0x100]
call fcn.100154a2
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x2c]
cmp esi, eax
mov eax, dword [ebp - 0x2c]
setle cl
xor edx, edx
sub ecx, 0x3d2717f4
cmp ecx, 0xfffffffe
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setge bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor eax, eax
inc ecx
je 0x1002b3a8
xor ecx, ecx
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x1c], eax
inc ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002b2f3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x64], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002b2de
xor eax, eax
push eax
lea ecx, [ebp - 0x100]
call fcn.100154a2
mov ecx, dword [ebp - 0x64]
xor edx, edx
cmp ecx, 0x454
mov esi, eax
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
setl dl
xor ebx, ebx
cmp edx, ecx
setle bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor eax, eax
cmp ecx, dword [esi]
lea ecx, [ebp - 0x100]
setne al
xor ebx, ebx
mov dword [ebp - 0x50], eax
inc ebx
mov eax, dword [ebp - 0x50]
push ebx
call fcn.100154a2
push ebx
lea ecx, [ebp - 0x100]
call fcn.100154a2
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x100]
mov eax, dword [ebp - 0x2c]
xor eax, eax
push eax
call fcn.100154a2
mov ecx, dword [ebp - 0x64]
sub ecx, dword [eax]
xor eax, eax
sub ecx, dword [ebp - 0x64]
imul esi, ecx, 0xebb6
lea ecx, [ebp - 0x100]
push eax
sub esi, 0x59a10f2a
call fcn.100154a2
xor edx, edx
cmp dword [eax], esi
mov eax, dword [ebp - 0x64]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002b401
push eax
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
jmp 0x1002b3ff
xor ebx, ebx
lea ecx, [ebp - 0x100]
inc ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 0xdc8ff05c
mov dword [ebp - 0x28], eax
mov eax, 0x6b4c01f9
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x310], eax
mov dword [ebp - 0x50], 0x6f6d7797
push 3
call fcn.100154a2
push 2
lea ecx, [ebp - 0x100]
mov esi, eax
call fcn.100154a2
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [ebp - 0x50]
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002b456
mov dword [ebp - 0x1c], 0x5f81
mov eax, dword [ebp - 0x1c]
neg eax
jne 0x1002b422
mov eax, dword [ebp - 0x38]
push ebx
lea ecx, [ebp - 0x100]
call fcn.100154a2
push ebx
lea ecx, [ebp - 0x100]
call fcn.100154a2
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x100]
push ebx
call fcn.100154a2
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax]
jg 0x1002b454
mov esi, ebx
jmp 0x1002b458
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0x100]
call fcn.100154a2
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp esi, ecx
mov byte [ebp - 4], 0x16
mov ecx, 0xc97d735f
sete dl
cmp ecx, edx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x100]
call fcn.10015486
xor eax, eax
lea ecx, [ebp - 0x5d4]
push eax
call fcn.100154a2
push 2
pop esi
mov dword [eax], esi
jmp 0x1002be2b
xor eax, eax
mov dword [ebp - 0x28], 0xea7
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1002b4c8
push eax
push eax
push eax
push eax
push 0xd00
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002b4dd
push eax
push 0x208a
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push esi
lea ecx, [ebp - 0xf7c]
call fcn.10015404
push 5
mov byte [ebp - 4], 0x19
pop eax
mov dword [ebp - 0x14], 0x8ade19d2
mov dword [ebp - 0x24], eax
xor eax, eax
push 3
mov dword [ebp - 0x2c], ebx
pop edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002b525
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2d8], 0xfffffff8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002b50d
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x1002b59a
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x10f4]
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
push ebx
call fcn.10015404
mov byte [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x50], 0xb7d8cf4c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002b571
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x10f4]
call fcn.100154a2
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002b557
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], eax
jl 0x1002b581
inc dword [ebp - 0x50]
dec dword [ebp - 0x40]
jns 0x1002b579
lea ecx, [ebp - 0x10f4]
mov byte [ebp - 4], 0x19
call fcn.10015486
inc dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jle 0x1002b52d
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jle 0x1002b6bf
mov dword [ebp - 0x20], 9
xor edx, edx
mov dword [ebp - 0x50], 0xad0d7276
mov dword [ebp - 0x50], 0xfffffffc
mov dword [ebp - 0x28], 0x2c16
mov dword [ebp - 0x50], 0x1e173482
mov dword [ebp - 0x30], 6
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setle dl
xor eax, eax
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
je 0x1002b6ad
mov eax, dword [ebp - 0x20]
xor ecx, ecx
inc eax
cmp eax, 7
setle cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x14]
je 0x1002b60e
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002b610
mov edx, ebx
jmp 0x1002b612
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x20]
sub edx, eax
mov eax, dword [ebp - 0x2d8]
cmp edx, eax
mov edx, dword [ebp - 0x50]
setne cl
sub edx, ecx
xor ecx, ecx
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp edx, eax
mov eax, 0x9da9
setge cl
xor edx, edx
sub eax, ecx
cmp eax, 0x127a4ef2
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
test ecx, ecx
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
test ecx, ecx
sets al
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2d8], eax
je 0x1002b691
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], ebx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x1002b6ab
mov eax, ebx
jmp 0x1002b6ad
xor eax, eax
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jg 0x1002b5a7
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002b6df
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6f0], 0x17571177
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002b6c7
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002b6ff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5b0], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002b6e7
xor eax, eax
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x5ac], ebx
jge 0x1002b72e
mov eax, dword [ebp - 0x5ac]
mov dword [ebp + eax*4 - 0x6f0], 4
inc dword [ebp - 0x5ac]
cmp dword [ebp - 0x5ac], ebx
jl 0x1002b70d
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002b746
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xf7c]
call fcn.100154a2
mov dword [eax], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002b733
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0xaf4]
mov eax, 0x3cfce294
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x50], 0xa48a2b8e
mov dword [ebp - 0x50], 0x8eb5ea28
mov dword [ebp - 0x28], 0x15fb26c4
push ebx
call fcn.10015404
xor eax, eax
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002b7ae
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf64], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002b79a
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002b7cd
or ecx, 0xffffffff
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x11f0], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002b7b9
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002b7e9
push dword [ebp - 0x24]
lea ecx, [ebp - 0xaf4]
call fcn.100154a2
mov dword [eax], 0x756fd8c6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002b7d2
mov eax, dword [ebp - 0x424]
cmp eax, dword [ebp - 0x424]
je 0x1002b805
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002b807
mov ecx, ebx
mov eax, dword [ebp - 0xf5c]
sub ecx, eax
je 0x1002b81f
xor eax, eax
cmp dword [ebp - 0x424], eax
je 0x1002b821
mov eax, ebx
jmp 0x1002b821
xor eax, eax
mov dword [ebp - 0x50], eax
xor edx, edx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x42c]
cmp ecx, eax
setle dl
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0xf5c]
mov ecx, dword [ebp - 0x50]
sub ecx, eax
mov dword [ebp - 0x28], ecx
je 0x1002b852
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002b854
mov edx, ebx
jmp 0x1002b856
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x11f0], ecx
lea ecx, [ebp - 0xaf4]
mov eax, dword [ebp - 0x42c]
mov eax, dword [ebp - 0x424]
mov esi, dword [ebp - 0x1c]
sub esi, eax
neg esi
sbb esi, esi
xor eax, eax
inc esi
push eax
neg esi
call fcn.100154a2
lea ecx, [ebp - 0xaf4]
mov dword [eax], esi
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 0x19
call fcn.10015486
inc dword [ebp - 0x4c]
xor eax, eax
mov dword [ebp - 0x20], 0x256
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], 6
push 0xfffffffffffffff7
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jne 0x1002b8f0
mov dword [ebp - 0x1c], eax
jmp 0x1002b8d7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x11fc], 0x53bc6e5c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002b8c6
inc dword [ebp - 0x11f4]
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], ecx
je 0x1002b8c1
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 0xfffffff9
jmp 0x1002b95d
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002b918
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x98], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002b904
xor eax, eax
mov dword [ebp - 0x98], 0x18
jmp 0x1002b951
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1002b94b
push 0x512
push eax
push 0x76a
push eax
push 0xc7
push 0x1aae
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
dec dword [ebp - 0x98]
cmp dword [ebp - 0x98], 0xd
jge 0x1002b924
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff3
jne 0x1002b8fc
mov byte [ebp - 0xd], al
lea ecx, [ebp - 0x2d4]
push edi
call fcn.10015404
push ebx
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 0x1c
call fcn.10015404
push edi
lea ecx, [ebp - 0x68c]
mov byte [ebp - 4], 0x1d
call fcn.10015404
mov byte [ebp - 4], 0x1e
or esi, 0xffffffff
mov dword [ebp - 0x44], esi
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002b9c7
xor eax, eax
lea ecx, [ebp - 0x5d4]
push eax
call fcn.100154a2
cmp dword [eax], 0
jge 0x1002b4a1
lea ecx, [ebp - 0x1108]
call fcn.10015486
or eax, 0xffffffff
lea ecx, [ebp - 0x5d4]
mov dword [ebp - 4], eax
call fcn.10015486
dec dword [ebp - 0x34]
mov edx, 0xc17c
jns 0x1002ac70
push 3
lea ecx, [ebp - 0x360]
call fcn.10015404
mov dword [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x20], 0xc2039807
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002beb1
push dword [ebp - 0x14]
lea ecx, [ebp - 0x360]
call fcn.100154a2
mov dword [eax], 0x1e55
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002be92
xor eax, eax
mov dword [ebp - 0x14], eax
or ecx, 0xffffffff
cmp dword [ebp - 0x14], esi
jge 0x1002bed0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x420], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002bebc
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1002bfc6
mov dword [ebp - 0x14], 0x74b666a7
mov dword [ebp - 0x28], 0xce3d9786
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jg 0x1002bfba
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 0x355c0c8f
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x360]
push dword [ebp - 0x14]
call fcn.100154a2
push dword [ebp - 0x14]
lea ecx, [ebp - 0x360]
mov esi, eax
call fcn.100154a2
mov ecx, dword [eax]
mov eax, dword [ebp - 0x20]
mov dword [esi], ecx
mov dword [ebp - 0x41c], ecx
add eax, dword [ebp - 0x41c]
je 0x1002bf9f
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002bf9f
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x360]
push dword [ebp - 0x14]
call fcn.100154a2
mov eax, dword [ebp - 0x41c]
lea ecx, [ebp - 0x360]
push dword [ebp - 0x14]
call fcn.100154a2
xor ecx, ecx
cmp dword [eax], 0x4d07
setge cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x360]
mov esi, dword [ebp - 0x4c]
mov dword [ebp - 0x420], esi
push dword [ebp - 0x14]
call fcn.100154a2
push 0xfffffffffffffff9
pop ecx
sub ecx, esi
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
push 2
pop esi
push 0
mov dword [ebp - 0x28], ebx
inc dword [ebp - 0x14]
pop eax
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x14], esi
jle 0x1002bef6
dec dword [ebp - 0x20]
push 0xffffffffffffffff
pop ecx
jns 0x1002bedc
or eax, 0xffffffff
lea ecx, [ebp - 0x360]
mov dword [ebp - 4], eax
call fcn.10015486
mov dword [ebp - 0x20], 0x8ade19d2
mov esi, 0x2466e9f0
xor eax, eax
mov dword [ebp - 0x4c], esi
push 3
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x1002c00b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1564], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002bff3
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x1002c02b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x15d0], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002c013
xor eax, eax
push 2
mov dword [ebp - 0x20], eax
pop ecx
jmp 0x1002c042
mov dword [ebp - 0x28], 0x5db3
cmp dword [ebp - 0x28], eax
jne 0x1002c047
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jle 0x1002c033
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x1002c194
push ebx
lea ecx, [ebp - 0x484]
call fcn.10015404
mov dword [ebp - 4], 0x22
lea ecx, [ebp - 0x11b4]
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x28], eax
push 4
call fcn.10015404
xor eax, eax
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002c0a8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x484]
call fcn.100154a2
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002c08d
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002c0d0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x11b4]
call fcn.100154a2
mov dword [eax], 0x9646b8d9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002c0b1
xor eax, eax
push eax
lea ecx, [ebp - 0x484]
call fcn.100154a2
mov dword [eax], 2
jmp 0x1002c153
push 2
lea ecx, [ebp - 0xf94]
call fcn.10015404
xor eax, eax
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002c11f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xf94]
call fcn.100154a2
mov dword [eax], 3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002c100
xor eax, eax
inc dword [ebp - 0x4c]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c134
call edi
push eax
call dword [sym.imp.USER32.dll_SetCapture]
lea ecx, [ebp - 0xf94]
mov byte [ebp - 4], 0x23
call fcn.10015486
xor eax, eax
lea ecx, [ebp - 0x484]
push eax
call fcn.100154a2
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x484]
push eax
call fcn.100154a2
cmp dword [eax], 0
jge 0x1002c0e4
lea ecx, [ebp - 0x11b4]
call fcn.10015486
or eax, 0xffffffff
lea ecx, [ebp - 0x484]
mov dword [ebp - 4], eax
call fcn.10015486
dec dword [ebp - 0x20]
jns 0x1002c053
push 3
xor eax, eax
pop edx
mov dword [ebp - 0x20], 0x8ade19d2
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x1002c1be
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1618], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002c1a6
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x1002c1de
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1570], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1002c1c6
xor eax, eax
push 2
mov dword [ebp - 0x20], eax
pop esi
jmp 0x1002c1f5
mov dword [ebp - 0x28], 0x5db3
cmp dword [ebp - 0x28], eax
jne 0x1002c1fa
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x1002c1e6
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1002c33a
push ebx
lea ecx, [ebp - 0x544]
call fcn.10015404
mov dword [ebp - 4], 0x25
lea ecx, [ebp - 0x111c]
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x28], eax
push 4
call fcn.10015404
xor eax, eax
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002c25b
push dword [ebp - 0x14]
lea ecx, [ebp - 0x544]
call fcn.100154a2
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002c240
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002c283
push dword [ebp - 0x14]
lea ecx, [ebp - 0x111c]
call fcn.100154a2
mov dword [eax], 0x9646b8d9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002c264
xor eax, eax
push eax
lea ecx, [ebp - 0x544]
call fcn.100154a2
mov dword [eax], esi
jmp 0x1002c2ff
push esi
lea ecx, [ebp - 0xfac]
call fcn.10015404
xor eax, eax
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002c2cb
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xfac]
call fcn.100154a2
mov dword [eax], 3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002c2ad
xor eax, eax
inc dword [ebp - 0x4c]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c2e0
call edi
push eax
call dword [sym.imp.USER32.dll_SetCapture]
lea ecx, [ebp - 0xfac]
mov byte [ebp - 4], 0x26
call fcn.10015486
xor eax, eax
lea ecx, [ebp - 0x544]
push eax
call fcn.100154a2
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x544]
push eax
call fcn.100154a2
cmp dword [eax], 0
jge 0x1002c293
lea ecx, [ebp - 0x111c]
call fcn.10015486
or eax, 0xffffffff
lea ecx, [ebp - 0x544]
mov dword [ebp - 4], eax
call fcn.10015486
dec dword [ebp - 0x20]
jns 0x1002c206
push 3
pop edx
push edx
lea ecx, [ebp - 0x3c0]
call fcn.10015404
mov dword [ebp - 4], 0x28
xor eax, eax
mov dword [ebp - 0x20], 0xc2039807
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002c37e
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3c0]
call fcn.100154a2
mov dword [eax], 0x1e55
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002c35f
xor eax, eax
mov dword [ebp - 0x14], eax
or ecx, 0xffffffff
cmp dword [ebp - 0x14], esi
jge 0x1002c39d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x438], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002c389
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1002c493
mov dword [ebp - 0x14], 0x74b666a7
mov dword [ebp - 0x28], 0xce3d9786
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jg 0x1002c487
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 0x355c0c8f
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x3c0]
push dword [ebp - 0x14]
call fcn.100154a2
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3c0]
mov esi, eax
call fcn.100154a2
mov ecx, dword [eax]
mov eax, dword [ebp - 0x20]
mov dword [esi], ecx
mov dword [ebp - 0x434], ecx
add eax, dword [ebp - 0x434]
je 0x1002c46c
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002c46c
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x3c0]
push dword [ebp - 0x14]
call fcn.100154a2
mov eax, dword [ebp - 0x434]
lea ecx, [ebp - 0x3c0]
push dword [ebp - 0x14]
call fcn.100154a2
xor ecx, ecx
cmp dword [eax], 0x4d07
setge cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x3c0]
mov esi, dword [ebp - 0x4c]
mov dword [ebp - 0x438], esi
push dword [ebp - 0x14]
call fcn.100154a2
push 0xfffffffffffffff9
pop ecx
sub ecx, esi
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
push 2
pop esi
push 0
mov dword [ebp - 0x28], ebx
inc dword [ebp - 0x14]
pop eax
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x14], esi
jle 0x1002c3c3
dec dword [ebp - 0x20]
push 0xffffffffffffffff
pop ecx
jns 0x1002c3a9
or eax, 0xffffffff
lea ecx, [ebp - 0x3c0]
mov dword [ebp - 4], eax
call fcn.10015486
movdqa xmm0, xmmword [0x100096e0]
lea eax, [ebp - 0x127c]
push eax
lea eax, [ebp - 0x128c]
push eax
lea ecx, [ebp - 0x1548]
movdqu xmmword [ebp - 0x128c], xmm0
call fcn.100154b1
lea ecx, [ebp - 0x1c9]
mov esi, eax
call fcn.1000a763
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x49c]
push dword [esi]
call fcn.10015460
xor eax, eax
mov dword [ebp - 4], 0x29
push 2
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jge 0x1002c517
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1124], 0xcff0ea75
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002c4ff
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c536
push eax
push 0x26c7
push 0x15f2
push 0x26dd
call dword [sym.imp.KERNEL32.dll_RaiseException]
push esi
lea ecx, [ebp - 0x49c]
call fcn.100154a2
and dword [eax], 0
jmp 0x1002c568
push esi
call fcn.100154a2
push esi
lea ecx, [ebp - 0x49c]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x1124], 0x108f8256
call fcn.100154a2
inc dword [eax]
push esi
lea ecx, [ebp - 0x49c]
call fcn.100154a2
lea ecx, [ebp - 0x49c]
cmp dword [eax], esi
jl 0x1002c547
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10015486
xor eax, eax
lea ecx, [ebp - 0xb0c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0x359b504d
mov dword [ebp - 0x28], eax
push 3
call fcn.10015404
push 3
lea ecx, [ebp - 0xfc4]
mov dword [ebp - 4], 0x2a
call fcn.10015404
xor eax, eax
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002c5e4
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb0c]
call fcn.100154a2
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002c5c8
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002c5fc
push dword [ebp - 0x14]
lea ecx, [ebp - 0xfc4]
call fcn.100154a2
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002c5e9
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1002c620
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x34]
jge 0x1002c61e
mov eax, ebx
jmp 0x1002c620
xor eax, eax
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0xb0c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
push ebx
call fcn.100154a2
lea ecx, [ebp - 0xfc4]
mov dword [eax], 0x10a83afd
call fcn.10015486
or eax, 0xffffffff
lea ecx, [ebp - 0xb0c]
mov dword [ebp - 4], eax
call fcn.10015486
push 3
lea ecx, [ebp - 0x39c]
call fcn.10015404
xor eax, eax
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0xd6a5
mov eax, dword [ebp - 0x24]
dec eax
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x24]
jne 0x1002c697
mov eax, dword [ebp - 0x24]
xor eax, eax
mov ecx, ebx
cmp dword [ebp - 0x24], eax
jne 0x1002c6a2
mov ecx, eax
xor eax, eax
cmp ecx, 0xfffffff6
push 9
setg al
xor ecx, ecx
imul eax, dword [ebp - 0x24]
pop edx
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setne cl
cmp dword [ebp - 0x24], ecx
jne 0x1002c7fb
push 3
lea ecx, [ebp - 0x1a8]
call fcn.10015404
xor eax, eax
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002c700
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1a8]
call fcn.100154a2
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002c6e2
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jg 0x1002c7ea
jmp 0x1002c710
xor eax, eax
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x1a8]
push dword [ebp - 0x24]
call fcn.100154a2
cmp dword [eax], 0
je 0x1002c7b5
push esi
lea ecx, [ebp - 0x1a8]
call fcn.100154a2
push esi
lea ecx, [ebp - 0x1a8]
call fcn.100154a2
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1a8]
call fcn.100154a2
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x1a8]
push dword [ebp - 0x24]
call fcn.100154a2
push esi
lea ecx, [ebp - 0x1a8]
call fcn.100154a2
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x1a8]
push dword [ebp - 0x24]
call fcn.100154a2
xor eax, eax
lea ecx, [ebp - 0x1a8]
push eax
call fcn.100154a2
xor ebx, ebx
lea ecx, [ebp - 0x1a8]
cmp dword [eax], ebx
setne bl
xor eax, eax
inc eax
push eax
call fcn.100154a2
mov eax, dword [eax]
add eax, ebx
xor ebx, ebx
sub eax, dword [ebp - 0x24]
inc ebx
cmp eax, dword [ebp - 0x24]
jl 0x1002c7b5
mov eax, ebx
jmp 0x1002c7b7
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002c7d8
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1a8]
call fcn.100154a2
mov dword [eax], 0xbdbb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002c7c1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1002c70e
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 0x2c
call fcn.10015486
jmp 0x1002c811
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002c811
push 0x130f
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x1c], 0xc2039807
lea ecx, [ebp - 0x5a4]
push esi
call fcn.10015404
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x1244]
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x28], 0x1813
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x28], eax
push 4
call fcn.10015404
mov byte [ebp - 4], 0x2f
xor eax, eax
mov dword [ebp - 0x4c], 0xc32b96ce
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002c88d
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5a4]
call fcn.100154a2
mov dword [eax], 0xdf99ff60
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002c86f
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002c8a9
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1244]
call fcn.100154a2
mov dword [eax], 0x141e4f1f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002c892
push ebx
lea ecx, [ebp - 0x5a4]
call fcn.100154a2
mov dword [eax], 0xfffffff9
jmp 0x1002c905
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002c8e4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x157c], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002c8d0
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002c8f4
push eax
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
dec dword [ebp - 0x4c]
lea ecx, [ebp - 0x5a4]
push ebx
call fcn.100154a2
inc dword [eax]
push ebx
lea ecx, [ebp - 0x5a4]
call fcn.100154a2
cmp dword [eax], 0xc
jl 0x1002c8c3
lea ecx, [ebp - 0x1244]
call fcn.10015486
lea ecx, [ebp - 0x5a4]
mov byte [ebp - 4], 0x2c
call fcn.10015486
xor eax, eax
mov dword [ebp - 0x14], 0x6e52
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x9b4]
mov dword [ebp - 0x4c], 0xc2c9
push ebx
call fcn.10015404
xor eax, eax
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002c97e
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9b4]
call fcn.100154a2
mov dword [eax], 0xcd329b3a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002c960
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002c989
jle 0x1002c989
xor eax, eax
jmp 0x1002c98b
mov eax, ebx
mov ecx, dword [ebp - 0x4c]
xor ebx, ebx
imul ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
lea ecx, [ebp - 0x9b4]
setne bl
xor eax, eax
push eax
call fcn.100154a2
mov dword [eax], ebx
xor eax, eax
cmp ebx, esi
setle al
xor ebx, ebx
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x14], eax
inc ebx
jmp 0x1002c9cc
push dword [ebp - 0x14]
call fcn.100154a2
mov dword [eax], ebx
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x9b4]
cmp dword [ebp - 0x14], ebx
jl 0x1002c9bf
mov byte [ebp - 4], 0x2c
call fcn.10015486
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1002c9fe
push dword [ebp - 0x14]
lea ecx, [ebp - 0x39c]
call fcn.100154a2
mov dword [eax], 0x1e55
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002c9e7
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0xdac]
mov eax, 0x3cfce294
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x4c], 0xa48a2b8e
mov dword [ebp - 0x4c], 0x8eb5ea28
mov dword [ebp - 0x28], 0x15fb26c4
push ebx
call fcn.10015404
xor eax, eax
mov byte [ebp - 4], 0x31
push 3
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1002ca6a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xfdc], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002ca56
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002ca89
or ecx, 0xffffffff
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1138], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002ca75
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002caa5
push dword [ebp - 0x24]
lea ecx, [ebp - 0xdac]
call fcn.100154a2
mov dword [eax], 0x756fd8c6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002ca8e
mov eax, dword [ebp - 0x43c]
cmp eax, dword [ebp - 0x43c]
je 0x1002cac1
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1c], eax
jne 0x1002cac3
mov ecx, ebx
mov eax, dword [ebp - 0xfd4]
sub ecx, eax
je 0x1002cadb
xor eax, eax
cmp dword [ebp - 0x43c], eax
je 0x1002cadd
mov eax, ebx
jmp 0x1002cadd
xor eax, eax
mov dword [ebp - 0x4c], eax
xor edx, edx
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x444]
cmp ecx, eax
setle dl
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0xfd4]
mov ecx, dword [ebp - 0x4c]
sub ecx, eax
mov dword [ebp - 0x28], ecx
je 0x1002cb0e
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002cb10
mov edx, ebx
jmp 0x1002cb12
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x1138], ecx
lea ecx, [ebp - 0xdac]
mov eax, dword [ebp - 0x444]
mov eax, dword [ebp - 0x43c]
mov esi, dword [ebp - 0x1c]
sub esi, eax
neg esi
sbb esi, esi
xor eax, eax
inc esi
push eax
neg esi
call fcn.100154a2
lea ecx, [ebp - 0xdac]
mov dword [eax], esi
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 0x2c
call fcn.10015486
xor eax, eax
or edx, 0xffffffff
push 2
mov dword [ebp - 0x14], eax
pop esi
cmp dword [ebp - 0x14], esi
jge 0x1002cb80
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x400], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002cb6c
xor eax, eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jge 0x1002cc35
push 2
pop edi
or eax, 0xffffffff
lea ecx, [ebp - 0x39c]
mov dword [ebp - 4], eax
call fcn.10015486
push 4
lea ecx, [ebp - 0xd4c]
call fcn.10015404
mov dword [ebp - 4], 0x3a
xor eax, eax
mov dword [ebp - 0x18], 0xdba76aab
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002cbe5
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xd4c]
call fcn.100154a2
mov dword [eax], 0x313d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002cbc6
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 3
pop esi
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x1002d7ba
mov dword [ebp - 0x40], 0xadae8c9f
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x40], eax
jl 0x1002d7a3
push edi
lea ecx, [ebp - 0x9e4]
call fcn.10015404
xor eax, eax
mov byte [ebp - 4], 0x3b
mov dword [ebp - 0x1c], eax
jmp 0x1002d75b
mov dword [ebp - 0x34], edx
push 3
mov dword [ebp - 0x28], 0x7a5b7d8c
mov dword [ebp - 0x20], eax
pop ecx
jmp 0x1002cc58
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1130], 0x45fe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002cc47
mov dword [ebp - 0x34], 0xffffffe6
jmp 0x1002cd58
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002d7b1
or eax, 0xffffffff
lea ecx, [ebp - 0xd4c]
mov dword [ebp - 4], eax
call fcn.10015486
push esi
lea ecx, [ebp - 0x384]
call fcn.10015404
mov dword [ebp - 4], 0x3c
xor eax, eax
mov dword [ebp - 0x1c], 0xc2039807
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002d80d
push dword [ebp - 0x14]
lea ecx, [ebp - 0x384]
call fcn.100154a2
mov dword [eax], 0x1e55
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002d7ef
mov dword [ebp - 0x14], eax
or ecx, 0xffffffff
cmp dword [ebp - 0x14], edi
jge 0x1002d82c