Function at 0x100296f8
Capabilities:
Check os version
Extract resource via kernel32 functions
Get common file path
Get disk information
Get disk size
Get file system object information
Get graphical window text
Identify system language via api
Modify service
Query service status
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xefc
push ebx
push esi
push edi
push 3
xor eax, eax
mov dword [ebp - 0x48], ecx
pop ecx
mov dword [ebp - 0x10], 8
mov dword [ebp - 8], eax
push 1
mov byte [ebp - 0x51], dl
pop edi
cmp dword [ebp - 8], ecx
jge 0x10029735
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xd94], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10029721
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 2
pop edx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], eax
jl 0x1002976c
mov dword [ebp - 8], eax
mov dword [ebp - 8], eax
jmp 0x10029762
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1002975f
push eax
call ebx
push 2
xor eax, eax
pop edx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jle 0x1002974e
dec dword [ebp - 0x10]
jns 0x10029746
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x12
je 0x10029798
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10029786
call esi
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x12
push 0
pop eax
jne 0x1002977b
push 2
pop edx
mov dword [ebp - 0x10], 8
push 3
mov dword [ebp - 8], eax
pop ecx
cmp dword [ebp - 8], ecx
jge 0x100297be
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xe00], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x100297aa
xor eax, eax
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], eax
jl 0x100297ec
mov dword [ebp - 8], eax
mov dword [ebp - 8], eax
jmp 0x100297e2
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100297df
push eax
call ebx
push 2
xor eax, eax
pop edx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jle 0x100297ce
dec dword [ebp - 0x10]
jns 0x100297c6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x12
je 0x10029812
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10029800
call esi
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x12
push 0
pop eax
jne 0x100297f5
push 2
pop edx
mov dword [ebp - 0x18], edi
push 3
mov dword [ebp - 0x34], 0xc3414b58
mov dword [ebp - 0x18], 0xa
pop esi
cmp dword [ebp - 0x18], 0xfffffff0
jge 0x100298d9
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jge 0x10029857
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x97c], 0x47dc4b4e
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x1002983f
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10029872
push eax
push 0x23f2
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
push 2
xor eax, eax
pop edx
mov dword [ebp - 0x20], eax
jmp 0x100298cc
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], edx
jg 0x100298c9
mov dword [ebp - 8], edx
mov dword [ebp - 8], eax
jmp 0x100298a9
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100298a6
push eax
push 0x178e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 2
xor eax, eax
pop edx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jle 0x1002988a
mov ecx, dword [ebp - 0x974]
mov eax, dword [ebp - 0x38]
push 0
mov dword [ebp + eax*4 - 0x97c], ecx
inc dword [ebp - 0x38]
pop eax
cmp dword [ebp - 0x38], edx
jle 0x10029882
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x10029877
dec dword [ebp - 0x18]
jmp 0x10029826
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x2c], 0xddbc3707
mov dword [ebp - 8], 0xe7f737a9
mov dword [ebp - 0x14], 0x8213af72
mov dword [ebp - 0x44], 0x4794
mov dword [ebp - 0x3c], 0xf9f7c8b1
mov dword [ebp - 0x20], 0x9135
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edx
jge 0x1002992a
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2cc], 0x67b8f5f4
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x10029912
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edx
jge 0x1002994a
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xcf0], 0xfffffffa
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x10029932
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1002995d
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
inc dword [ebp - 0x3c]
jne 0x100299cb
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
xor eax, eax
cmp dword [ebp - 0x2cc], eax
jne 0x10029975
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edi
mov eax, dword [ebp - 0x2cc]
setle cl
xor edx, edx
cmp ecx, eax
setge dl
imul ecx, dword [ebp - 0x2c], 0x67b3
mov eax, dword [ebp - 0x2c8]
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, eax
mov eax, dword [ebp - 0x2c]
add eax, ecx
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x100299bb
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x100299bd
mov eax, edi
jmp 0x100299bd
xor eax, eax
cmp eax, dword [ebp - 0x2cc]
jl 0x100299cb
xor eax, eax
mov ecx, eax
jmp 0x100299cd
mov ecx, edi
mov eax, dword [ebp - 0x2cc]
sub ecx, eax
jne 0x100299e0
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x20], eax
je 0x100299e2
mov edx, edi
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jge 0x10029a30
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xa74], 0xbf506e60
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x10029a18
xor eax, eax
mov dword [ebp - 0x428], eax
jmp 0x10029a7c
mov dword [ebp - 8], 0x94fe5f36
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10029a50
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jl 0x10029a76
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10029a71
push eax
push eax
push 0x14ef
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor eax, eax
dec dword [ebp - 8]
jns 0x10029a58
inc dword [ebp - 0x428]
cmp dword [ebp - 0x428], 0x16
jne 0x10029a38
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jge 0x10029aa1
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xe6c], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x10029a8d
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x10029b1b
mov dword [ebp - 0x34], 0xffffffff
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10029acb
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10029af7
push eax
call esi
push eax
push 0x2049
push 0x2290
push 0x613
push 0x25aa
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenu]
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 8], eax
jmp 0x10029b10
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10029b0d
push eax
call ebx
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x10029aff
dec dword [ebp - 0x10]
jns 0x10029ab3
mov dword [ebp - 0x10], eax
jmp 0x10029b38
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10029b2f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x10]
push 0
pop eax
cmp dword [ebp - 0x10], 0x12
jne 0x10029b20
mov dword [ebp - 0x24], edi
xor edx, edx
mov dword [ebp - 0x2c], 0x486b6feb
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x10], 0x609fa85f
mov dword [ebp - 0x38], 0xfb8eb5ea
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0xf545
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 8]
jge 0x10029ba1
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10029ba1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], edi
xor ecx, ecx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x24]
imul eax, eax, 0x6c7f
cmp eax, 8
mov eax, dword [ebp - 8]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x38], 0xffffffed
jge 0x10029c1f
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jge 0x10029bfa
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x51c], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x10029be2
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10029c16
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x51c], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10029c02
xor eax, eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffed
jl 0x10029bda
mov eax, 0x2d5e48d3
mov dword [ebp - 0x64c], eax
mov dword [ebp - 0x648], eax
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x640], eax
push 3
pop eax
mov dword [ebp - 0x38], 0x52061f6
mov dword [ebp - 0x38], eax
xor eax, eax
cmp dword [ebp - 0x38], eax
jl 0x10029c6b
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp + eax*4 - 0x64c]
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x64c], ecx
dec dword [ebp - 0x38]
jns 0x10029c50
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10029c81
push 0x1d30
call dword [sym.imp.USER32.dll_MessageBeep]
xor eax, eax
mov dword [ebp - 0x3c], eax
push 2
mov dword [ebp - 0xc], eax
pop ecx
cmp dword [ebp - 0xc], ecx
jge 0x10029ca7
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x128], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x10029c8f
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ecx
jge 0x10029cc7
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x69c], 0xc4d1454b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x10029caf
xor eax, eax
cmp dword [ebp - 0x124], eax
je 0x10029cd1
mov eax, edi
mov dword [ebp - 0x69c], eax
xor edx, edx
mov ecx, dword [ebp - 0x69c]
mov eax, dword [ebp - 0x124]
imul ecx, eax
mov eax, dword [ebp - 0x124]
cmp ecx, eax
mov eax, dword [ebp - 0x128]
sete dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x124]
setne bl
sub ebx, eax
neg ebx
sbb ebx, ebx
sub ecx, dword [ebp - 0x124]
inc ebx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, ebx
setne al
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10029d3d
call esi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
mov dword [ebp - 0x18], edi
push 2
mov dword [ebp - 0x34], 0xc3414b58
mov dword [ebp - 0x18], 0xa
pop ebx
cmp dword [ebp - 0x18], 0xfffffff0
jge 0x10029e01
mov dword [ebp - 0x20], 0xffffffff
push 3
mov dword [ebp - 8], eax
pop ecx
cmp dword [ebp - 8], ecx
jge 0x10029d85
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xa18], 0x47dc4b4e
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10029d6d
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10029d9d
push eax
push 0x23f2
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10029df4
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jg 0x10029df1
mov dword [ebp - 8], ebx
mov dword [ebp - 8], eax
jmp 0x10029dd1
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10029dce
push eax
push 0x178e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x10029db5
mov ecx, dword [ebp - 0xa10]
mov eax, dword [ebp - 0x38]
push 0
mov dword [ebp + eax*4 - 0xa18], ecx
inc dword [ebp - 0x38]
pop eax
cmp dword [ebp - 0x38], ebx
jle 0x10029dad
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10029da2
dec dword [ebp - 0x18]
jmp 0x10029d51
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x2c], 0xddbc3707
mov dword [ebp - 8], 0xe7f737a9
mov dword [ebp - 0x14], 0x8213af72
mov dword [ebp - 0x44], 0x4794
mov dword [ebp - 0x3c], 0xf9f7c8b1
mov dword [ebp - 0x20], 0x9135
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x10029e59
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x21c], 0x67b8f5f4
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x10029e41
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x10029e79
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc90], 0xfffffffa
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x10029e61
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10029e8c
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
inc dword [ebp - 0x3c]
jne 0x10029efa
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
xor eax, eax
cmp dword [ebp - 0x21c], eax
jne 0x10029ea4
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edi
mov eax, dword [ebp - 0x21c]
setle cl
xor edx, edx
cmp ecx, eax
setge dl
imul ecx, dword [ebp - 0x2c], 0x67b3
mov eax, dword [ebp - 0x218]
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, eax
mov eax, dword [ebp - 0x2c]
add eax, ecx
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x10029eea
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x10029eec
mov eax, edi
jmp 0x10029eec
xor eax, eax
cmp eax, dword [ebp - 0x21c]
jl 0x10029efa
xor eax, eax
mov ecx, eax
jmp 0x10029efc
mov ecx, edi
mov eax, dword [ebp - 0x21c]
sub ecx, eax
jne 0x10029f0f
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x20], eax
je 0x10029f11
mov edx, edi
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jge 0x10029f58
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb28], 0xbf506e60
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x10029f40
xor eax, eax
mov dword [ebp - 0x448], eax
jmp 0x10029fa4
mov dword [ebp - 8], 0x94fe5f36
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10029f78
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jl 0x10029f9e
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10029f99
push eax
push eax
push 0x14ef
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor eax, eax
dec dword [ebp - 8]
jns 0x10029f80
inc dword [ebp - 0x448]
cmp dword [ebp - 0x448], 0x16
jne 0x10029f60
push 3
mov dword [ebp - 8], eax
pop ecx
cmp dword [ebp - 8], ecx
jge 0x10029fcc
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xe48], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10029fb8
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDC]
push 2
pop edx
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x1002a4ee
mov dword [ebp - 0x10], 0x730f94f3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x1002a00a
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xd20], 0x4ec2e0cf
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x10029ff1
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x1002a047
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1002a026
call dword [sym.imp.USER32.dll_CreateMenu]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1002a03c
push 0x1c21
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x1002a015
push 2
pop edx
push 3
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002a069
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd20], 0xccbad86e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002a050
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], 0xce3051eb
mov dword [ebp - 0x3c], 0x299e885d
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edx
jge 0x1002a09a
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x348], 0x6915
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x1002a082
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ecx
jge 0x1002a0b6
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xb80], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1002a0a2
xor eax, eax
mov dword [ebp - 0x344], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x348]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x344]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xb80], eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x344]
imul eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jg 0x1002a4e2
jmp 0x1002a100
push 3
pop ecx
mov byte [ebp - 1], al
mov dword [ebp - 0x930], 0x4a68
mov dword [ebp - 0x92c], 0x4a68
mov dword [ebp - 0x928], 0x4a68
mov dword [ebp - 0x924], 0x4a68
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x1002a154
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x930], 0x71c7
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
jl 0x1002a13b
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1002a16c
push eax
call dword [sym.imp.GDI32.dll_GetObjectType]
push 2
pop edx
push 3
xor eax, eax
pop ecx
cmp byte [ebp - 1], 0
je 0x1002a4d3
mov dword [ebp - 0x24], 0xf4a8b108
mov dword [ebp - 0x28], 0xb13281d2
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edx
jge 0x1002a1a7
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x368], 0xea75c96
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x1002a18f
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ecx
jge 0x1002a1cb
push 3
xor ecx, ecx
pop edi
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x490], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x1002a1b4
xor edi, edi
inc edi
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edx
jge 0x1002a1eb
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x764], 0x24791a13
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x1002a1d3
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x364], eax
je 0x1002a2ca
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 8], eax
jmp 0x1002a221
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x2a4], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1002a210
mov dword [ebp - 0x2a4], 0x54db
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x490], eax
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002a285
mov ecx, dword [ebp - 0x364]
mov eax, dword [ebp - 0x364]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
xor eax, eax
cmp ecx, 0x93f04518
setne al
xor ecx, ecx
test eax, eax
sets cl
sub ecx, 0x3395cc9e
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xc3d8
jne 0x1002a283
mov eax, edi
jmp 0x1002a285
xor eax, eax
xor edx, edx
push 3
pop ecx
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
imul eax, ecx, 0x9aeb
xor ecx, ecx
cmp eax, 0xc0c84a4e
setne cl
cmp dword [ebp - 0x3c], ecx
jne 0x1002a2b4
mov eax, dword [ebp - 0x364]
mov eax, dword [ebp - 0x2a4]
mov eax, dword [ebp - 0x14]
push 0xfffffffffffffff8
pop ecx
sub ecx, eax
mov dword [ebp - 0x24], ecx
jmp 0x1002a4c7
mov dword [ebp - 0x10], 0x642ee1e3
mov ecx, 0x24bd
mov dword [ebp - 8], edi
mov dword [ebp - 0x5a4], ecx
mov dword [ebp - 0x5a0], ecx
mov dword [ebp - 0x59c], ecx
mov dword [ebp - 0x598], ecx
mov dword [ebp - 0x14], 0x7774ca6a
mov dword [ebp - 0x910], eax
mov dword [ebp - 0x90c], eax
mov dword [ebp - 0x908], eax
mov dword [ebp - 0x904], eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002a33c
push 0x20cd
push eax
push eax
push 0x2107
push 0xf8c
push eax
call esi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
push 2
xor eax, eax
pop edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffef
jle 0x1002a4c9
mov dword [ebp - 0x18], 0xa9f13988
mov dword [ebp - 0x2c], 0x1986173b
mov dword [ebp - 0x28], eax
jmp 0x1002a44a
mov dword [ebp - 0x44], 0x58e9526d
mov dword [ebp - 8], 0x4e64a2b
mov dword [ebp - 8], eax
jmp 0x1002a383
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xa20], 0x7fce2e64
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x1002a372
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
setl cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x18]
setl cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x598]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x760]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x490], edi
cmp dword [ebp - 0x14], eax
jne 0x1002a3f7
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x490], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setg dl
xor eax, eax
mov dword [ebp - 0xa20], edx
test edx, edx
je 0x1002a426
mov edx, edi
cmp dword [ebp - 8], eax
jne 0x1002a428
mov edx, eax
mov eax, dword [ebp - 0x59c]
xor ecx, ecx
sub eax, dword [ebp - 0x10]
cmp eax, edx
push 0
setg cl
imul eax, ecx, 0xfffb
mov dword [ebp - 8], eax
inc dword [ebp - 0x28]
pop eax
push 2
pop edx
cmp dword [ebp - 0x28], 0x29
jg 0x1002a35f
mov ecx, dword [ebp - 0x598]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setge dl
imul eax, edx
xor edx, edx
push 0
imul ecx, eax, 0x987
mov eax, dword [ebp - 0x910]
cmp ecx, eax
mov ecx, dword [ebp - 0x760]
mov eax, dword [ebp - 0x48c]
setge dl
sub ecx, edx
xor edx, edx
cmp ecx, eax
setg dl
xor eax, eax
add edx, 0x50b9
cmp edx, 0xffffffff
setne al
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 8]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x490], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffef
pop eax
push 2
pop edx
jg 0x1002a349
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 2
pop edx
inc dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], edx
jle 0x1002a0fd
dec dword [ebp - 0x1c]
push 0
pop eax
jns 0x10029fe1
mov dword [ebp - 0x34], 0xffffffff
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002a506
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002a532
push eax
call esi
push eax
push 0x2049
push 0x2290
push 0x613
push 0x25aa
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenu]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x12
je 0x1002a88c
push 2
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ecx
jge 0x1002a562
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x6b4], 5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1002a54a
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edi
jge 0x1002a57d
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x68], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x1002a56c
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002a596
push 0x1ea9
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
xor eax, eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], edi
jg 0x1002a5bf
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp + eax*4 - 0x6b4]
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x6b4], ecx
mov eax, dword [ebp - 0x68]
inc dword [ebp - 0x68]
cmp dword [ebp - 0x68], edi
jle 0x1002a59e
xor eax, eax
mov dword [ebp - 0x38], 0x838a1f94
push 3
mov dword [ebp - 8], eax
pop ecx
cmp dword [ebp - 8], ecx
jge 0x1002a5e9
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xc34], 0xa61928c1
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x1002a5d1
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ecx
jge 0x1002a609
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xc34], 0x4a53aa9a
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x1002a5f1
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002a61e
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 3
xor eax, eax
pop ecx
mov byte [ebp - 0x2d], al
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x34], eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x1002a654
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xd38], 0x841b3c69
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x1002a63b
xor eax, eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x1002a6bf
mov dword [ebp - 8], 0x9f7fd1e8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ecx
jg 0x1002a6ad
push 9
pop edx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x3c], edx
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002a6a2
push 0x126d
push eax
push 0x24ab
push 0x56f
push eax
call esi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
push 3
pop ecx
push 9
xor eax, eax
pop edx
dec dword [ebp - 0x3c]
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jle 0x1002a66e
mov eax, dword [ebp - 0x20]
push 0
mov eax, dword [ebp + eax*4 - 0xd38]
dec dword [ebp - 0x20]
pop eax
jns 0x1002a65c
cmp byte [ebp - 0x2d], 0
je 0x1002a76f
mov dword [ebp - 0x24], 0xa137b189
mov dword [ebp - 0x3c], 0xcb61d225
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 0x8d72a67f
mov dword [ebp - 0x2c], 0xe5809974
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 8], eax
jmp 0x1002a709
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xc58], 0xe31bb000
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x1002a6f8
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setg dl
xor ecx, ecx
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, 0x9384
mov dword [ebp - 0xc58], eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0xffff
setne cl
mov dword [ebp - 0x3c], ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 3
pop ecx
xor eax, eax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ecx
jge 0x1002a794
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x3f8], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x1002a780
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x1002a857
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ecx
jg 0x1002a826
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x3f8], ecx
jne 0x1002a814
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x3f8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x3f8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x3f4]
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x3f8], ecx
jne 0x1002a7f5
xor eax, eax
mov edx, eax
cmp dword [ebp - 0xc], eax
je 0x1002a7f7
mov edx, edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x3f8]
xor eax, eax
cmp edx, 0xc2d6
setge al
sub ecx, eax
jne 0x1002a814
xor eax, eax
jmp 0x1002a816
mov eax, edi
mov dword [ebp - 0x38], eax
inc dword [ebp - 0xc]
push 2
pop ecx
cmp dword [ebp - 0xc], ecx
jle 0x1002a7b5
xor eax, eax
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], eax
jl 0x1002a854
mov dword [ebp - 0x38], eax
jmp 0x1002a84a
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002a847
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jle 0x1002a833
dec dword [ebp - 0xc]
jns 0x1002a82e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x1002a79f
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002a879
push eax
call esi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 2
pop ecx
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x12
push 0
pop eax
jne 0x1002a542
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], 0x82062403
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002a8a8
push eax
push eax
call esi
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_SetClassLongA]
mov dword [ebp - 8], eax
jmp 0x1002a8d4
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002a8d1
push 0x14ee
push 0x9ac
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 5
jl 0x1002a8b3
mov dword [ebp - 0x10], edi
xor edx, edx
mov dword [ebp - 0x2c], 0x486b6feb
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x24], 0x609fa85f
mov dword [ebp - 0x38], 0xfb8eb5ea
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x10]
cmp eax, 0xf545
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 8]
jge 0x1002a93d
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002a93d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edi
xor ecx, ecx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x10]
imul eax, eax, 0x6c7f
cmp eax, 8
mov eax, dword [ebp - 8]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x38], 0xffffffed
jge 0x1002a9bb
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jge 0x1002a996
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x52c], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1002a97e
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002a9b2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x52c], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002a99e
xor eax, eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffed
jl 0x1002a976
mov dword [ebp - 0xc], edi
xor eax, eax
mov dword [ebp - 0x34], 0x744d0289
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jge 0x1002a9e7
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x28c], 0x99ac7894
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1002a9cf
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], eax
jg 0x1002aa2c
mov dword [ebp - 0x38], edi
xor ecx, ecx
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x28c], ecx
jne 0x1002aa2a
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], edi
jge 0x1002aa22
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x28c], 0x7cefa9d1
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edi
jl 0x1002aa0a
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jle 0x1002a9ef
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x1002aa4d
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002aa4a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jle 0x1002aa31
mov dword [ebp - 0x10], edi
xor edx, edx
mov dword [ebp - 0x2c], 0x486b6feb
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x24], 0x609fa85f
mov dword [ebp - 0x38], 0xfb8eb5ea
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x10]
cmp eax, 0xf545
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 8]
jge 0x1002aab5
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002aab5
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edi
xor ecx, ecx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x10]
imul eax, eax, 0x6c7f
cmp eax, 8
mov eax, dword [ebp - 8]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x38], 0xffffffed
jge 0x1002ab33
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jge 0x1002ab0e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x498], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1002aaf6
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002ab2a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x498], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002ab16
xor eax, eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffed
jl 0x1002aaee
xor eax, eax
mov dword [ebp - 0xc], 8
mov dword [ebp - 0x3c], eax
push 2
mov dword [ebp - 8], eax
pop ecx
cmp dword [ebp - 8], ecx
jge 0x1002ab62
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x654], 4
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x1002ab4a
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002ab7d
push 0x1ea9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 3
pop eax
mov dword [ebp - 0xc], eax
jmp 0x1002ac52
mov dword [ebp - 0x2c], 0x8efa97f5
mov dword [ebp - 8], 0x9495116
mov dword [ebp - 0x3c], 0xffffffff
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0xc]
xor eax, eax
cmp dword [ebp - 0xc], eax
jge 0x1002abbd
mov ecx, eax
cmp dword [ebp - 0x650], eax
je 0x1002abbf
mov ecx, edi
mov eax, dword [ebp - 0xc]
xor edx, edx
sub ecx, eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
cmp eax, 0x3847d228
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
setl cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0x7f39ab77
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0xc]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x2ae8
setle al
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1002ac22
cmp eax, dword [ebp - 0x2c]
je 0x1002ac48
mov eax, edi
cmp eax, dword [ebp - 0x2c]
jge 0x1002ac48
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x1002ac4f
push 0x2395
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1002ac4f
xor eax, eax
cmp dword [ebp - 8], eax
jne 0x1002ac5c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
je 0x1002ab88
xor eax, eax
mov dword [ebp - 8], 0x82062403
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x1002ac73
push eax
push eax
call esi
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x1002ac99
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002ac96
push 0x14ee
push 0x9ac
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 5
jl 0x1002ac78
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x34], 0x744d0289
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jge 0x1002acc9
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x208], 0x99ac7894
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1002acb1
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], eax
jg 0x1002ad0e
mov dword [ebp - 0x38], edi
xor ecx, ecx
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x208], ecx
jne 0x1002ad0c
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], edi
jge 0x1002ad04
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x208], 0x7cefa9d1
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edi
jl 0x1002acec
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jle 0x1002acd1
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x1002ad2f
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002ad2c
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jle 0x1002ad13
mov dword [ebp - 8], 0x82062403
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002ad4a
push eax
push eax
call esi
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x1002ad70
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002ad6d
push 0x14ee
push 0x9ac
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 5
jl 0x1002ad4f
mov dword [ebp - 0xc], 8
mov dword [ebp - 0x3c], eax
push 2
mov dword [ebp - 8], eax
pop ebx
cmp dword [ebp - 8], ebx
jge 0x1002ada3
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x6dc], 4
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x1002ad8b
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002adbe
push 0x1ea9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 3
pop eax
mov dword [ebp - 0xc], eax
jmp 0x1002ae93
mov dword [ebp - 0x2c], 0x8efa97f5
mov dword [ebp - 8], 0x9495116
mov dword [ebp - 0x3c], 0xffffffff
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x6d8], eax
mov eax, dword [ebp - 0xc]
xor eax, eax
cmp dword [ebp - 0xc], eax
jge 0x1002adfe
mov ecx, eax
cmp dword [ebp - 0x6d8], eax
je 0x1002ae00
mov ecx, edi
mov eax, dword [ebp - 0xc]
xor edx, edx
sub ecx, eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
cmp eax, 0x3847d228
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
setl cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0x7f39ab77
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0xc]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x2ae8
setle al
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1002ae63
cmp eax, dword [ebp - 0x2c]
je 0x1002ae89
mov eax, edi
cmp eax, dword [ebp - 0x2c]
jge 0x1002ae89
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x1002ae90
push 0x2395
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1002ae90
xor eax, eax
cmp dword [ebp - 8], eax
jne 0x1002ae9d
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
je 0x1002adc9
xor eax, eax
mov dword [ebp - 0x10], 0x3d06ce12
mov dword [ebp - 8], eax
jmp 0x1002aeb8
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x540], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x1002aeab
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x53c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jle 0x1002af4d
mov dword [ebp - 0x24], 0x439cb61d
mov ecx, edi
mov dword [ebp - 0x3c], 0x700168aa
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x540]
mov eax, dword [ebp - 0x24]
sub ecx, eax
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x110e
setg al
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
je 0x1002af1d
xor eax, eax
cmp dword [ebp - 0x53c], eax
je 0x1002af1f
mov ecx, edi
jmp 0x1002af21
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, 8
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jg 0x1002aed1
xor eax, eax
mov dword [ebp - 0xc], 0xb26bdde0
mov ebx, 0xfffa
mov dword [ebp - 0x3c], 0x44f34d89
mov dword [ebp - 0x3c], 0x8f438361
mov dword [ebp - 0x20], eax
push 3
mov dword [ebp - 0xc], 0xffffffee
pop ecx
cmp dword [ebp - 0xc], ecx
jle 0x1002b099
mov dword [ebp - 0x44], 0x9d60
xor edx, edx
mov dword [ebp - 8], 0x9b8f
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x14], 0x5f0e
mov dword [ebp - 0x3c], 0xc02dfce9
mov dword [ebp - 0x2c], 0xfffffff7
imul eax, dword [ebp - 0xc], 0xf5ec
add eax, dword [ebp - 0xc]
cmp eax, 0xef7e
mov eax, dword [ebp - 0xc]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0xc]
jge 0x1002afd3
xor eax, eax
mov edx, eax
cmp dword [ebp - 0xc], eax
je 0x1002afd5
mov edx, edi
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jne 0x1002afec
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, 0xfffffffa
add edx, dword [ebp - 0xc]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002b035
cmp dword [ebp - 0xc], eax
je 0x1002b035
mov eax, edi
mov dword [ebp - 0x3c], eax
xor edx, edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
setg dl
add edx, dword [ebp - 0x44]
cmp edx, 0xfffb
sbb eax, eax
neg eax
inc eax
cmp eax, ebx
jae 0x1002b071
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002b073
mov eax, edi
jmp 0x1002b073
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x1002b088
push eax
push eax
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
inc dword [ebp - 0xc]
push 3
pop eax
cmp dword [ebp - 0xc], eax
jg 0x1002af7d
xor eax, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x10], 0xc87a7525
mov dword [ebp - 0x3c], 0x34071e99
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x3c], 0xad9236f9
mov dword [ebp - 0x44], 0xfffffffd
mov dword [ebp - 0x3c], 0x21f5eb7
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edi
jge 0x1002b0df
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x50], 0x98a5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x1002b0ca
xor eax, eax
push 2
mov dword [ebp - 0xc], eax
pop ebx
cmp dword [ebp - 0xc], ebx
jge 0x1002b102
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xa34], 0xd9e62b56
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x1002b0ea
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x1002b118
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xa48], 0x1e34f9a3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x1002b107
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0xa30], 0x5984
cmp dword [ebp - 0x10], eax
je 0x1002b137
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x10]
mov dword [ebp - 0xa44], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, edi
sete al
xor ecx, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0x947a
mov eax, dword [ebp - 0x50]
setge cl
xor edx, edx
cmp ecx, 0x5b4d633c
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x50]
setg cl
xor edx, edx
cmp ecx, 0x1913
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x50]
setle cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
setne dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
add edx, dword [ebp - 0x50]
cmp edx, 0x510212ae
setne al
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], 0x486b6feb
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x34], 0xc3414b58
mov dword [ebp - 0x18], 0xa
cmp dword [ebp - 0x18], 0xfffffff0
jge 0x1002b2ad
xor eax, eax
mov dword [ebp - 0x20], 0xffffffff
push 3
mov dword [ebp - 8], eax
pop ecx
cmp dword [ebp - 8], ecx
jge 0x1002b22c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x98c], 0x47dc4b4e
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x1002b214
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002b244
push eax
push 0x23f2
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1002b29b
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jg 0x1002b298
mov dword [ebp - 8], ebx
mov dword [ebp - 8], eax
jmp 0x1002b278
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002b275
push eax
push 0x178e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x1002b25c
mov ecx, dword [ebp - 0x984]
mov eax, dword [ebp - 0x38]
push 0
mov dword [ebp + eax*4 - 0x98c], ecx
inc dword [ebp - 0x38]
pop eax
cmp dword [ebp - 0x38], ebx
jle 0x1002b254
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1002b249
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff0
jl 0x1002b202
mov dword [ebp - 0x20], 0xffffffff
xor eax, eax
push 3
mov dword [ebp - 0x28], 0x609fa85f
pop ecx
mov dword [ebp - 8], 0xfffffffc
mov dword [ebp - 0xc], eax
push 6
pop edx
cmp dword [ebp - 0xc], ecx
jge 0x1002b2e6
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x464], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1002b2d2
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edi
jge 0x1002b2ff
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x4c], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x1002b2ee
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], ebx
jg 0x1002b44f
mov dword [ebp - 0xc], 0xbb11accb
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], eax
jl 0x1002b40c
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x830], eax
mov dword [ebp - 0x82c], eax
mov dword [ebp - 0x828], eax
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x3c], 0xffffffff
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x464]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x464]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x1002b370
cmp dword [ebp - 0xc], eax
je 0x1002b377
mov edx, edi
cmp dword [ebp - 0xc], eax
jne 0x1002b379
mov edx, eax
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp eax, 0x75d5
setl cl
sub ecx, edx
je 0x1002b39c
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x464], ecx
je 0x1002b39c
mov edx, edi
jmp 0x1002b3a0
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x824]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
sete cl
xor ebx, ebx
cmp ecx, 0xfffffffa
mov edx, dword [ebp + eax*4 - 0x464]
mov eax, dword [ebp - 0xc]
setne bl
imul eax, ebx
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x464]
mov eax, dword [ebp - 0xc]
cmp eax, edi
setge cl
xor eax, eax
cmp ecx, 0xadc7
setle al
imul eax, dword [ebp - 0xc]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0xc]
jns 0x1002b325
push 2
xor eax, eax
pop ebx
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], eax
jl 0x1002b440
mov dword [ebp - 0x38], eax
jmp 0x1002b436
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002b433
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x1002b419
dec dword [ebp - 0xc]
jns 0x1002b414
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ebx
jle 0x1002b30b
push 6
pop edx
mov dword [ebp - 8], 0x13
jmp 0x1002b471
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x3c], 0xb3925b97
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xa
jge 0x1002b458
push 9
mov dword [ebp - 0x18], 0xfb8eb5ea
pop eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jge 0x1002b4a6
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xa5c], 7
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x1002b48e
xor eax, eax
mov dword [ebp - 8], edi
cmp dword [ebp - 8], eax
jl 0x1002b4c7
mov dword [ebp - 0x3c], 0x88adae8c
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0xa5c]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 8]
jns 0x1002b4ae
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0xf545
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x20]
jge 0x1002b50b
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002b50b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edi
xor ecx, ecx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x24]
imul eax, eax, 0x6c7f
cmp eax, 8
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], 0x4643cdf9
mov dword [ebp - 0x38], eax
mov eax, 0xaafa
mov dword [ebp - 0x8d0], eax
mov dword [ebp - 0x8cc], eax
mov dword [ebp - 0x8c8], eax
mov dword [ebp - 0x8c4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x1002b586
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x378], 0xc93b4e1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x1002b56d
xor eax, eax
push 3
mov dword [ebp - 0xc], eax
pop edx
cmp dword [ebp - 0xc], edx
jge 0x1002b5a9
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc70], 0x5b4d633c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x1002b591
xor eax, eax
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], eax
jl 0x1002b72a
mov dword [ebp - 0x40], 0x3fbb4ebb
mov dword [ebp - 0x3c], 0xffffffff
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x378]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x378], ecx
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x1002b716
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x1002b60a
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x304], 0x22a149ce
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x1002b5f1
xor eax, eax
mov dword [ebp - 0x2fc], eax
jmp 0x1002b6dd
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x378], ecx
je 0x1002b64e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x378]
mov eax, dword [ebp - 0x2fc]
mov dword [ebp + eax*4 - 0x378], ecx
xor eax, eax
test ecx, ecx
jne 0x1002b645
cmp dword [ebp - 0xc], eax
je 0x1002b650
cmp dword [ebp - 0xc], eax
je 0x1002b650
mov ecx, edi
jmp 0x1002b652
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x2f8]
imul eax, ecx
test eax, eax
jne 0x1002b669
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x378]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x38], edx
xor eax, eax
cmp dword [ebp - 0x38], eax
jl 0x1002b6b4
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp + eax*4 - 0x378]
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x378], ecx
xor eax, eax
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jl 0x1002b6ad
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002b6d7
cmp dword [ebp - 0x2fc], edx
jle 0x1002b615
mov eax, dword [ebp - 0x8cc]
mov ecx, 0xffff0001
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0xc6c], eax
mov eax, dword [ebp - 0x300]
sub ecx, eax
mov eax, dword [ebp - 0x20]
add eax, ecx
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x40]
push 0
pop eax
cmp dword [ebp - 0x40], edx
jle 0x1002b5e1
dec dword [ebp - 0xc]
jns 0x1002b5b5
xor eax, eax
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], 0xffffffed
jge 0x1002c130
jmp 0x1002b73b
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0xc], 0xc0ae9714
mov dword [ebp - 0x1c], 0xc1b6eab3
mov dword [ebp - 0x3c], 0x3560277e
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002b776
push 0x68b
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
xor eax, eax
mov dword [ebp - 0xc], 0x16
cmp dword [ebp - 0xc], 4
jle 0x1002b85b
xor eax, eax
mov dword [ebp - 0x44], 0x480
mov dword [ebp - 0x14], 0x12e1dfe0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], 0x28a99612
mov dword [ebp - 0x3c], 0xca862934
mov dword [ebp - 0x2c], 0x5de2caea
mov dword [ebp - 0x20], 0xeb81f947
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x5fc0266d
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x10b42b8f
mov dword [ebp - 8], edi
push 2
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x1002b7f3
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa70], 0xd83d7839
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002b7db
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x1002b80f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x278], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1002b7fb
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1002b82f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x358], 0xaeba
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002b817
xor eax, eax
push 3
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x1002b851
push 9
pop edx
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x608], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1002b83d
mov dword [ebp - 0x28], eax
jmp 0x1002b9ce
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
jmp 0x1002b877
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x46c], 0x3111
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1002b866
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x28]
jg 0x1002b891
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002b893
mov eax, edi
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
push 2
setg cl
imul ecx, dword [ebp - 0x28]
pop eax
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xdb84
mov eax, 0x4a6f4440
setg cl
xor edx, edx
sub eax, ecx
cmp eax, 0xd7c8
mov eax, dword [ebp - 0xc]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0xc]
jg 0x1002b8d9
mov dword [ebp - 0x1c], edi
xor eax, eax
mov dword [ebp - 0x34], 0x744d0289
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jge 0x1002c15c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x210], 0x99ac7894
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1002c144
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1002c1a1
mov dword [ebp - 0x18], edi
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x210], ecx
jne 0x1002c19f
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002c197
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x210], 0x7cefa9d1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002c17f
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002c164
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002c1c2
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x1002c1bf
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1002c1a6
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002c1ea
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x108], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002c1d2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002c20a