Function at 0x10029e23
Capabilities:
Accept command line arguments
Clear file content
Create process on windows
Enumerate gui resources
Get common file path
Get memory capacity
Get session user name
Set thread local storage value
Write and execute a file

Disassembly:
mov eax, 0x1007624a
call fcn.10075bdc
mov eax, 0x12f8
call fcn.10071db0
mov dword [ebp - 0x34], 6
xor eax, eax
mov dword [ebp - 0x30], 0x3eb60693
mov dword [ebp - 0x50], 0xbc7dcd66
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 0x7631615e
push ebx
mov dword [ebp - 0x48], 0xade661fb
push esi
mov dword [ebp - 0x60], ecx
mov ecx, 0xc2076acb
mov dword [ebp - 0x7c4], ecx
mov dword [ebp - 0x7c0], ecx
push edi
mov dword [ebp - 0x7bc], ecx
mov dword [ebp - 0x7b8], ecx
push 3
mov dword [ebp - 0x30], 4
pop ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
push 1
mov byte [ebp - 0x65], dl
pop esi
cmp dword [ebp - 0x24], ebx
jge 0x10029eb8
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1264], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10029ea4
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10029ed8
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xba4], 0x29a2a67f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10029ec0
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10029ef9
push eax
push eax
push eax
push eax
push 0x25f7
push esi
push eax
push eax
push eax
push eax
call edi
xor eax, eax
push 9
pop edx
mov dword [ebp - 0x34], 0x1a
cmp dword [ebp - 0x34], 0xb
push 2
pop ecx
jne 0x1002a035
jmp 0x10029f14
xor eax, eax
mov dword [ebp - 0x3c], 0x526d2e85
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x30], 0x244d513c
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x10029f5d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x578], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10029f45
xor eax, eax
cmp dword [ebp - 0x7bc], eax
jne 0x10029fbc
cmp dword [ebp - 0x4c], eax
je 0x10029faf
mov eax, dword [ebp - 0x578]
mov ecx, 0x71be33bd
sub ecx, eax
mov eax, dword [ebp - 0x20]
add eax, ecx
je 0x10029f81
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x574]
cmp eax, 0xb2b4
mov eax, dword [ebp - 0x50]
setg dl
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, dword [ebp - 0x7b8]
je 0x10029fad
mov eax, esi
jmp 0x10029faf
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
xor eax, eax
jmp 0x10029fbe
mov eax, esi
mov dword [ebp - 0x574], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xba0]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
inc ecx
inc dword [ebp - 0x40]
cmp eax, ecx
jg 0x10029ff5
mov edx, esi
jmp 0x10029ff9
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp edx, eax
push 2
setg cl
xor eax, eax
mov dword [ebp - 0x10], ecx
pop ecx
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jl 0x1002a025
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0xba4], 0
jne 0x1002a025
dec dword [ebp - 0x3c]
jns 0x1002a013
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xb
push 9
pop edx
je 0x10029f12
mov dword [ebp - 0x34], 6
mov ecx, 0xc2076acb
mov dword [ebp - 0x30], 0x3eb60693
mov dword [ebp - 0x50], 0xbc7dcd66
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 0x7631615e
mov dword [ebp - 0x48], 0xade661fb
mov dword [ebp - 0x7dc], ecx
mov dword [ebp - 0x7d8], ecx
mov dword [ebp - 0x7d4], ecx
mov dword [ebp - 0x7d0], ecx
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002a0a6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1210], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002a092
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002a0c6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa64], 0x29a2a67f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002a0ae
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002a0e1
push eax
push eax
push eax
push eax
push 0x25f7
push esi
push eax
push eax
push eax
push eax
call edi
xor eax, eax
mov dword [ebp - 0x34], 0x1a
cmp dword [ebp - 0x34], 0xb
jne 0x1002a21b
push 2
pop ecx
jmp 0x1002a0f9
xor eax, eax
mov dword [ebp - 0x3c], 0x526d2e85
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x30], 0x244d513c
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002a146
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x584], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002a12e
xor eax, eax
cmp dword [ebp - 0x7d4], eax
jne 0x1002a1a5
cmp dword [ebp - 0x4c], eax
je 0x1002a198
mov eax, dword [ebp - 0x584]
mov ecx, 0x71be33bd
sub ecx, eax
mov eax, dword [ebp - 0x20]
add eax, ecx
je 0x1002a16a
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x580]
cmp eax, 0xb2b4
mov eax, dword [ebp - 0x50]
setg dl
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, dword [ebp - 0x7d0]
je 0x1002a196
mov eax, esi
jmp 0x1002a198
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
xor eax, eax
jmp 0x1002a1a7
mov eax, esi
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xa60]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
inc ecx
inc dword [ebp - 0x40]
cmp eax, ecx
jg 0x1002a1de
mov edx, esi
jmp 0x1002a1e2
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp edx, eax
push 2
setg cl
xor eax, eax
mov dword [ebp - 0x10], ecx
pop ecx
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jl 0x1002a20e
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0xa64], 0
jne 0x1002a20e
dec dword [ebp - 0x3c]
jns 0x1002a1fc
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xb
je 0x1002a0f7
mov dword [ebp - 0x48], 0xc9b7
xor eax, eax
mov dword [ebp - 0x44], 0x38f738f5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002a24b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x9c], 4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002a233
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002a26d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x240], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002a254
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002a280
push eax
push eax
call dword [sym.imp.USER32.dll_EnumWindows]
xor eax, eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], eax
jl 0x1002a39a
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002a2c0
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x62c], 0xdf860956
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002a2a8
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002a2d6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe38], 0xcfdfe924
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002a2c5
mov eax, dword [ebp - 0x234]
xor edx, edx
push 0
mov eax, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x234]
mov eax, dword [ebp + eax*4 - 0x9c]
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x234]
mov eax, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x234]
mov eax, dword [ebp + eax*4 - 0x9c]
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0xe30], ecx
mov eax, dword [ebp - 0x238]
cmp ecx, eax
mov ecx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x23c]
setle dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x234]
sete dl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x9c]
cmp eax, edx
mov eax, dword [ebp - 0x234]
setl bl
xor ecx, ecx
neg ebx
mov eax, dword [ebp + eax*4 - 0x9c]
cmp ebx, eax
mov eax, dword [ebp - 0x23c]
setl cl
imul eax, ecx
xor ecx, ecx
cmp eax, 0xfffffff8
pop eax
setl cl
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0x234]
push 3
pop ebx
jns 0x1002a292
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x30], 0x3eb60693
mov dword [ebp - 0x50], 0xbc7dcd66
push 0xfffffffffffffff9
pop ecx
mov dword [ebp - 0x30], ecx
mov ecx, 0xc2076acb
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 0x7631615e
mov dword [ebp - 0x48], 0xade661fb
mov dword [ebp - 0x7f4], ecx
mov dword [ebp - 0x7f0], ecx
mov dword [ebp - 0x7ec], ecx
mov dword [ebp - 0x7e8], ecx
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002a409
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1228], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002a3f5
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002a429
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc94], 0x29a2a67f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002a411
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002a444
push eax
push eax
push eax
push eax
push 0x25f7
push esi
push eax
push eax
push eax
push eax
call edi
xor eax, eax
mov dword [ebp - 0x34], 0x1a
cmp dword [ebp - 0x34], 0xb
push 2
pop ecx
jne 0x1002a57e
jmp 0x1002a45c
xor eax, eax
mov dword [ebp - 0x3c], 0x526d2e85
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x30], 0x244d513c
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002a4a9
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x598], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002a491
xor eax, eax
cmp dword [ebp - 0x7ec], eax
jne 0x1002a508
cmp dword [ebp - 0x4c], eax
je 0x1002a4fb
mov eax, dword [ebp - 0x598]
mov ecx, 0x71be33bd
sub ecx, eax
mov eax, dword [ebp - 0x20]
add eax, ecx
je 0x1002a4cd
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x594]
cmp eax, 0xb2b4
mov eax, dword [ebp - 0x50]
setg dl
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, dword [ebp - 0x7e8]
je 0x1002a4f9
mov eax, esi
jmp 0x1002a4fb
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
xor eax, eax
jmp 0x1002a50a
mov eax, esi
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc90]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
inc ecx
inc dword [ebp - 0x40]
cmp eax, ecx
jg 0x1002a541
mov edx, esi
jmp 0x1002a545
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp edx, eax
push 2
setg cl
xor eax, eax
mov dword [ebp - 0x10], ecx
pop ecx
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jl 0x1002a571
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0xc94], 0
jne 0x1002a571
dec dword [ebp - 0x3c]
jns 0x1002a55f
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xb
je 0x1002a45a
mov dword [ebp - 0x28], 0x41b3c692
xor eax, eax
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0xc8d46758
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x30], 0x920a6ff6
mov dword [ebp - 0x44], esi
push 4
mov dword [ebp - 0x24], eax
pop edx
cmp dword [ebp - 0x24], edx
jge 0x1002a5c9
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x12a4], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1002a5b1
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1002a5e9
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x10dc], 0x9bc00ead
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002a5d1
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff4
jmp 0x1002a601
mov dword [ebp - 0x20], 0x48f69f7f
cmp dword [ebp - 0x20], eax
jne 0x1002a607
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x18
jl 0x1002a5f2
dec dword [ebp - 0x44]
mov dword [ebp - 0x48], 0xc9b7
mov dword [ebp - 0x44], 0x38f738f5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002a634
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x90], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002a620
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jge 0x1002a654
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x260], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1002a63c
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002a667
push eax
push eax
call dword [sym.imp.USER32.dll_EnumWindows]
xor eax, eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], eax
jl 0x1002a781
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002a6a7
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x568], 0xdf860956
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002a68f
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002a6bd
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe5c], 0xcfdfe924
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002a6ac
mov eax, dword [ebp - 0x254]
xor edx, edx
push 0
mov eax, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x254]
mov eax, dword [ebp + eax*4 - 0x90]
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x254]
mov eax, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x254]
mov eax, dword [ebp + eax*4 - 0x90]
mov dword [ebp - 0x568], eax
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0xe54], ecx
mov eax, dword [ebp - 0x258]
cmp ecx, eax
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x25c]
setle dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x254]
sete dl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x90]
cmp eax, edx
mov eax, dword [ebp - 0x254]
setl bl
xor ecx, ecx
neg ebx
mov eax, dword [ebp + eax*4 - 0x90]
cmp ebx, eax
mov eax, dword [ebp - 0x25c]
setl cl
imul eax, ecx
xor ecx, ecx
cmp eax, 0xfffffff8
pop eax
setl cl
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0x254]
push 3
pop ebx
jns 0x1002a679
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x44], 0x1fc
mov dword [ebp - 0x20], 0x1145714f
mov dword [ebp - 0x30], 0x799333c7
mov dword [ebp - 0x30], 0x495761be
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0xbbd4
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x4c], 0xfffffff8
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x28]
sub ecx, eax
mov eax, dword [ebp - 0x28]
neg ecx
push 9
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
setg bl
sub ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, 0x4b28
setne dl
xor ecx, ecx
cmp eax, edx
pop eax
setne cl
cmp ecx, eax
mov eax, dword [ebp - 0x44]
push 2
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
pop ecx
setl dl
sub edx, 0x76373a4c
neg edx
sbb edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x20], edx
dec dword [ebp - 0x4c]
mov dword [ebp - 0x3c], 0x6deec541
mov dword [ebp - 0x10], 0xeea53061
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1002a848
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x7e4], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002a834
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002a85e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc0c], 0xdb84c6a3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002a84d
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov dword [ebp - 0x10], 0xf44401d1
mov eax, dword [ebp - 0x10]
cmp eax, 0x51ebf0dd
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
imul eax, ecx, 0xdacd
mov ecx, dword [ebp - 0x3c]
sub ecx, eax
sub ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x3c]
setl cl
sub edx, ecx
xor ecx, ecx
add edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp edx, eax
setl cl
mov dword [ebp - 0x7e4], ecx
mov dword [ebp - 0x10], 0xffffffe3
jmp 0x1002a8f1
mov dword [ebp - 0x44], 0x229a
mov dword [ebp - 0x44], esi
mov eax, dword [ebp - 0xc0c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x7e4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1d
jl 0x1002a8cc
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x34], 0x261f9c28
push 7
pop eax
mov dword [ebp - 0x938], eax
mov dword [ebp - 0x934], eax
mov dword [ebp - 0x930], eax
mov dword [ebp - 0x92c], eax
xor eax, eax
mov dword [ebp - 0x20], 0x9fff12f3
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002a94b
push 0x10a6
push eax
push eax
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
xor eax, eax
push 3
mov dword [ebp - 0x34], 7
pop edx
cmp dword [ebp - 0x34], 0x1c
jl 0x1002aa19
mov dword [ebp - 0x3c], 0xcf2e5664
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], eax
jl 0x1002a9fd
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jge 0x1002a992
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x590], 0xafe30f58
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1002a97a
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jge 0x1002a9b1
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe74], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1002a99d
xor eax, eax
mov dword [ebp - 0x588], eax
jmp 0x1002a9ec
mov dword [ebp - 0x28], 0x7d8cf4c5
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], eax
jl 0x1002a9dc
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x938], 0
jne 0x1002a9da
dec dword [ebp - 0x28]
jns 0x1002a9c8
xor eax, eax
mov dword [ebp - 0xe6c], 0x310c13fe
inc dword [ebp - 0x588]
cmp dword [ebp - 0x588], edx
jle 0x1002a9b9
dec dword [ebp - 0x3c]
jns 0x1002a972
mov dword [ebp - 0x3c], eax
jmp 0x1002aa0c
mov dword [ebp - 0x20], 0xb6fd43dd
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edx
jle 0x1002aa02
inc dword [ebp - 0x34]
jmp 0x1002a955
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x50], 0xa43b2b74
push 2
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x1002aa51
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc1c], 0xfffffff8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002aa39
xor eax, eax
mov dword [ebp - 0x3c], 0xb
cmp dword [ebp - 0x3c], 0x15
jg 0x1002ab01
jmp 0x1002aa66
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], eax
jmp 0x1002aa7f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x3fc], 6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002aa6e
mov eax, dword [ebp - 0x3f4]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1002aaf4
mov dword [ebp - 0x40], 0x69be541
cmp dword [ebp - 0x3f4], eax
je 0x1002aadf
mov eax, dword [ebp - 0x3f8]
xor ecx, ecx
mov dword [ebp - 0x50], eax
inc ecx
cmp dword [ebp - 0x50], ecx
jle 0x1002aadd
mov eax, dword [ebp - 0x3f4]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x3f4], eax
jne 0x1002aaca
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3f8]
mov edx, ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3f4], ecx
jmp 0x1002aae1
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
push 3
setl cl
mov dword [ebp - 0xc1c], ecx
pop edx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x15
jle 0x1002aa64
mov dword [ebp - 0x30], 0x3eb60693
xor eax, eax
mov dword [ebp - 0x24], 0xaf1124f0
mov dword [ebp - 0x24], eax
jmp 0x1002ab3e
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x48], 0x67215912
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002ab3b
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff2
jl 0x1002ab16
mov eax, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setl dl
imul eax, edx, 0xbb6b
test eax, eax
je 0x1002ab6a
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002ab6c
lea ecx, [eax + 1]
jmp 0x1002ab6e
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x24]
imul eax, ecx
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x58], 0xbc7dcd66
mov dword [ebp - 0x2c], 0x2c9cc141
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0x5f7f7777
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002abc3
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1a0], 0xdc7555b7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002abaa
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002abe5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe8c], 0x88b9abc1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002abcc
xor eax, eax
cmp dword [ebp - 0x198], eax
je 0x1002abef
mov eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
sbb eax, eax
inc eax
imul eax, eax, 0xbf38
test eax, eax
je 0x1002ac31
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002ac26
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002ac23
push eax
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
xor eax, eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe4
jne 0x1002ac0b
jmp 0x1002acc0
xor eax, eax
push 2
mov dword [ebp - 0x2c], eax
pop ecx
jmp 0x1002acb7
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002ac5d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x4fc], 0xfffffff7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002ac44
xor eax, eax
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], ecx
jg 0x1002ac8f
mov dword [ebp - 0x20], 0xb8bffbef
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x4f4]
cmp dword [ebp - 0x4f4], ecx
jle 0x1002ac6b
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002acb4
push eax
push 0x1f21
push 0x82d
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jle 0x1002ac3b
mov eax, dword [ebp - 0x198]
xor ecx, ecx
cmp eax, 0xdcefbde2
setne cl
xor ebx, ebx
mov dword [ebp - 0x2c], ecx
inc ebx
mov eax, dword [ebp - 0x2c]
mov ecx, ebx
mov eax, dword [ebp - 0x198]
mov eax, dword [ebp - 0x19c]
mov eax, dword [ebp - 0x198]
sub ecx, eax
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x50], eax
je 0x1002ad08
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x1002ad0a
mov eax, ebx
jmp 0x1002ad0a
xor eax, eax
mov dword [ebp - 0x44], eax
xor edx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x19c]
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x44], 0x1422
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x44]
sub ecx, eax
mov eax, dword [ebp - 0x19c]
cmp ecx, eax
push 0xfffffffffffffff9
setl dl
mov dword [ebp - 0xe88], edx
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x20], eax
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x274952f
mov dword [ebp - 0x30], 0x1b17d72b
push 9
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x44], 0x4361
mov dword [ebp - 0x30], 0x263b0a6d
push 3
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jge 0x1002ad9b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9d4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002ad87
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002adbb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9f8], 0x57ad95e1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002ada3
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002addb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1240], 0x576c3a0b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002adc3
xor eax, eax
inc dword [ebp - 0x9d0]
inc dword [ebp - 0x44]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002ae0a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xea4], 4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002adf2
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002ae25
push 0x1f45
push eax
push eax
push 0x69e
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xe9c], eax
xor eax, eax
mov dword [ebp - 0x30], 0x7631615e
mov dword [ebp - 0x30], 0xade661fb
mov dword [ebp - 0x34], 0xffffffff
push 2
mov dword [ebp - 0x28], eax
pop edx
cmp dword [ebp - 0x28], edx
jge 0x1002ae68
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x7cc], 0xb57f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002ae50
xor eax, eax
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], eax
jl 0x1002ae9b
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x1002ae96
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + eax*4 - 0x7cc]
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x7cc], ecx
dec dword [ebp - 0x14]
jns 0x1002ae7b
xor eax, eax
dec dword [ebp - 0x34]
jns 0x1002ae70
mov ecx, 0xc2076acb
mov dword [ebp - 0x80c], ecx
mov dword [ebp - 0x808], ecx
mov dword [ebp - 0x804], ecx
mov dword [ebp - 0x800], ecx
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x50], 0xfffffffd
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jge 0x1002aee6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1f8], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1002aece
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002af06
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x64c], 0xedfe012d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002aeee
xor eax, eax
mov dword [ebp - 0x1f8], 0x1b
cmp dword [ebp - 0x1f8], 0x1c
je 0x1002afd8
mov dword [ebp - 0x48], 0x3371247a
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x40], 0xcf13e13a
mov dword [ebp - 0x50], 6
mov dword [ebp - 0x28], eax
jmp 0x1002af4a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x558], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002af3d
mov eax, dword [ebp - 0x1f8]
xor edx, edx
dec dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1f8]
sub ecx, eax
mov dword [ebp - 0x558], ecx
mov eax, dword [ebp - 0x44]
cmp ecx, eax
push 0
setg dl
imul eax, dword [ebp - 0x4c], 0x7331
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x4c]
setl cl
xor edx, edx
cmp ecx, 0xa41b8700
setne dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x40]
setle bl
xor ecx, ecx
cmp ebx, eax
setge cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x40]
sub eax, 0xb8e0
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x50], eax
inc dword [ebp - 0x1f8]
cmp dword [ebp - 0x1f8], 0x1c
pop eax
push 1
pop ebx
jne 0x1002af1d
push 2
pop edx
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jge 0x1002b006
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xfbc], 0x1713
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002afee
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x1002b036
or ecx, 0xffffffff
mov dword [ebp - 0x958], ecx
mov dword [ebp - 0x954], ecx
mov dword [ebp - 0x950], ecx
mov dword [ebp - 0x94c], ecx
cmp dword [ebp - 0x954], eax
jne 0x1002b036
dec dword [ebp - 0x14]
jns 0x1002b011
push 3
mov dword [ebp - 0x48], 0xffff
mov dword [ebp - 0x28], eax
pop ebx
jmp 0x1002b056
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xbb4], 0xade19d29
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002b045
mov eax, dword [ebp - 0xbac]
mov eax, dword [ebp - 0xbac]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x48], eax
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002b07e
call esi
xor eax, eax
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x2c], 0xd3df75dc
mov dword [ebp - 0x44], 0xd832937a
mov dword [ebp - 0x2c], 0x1a
cmp dword [ebp - 0x2c], 0xffffffed
jg 0x1002b161
jmp 0x1002b0a8
xor eax, eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x14], 8
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002b0c5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], 0xfffffffe
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setg bl
xor ecx, ecx
cmp eax, ebx
setne cl
cmp dword [ebp - 0x44], ecx
jge 0x1002b13f
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002b151
push 0xb83
inc eax
push eax
push 0x1577
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x1002b151
mov dword [ebp - 0x48], eax
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002b14e
call esi
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffed
jle 0x1002b0a6
push 3
pop ebx
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x54], 0x48261f9c
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002b182
push 0xd53
call dword [sym.imp.GDI32.dll_GetStockObject]
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002b1aa
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
xor eax, eax
push eax
push 0x15fe
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
xor eax, eax
xor esi, esi
mov dword [ebp - 0x48], 0xb7e80d68
mov dword [ebp - 0x28], eax
inc esi
cmp dword [ebp - 0x28], esi
jge 0x1002b1d4
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x84], 0xd1d8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002b1bc
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002b1f4
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor eax, eax
cmp dword [ebp - 0x84], eax
je 0x1002b1fe
mov eax, esi
mov ecx, dword [ebp - 0x84]
add ecx, dword [ebp - 0x84]
push 0xfffffffffffffffb
pop edx
cmp edx, eax
sbb eax, eax
xor edx, edx
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0x84]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x84]
setle cl
xor edx, edx
imul ecx, ecx, 0xf29a
cmp ecx, eax
mov eax, dword [ebp - 0x84]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x84]
sete cl
xor edx, edx
cmp ecx, 0x38ec
setge dl
imul eax, edx
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002b27b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x127c], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002b267
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002b291
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa9c], 0x29a2a67f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002b280
mov dword [ebp - 0x14], 0xf09cc25f
mov eax, 0x12af048
mov dword [ebp - 0x998], eax
mov dword [ebp - 0x994], eax
mov dword [ebp - 0x990], eax
mov dword [ebp - 0x98c], eax
xor eax, eax
mov dword [ebp - 0x48], 0x9df9481f
mov dword [ebp - 0x44], 0x4adf2985
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002b2ed
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc2c], 0x6d444182
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002b2d5
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002b30f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1054], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002b2f6
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002b32f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xebc], 0x24f20479
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002b317
xor eax, eax
cmp dword [ebp - 0xc28], eax
jne 0x1002b33a
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x104c], eax
mov ecx, dword [ebp - 0x14]
imul ecx, eax
mov dword [ebp - 0x990], ecx
mov dword [ebp - 0xeb8], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
add edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1002b389
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x308], 0xb110c93b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1002b371
xor eax, eax
mov dword [ebp - 0x300], eax
mov edx, 0xa7a81a82
cmp dword [ebp - 0x300], 0x1c
jne 0x1002b446
push 4
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x28], eax
jmp 0x1002b3b9
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x728], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002b3ac
mov eax, dword [ebp - 0x728]
mov eax, dword [ebp - 0x728]
mov eax, dword [ebp - 0x300]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x304]
je 0x1002b3ec
xor eax, eax
cmp dword [ebp - 0x720], eax
je 0x1002b3ee
mov eax, esi
jmp 0x1002b3ee
xor eax, eax
cmp edx, eax
mov eax, dword [ebp - 0x304]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, dword [ebp - 0x728]
je 0x1002b414
cmp dword [ebp - 0x728], eax
je 0x1002b414
mov eax, esi
mov dword [ebp - 0x44], 0xffffffff
mov edx, 0xa7a81a82
mov ecx, dword [ebp - 0x44]
imul ecx, eax
mov eax, esi
push 0
sub eax, ecx
mov dword [ebp - 0x71c], eax
inc dword [ebp - 0x300]
cmp dword [ebp - 0x300], 0x1c
pop eax
je 0x1002b3a1
mov byte [ebp - 0x35], al
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x3c], 0xe21afa9b
mov dword [ebp - 0x5c], 0xf5d870a3
mov dword [ebp - 0x48], 0xaa165420
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x54], 0xee34edf6
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x54], 0xb35d5697
mov dword [ebp - 0x54], 0xffffffff
push 2
mov dword [ebp - 0x50], 0xe80c6548
mov dword [ebp - 0x28], eax
pop ecx
jmp 0x1002b4b1
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x468], 5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002b4a0
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x50]
cmp eax, ecx
jge 0x1002b4c7
mov eax, esi
jmp 0x1002b4c9
xor eax, eax
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x4c]
sub edx, 0x5116
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x464]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, 0xb9c309ab
setge cl
cmp eax, ecx
mov eax, dword [ebp - 0x14]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setle dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x5c]
setge bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x4c]
sete cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setge bl
imul eax, dword [ebp - 0x40]
xor edx, edx
neg eax
cmp eax, ebx
mov eax, dword [ebp - 0x5c]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], esi
jg 0x1002b615
push 2
pop ecx
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1002b576
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc3c], 0x544b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002b55e
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002b598
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xed4], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002b57f
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jg 0x1002b609
mov dword [ebp - 0x44], 0xfffa
xor edx, edx
inc dword [ebp - 0x44]
mov eax, dword [ebp - 0xc38]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + eax*4 - 0x468]
imul eax, dword [ebp - 0xed0], 0xb221
cmp ecx, eax
setne dl
cmp edx, dword [ebp - 0x34]
jl 0x1002b5d9
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x3c], eax
je 0x1002b5db
mov ecx, esi
mov eax, dword [ebp - 0x464]
sub eax, ecx
xor ecx, ecx
cmp eax, 0x8045
mov eax, dword [ebp - 0x3c]
setle cl
mov eax, dword [ebp + eax*4 - 0x468]
sub eax, ecx
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x1002b5a0
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jle 0x1002b54f
cmp byte [ebp - 0x35], 0
mov ecx, 0x6cc7
je 0x1002b739
push 0xfffffffffffffff9
pop edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0x5e3d1aa1
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x6c8], ecx
mov dword [ebp - 0x6c4], ecx
mov dword [ebp - 0x6c0], ecx
mov dword [ebp - 0x6bc], ecx
mov dword [ebp - 0x34], 0x74f0e4f
mov dword [ebp - 0x28], eax
jmp 0x1002b670
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa7c], 0xfffffffc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002b65f
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setge dl
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], esi
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x1002b69d
mov edx, eax
cmp dword [ebp - 0x3c], eax
je 0x1002b69f
mov edx, esi
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x3c]
imul ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x3c]
mov dword [ebp - 0xa78], ecx
mov eax, dword [ebp - 0xa78]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x6c8]
mov eax, dword [ebp - 0x50]
xor eax, eax
cmp dword [ebp - 0x6c8], esi
jle 0x1002b6dc
mov ecx, esi
cmp dword [ebp - 0x50], eax
jne 0x1002b6de
mov ecx, eax
mov edx, dword [ebp - 0x6bc]
mov eax, dword [ebp - 0x3c]
add edx, ecx
xor ecx, ecx
cmp eax, 0xffff41e3
setl cl
xor eax, eax
cmp ecx, edx
setne al
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x15
cmp dword [ebp - 0x34], 0xd
je 0x1002b727
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002b71e
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xd
jne 0x1002b70c
xor eax, eax
push eax
push eax
push eax
push eax
push 0x25f7
push esi
push eax
push eax
push eax
push eax
call edi
mov dword [ebp - 0x3c], 3
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x40], 0x91f0
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x54], 0xa0165d3e
mov dword [ebp - 0x54], 0x6cf6d707
mov dword [ebp - 0x54], 0xfffffffa
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002b784
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa6c], 0x3dee6ee3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002b76c
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002b7a6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc48], 0x926a6722
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002b78d
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffff2
je 0x1002b895
mov dword [ebp - 0x4c], 0x39d6b9c2
mov dword [ebp - 0x50], 0xffff
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x44], 0xc44d4e2b
mov dword [ebp - 0x54], 0x48792891
mov dword [ebp - 0x54], 0xa0c09020
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002b807
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xbb8], 0xc437ffea
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002b7ef
xor eax, eax
mov dword [ebp - 0x34], 0x357
cmp dword [ebp - 0x34], eax
je 0x1002b855
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
cmp eax, edx
setle cl
imul ecx, dword [ebp - 0x50]
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x4c]
je 0x1002b853
mov ecx, esi
jmp 0x1002b857
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
sub ecx, eax
push 0xfffffffffffffffb
mov dword [ebp - 0x44], ecx
pop eax
cmp dword [ebp - 0x44], eax
je 0x1002b86a
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], esi
inc dword [ebp - 0xc40]
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff2
push 0
pop eax
jne 0x1002b7b3
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x14], 0x1a
cmp dword [ebp - 0x14], 0xb
jne 0x1002c664
mov ebx, 0x7249aaed
jmp 0x1002b8b5
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x54], 0x6f7fbf21
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x5f8], ebx
mov dword [ebp - 0x5f4], ebx
mov dword [ebp - 0x5f0], ebx
mov dword [ebp - 0x5ec], ebx
mov dword [ebp - 0x3c], 0x64dbb9a2
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002b90e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x11a4], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002b8f5
xor eax, eax
mov dword [ebp - 0x34], 0xffffffe6
jmp 0x1002b9e2
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x54], 0x754320e3
mov dword [ebp - 0x54], 0xfffffffd
mov dword [ebp - 0x54], 0xb0639e6a
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002b94e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xbc8], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002b93a
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1002b971
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1164], 0x68108531
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002b959
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x1002b9df
mov dword [ebp - 0x54], 0xfffffff8
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002b9ac
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x124c], 0x39ee491
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002b993
xor eax, eax
inc dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
jmp 0x1002b9d5
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002b9d2
push eax
push 0x1510
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jle 0x1002b9b4
dec dword [ebp - 0x10]
jns 0x1002b979
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffef
jge 0x1002b91a
mov dword [ebp - 0x10], 0x526d2e85
push 9
pop ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x48], 0x274952f
mov dword [ebp - 0x48], 0x1b17d72b
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x44], 0x4361
mov dword [ebp - 0x48], 0x263b0a6d
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002ba3d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa8c], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002ba28
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002ba5d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbd8], 0x57ad95e1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002ba45
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002ba7f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x11bc], 0x576c3a0b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002ba66
xor eax, eax
inc dword [ebp - 0xa88]
inc dword [ebp - 0x44]
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x48], 0x244d513c
mov dword [ebp - 0x3c], 0x60477862
mov dword [ebp - 0x28], 0xf6d4a0d4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002bac4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd8], 3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002baac
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002bae4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x560], 0xc5336de0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002bacc
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1002bb22
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x1002bb1f
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002bb05
push eax
push eax
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0xd8], 0
jne 0x1002bb1a
dec dword [ebp - 0x28]
push 0
pop eax
jns 0x1002baf4
push 9
xor eax, eax
pop ecx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 7
je 0x1002bae9
mov eax, dword [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x28], eax
jl 0x1002bb4f
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1002bb51
mov ecx, esi
jmp 0x1002bb53
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x560], ecx
mov eax, dword [ebp - 0xd8]
imul eax, dword [ebp - 0xd8]
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x34], 0x1cecb457
mov dword [ebp - 0x48], 0x65c829e
mov dword [ebp - 0x44], 0xce96f8f9
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002bba7
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1294], 0x9841b3c6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002bb8e
xor eax, eax
push 2
mov dword [ebp - 0x34], eax
pop ecx
jmp 0x1002bc38
mov dword [ebp - 0x48], 0xfffffffa
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002bbd5
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xbe8], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002bbc1
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002bc32
push 0x1a78
push 0x1633
push 0x9f0
push 0xf70
push 0x1a17
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x22cf
push 0x1878
push 0x1150
push 0x61a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x44]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jle 0x1002bbb2
mov dword [ebp - 0x3c], 0x3ae35568
mov dword [ebp - 0x50], 0xb61b
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002bc71
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xbc4], 0xeb905d09
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002bc58
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xa
je 0x1002bd24
mov dword [ebp - 0x34], 0xd526d2e8
mov dword [ebp - 0x44], 0x1615e82a
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], 0xdd711a53
dec dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1002bcb3
mov edx, eax
cmp dword [ebp - 0xbbc], eax
je 0x1002bcb5
mov edx, esi
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x3c]
imul ecx, edx
add ecx, 0xe55cec41
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setle dl
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], eax
ja 0x1002bcef
cmp dword [ebp - 0x34], eax
jne 0x1002bcf6
mov edx, eax
cmp dword [ebp - 0x50], eax
je 0x1002bcf8
mov edx, esi
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
push 0
setle cl
imul eax, ecx, 0xffff
mov dword [ebp - 0xbc0], ecx
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xa
pop eax
jne 0x1002bc7e
push 2
pop ecx
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x44], 0xb3895196
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002bd57
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x8f8], 0x7117
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002bd3e
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002bd79
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2a8], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002bd60
xor eax, eax
mov dword [ebp - 0x2a4], ecx
cmp dword [ebp - 0x2a4], eax
jl 0x1002bdd7
mov dword [ebp - 0x50], 0xb6890635
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2a0]
mov eax, dword [ebp - 0x8f4]
mov eax, dword [ebp - 0x2a4]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x8f4]
mov eax, dword [ebp - 0x8f0]
mov eax, dword [ebp - 0x2a4]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x2a0]
mov eax, dword [ebp - 0x2a4]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x2a4]
jns 0x1002bd87
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002be05
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xbf8], 0x905d09ea
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002bded
xor eax, eax
mov dword [ebp - 0x34], 0xfffffff5
jmp 0x1002be2d
cmp dword [ebp - 0x34], eax
jne 0x1002be33
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002be2a
push 0x776
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor eax, eax
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffef
jge 0x1002be0e
mov dword [ebp - 0x24], 0x881dda8
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1002be5a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x64], 0x8cff0ea7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002be45
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xfffffff7
je 0x1002c083
mov esi, dword [sym.imp.GDI32.dll_GetClipBox]
xor eax, eax
mov dword [ebp - 0x30], 0x799a
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002c68e
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002c6a6
push 0xea7
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor eax, eax
mov dword [ebp - 0x14], 0x41b3c692
xor ecx, ecx
mov dword [ebp - 0x30], 0xffffffff
inc ecx
mov dword [ebp - 0x30], 0xc8d46758
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x30], 0x920a6ff6
mov dword [ebp - 0x20], ecx
push 4
mov dword [ebp - 0x24], eax
pop ebx
cmp dword [ebp - 0x24], ebx
jge 0x1002c6f2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x12f4], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002c6da
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop edx
cmp dword [ebp - 0x24], edx
jge 0x1002c715
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xfd4], 0x9bc00ead
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1002c6fd
xor eax, eax
mov dword [ebp - 0x14], 0xfffffff4
jmp 0x1002c72d
mov dword [ebp - 0x30], 0x48f69f7f
cmp dword [ebp - 0x30], eax
jne 0x1002c733
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x18
jl 0x1002c71e
dec dword [ebp - 0x20]
mov dword [ebp - 0x54], 0xc9b7
mov dword [ebp - 0x20], 0x38f738f5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1002c760
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x94], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002c74c
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002c780
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x278], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002c768
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002c796
push eax
push eax
call dword [sym.imp.USER32.dll_EnumWindows]
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], eax
jl 0x1002c8b1
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1002c7d6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x664], 0xdf860956
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002c7be
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002c7ec
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf1c], 0xcfdfe924
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1002c7db
mov eax, dword [ebp - 0x26c]
xor edx, edx
push 0
mov eax, dword [ebp + eax*4 - 0x94]
mov eax, dword [ebp - 0x26c]
mov eax, dword [ebp + eax*4 - 0x94]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x26c]
mov eax, dword [ebp + eax*4 - 0x94]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x26c]
mov eax, dword [ebp + eax*4 - 0x94]
mov dword [ebp - 0x664], eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0xf14], ecx
mov eax, dword [ebp - 0x270]
cmp ecx, eax
mov ecx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x274]
setle dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x26c]
sete dl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x94]
cmp eax, edx
mov eax, dword [ebp - 0x26c]
setl bl
xor ecx, ecx
neg ebx
mov eax, dword [ebp + eax*4 - 0x94]
cmp ebx, eax
mov eax, dword [ebp - 0x274]
setl cl
imul eax, ecx
xor ecx, ecx
cmp eax, 0xfffffff8
pop eax
setl cl
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x26c]
push 1
pop ecx
jns 0x1002c7a8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0x1fc
mov dword [ebp - 0x30], 0x1145714f
mov dword [ebp - 0x30], 0x799333c7
mov dword [ebp - 0x30], 0x495761be
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0xbbd4
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x48], 0xfffffff8
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x14]
neg ecx
push 9
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
setg bl
sub ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, 0x4b28
setne dl
xor ecx, ecx
cmp eax, edx
pop eax
setne cl
cmp ecx, eax
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setl dl
sub edx, 0x76373a4c
neg edx
sbb edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x30], edx
dec dword [ebp - 0x48]
mov dword [ebp - 0x30], 0x799a
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1002c96d
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002c985
push 0xea7
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor eax, eax
mov dword [ebp - 0x2c], 0xb4495231
push 3
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jge 0x1002c9af
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x768], 0x7571177e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002c997
xor eax, eax
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002c9d2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3a0], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002c9ba
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1002c9ee
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1074], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002c9da
xor eax, eax
push 2
pop ecx
mov dword [ebp - 0x394], ecx
cmp dword [ebp - 0x394], eax
jl 0x1002cb87
push 0xfffffffffffffffb
pop edi
mov dword [ebp - 0x30], 0xc96c7979
xor ebx, ebx
mov dword [ebp - 0x30], 0x7e71
inc ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002ca31
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf34], ebx
inc dword [ebp - 0x14]
jmp 0x1002ca1d
mov eax, dword [ebp - 0x394]
mov eax, dword [ebp + eax*4 - 0x768]
inc eax
jne 0x1002cb2c
mov eax, dword [ebp - 0x394]
xor ecx, ecx
push 2
mov edx, dword [ebp + eax*4 - 0x768]
mov eax, dword [ebp - 0x30]
inc eax
cmp eax, edx
setge cl
mov dword [ebp - 0xf30], ecx
mov eax, dword [ebp - 0x394]
mov eax, dword [ebp + eax*4 - 0x768]
cmp eax, dword [ebp - 0x394]
jle 0x1002cb2b
mov dword [ebp - 0x40], 0x208af066
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], eax
pop ebx
jmp 0x1002cac2
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002caae
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002cabf
call dword [sym.imp.USER32.dll_GetCapture]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1002ca90
mov dword [ebp - 0x1074], edi
mov dword [ebp - 0x20], 0xfffffffc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], 0x30054750
mov ecx, dword [ebp - 0x2c]
neg ecx
push 2
sbb ecx, ecx
xor edx, edx
inc ecx
imul ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x398]
setge dl
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x394]
mov eax, dword [ebp + eax*4 - 0x768]
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
pop ecx
setg dl
xor eax, eax
mov dword [ebp - 0x40], edx
jmp 0x1002cb31
pop ecx
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], eax
jmp 0x1002cb6d
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002cb6a
push 0x10d9
push eax
push eax
push 0x24db
push 0x2378
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jle 0x1002cb36
dec dword [ebp - 0x394]
push 0
pop eax
jns 0x1002ca06
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x14], 0x41b3c692
or edx, 0xffffffff
mov dword [ebp - 0x30], edx
xor ebx, ebx
mov dword [ebp - 0x30], 0xc8d46758
inc ebx
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x30], 0x920a6ff6
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002cbcd
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x12d4], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002cbb8
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1002cbed
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x10ac], 0x9bc00ead
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002cbd5
xor eax, eax
mov dword [ebp - 0x14], 0xfffffff4
jmp 0x1002cc05
mov dword [ebp - 0x30], 0x48f69f7f
cmp dword [ebp - 0x30], eax
jne 0x1002cc0b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x18
jl 0x1002cbf6
dec dword [ebp - 0x20]
mov dword [ebp - 0x24], 0xbac64a68
mov dword [ebp - 0x54], 0x7440
mov dword [ebp - 0x3c], 0xc8ef34ea
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002cc43
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf4c], 0x744e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002cc2b
xor eax, eax
mov dword [ebp - 0x24], 0xfffffffd
jmp 0x1002cd3b
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 0x8f738f58
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002cc7b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x570], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002cc67
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
jg 0x1002cd38
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1002cca3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x34c], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002cc8f
xor eax, eax
cmp dword [ebp - 0x348], eax
jne 0x1002ccb4
mov eax, dword [ebp - 0x348]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
neg eax
push 0
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
imul edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x570]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
add ecx, 0x25e
cmp ecx, eax
setg dl
mov dword [ebp - 0x20], edx
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34c]
cmp ecx, eax
mov eax, dword [ebp - 0x348]
setge dl
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x54]
setl cl
xor edx, edx
cmp ecx, eax
pop eax
setne dl
sub edx, dword [ebp - 0x348]
neg edx
push 2
sbb edx, edx
inc edx
mov dword [ebp - 0x3c], edx
or edx, 0xffffffff
dec dword [ebp - 0x34]
pop ecx
cmp dword [ebp - 0x34], edx
jle 0x1002cc87
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffeb
jge 0x1002cc4f
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jl 0x1002cd6e
mov dword [ebp - 0x30], 0x1c17854c
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0xf4c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x3c]
jns 0x1002cd4d
xor eax, eax
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x1002cf02
mov dword [ebp - 0x10], 0xc7c8a6b9
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x1002ced9
mov dword [ebp - 0x30], 0xa63a74ad
mov dword [ebp - 0x54], 0x5ee6d54e
mov dword [ebp - 0x48], 0xfffc
mov dword [ebp - 0x14], eax
jmp 0x1002cddd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc64], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002cdd0
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x288]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setg dl
add eax, edx
je 0x1002ce0f
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002cef6
push eax
push 0x3cd
push eax
push 0x25ad
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor eax, eax
dec dword [ebp - 0x28]
push 2
pop ecx
jns 0x1002cd9c
mov dword [ebp - 0x14], 0x24ec2e0c
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1002cf2f
push eax
push 0x5f7
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
xor eax, eax
mov dword [ebp - 0x14], 0xffffffef
jmp 0x1002cf45
mov dword [ebp - 0x30], 0x425a
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff1
jl 0x1002cf38
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1002cf72