Function at 0x1002f310
Capabilities:
Check os version
Connect pipe
Create pipe
Enumerate gui resources
Get common file path
Get disk size
Parse pe header
Query environment variable
Query or enumerate registry value
Read .ini file

Disassembly:
mov eax, 0x10083581
call fcn.100819a0
mov eax, 0x1804
call fcn.1007ded0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x58], ecx
push edi
inc eax
mov byte [ebp - 0x65], dl
push eax
lea ecx, [ebp - 0x116c]
call fcn.10016f4f
xor eax, eax
xor ebx, ebx
mov dword [ebp - 4], eax
inc ebx
mov dword [ebp - 0x28], 0x12b57e8b
mov dword [ebp - 0x28], 0x4b5c
mov dword [ebp - 0x28], 0x12aa53f0
mov dword [ebp - 0x28], 0x678e
mov dword [ebp - 0x28], 0x574b
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002f39d
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x116c]
call fcn.10016fbc
mov dword [eax], 0x99ac
xor eax, eax
inc dword [ebp - 0x2c]
inc eax
cmp dword [ebp - 0x2c], eax
jl 0x1002f379
xor ebx, ebx
xor eax, eax
inc ebx
push 4
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x1002f3c0
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x17ac], 0x2edc7555
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1002f3a8
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
push 2
pop esi
jge 0x1002f3e1
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x173c], esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1002f3cc
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002f3f7
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x9b8], 0xeeb
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1002f3e6
inc dword [ebp - 0x9b8]
lea ecx, [ebp - 0x116c]
or edi, 0xffffffff
mov dword [ebp - 4], edi
call fcn.10016fb7
mov dword [ebp - 0x28], edi
lea ecx, [ebp - 0xf64]
mov dword [ebp - 0x28], 0x7730f94f
mov dword [ebp - 0x28], 0x9532bb11
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], 0xc23afc37
mov dword [ebp - 0x28], 0xe3580d41
mov dword [ebp - 0x28], 0xfffffff6
push esi
call fcn.10016f4f
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002f469
push dword [ebp - 0x10]
call fcn.10016fbc
mov dword [eax], 0x8b5131d8
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xf64]
cmp dword [ebp - 0x10], esi
jl 0x1002f458
dec dword [ebp - 0x44]
mov dword [ebp - 4], edi
call fcn.10016fb7
xor eax, eax
mov dword [ebp - 0x10], 0x8ade19d2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002f4aa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x179c], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002f491
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002f4be
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1002f4d0
mov dword [ebp - 0x44], 0x34e6
dec dword [ebp - 0x44]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x1002f4c3
mov dword [ebp - 0x18], 0x7ca0029b
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x2c], 0xe974a520
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x1c], 0x1d11
mov dword [ebp - 0x24], 0x89a278c0
mov dword [ebp - 0x20], 0x9f42c60e
push esi
call fcn.10016f4f
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x40], 0xbc8b421d
mov dword [ebp - 0x4c], 0x5297f1ff
mov dword [ebp - 0x10], eax
jmp 0x1002f532
push dword [ebp - 0x10]
lea ecx, [ebp - 0x138]
call fcn.10016fbc
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002f51f
mov ecx, dword [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0x50]
cmp ecx, eax
mov eax, dword [ebp - 0x50]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x1002f55d
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1002f55f
mov eax, ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x138]
mov esi, dword [ebp - 0x20]
push ebx
call fcn.10016fbc
mov ecx, dword [ebp - 0x50]
neg ecx
sbb ecx, ecx
mov dword [eax], esi
xor eax, eax
neg ecx
cmp ecx, esi
mov esi, 0xfffd
setg al
xor edx, edx
imul ecx, eax, 0xc12a
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jge 0x1002f5fe
push 2
pop ebx
lea ecx, [ebp - 0x138]
mov dword [ebp - 4], edi
call fcn.10016fb7
xor eax, eax
mov ecx, 0xa3888451
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
jne 0x1002f99f
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1002f99f
mov ecx, eax
jmp 0x1002f9a4
xor ebx, ebx
inc ebx
push 4
pop eax
mov dword [ebp - 0x30], edi
lea ecx, [ebp - 0x940]
mov dword [ebp - 0x40], 0x1ae9c7d4
push eax
call fcn.10016f4f
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x934]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x44], esi
push ebx
call fcn.10016f4f
push 4
pop ebx
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1002f65b
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x940]
call fcn.10016fbc
mov dword [eax], 0xb1cc
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1002f63d
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1002f677
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x934]
call fcn.10016fbc
mov dword [eax], 8
inc dword [ebp - 0x2c]
xor eax, eax
inc eax
cmp dword [ebp - 0x2c], eax
jl 0x1002f660
push dword [ebp - 0x24]
lea ecx, [ebp - 0x138]
call fcn.10016fbc
xor ebx, ebx
cmp dword [eax], ebx
je 0x1002f6ca
push dword [ebp - 0x24]
lea ecx, [ebp - 0x138]
call fcn.10016fbc
cmp dword [eax], ebx
jne 0x1002f6bb
push dword [ebp - 0x24]
lea ecx, [ebp - 0x138]
call fcn.10016fbc
cmp dword [eax], ebx
jne 0x1002f6bb
xor eax, eax
jmp 0x1002f6be
xor eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jle 0x1002f6ca
xor eax, eax
lea esi, [eax + 1]
jmp 0x1002f6ce
xor eax, eax
mov esi, eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x138]
call fcn.10016fbc
mov dword [eax], esi
lea eax, [esi + 0xd857]
imul eax, dword [ebp - 0x1c]
test eax, eax
je 0x1002f910
movdqa xmm0, xmmword [0x10007f00]
lea eax, [ebp - 0x143c]
push eax
lea eax, [ebp - 0x144c]
push eax
lea ecx, [ebp - 0x15a8]
movdqu xmmword [ebp - 0x144c], xmm0
call fcn.10016fcb
lea ecx, [ebp - 0x1e0]
mov esi, eax
call fcn.10008f43
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x6b4]
push dword [esi]
call fcn.10016f91
push 5
pop eax
mov byte [ebp - 4], al
push 6
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], 0xf3ae864e
mov dword [ebp - 0x28], 0x7713999e
push 9
mov dword [ebp - 0x28], 0x42fb88b
pop eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffec
jl 0x1002f900
xor edi, edi
inc edi
or eax, 0xffffffff
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], 8
push edi
call fcn.10016fbc
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
push dword [ebp - 0x24]
cmp dword [eax], ecx
lea ecx, [ebp - 0x138]
setg bl
call fcn.10016fbc
push 2
lea ecx, [ebp - 0x6b4]
mov dword [eax], ebx
pop eax
push eax
call fcn.10016fbc
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov dword [eax], ebx
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
setne dl
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp esi, eax
mov eax, dword [ebp - 0x30]
setl cl
cmp ecx, 0x8160a871
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x50]
setl cl
sub ebx, ecx
neg ebx
sbb ebx, ebx
xor ecx, ecx
neg ebx
cmp eax, ebx
setle cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x4c]
sub ecx, eax
je 0x1002f81a
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x1002f8fd
jmp 0x1002f834
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002f832
push eax
push eax
push 0x1b99
push eax
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
xor eax, eax
push 2
pop ebx
cmp dword [ebp - 0x30], eax
je 0x1002f86e
cmp dword [ebp - 0x1c], eax
jne 0x1002f865
push ebx
lea ecx, [ebp - 0x940]
call fcn.10016fbc
push edi
lea ecx, [ebp - 0x6b4]
call fcn.10016fbc
xor ecx, ecx
cmp dword [eax], ecx
setne cl
cmp ecx, dword [ebp - 0x34]
jg 0x1002f86c
xor eax, eax
lea edi, [eax + 1]
jmp 0x1002f870
xor eax, eax
mov edi, eax
push 3
lea ecx, [ebp - 0x6b4]
call fcn.10016fbc
mov ecx, dword [ebp - 0x34]
lea edx, [edi - 0xee151ae]
mov esi, eax
xor eax, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x34]
push ebx
setle al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x940]
setne dl
imul edx, dword [esi]
mov dword [ebp - 0x38], edx
call fcn.10016fbc
mov esi, dword [ebp - 0x38]
lea ecx, [ebp - 0x6b4]
xor edi, edi
inc edi
add esi, dword [eax]
push edi
call fcn.10016fbc
xor ebx, ebx
lea ecx, [ebp - 0x138]
push edi
cmp esi, dword [eax]
sete bl
call fcn.10016fbc
mov ecx, dword [ebp - 0x34]
imul ecx, dword [ebp - 0x1c]
push edi
sub ecx, ebx
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x138]
setl bl
call fcn.10016fbc
mov dword [eax], ebx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffec
jge 0x1002f76b
or edi, 0xffffffff
inc dword [ebp - 0x44]
lea ecx, [ebp - 0x6b4]
call fcn.10016fb7
jmp 0x1002f970
mov dword [ebp - 0x44], 0x1c0e03a8
lea ecx, [ebp - 0x934]
mov dword [ebp - 0x30], 0x4566f38f
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
xor eax, eax
push eax
call fcn.10016fbc
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x138]
mov esi, dword [ebp - 0x44]
push dword [ebp - 0x24]
neg esi
sbb esi, esi
neg esi
call fcn.10016fbc
lea ecx, [ebp - 0x934]
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x30], esi
push eax
call fcn.10016fbc
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
lea ecx, [ebp - 0x934]
call fcn.10016fb7
push 2
pop ebx
lea ecx, [ebp - 0x940]
mov byte [ebp - 4], bl
call fcn.10016fb7
dec dword [ebp - 0x24]
mov esi, 0xfffd
jns 0x1002f5fb
jmp 0x1002f5bd
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
mov ecx, 0xd853
setge dl
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, 0x1b17
setne dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
sub eax, edx
mov edx, 0xffff
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10030155
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10030152
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0xf7c]
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x1c], 0x6d64bda9
mov dword [ebp - 0x10], 0x40c88307
push 4
mov dword [ebp - 0x3c], edx
pop esi
mov dword [ebp - 0x40], 0xf73ecb6a
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xfffffffe
push esi
call fcn.10016f4f
push 6
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], eax
jmp 0x1002fa6a
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf7c]
call fcn.10016fbc
mov dword [eax], 0x330c202e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002fa53
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jge 0x1002fb33
xor eax, eax
mov dword [ebp - 0x50], 0x664d
inc eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x40], 0xc78ef8a6
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002fab1
push 0x1367
push eax
push 0x1d62
push 0x1512
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1002fad7
mov edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x50]
cmp edx, eax
mov eax, 0xffff
setg cl
sub ecx, dword [ebp - 0x50]
sub ecx, eax
mov dword [ebp - 0x40], ecx
jne 0x1002fad7
xor eax, eax
mov ecx, eax
jmp 0x1002fadc
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x20]
add eax, 0x30c4e2bf
add eax, ecx
xor ecx, ecx
cmp eax, 0xf5e3
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x50]
neg edx
sbb edx, edx
add edx, 0x11e368c0
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
inc edx
add edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x50]
add edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
cmp edx, eax
setne cl
mov dword [ebp - 0x40], ecx
jmp 0x1002fd0b
push ebx
lea ecx, [ebp - 0x3b4]
call fcn.10016f4f
xor eax, eax
mov byte [ebp - 4], 7
mov dword [ebp - 0x10], eax
jmp 0x1002fb61
push dword [ebp - 0x10]
lea ecx, [ebp - 0x3b4]
call fcn.10016fbc
mov dword [eax], 0xe8aff65c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002fb4a
mov dword [ebp - 0x1c], 0xffffffec
cmp dword [ebp - 0x1c], 0x17
jge 0x1002fd00
movdqa xmm0, xmmword [0x10007ec0]
lea eax, [ebp - 0x137c]
push eax
xor ebx, ebx
mov dword [ebp - 0x30], 0x16e0
lea eax, [ebp - 0x138c]
mov dword [ebp - 0x4c], 0xfffffff8
inc ebx
lea ecx, [ebp - 0x16b8]
mov dword [ebp - 0x40], ebx
push eax
movdqu xmmword [ebp - 0x138c], xmm0
call fcn.10016fcb
lea ecx, [ebp - 0x19a]
mov esi, eax
call fcn.10008f43
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x12b0]
push dword [esi]
call fcn.10016f91
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1002fc26
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x3b4]
mov eax, dword [ebp - 0x10]
push ebx
call fcn.10016fbc
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x10], eax
jne 0x1002fc06
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x3b4]
mov eax, dword [ebp - 0x30]
push ebx
call fcn.10016fbc
cmp dword [eax], 0
je 0x1002fc24
xor eax, eax
inc eax
mov esi, eax
jmp 0x1002fc2b
xor eax, eax
mov esi, eax
xor eax, eax
inc eax
push eax
lea ecx, [ebp - 0x3b4]
call fcn.10016fbc
xor ebx, ebx
lea ecx, [ebp - 0x3b4]
cmp esi, dword [eax]
setge bl
xor eax, eax
push eax
call fcn.10016fbc
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp ebx, ecx
mov eax, dword [eax]
sete dl
add eax, 0xffff0001
add eax, edx
jne 0x1002fc79
push eax
lea ecx, [ebp - 0x3b4]
call fcn.10016fbc
cmp dword [eax], 0
jne 0x1002fc79
xor eax, eax
mov edi, eax
inc eax
jmp 0x1002fc7e
xor eax, eax
inc eax
mov edi, eax
push eax
lea ecx, [ebp - 0x3b4]
call fcn.10016fbc
mov ecx, dword [ebp - 0x1c]
mov esi, eax
xor eax, eax
cmp edi, 0x2102
push 5
setl al
xor edx, edx
cmp eax, ecx
pop eax
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor ebx, ebx
cmp ecx, dword [esi]
lea ecx, [ebp - 0x12b0]
setne bl
xor eax, eax
push eax
call fcn.10016fbc
xor ecx, ecx
cmp ebx, dword [eax]
setg cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x12b0]
mov byte [ebp - 4], 7
call fcn.10016fb7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
jl 0x1002fb77
push 2
pop ebx
or edi, 0xffffffff
lea ecx, [ebp - 0x3b4]
call fcn.10016fb7
dec dword [ebp - 0x44]
lea ecx, [ebp - 0xf7c]
mov dword [ebp - 4], edi
call fcn.10016fb7
push 6
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe2
je 0x1002fdfc
xor esi, esi
inc esi
jmp 0x1002fd40
push 2
pop ebx
push 4
pop edi
push edi
lea ecx, [ebp - 0x4e0]
call fcn.10016f4f
push 9
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002fd77
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1290], 0xde0b4074
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002fd5f
xor eax, eax
mov dword [ebp - 0x24], eax
xor ebx, ebx
lea ecx, [ebp - 0x4e0]
cmp dword [ebp - 0x24], edi
jge 0x1002fd96
push dword [ebp - 0x24]
call fcn.10016fbc
mov dword [eax], ebx
inc dword [ebp - 0x24]
jmp 0x1002fd7c
push esi
call fcn.10016fbc
push esi
lea ecx, [ebp - 0x4e0]
mov dword [eax], ebx
call fcn.10016fbc
push 2
pop edi
jmp 0x1002fdd8
push esi
call fcn.10016fbc
push esi
lea ecx, [ebp - 0x4e0]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x1290], ebx
call fcn.10016fbc
push esi
lea ecx, [ebp - 0x4e0]
inc dword [eax]
call fcn.10016fbc
lea ecx, [ebp - 0x4e0]
cmp dword [eax], edi
jl 0x1002fdaf
or ebx, 0xffffffff
mov dword [ebp - 4], ebx
call fcn.10016fb7
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe2
jne 0x1002fd3d
jmp 0x1002fe02
push 2
pop edi
or ebx, 0xffffffff
mov dword [ebp - 0x2c], 0xb
jmp 0x1003012c
movdqa xmm0, xmmword [0x10007ee0]
lea eax, [ebp - 0x14dc]
push eax
mov dword [ebp - 0x38], 0xb3ae3556
lea eax, [ebp - 0x14ec]
mov dword [ebp - 0x10], 0xb818f8f6
lea ecx, [ebp - 0x1610]
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x40], 0xa2fc53d
push eax
movdqu xmmword [ebp - 0x14ec], xmm0
call fcn.10016fcb
lea ecx, [ebp - 0x1bc]
mov esi, eax
call fcn.10008f43
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1184]
push dword [esi]
call fcn.10016f91
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x38], 0xfffffff1
cmp dword [ebp - 0x38], 0xe
je 0x10030118
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], 0x1c17c774
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1002feb5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x170], 0x73eb905d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002fe9d
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jg 0x100300a2
push 4
pop esi
jmp 0x1002fecc
xor eax, eax
inc eax
push eax
lea ecx, [ebp - 0x32c]
call fcn.10016f4f
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xaa8]
mov dword [ebp - 0x44], 3
push esi
call fcn.10016f4f
xor eax, eax
mov byte [ebp - 4], 0xc
xor ebx, ebx
mov dword [ebp - 0x24], eax
inc ebx
cmp dword [ebp - 0x24], ebx
jge 0x1002ff24
push dword [ebp - 0x24]
lea ecx, [ebp - 0x32c]
call fcn.10016fbc
mov dword [eax], 0x6d2e8588
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jl 0x1002ff00
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1002ff4a
push dword [ebp - 0x24]
lea ecx, [ebp - 0xaa8]
call fcn.10016fbc
mov dword [eax], 0x3ae4c7ba
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1002ff2c
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1002ff61
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor eax, eax
push eax
lea ecx, [ebp - 0x32c]
call fcn.10016fbc
lea ecx, [ebp - 0x32c]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10016fbc
cmp dword [eax], ebx
jg 0x10030079
xor eax, eax
mov dword [ebp - 0x20], 0xe4562513
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1002ffa1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x10030052
or ecx, 0xffffffff
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x50], eax
jmp 0x1002ffda
mov dword [ebp - 0x44], ebx
push eax
call fcn.10016fbc
mov ecx, dword [ebp - 0x50]
push 0
mov ecx, dword [ebp + ecx*4 - 0x170]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x170], ecx
inc dword [ebp - 0x50]
pop eax
lea ecx, [ebp - 0x32c]
cmp dword [ebp - 0x50], ebx
jle 0x1002ffb8
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x170]
xor eax, eax
push eax
call fcn.10016fbc
xor edx, edx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x170]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
dec ecx
cmp ecx, eax
lea ecx, [ebp - 0xaa8]
setle dl
xor eax, eax
cmp edx, 6
setl al
mov dword [ebp - 0x44], eax
xor eax, eax
push eax
call fcn.10016fbc
mov ecx, dword [ebp - 0x1c]
xor edx, edx
push 0
mov esi, dword [ebp + ecx*4 - 0x170]
mov ecx, dword [ebp - 0x44]
add ecx, 0x27a2
cmp esi, ecx
setge dl
mov dword [eax], edx
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], ebx
jle 0x1002ffad
push eax
lea ecx, [ebp - 0x32c]
call fcn.10016fbc
lea ecx, [ebp - 0x32c]
inc dword [eax]
xor eax, eax
push eax
call fcn.10016fbc
cmp dword [eax], ebx
jle 0x1002ff86
push 4
pop esi
lea ecx, [ebp - 0xaa8]
call fcn.10016fb7
lea ecx, [ebp - 0x32c]
mov byte [ebp - 4], 0xa
call fcn.10016fb7
inc dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jle 0x1002fec9
mov eax, dword [ebp - 0x170]
xor edx, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x10], eax
jne 0x100300d7
cmp dword [ebp - 0x1c], eax
je 0x100300da
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1184]
mov eax, dword [ebp - 0x10]
sub eax, 0x6e57c533
mov dword [ebp - 0x1c], eax
xor eax, eax
inc eax
push eax
call fcn.10016fbc
mov edx, dword [ebp - 0x1c]
mov esi, eax
mov ecx, dword [ebp - 0x30]
xor eax, eax
cmp edx, ecx
setge al
mov dword [esi], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xe
jne 0x1002fe89
or ebx, 0xffffffff
lea ecx, [ebp - 0x1184]
mov dword [ebp - 4], ebx
call fcn.10016fb7
mov dword [ebp - 0x40], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x18
je 0x1002fe0e
inc dword [ebp - 0x18]
mov edx, 0xffff
push 2
pop ebx
push 0
pop eax
push 0xffffffffffffffff
pop edi
cmp dword [ebp - 0x18], ebx
jl 0x1002fa0c
or edi, edi
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe8
jle 0x1002fa00
mov dword [ebp - 0x10], 0x8ade19d2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10030188
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1760], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003016f
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1003019c
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100301ae
mov dword [ebp - 0x44], 0x34e6
dec dword [ebp - 0x44]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x100301a1
mov dword [ebp - 0x1c], 0x3ae35568
mov dword [ebp - 0x44], 0x43eb6069
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x40], 0xd62a04f7
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], 0xe
cmp dword [ebp - 0x1c], 0xfffffffb
jne 0x10030254
jmp 0x100301df
xor eax, eax
mov dword [ebp - 0x10], 0xd3f7
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x40], edi
cmp dword [ebp - 0x1c], eax
je 0x10030201
mov eax, dword [ebp - 0x1c]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x8b01
setle cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov esi, dword [ebp - 0x44]
sub esi, dword [ebp - 0x1c]
add esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setl dl
xor eax, eax
cmp esi, edx
setg al
neg eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10030254
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffb
je 0x100301dd
xor ebx, ebx
lea ecx, [ebp - 0xf94]
inc ebx
push ebx
call fcn.10016f4f
mov dword [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x28], 0x12b57e8b
mov dword [ebp - 0x28], 0x4b5c
mov dword [ebp - 0x28], 0x12aa53f0
mov dword [ebp - 0x28], 0x678e
mov dword [ebp - 0x28], 0x574b
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x100302c5
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xf94]
call fcn.10016fbc
mov dword [eax], 0x99ac
xor eax, eax
inc dword [ebp - 0x2c]
inc eax
cmp dword [ebp - 0x2c], eax
jl 0x100302a1
xor ebx, ebx
xor eax, eax
inc ebx
push 4
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x100302e8
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x17fc], 0x2edc7555
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x100302d0
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
push 2
pop edi
jge 0x10030309
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x176c], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x100302f4
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1003031f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x9c0], 0xeeb
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1003030e
inc dword [ebp - 0x9c0]
lea ecx, [ebp - 0xf94]
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.10016fb7
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x1c], 0x1d11
mov dword [ebp - 0x18], 0x89a278c0
mov dword [ebp - 0x20], 0x9f42c60e
push edi
call fcn.10016f4f
mov dword [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x40], 0xbc8b421d
mov dword [ebp - 0x4c], 0x5297f1ff
mov dword [ebp - 0x10], eax
jmp 0x1003038e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x120]
call fcn.10016fbc
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003037b
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x100303b9
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100303bb
mov eax, ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x120]
mov esi, dword [ebp - 0x20]
push ebx
call fcn.10016fbc
mov ecx, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
mov dword [eax], esi
xor eax, eax
neg ecx
cmp ecx, esi
setg al
xor edx, edx
imul ecx, eax, 0xc12a
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x100307b4
push 4
pop edi
or esi, 0xffffffff
lea ecx, [ebp - 0x970]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x40], 0x1ae9c7d4
push edi
call fcn.10016f4f
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x958]
mov eax, 0xfffd
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x44], eax
push ebx
call fcn.10016f4f
xor eax, eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10030478
push dword [ebp - 0x24]
lea ecx, [ebp - 0x970]
call fcn.10016fbc
mov dword [eax], 0xb1cc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1003045a
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10030494
push dword [ebp - 0x24]
lea ecx, [ebp - 0x958]
call fcn.10016fbc
mov dword [eax], 8
inc dword [ebp - 0x24]
xor eax, eax
inc eax
cmp dword [ebp - 0x24], eax
jl 0x1003047d
push dword [ebp - 0x18]
lea ecx, [ebp - 0x120]
call fcn.10016fbc
xor ebx, ebx
cmp dword [eax], ebx
je 0x100304e7
push dword [ebp - 0x18]
lea ecx, [ebp - 0x120]
call fcn.10016fbc
cmp dword [eax], ebx
jne 0x100304d8
push dword [ebp - 0x18]
lea ecx, [ebp - 0x120]
call fcn.10016fbc
cmp dword [eax], ebx
jne 0x100304d8
xor eax, eax
jmp 0x100304db
xor eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jle 0x100304e7
xor eax, eax
lea esi, [eax + 1]
jmp 0x100304eb
xor eax, eax
mov esi, eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x120]
call fcn.10016fbc
mov dword [eax], esi
lea eax, [esi + 0xd857]
imul eax, dword [ebp - 0x1c]
test eax, eax
je 0x1003072b
movdqa xmm0, xmmword [0x10007f00]
lea eax, [ebp - 0x139c]
push eax
lea eax, [ebp - 0x13ac]
push eax
lea ecx, [ebp - 0x1690]
movdqu xmmword [ebp - 0x13ac], xmm0
call fcn.10016fcb
lea ecx, [ebp - 0x19c]
mov esi, eax
call fcn.10008f43
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x6c4]
push dword [esi]
call fcn.10016f91
mov byte [ebp - 4], 0x11
push 6
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], 0xf3ae864e
mov dword [ebp - 0x28], 0x7713999e
push 9
mov dword [ebp - 0x28], 0x42fb88b
pop eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffec
jl 0x1003071b
xor edi, edi
inc edi
or eax, 0xffffffff
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x50], 8
push edi
call fcn.10016fbc
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
push dword [ebp - 0x18]
cmp dword [eax], ecx
lea ecx, [ebp - 0x120]
setg bl
call fcn.10016fbc
push 2
lea ecx, [ebp - 0x6c4]
mov dword [eax], ebx
pop eax
push eax
call fcn.10016fbc
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov dword [eax], ebx
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
setne dl
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp esi, eax
mov eax, dword [ebp - 0x30]
setl cl
cmp ecx, 0x8160a871
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setl cl
sub ebx, ecx
neg ebx
sbb ebx, ebx
xor ecx, ecx
neg ebx
cmp eax, ebx
setle cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x4c]
sub ecx, eax
je 0x10030635
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x10030718
jmp 0x1003064f
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1003064d
push eax
push eax
push 0x1b99
push eax
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
xor eax, eax
push 2
pop ebx
cmp dword [ebp - 0x30], eax
je 0x10030689
cmp dword [ebp - 0x1c], eax
jne 0x10030680
push ebx
lea ecx, [ebp - 0x970]
call fcn.10016fbc
push edi
lea ecx, [ebp - 0x6c4]
call fcn.10016fbc
xor ecx, ecx
cmp dword [eax], ecx
setne cl
cmp ecx, dword [ebp - 0x50]
jg 0x10030687
xor eax, eax
lea edi, [eax + 1]
jmp 0x1003068b
xor eax, eax
mov edi, eax
push 3
lea ecx, [ebp - 0x6c4]
call fcn.10016fbc
mov ecx, dword [ebp - 0x50]
lea edx, [edi - 0xee151ae]
mov esi, eax
xor eax, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x50]
push ebx
setle al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x970]
setne dl
imul edx, dword [esi]
mov dword [ebp - 0x38], edx
call fcn.10016fbc
mov esi, dword [ebp - 0x38]
lea ecx, [ebp - 0x6c4]
xor edi, edi
inc edi
add esi, dword [eax]
push edi
call fcn.10016fbc
xor ebx, ebx
lea ecx, [ebp - 0x120]
push edi
cmp esi, dword [eax]
sete bl
call fcn.10016fbc
mov ecx, dword [ebp - 0x50]
imul ecx, dword [ebp - 0x1c]
push edi
sub ecx, ebx
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x120]
setl bl
call fcn.10016fbc
mov dword [eax], ebx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffec
jge 0x10030586
push 4
pop edi
inc dword [ebp - 0x44]
lea ecx, [ebp - 0x6c4]
call fcn.10016fb7
jmp 0x1003078b
mov dword [ebp - 0x44], 0x1c0e03a8
lea ecx, [ebp - 0x958]
mov dword [ebp - 0x30], 0x4566f38f
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
xor eax, eax
push eax
call fcn.10016fbc
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x120]
mov esi, dword [ebp - 0x44]
push dword [ebp - 0x18]
neg esi
sbb esi, esi
neg esi
call fcn.10016fbc
lea ecx, [ebp - 0x958]
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x30], esi
push eax
call fcn.10016fbc
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
lea ecx, [ebp - 0x958]
call fcn.10016fb7
lea ecx, [ebp - 0x970]
mov byte [ebp - 4], 0xe
call fcn.10016fb7
dec dword [ebp - 0x18]
push 1
pop ebx
jns 0x10030418
push 2
pop edi
or esi, 0xffffffff
lea ecx, [ebp - 0x120]
mov dword [ebp - 4], esi
call fcn.10016fb7
mov dword [ebp - 0x18], 0x7ca0029b
lea ecx, [ebp - 0xfac]
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, 0xffff
mov dword [ebp - 0x1c], 0x6d64bda9
push 0xfffffffffffffff9
mov dword [ebp - 0x10], 0x40c88307
mov dword [ebp - 0x3c], eax
pop eax
push 4
mov dword [ebp - 0x40], 0xf73ecb6a
mov dword [ebp - 0x28], eax
pop eax
mov dword [ebp - 0x28], 0xfffffffe
push eax
call fcn.10016f4f
xor eax, eax
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], eax
push 4
pop eax
cmp dword [ebp - 0x10], eax
jge 0x10030842
push eax
pop ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0xfac]
call fcn.10016fbc
mov dword [eax], 0x330c202e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10030823
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jge 0x10030903
mov dword [ebp - 0x34], 0x664d
xor eax, eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], 0xc78ef8a6
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10030881
push 0x1367
push eax
push 0x1d62
push 0x1512
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x100308a7
mov edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp edx, eax
mov eax, 0xffff
setg cl
sub ecx, dword [ebp - 0x34]
sub ecx, eax
mov dword [ebp - 0x40], ecx
jne 0x100308a7
xor eax, eax
mov ecx, eax
jmp 0x100308ac
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x20]
add eax, 0x30c4e2bf
add eax, ecx
xor ecx, ecx
cmp eax, 0xf5e3
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x34]
neg edx
sbb edx, edx
add edx, 0x11e368c0
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
inc edx
add edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp edx, eax
setne cl
mov dword [ebp - 0x40], ecx
jmp 0x10030adb
push edi
lea ecx, [ebp - 0x40c]
call fcn.10016f4f
xor eax, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x10], eax
jmp 0x10030931
push dword [ebp - 0x10]
lea ecx, [ebp - 0x40c]
call fcn.10016fbc
mov dword [eax], 0xe8aff65c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003091a
mov dword [ebp - 0x1c], 0xffffffec
cmp dword [ebp - 0x1c], 0x17
jge 0x10030ad0
movdqa xmm0, xmmword [0x10007ec0]
lea eax, [ebp - 0x145c]
push eax
lea eax, [ebp - 0x146c]
mov dword [ebp - 0x30], 0x16e0
mov dword [ebp - 0x4c], 0xfffffff8
lea ecx, [ebp - 0x1620]
mov dword [ebp - 0x40], ebx
push eax
movdqu xmmword [ebp - 0x146c], xmm0
call fcn.10016fcb
lea ecx, [ebp - 0x1df]
mov esi, eax
call fcn.10008f43
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1260]
push dword [esi]
call fcn.10016f91
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x100309f3
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x40c]
mov eax, dword [ebp - 0x10]
push ebx
call fcn.10016fbc
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x10], eax
jne 0x100309d3
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x40c]
mov eax, dword [ebp - 0x30]
push ebx
call fcn.10016fbc
cmp dword [eax], 0
je 0x100309f1
xor eax, eax
inc eax
mov esi, eax
jmp 0x100309f8
xor eax, eax
mov esi, eax
xor eax, eax
inc eax
push eax
lea ecx, [ebp - 0x40c]
call fcn.10016fbc
xor ebx, ebx
lea ecx, [ebp - 0x40c]
cmp esi, dword [eax]
setge bl
xor eax, eax
push eax
call fcn.10016fbc
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp ebx, ecx
mov eax, dword [eax]
sete dl
add eax, 0xffff0001
add eax, edx
jne 0x10030a46
push eax
lea ecx, [ebp - 0x40c]
call fcn.10016fbc
cmp dword [eax], 0
jne 0x10030a46
xor eax, eax
mov edi, eax
inc eax
jmp 0x10030a4b
xor eax, eax
inc eax
mov edi, eax
push eax
lea ecx, [ebp - 0x40c]
call fcn.10016fbc
mov ecx, dword [ebp - 0x1c]
mov esi, eax
xor eax, eax
cmp edi, 0x2102
push 5
setl al
xor edx, edx
cmp eax, ecx
pop eax
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor ebx, ebx
cmp ecx, dword [esi]
lea ecx, [ebp - 0x1260]
setne bl
xor eax, eax
push eax
call fcn.10016fbc
xor ecx, ecx
cmp ebx, dword [eax]
setg cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x1260]
mov byte [ebp - 4], 0x13
call fcn.10016fb7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
push 1
pop ebx
jl 0x10030947
push 2
pop edi
or esi, 0xffffffff
lea ecx, [ebp - 0x40c]
call fcn.10016fb7
dec dword [ebp - 0x44]
lea ecx, [ebp - 0xfac]
mov dword [ebp - 4], esi
call fcn.10016fb7
mov dword [ebp - 0x1c], 0xe974a520
xor eax, eax
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe2
je 0x10030bcd
xor esi, esi
inc esi
push 4
pop ebx
push ebx
lea ecx, [ebp - 0x4c8]
call fcn.10016f4f
xor eax, eax
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10030b44
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x12a4], 0xde0b4074
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10030b2c
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10030b6e
push 4
xor ebx, ebx
pop esi
push dword [ebp - 0x24]
lea ecx, [ebp - 0x4c8]
call fcn.10016fbc
mov dword [eax], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10030b51
xor esi, esi
inc esi
jmp 0x10030b70
xor ebx, ebx
push esi
lea ecx, [ebp - 0x4c8]
call fcn.10016fbc
mov dword [eax], ebx
jmp 0x10030b9d
push esi
call fcn.10016fbc
push esi
lea ecx, [ebp - 0x4c8]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x12a4], ebx
call fcn.10016fbc
inc dword [eax]
push esi
lea ecx, [ebp - 0x4c8]
call fcn.10016fbc
lea ecx, [ebp - 0x4c8]
cmp dword [eax], edi
jl 0x10030b80
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016fb7
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe2
jne 0x10030b0c
xor eax, eax
mov dword [ebp - 0x34], eax
mov ecx, 0xa3888451
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
jne 0x10030bf0
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10030bf0
mov edx, eax
jmp 0x10030bf5
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
movdqa xmm0, xmmword [0x10007ee0]
mov eax, dword [ebp - 0x18]
mov edi, 0xd853
setge cl
mov edx, edi
sub edx, ecx
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne bl
xor ecx, ecx
cmp ebx, eax
setge cl
xor edx, edx
cmp ecx, 0x1b17
lea ecx, [ebp - 0x1630]
setne dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
movdqu xmmword [ebp - 0x13cc], xmm0
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x13bc]
push eax
mov dword [ebp - 0x38], 0xb3ae3556
lea eax, [ebp - 0x13cc]
mov dword [ebp - 0x10], 0xb818f8f6
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x40], 0xa2fc53d
push eax
call fcn.10016fcb
lea ecx, [ebp - 0x19e]
mov esi, eax
call fcn.10008f43
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x119c]
push dword [esi]
call fcn.10016f91
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x38], 0xfffffff1
cmp dword [ebp - 0x38], 0xe
je 0x10030f54
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], 0x1c17c774
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10030cee
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x17c], 0x73eb905d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10030cd6
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jg 0x10030edb
push 4
pop esi
jmp 0x10030d05
xor eax, eax
inc eax
push eax
lea ecx, [ebp - 0x344]
call fcn.10016f4f
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xca0]
mov dword [ebp - 0x44], 3
push esi
call fcn.10016f4f
xor eax, eax
mov byte [ebp - 4], 0x18
xor ebx, ebx
mov dword [ebp - 0x18], eax
inc ebx
cmp dword [ebp - 0x18], ebx
jge 0x10030d5d
push dword [ebp - 0x18]
lea ecx, [ebp - 0x344]
call fcn.10016fbc
mov dword [eax], 0x6d2e8588
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10030d39
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10030d83
push dword [ebp - 0x18]
lea ecx, [ebp - 0xca0]
call fcn.10016fbc
mov dword [eax], 0x3ae4c7ba
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10030d65
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10030d9a
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor eax, eax
push eax
lea ecx, [ebp - 0x344]
call fcn.10016fbc
lea ecx, [ebp - 0x344]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10016fbc
cmp dword [eax], ebx
jg 0x10030eb2
xor eax, eax
mov dword [ebp - 0x20], 0xe4562513
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10030dda
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x10030e8b
or ecx, 0xffffffff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], eax
jmp 0x10030e13
mov dword [ebp - 0x44], ebx
push eax
call fcn.10016fbc
mov ecx, dword [ebp - 0x34]
push 0
mov ecx, dword [ebp + ecx*4 - 0x17c]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x17c], ecx
inc dword [ebp - 0x34]
pop eax
lea ecx, [ebp - 0x344]
cmp dword [ebp - 0x34], ebx
jle 0x10030df1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x17c]
xor eax, eax
push eax
call fcn.10016fbc
xor edx, edx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x17c]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
dec ecx
cmp ecx, eax
lea ecx, [ebp - 0xca0]
setle dl
xor eax, eax
cmp edx, 6
setl al
mov dword [ebp - 0x44], eax
xor eax, eax
push eax
call fcn.10016fbc
mov ecx, dword [ebp - 0x1c]
xor edx, edx
push 0
mov esi, dword [ebp + ecx*4 - 0x17c]
mov ecx, dword [ebp - 0x44]
add ecx, 0x27a2
cmp esi, ecx
setge dl
mov dword [eax], edx
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], ebx
jle 0x10030de6
push eax
lea ecx, [ebp - 0x344]
call fcn.10016fbc
lea ecx, [ebp - 0x344]
inc dword [eax]
xor eax, eax
push eax
call fcn.10016fbc
cmp dword [eax], ebx
jle 0x10030dbf
push 4
pop esi
lea ecx, [ebp - 0xca0]
call fcn.10016fb7
lea ecx, [ebp - 0x344]
mov byte [ebp - 4], 0x16
call fcn.10016fb7
inc dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jle 0x10030d02
mov eax, dword [ebp - 0x17c]
xor edx, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x178]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x10], eax
jne 0x10030f15
cmp dword [ebp - 0x1c], eax
jne 0x10030f15
xor ebx, ebx
inc ebx
jmp 0x10030f1a
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x119c]
mov eax, dword [ebp - 0x10]
sub eax, 0x6e57c533
mov dword [ebp - 0x1c], eax
push ebx
call fcn.10016fbc
mov edx, dword [ebp - 0x1c]
mov esi, eax
mov ecx, dword [ebp - 0x30]
xor eax, eax
cmp edx, ecx
setge al
mov dword [esi], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xe
jne 0x10030cbf
jmp 0x10030f57
xor ebx, ebx
inc ebx
or eax, 0xffffffff
lea ecx, [ebp - 0x119c]
mov dword [ebp - 4], eax
call fcn.10016fb7
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffe8
jg 0x100312f9
or edi, 0xffffffff
mov dword [ebp - 0x1c], 0x3ae35568
mov dword [ebp - 0x44], 0x43eb6069
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x40], 0xd62a04f7
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], 0xe
cmp dword [ebp - 0x1c], 0xfffffffb
jne 0x10031019
mov dword [ebp - 0x10], 0xd3f7
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x40], edi
cmp dword [ebp - 0x1c], eax
je 0x10030fc4
mov eax, dword [ebp - 0x1c]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x8b01
setle cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov esi, dword [ebp - 0x44]
sub esi, dword [ebp - 0x1c]
add esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setl dl
xor eax, eax
cmp esi, edx
setg al
neg eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10031017
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffb
je 0x10030fa2
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x100312e4
push ebx
lea ecx, [ebp - 0xfc4]
call fcn.10016f4f
mov dword [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x28], 0x12b57e8b
mov dword [ebp - 0x28], 0x4b5c
mov dword [ebp - 0x28], 0x12aa53f0
mov dword [ebp - 0x28], 0x678e
mov dword [ebp - 0x28], 0x574b
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10031096
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xfc4]
call fcn.10016fbc
mov dword [eax], 0x99ac
xor eax, eax
inc dword [ebp - 0x2c]
inc eax
cmp dword [ebp - 0x2c], eax
jl 0x10031072
xor ebx, ebx
xor eax, eax
inc ebx
push 4
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x100310b9
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x17dc], 0x2edc7555
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x100310a1
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x100310d7
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1784], esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x100310c2
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x100310ed
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x9d0], 0xeeb
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x100310dc
inc dword [ebp - 0x9d0]
lea ecx, [ebp - 0xfc4]
mov dword [ebp - 4], edi
call fcn.10016fb7
push 6
pop eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x42c]
xor eax, eax
mov dword [ebp - 0x1c], eax
push ebx
call fcn.10016f4f
mov dword [ebp - 4], 0x1a
lea ecx, [ebp - 0x988]
mov dword [ebp - 0x44], 0x36378284
mov dword [ebp - 0x44], 0xc1031c36
push ebx
call fcn.10016f4f
mov byte [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x44], 0xbbda73a1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10031175
push dword [ebp - 0x24]
lea ecx, [ebp - 0x42c]
call fcn.10016fbc
mov dword [eax], ebx
xor eax, eax
inc dword [ebp - 0x24]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x24], eax
jl 0x10031153
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x100311a1
push dword [ebp - 0x24]
lea ecx, [ebp - 0x988]
call fcn.10016fbc
mov dword [eax], 0xa66fa4bc
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jl 0x1003117d
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x100311c0
push 5
pop ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x12b8], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100311ac
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x100311ca
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
lea ecx, [ebp - 0x42c]
call fcn.10016fbc
xor eax, eax
lea ecx, [ebp - 0x42c]
push eax
call fcn.10016fbc
cmp dword [eax], 0
je 0x10031200
xor eax, eax
lea ecx, [ebp - 0x42c]
push eax
call fcn.10016fbc
cmp dword [eax], 0
je 0x10031200
mov eax, ebx
jmp 0x10031202
xor eax, eax
imul eax, eax, 0x59ee
lea ecx, [ebp - 0x42c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.10016fbc
lea ecx, [ebp - 0x988]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
xor eax, eax
mov esi, dword [ebp - 0x44]
push eax
call fcn.10016fbc
mov dword [eax], esi
test esi, esi
je 0x10031257
xor eax, eax
lea ecx, [ebp - 0x988]
push eax
call fcn.10016fbc
cmp dword [eax], 0
je 0x10031257
xor eax, eax
lea edi, [eax + 1]
jmp 0x1003125b
xor eax, eax
mov edi, eax
push eax
lea ecx, [ebp - 0x42c]
call fcn.10016fbc
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, edi
mov esi, eax
mov ecx, 0xcce1cc0e
setne dl
sub edx, 0x3053bf84
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, dword [esi]
setle al
cmp ecx, eax
lea ecx, [ebp - 0x988]
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x12b4], eax
call fcn.10016fb7
or edi, 0xffffffff
lea ecx, [ebp - 0x42c]
mov dword [ebp - 4], edi
call fcn.10016fb7
mov dword [ebp - 0x1c], 0xb
jmp 0x100312ca
mov dword [ebp - 0x40], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x18
je 0x100312c4
inc dword [ebp - 0x18]
push 2
pop esi
push 1
pop ebx
cmp dword [ebp - 0x18], esi
jl 0x10031028
xor eax, eax
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe8
push 1
pop ebx
jle 0x10030f7a
mov edi, 0xd853
mov dword [ebp - 0x30], 0xfffffffc
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10031322
xor edx, edx
inc edx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x94], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003130e
xor eax, eax
cmp dword [ebp - 0x90], eax
jne 0x1003139e
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x30], 0x83cc47d1
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x94]
xor eax, eax
cmp dword [ebp - 0x90], eax
je 0x10031366
cmp dword [ebp - 0x30], eax
je 0x10031366
lea edx, [eax + 1]
jmp 0x10031368
mov edx, eax
mov eax, dword [ebp - 0x90]
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x90]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, 0xfffd
setge cl
cmp ecx, eax
je 0x1003139e
xor eax, eax
mov edx, eax
jmp 0x100313a3
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x90]
xor ecx, ecx
mov esi, dword [sym.imp.USER32.dll_GetWindowInfo]
cmp eax, edx
setne cl
cmp ecx, dword [ebp - 0x90]
jle 0x100313e1
xor eax, eax
mov dword [ebp - 0x44], 0x26fb
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x100313dc
push 0x1551
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
inc dword [ebp - 0x44]
jmp 0x100313f5
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x100313f7
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
xor eax, eax
mov dword [ebp - 0x18], 0x7ca0029b
mov ecx, 0xa3888451
mov dword [ebp - 0x1c], 0xe974a520
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
jne 0x10031428
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10031428
mov edx, eax
jmp 0x1003142d
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
mov edx, edi
mov eax, dword [ebp - 0x18]
setge cl
xor ebx, ebx
sub edx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
push 0xffffffffffffffe8
setne bl
xor ecx, ecx
cmp ebx, eax
pop ebx
setge cl
xor edx, edx
cmp ecx, 0x1b17
setne dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jg 0x100314bf
push 2
pop ecx
mov dword [ebp - 0x18], eax
jmp 0x100314b2
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x1c], 0xb
cmp dword [ebp - 0x1c], 0x18
jne 0x100314af
or edx, 0xffffffff
mov dword [ebp - 0x40], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x18
je 0x100314a3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003148c
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x10031487
mov dword [ebp - 0x18], 0x7ca0029b
mov ecx, 0xa3888451
mov dword [ebp - 0x1c], 0xe974a520
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
jne 0x100314f0
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x100314f0
mov edx, eax
jmp 0x100314f5
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x18]
push 2
setge cl
xor edx, edx
sub edi, ecx
cmp edi, eax
mov eax, dword [ebp - 0x18]
pop edi
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, 0x1b17
setne dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jg 0x1003157f
mov dword [ebp - 0x18], eax
jmp 0x10031575
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x1c], 0xb
cmp dword [ebp - 0x1c], 0x18
jne 0x10031572
or ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x18
je 0x10031566
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1003154f
dec dword [ebp - 0x34]
jmp 0x10031545
push 0xfffffffffffffffc
pop ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x100315a4
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10031590
xor eax, eax
cmp dword [ebp - 0x88], eax
jne 0x10031620
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x30], 0x83cc47d1
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x8c]
xor eax, eax
cmp dword [ebp - 0x88], eax
je 0x100315e8
cmp dword [ebp - 0x30], eax
je 0x100315e8
lea edx, [eax + 1]
jmp 0x100315ea
mov edx, eax
mov eax, dword [ebp - 0x88]
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x88]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, 0xfffd
setge cl
cmp ecx, eax
je 0x10031620
xor eax, eax
mov edx, eax
jmp 0x10031625
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x88]
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, dword [ebp - 0x88]
jle 0x1003165d
mov dword [ebp - 0x44], 0x26fb
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10031658
push 0x1551
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
inc dword [ebp - 0x44]
jmp 0x1003166f
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10031671
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10031693
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003167f
xor eax, eax
cmp dword [ebp - 0x98], eax
jne 0x1003170f
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x30], 0x83cc47d1
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x9c]
xor eax, eax
cmp dword [ebp - 0x98], eax
je 0x100316d7
cmp dword [ebp - 0x30], eax
je 0x100316d7
lea edx, [eax + 1]
jmp 0x100316d9
mov edx, eax
mov eax, dword [ebp - 0x98]
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x98]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, 0xfffd
setge cl
cmp ecx, eax
je 0x1003170f
xor eax, eax
mov edx, eax
jmp 0x10031714
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x98]
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, dword [ebp - 0x98]
jle 0x1003174c
mov dword [ebp - 0x44], 0x26fb
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10031747
push 0x1551
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
inc dword [ebp - 0x44]
jmp 0x1003175e
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1003175e
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffe
inc eax
lea ecx, [ebp - 0xac0]
mov dword [ebp - 0x44], eax
push edi
call fcn.10016f4f
xor eax, eax
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100317a2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x12ec], 0x4be76d23
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10031789
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100317be
push dword [ebp - 0x18]
lea ecx, [ebp - 0xac0]
call fcn.10016fbc
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100317a7
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x100317da
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x100317de
mov ecx, eax
jmp 0x100317e3
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x2c]
mov edi, dword [sym.imp.GDI32.dll_SetPolyFillMode]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
imul eax, ecx
test eax, eax
je 0x10031821
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10031940
push 0x975
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
jmp 0x10031940
xor eax, eax
inc eax
push 2
mov dword [ebp - 0x34], eax
xor eax, eax
pop ecx
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jl 0x10031940
xor esi, esi
inc esi
or edi, 0xffffffff
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x44], 0xd88101ae
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jg 0x10031917
mov dword [ebp - 0x50], edi
xor ecx, ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], edi
mov eax, dword [ebp - 0x2c]
push esi
mov eax, dword [ebp + eax*4 - 0x12ec]
cmp eax, 0x279e56e
setle cl
xor edx, edx
add ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x50]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp + eax*4 - 0x12ec]
sub edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setle cl
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0xac0]
call fcn.10016fbc
mov ecx, dword [ebp - 0x44]
push 2
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x50], eax
pop ecx
jmp 0x10031903
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100318de
push 0x23c3
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x34], eax
jmp 0x100318fb
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100318f8
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jle 0x100318e3
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], ecx
jle 0x100318c4
inc dword [ebp - 0x1c]
push 0
pop eax
cmp dword [ebp - 0x1c], ecx
jle 0x10031858
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10031928
push eax
push eax
push esi
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x2c]
push 2
pop ecx
jns 0x1003183e
mov esi, dword [sym.imp.USER32.dll_GetWindowInfo]
mov edi, dword [sym.imp.GDI32.dll_SetPolyFillMode]
or eax, 0xffffffff
lea ecx, [ebp - 0xac0]
mov dword [ebp - 4], eax
call fcn.10016fb7
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffe
inc eax
lea ecx, [ebp - 0xdf0]
push 2
mov dword [ebp - 0x44], eax
pop eax
push eax
call fcn.10016f4f
xor eax, eax
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10031998
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xfdc], 0x4be76d23
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003197f
xor eax, eax
mov dword [ebp - 0x18], eax
push 2
pop eax
cmp dword [ebp - 0x18], eax
jge 0x100319c7
push eax
pop edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdf0]
call fcn.10016fbc
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100319a5
mov edi, dword [sym.imp.GDI32.dll_SetPolyFillMode]
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x100319de
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x100319e2
mov ecx, eax
jmp 0x100319e7
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x2c]
imul eax, ecx
test eax, eax
je 0x10031a19
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10031b38
push 0x975
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
jmp 0x10031b38
xor eax, eax
inc eax
push 2
mov dword [ebp - 0x34], eax
xor eax, eax
pop ecx
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jl 0x10031b38
xor esi, esi
inc esi
or edi, 0xffffffff
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x44], 0xd88101ae
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jg 0x10031b0f
mov dword [ebp - 0x50], edi
xor ecx, ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], edi
mov eax, dword [ebp - 0x2c]
push esi
mov eax, dword [ebp + eax*4 - 0xfdc]
cmp eax, 0x279e56e
setle cl
xor edx, edx
add ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x50]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp + eax*4 - 0xfdc]
sub edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setle cl
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0xdf0]
call fcn.10016fbc
mov ecx, dword [ebp - 0x44]
push 2
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x50], eax
pop ecx
jmp 0x10031afb
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10031ad6
push 0x23c3
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x34], eax
jmp 0x10031af3
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10031af0
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jle 0x10031adb
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], ecx
jle 0x10031abc
inc dword [ebp - 0x1c]
push 0
pop eax
cmp dword [ebp - 0x1c], ecx
jle 0x10031a50
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10031b20
push eax
push eax
push esi
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x2c]
push 2
pop ecx
jns 0x10031a36
mov esi, dword [sym.imp.USER32.dll_GetWindowInfo]
mov edi, dword [sym.imp.GDI32.dll_SetPolyFillMode]
or ebx, 0xffffffff
lea ecx, [ebp - 0xdf0]
mov dword [ebp - 4], ebx
call fcn.10016fb7
mov eax, 0xf825e7a6
mov dword [ebp - 0xe2c], eax
mov dword [ebp - 0xe28], eax
mov dword [ebp - 0xe24], eax
mov dword [ebp - 0xe20], eax
push 5
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x44], ebx
xor ebx, ebx
mov dword [ebp - 0x4c], 0x4d073ff8
inc ebx
mov dword [ebp - 0x30], 0xfffc
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x54], 0x4b5a
mov dword [ebp - 0x28], ebx
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0xe28]
push 4
pop ecx
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setl dl
xor eax, eax
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe2
je 0x10031cad
xor edi, edi
inc edi
or esi, 0xffffffff
push 4
pop ebx
push ebx
lea ecx, [ebp - 0x4f8]
call fcn.10016f4f
xor eax, eax
mov dword [ebp - 4], 0x1e
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10031c17
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x12cc], 0xde0b4074
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10031bff
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10031c41
push 4
xor ebx, ebx
pop edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4f8]
call fcn.10016fbc
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10031c24
xor edi, edi
inc edi
jmp 0x10031c43
xor ebx, ebx
push edi
lea ecx, [ebp - 0x4f8]
call fcn.10016fbc
mov dword [eax], ebx
jmp 0x10031c70
push edi
call fcn.10016fbc
push edi
lea ecx, [ebp - 0x4f8]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x12cc], ebx
call fcn.10016fbc
inc dword [eax]
push edi
lea ecx, [ebp - 0x4f8]
call fcn.10016fbc
lea ecx, [ebp - 0x4f8]
cmp dword [eax], 2
jl 0x10031c53
mov dword [ebp - 4], esi
call fcn.10016fb7
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe2
jne 0x10031bdc
mov esi, dword [sym.imp.USER32.dll_GetWindowInfo]
xor ebx, ebx
mov edi, dword [sym.imp.GDI32.dll_SetPolyFillMode]
xor eax, eax
inc ebx
or ecx, 0xffffffff
push 2
mov dword [ebp - 0x18], ecx
pop edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031cdb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3cc], 0x41b3c692
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031cc2
xor eax, eax
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], eax
jl 0x10031d98
jmp 0x10031ceb
xor eax, eax
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x4c], 0x1826fbd1
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3cc]
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x10031d36
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
push 2
sbb edx, edx
xor ecx, ecx
neg edx
mov eax, dword [ebp + eax*4 - 0x3cc]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setle cl
pop edx
mov dword [ebp + eax*4 - 0x3cc], ecx
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], eax
jmp 0x10031d8a
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x3cc]
add ecx, dword [ebp - 0x30]
imul ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x1c]
cmp ecx, eax
je 0x10031d6b
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x3cc], 0
jne 0x10031d6b
xor eax, eax
jmp 0x10031d6d
mov eax, ebx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x3cc]
add ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3cc], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x10031d3e
dec dword [ebp - 0x18]
jns 0x10031ce9
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xff4]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3cc], eax
push 3
call fcn.10016f4f
mov dword [ebp - 4], 0x1f
xor eax, eax
mov dword [ebp - 0x38], eax
or ecx, 0xffffffff
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 0xeb32a831
mov dword [ebp - 0x28], 0x7e5c285c
mov dword [ebp - 0x28], 0x74b28ed4
mov dword [ebp - 0x28], eax
push 4
mov dword [ebp - 0x28], 0x495761be
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031e16
push dword [ebp - 0x10]
lea ecx, [ebp - 0xff4]
call fcn.10016fbc
mov dword [eax], 2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031df7
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jg 0x10031ec4
push 2
pop esi
push 4
pop edi
jmp 0x10031e2d
xor eax, eax
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x11b4]
mov dword [ebp - 0x28], 0x4b4b1328
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x28], 0xf9c25b05
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x28], 0x70ab227d
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], ebx
push edi
call fcn.10016f4f
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10031e9a
or ebx, 0xffffffff
push dword [ebp - 0x10]
lea ecx, [ebp - 0x11b4]
call fcn.10016fbc
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10031e7f
xor ebx, ebx
inc ebx
inc dword [ebp - 0x44]
lea ecx, [ebp - 0x11b4]
mov byte [ebp - 4], 0x1f
call fcn.10016fb7
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jle 0x10031e2b
mov esi, dword [sym.imp.USER32.dll_GetWindowInfo]
mov edi, dword [sym.imp.GDI32.dll_SetPolyFillMode]
or eax, 0xffffffff
lea ecx, [ebp - 0xff4]
mov dword [ebp - 4], eax
call fcn.10016fb7
mov dword [ebp - 0x30], 0xfffffffc
xor eax, eax
mov dword [ebp - 0x28], 0x2eb9
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10031f01
push eax
push 0x1d7
push 0x11b4
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10031f13
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031f4d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x510], 0x46cdead9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031f34
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10031f73
push eax
push 0x873
push 0x1e52
push eax
push 0x67a
push 0x25e4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x50c]
xor edx, edx
mov eax, dword [ebp - 0x50c]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x44], edx
imul eax, dword [ebp - 0x50c], 9
cmp eax, 0xfffffff8
setge cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x508]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x10031fbc
cmp dword [ebp - 0x50c], eax
je 0x10031fbe
mov eax, ebx
xor ecx, ecx
mov edx, 0xffff
cmp eax, edx
mov eax, dword [ebp - 0x508]
push 2
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x50c]
pop ecx
setg dl
sub edx, eax
xor eax, eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x10], eax
jmp 0x10031ff9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x84], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10031fec
push ebx
lea ecx, [ebp - 0x1c8]
call fcn.10016f4f
mov dword [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x30], 0x3ae50714
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003204f
xor edi, edi
inc edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1c8]
call fcn.10016fbc
mov dword [eax], 0x1f7e2799
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10032028
mov edi, dword [sym.imp.GDI32.dll_SetPolyFillMode]
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10032078
xor esi, esi
inc esi
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6a0], 0xfff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1003205a
mov esi, dword [sym.imp.USER32.dll_GetWindowInfo]
xor eax, eax
push eax
lea ecx, [ebp - 0x1c8]
call fcn.10016fbc
lea ecx, [ebp - 0x1c8]
mov dword [eax], 0xffffffee
xor eax, eax
push eax
call fcn.10016fbc
cmp dword [eax], 0xfffffff6
jle 0x1003222b
xor edi, edi
inc edi
xor eax, eax
mov dword [ebp - 0x18], 0x733e34b6
push eax
lea ecx, [ebp - 0x1c8]
call fcn.10016fbc
cmp dword [eax], 0
jne 0x100320d2
xor eax, eax
lea ecx, [ebp - 0x1c8]
push eax
call fcn.10016fbc
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
lea ecx, [ebp - 0x1c8]
push eax
call fcn.10016fbc
xor ecx, ecx
cmp dword [eax], ecx
setne cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x1c8]
push eax
call fcn.10016fbc
mov ecx, dword [ebp - 0x40]
xor ebx, ebx
cmp dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x1c8]
sete bl
sub ebx, dword [eax]
xor eax, eax
push eax
call fcn.10016fbc
cmp dword [eax], ebx
jle 0x100321e8
mov dword [ebp - 0x1c], 0x2c5b641b
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100321b0
push edi
lea ecx, [ebp - 0x9a0]
call fcn.10016f4f
xor eax, eax
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x10], eax
jmp 0x10032155
push dword [ebp - 0x10]
call fcn.10016fbc
mov dword [eax], 0xe2cf4565
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x9a0]
cmp dword [ebp - 0x10], edi
jl 0x10032144
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10016fbc
mov ecx, dword [ebp - 0x1c]
xor edx, edx
test ecx, ecx
lea ecx, [ebp - 0x9a0]
mov esi, dword [eax]
sets dl
xor eax, eax
add edx, 0xfffffffa
push eax
add esi, edx
call fcn.10016fbc
xor ecx, ecx
mov edx, dword [eax]
mov eax, dword [ebp - 0x18]
imul edx, esi
cmp edx, eax
sete cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x9a0]
mov byte [ebp - 4], 0x21
call fcn.10016fb7
jmp 0x100321f2
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], eax
jmp 0x100321db
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100321d8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6a0], 0x9a9d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100321c0
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffc
jle 0x100321b8
cmp dword [ebp - 0x3c], eax
jne 0x1003221f
jmp 0x100321f2
mov dword [ebp - 0x44], 0x32c2
dec dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 0x18], eax
xor eax, eax
push eax
call fcn.10016fbc
lea ecx, [ebp - 0x1c8]
inc dword [eax]
xor eax, eax
push eax
call fcn.10016fbc
cmp dword [eax], 0xfffffff6
jg 0x100320a4
mov esi, dword [sym.imp.USER32.dll_GetWindowInfo]
mov edi, dword [sym.imp.GDI32.dll_SetPolyFillMode]
or ebx, 0xffffffff
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 4], ebx
call fcn.10016fb7
xor eax, eax
cmp dword [ebp - 0x80], eax
jne 0x100322a5
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x30], 0x83cc47d1
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x84]
xor eax, eax
cmp dword [ebp - 0x80], eax
je 0x10032273
cmp dword [ebp - 0x30], eax
je 0x10032273
lea edx, [eax + 1]
jmp 0x10032275
mov edx, eax
mov eax, dword [ebp - 0x80]
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x80]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, 0xfffd
setge cl
cmp ecx, eax
je 0x100322a5
xor eax, eax
mov edx, eax
jmp 0x100322aa
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x80]
xor ecx, ecx
cmp eax, edx
push 2
setne cl
cmp ecx, dword [ebp - 0x80]
jle 0x10032c1e
pop esi
push esi
lea ecx, [ebp - 0x11cc]
call fcn.10016f4f
mov dword [ebp - 4], 0x23
lea ecx, [ebp - 0x100c]
push 0xfffffffffffffff9
mov dword [ebp - 0x10], 0x19d29be1
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xaafe30f5
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], 0xe7ccc895
mov dword [ebp - 0x28], 0xfe662db8
push esi
call fcn.10016f4f
xor eax, eax
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10032330
push dword [ebp - 0x18]
lea ecx, [ebp - 0x11cc]
call fcn.10016fbc
mov dword [eax], 0x6482
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10032312
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10032356
push dword [ebp - 0x18]
lea ecx, [ebp - 0x100c]
call fcn.10016fbc
mov dword [eax], 0x8d963785
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10032338
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x10032468
xor edi, edi
inc edi
mov dword [ebp - 0x1c], 0x45db34e6
lea ecx, [ebp - 0x1270]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xb7d8cf4c
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], eax
push edi
call fcn.10016f4f
push 3
lea ecx, [ebp - 0xad8]
mov byte [ebp - 4], 0x25
call fcn.10016f4f
xor eax, eax
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100323c8
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1270]
call fcn.10016fbc
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100323aa
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100323f0
push dword [ebp - 0x18]
lea ecx, [ebp - 0xad8]
call fcn.10016fbc
mov dword [eax], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100323d1
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10032414
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10032411
push 0x6c0
push 0x46b
push eax
call dword [sym.imp.USER32.dll_InflateRect]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x100323f5
push esi
lea ecx, [ebp - 0xad8]
call fcn.10016fbc
inc dword [eax]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10032434
mov dword [ebp - 0x40], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x1003242e
lea ecx, [ebp - 0xad8]
call fcn.10016fb7
lea ecx, [ebp - 0x1270]
mov byte [ebp - 4], 0x24
call fcn.10016fb7
dec dword [ebp - 0x10]
push 0
pop eax
jns 0x10032368
mov edi, dword [sym.imp.GDI32.dll_SetPolyFillMode]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x34], 0xe
jmp 0x10032479
cmp dword [ebp - 0x34], eax
jne 0x1003247e
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
je 0x10032471
lea ecx, [ebp - 0x100c]
call fcn.10016fb7
or eax, 0xffffffff
lea ecx, [ebp - 0x11cc]
mov dword [ebp - 4], eax
call fcn.10016fb7
mov dword [ebp - 0x2c], 0x26fb
or eax, 0xffffffff
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x44], eax
xor eax, eax
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x100324d3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x16b0], 0xe3cb5af9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100324bb
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100324ec
push eax
push 0x90d
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
push 4
pop ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg eax
push ecx
sbb eax, eax
lea ecx, [ebp - 0x150]
neg eax
mov dword [ebp - 0x16a4], eax
call fcn.10016f4f
mov dword [ebp - 4], 0x27
lea ecx, [ebp - 0xcb8]
or eax, 0xffffffff
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x3c], 0xbcce3f50
push 3
call fcn.10016f4f
mov byte [ebp - 4], 0x28
xor eax, eax
mov dword [ebp - 0x44], 0x3f4b1a25
mov dword [ebp - 0x28], ebx
push 4
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10032591
push ecx
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x150]
call fcn.10016fbc
mov dword [eax], 0xf75dcec3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10032570
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100325b9
push dword [ebp - 0x18]
lea ecx, [ebp - 0xcb8]
call fcn.10016fbc
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003259a
xor eax, eax
mov dword [ebp - 0x24], 3
cmp dword [ebp - 0x24], eax
jl 0x100328a0
mov ecx, 0x1afc438f
jmp 0x100325d2
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xa78], ecx
mov dword [ebp - 0xa74], ecx
mov dword [ebp - 0xa70], ecx
mov dword [ebp - 0xa6c], ecx
lea ecx, [ebp - 0x150]
push dword [ebp - 0x24]
call fcn.10016fbc
cmp dword [eax], 0
jne 0x10032607
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10032609
mov eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x24], eax
je 0x1003262a
push 3
lea ecx, [ebp - 0x150]
call fcn.10016fbc
cmp dword [eax], 0
je 0x1003262a
mov edi, ebx
jmp 0x1003262e
xor eax, eax
mov edi, eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x150]
call fcn.10016fbc
push 2
mov esi, eax
lea ecx, [ebp - 0x150]
pop eax
push eax
call fcn.10016fbc
mov ecx, dword [esi]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
sub edi, ecx
inc edi
je 0x100326eb
mov dword [ebp - 0x44], 0x12e75507
lea ecx, [ebp - 0x150]
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1c], 0x421d
push dword [ebp - 0x24]
call fcn.10016fbc
mov ecx, dword [ebp - 0x24]
xor ebx, ebx
push 9
cmp dword [eax], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
setle bl
add ecx, 0x1c0a
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
lea ecx, [ebp - 0x150]
pop eax
setl dl
sub edx, eax
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp ebx, edx
setg al
mov dword [ebp - 0x34], eax
push dword [ebp - 0x24]
call fcn.10016fbc
mov ecx, dword [ebp - 0x34]
xor edx, edx
push 4
pop ebx
cmp ecx, ebx
setg dl
sub edx, dword [ebp - 0x44]
neg edx
sbb edx, edx
inc edx
add edx, dword [eax]
xor eax, eax
cmp edx, 0xfffffff9
setl al
mov dword [ebp - 0x40], eax
jmp 0x10032886
movdqa xmm0, xmmword [0x10007eb0]
lea eax, [ebp - 0x14bc]
push eax
lea eax, [ebp - 0x14cc]
push eax
lea ecx, [ebp - 0x1608]
movdqu xmmword [ebp - 0x14cc], xmm0
call fcn.10016fcb
lea ecx, [ebp - 0x1c9]
mov esi, eax
call fcn.10008f43
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1024]
push dword [esi]
call fcn.10016f91
mov byte [ebp - 4], 0x29
xor eax, eax
mov dword [ebp - 0x40], 0xb1cc8ffc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003275e
push 4
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3f0], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003274a
xor eax, eax
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x10032877
mov dword [ebp - 0x50], 0xa1372625
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x40], 0x1eed764
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
push dword [ebp - 0x24]
call fcn.10016fbc
push dword [ebp - 0x24]
lea ecx, [ebp - 0x150]
mov esi, eax
call fcn.10016fbc
mov edx, dword [ebp - 0x3f0]
xor ebx, ebx
push 5
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x34]
cmp edx, ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x3c]
setg bl
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
sub ebx, ecx
add ebx, dword [ebp - 0x50]
cmp dword [esi], ebx
pop ecx
sete al
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x3f0]
cmp eax, 7
setl cl
xor eax, eax
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x1024]
push eax
call fcn.10016fbc
lea ecx, [ebp - 0xcb8]
mov eax, dword [eax]
mov dword [ebp - 0xa74], eax
xor eax, eax
inc eax
push eax
call fcn.10016fbc
mov edx, dword [ebp - 0x34]
add edx, dword [eax]
xor eax, eax
cmp dword [ebp - 0xa74], eax
sete al
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setl cl
xor edx, edx
cmp ecx, 0x6135443c
lea ecx, [ebp - 0x150]
setg dl
imul eax, edx
mov dword [ebp - 0x44], eax
push dword [ebp - 0x24]
call fcn.10016fbc
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x150]
push dword [ebp - 0x24]
sub esi, dword [eax]
call fcn.10016fbc
xor edx, edx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x50]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x1c]
jns 0x1003276e
lea ecx, [ebp - 0x1024]
mov byte [ebp - 4], 0x28
call fcn.10016fb7
dec dword [ebp - 0x24]
mov ecx, 0x1afc438f
push 1
pop ebx
jns 0x100325d0
mov edi, dword [sym.imp.GDI32.dll_SetPolyFillMode]
push 2
pop esi
lea ecx, [ebp - 0xcb8]
call fcn.10016fb7
or eax, 0xffffffff
lea ecx, [ebp - 0x150]
mov dword [ebp - 4], eax
call fcn.10016fb7
xor eax, eax
mov byte [ebp - 0x11], al
mov dword [ebp - 0x38], 0xdb3ae355
mov dword [ebp - 0x40], 0xdade661f
mov dword [ebp - 0x44], 0x73063d62
mov dword [ebp - 0x38], 0x16
cmp dword [ebp - 0x38], 0xffffffe9
jne 0x10032a85
or edi, 0xffffffff
mov dword [ebp - 0x1c], 0xa473eb90
lea ecx, [ebp - 0xaf0]
mov dword [ebp - 0x18], ebx
push 3
call fcn.10016f4f
mov dword [ebp - 4], 0x2a
xor eax, eax
mov dword [ebp - 0x28], 0x2076acb8
mov dword [ebp - 0x28], 0x7c28cae2
mov dword [ebp - 0x28], 0xae8b0121
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10032943
push dword [ebp - 0x10]
lea ecx, [ebp - 0xaf0]
call fcn.10016fbc
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10032928
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1003296b
mov dword [ebp - 0x18], eax
jmp 0x10032962
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1003295f
push eax
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffee
jle 0x1003294d
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe3
mov dword [ebp - 0x18], eax
jg 0x10032948
jmp 0x10032a58
cmp dword [ebp - 0x18], 0xffffffea
jle 0x10032979
cmp byte [ebp - 0x11], 0
je 0x10032c16
mov dword [ebp - 0x38], 0xa290be4
or ecx, 0xffffffff
push 0xfffffffffffffffb
pop edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x30], 0xa028ea38
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x10], 0xb0b56cef
mov dword [ebp - 0x3c], 0x5584
mov dword [ebp - 0x10], eax
jmp 0x10032ad7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12c4], 0xfdc8dfba
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10032ac6
mov dword [ebp - 0x10], 0xb933
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x12c0], eax
mov dword [ebp - 0x44], eax
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x10032aff
cmp dword [ebp - 0x12c4], eax
je 0x10032b01
mov eax, ebx
mov dword [ebp - 0x30], eax
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x30], eax
je 0x10032b0f
mov esi, ebx
dec dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setge dl
add eax, esi
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setge cl
xor edx, edx
neg ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
setg dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
setle dl
xor eax, eax
sub edx, 0x5d932117
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x17
jge 0x10032c09
mov edi, 0xffff
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x44], 0x2983
mov dword [ebp - 0x30], 0xe9505c00
mov dword [ebp - 0x54], 0xfffffff7
cmp dword [ebp - 0x20], eax
je 0x10032bb4
mov ecx, dword [ebp - 0x20]
xor edx, edx
add ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setle dl
xor eax, eax
test edx, edx
sets al
add eax, dword [ebp - 0x10]
je 0x10032bb2
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10032bb2
mov eax, ebx
cmp edi, eax
sbb eax, eax
neg eax
sub eax, 3
jne 0x10032bc4
cmp dword [ebp - 0x20], eax
je 0x10032bc6
mov eax, ebx
imul eax, eax, 0xffff
test eax, eax
jne 0x10032bd7
push 0x1551
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
inc dword [ebp - 0x2c]
jmp 0x10032df5
pop ebx
push ebx
lea ecx, [ebp - 0x103c]
call fcn.10016f4f
push 4
mov dword [ebp - 4], 0x2c
pop eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10032c60
push dword [ebp - 0x10]
lea ecx, [ebp - 0x103c]
call fcn.10016fbc
mov dword [eax], 0xdf75dcec
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032c42
xor eax, eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x10032c8c
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032c87
push 0x25a
push eax
push 0x1290
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x10032c6b
or eax, 0xffffffff
lea ecx, [ebp - 0x103c]
mov dword [ebp - 4], eax
call fcn.10016fb7
xor eax, eax
or ecx, 0xffffffff
mov byte [ebp - 0x11], al
mov dword [ebp - 0x10], 0x8901f2c2
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x28], 0xfb37b048
mov dword [ebp - 0x40], 0xe0091df8
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x28], 0x38330377
mov dword [ebp - 0x44], 0xafa32fd2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10032cf4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1748], 0x6af1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10032cdb
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10032d1d
mov dword [ebp - 0x40], 0x46721591
mov dword [ebp - 0x28], 0x25fcc58a
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x44]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10032cf9
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
cmp byte [ebp - 0x11], 0
je 0x10032df5
mov dword [ebp - 0x34], 0xac64a684
mov dword [ebp - 0x34], 0xffffffe3
cmp dword [ebp - 0x34], 0xffffffed
jge 0x10032dc0
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x11
je 0x10032db7
mov dword [ebp - 0x10], 0xcad2086b
mov dword [ebp - 0x10], eax
jmp 0x10032da5
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032d8a
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032da2
push 0x17ee
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x10032d78
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x11
jne 0x10032d6c
or ecx, 0xffffffff
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffed
jl 0x10032d48
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10032deb
push eax
push 0x9a7
push 0x144c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor eax, eax
mov dword [ebp - 0x28], 0xbca6
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10032e16
push 0x10e5
push eax
call ebx
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032e3a
push 0x2301
push 0xcff
push 0x1cd7
push 0x1114
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 2
xor esi, esi
mov dword [ebp - 0x2c], 0xfffffffe
pop eax
inc esi
lea ecx, [ebp - 0xda8]
mov dword [ebp - 0x44], esi
push eax
call fcn.10016f4f
xor eax, eax
mov dword [ebp - 4], 0x2d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10032e81
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11e4], 0x4be76d23
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10032e68
xor eax, eax
mov dword [ebp - 0x18], eax
push 2
pop eax
cmp dword [ebp - 0x18], eax
jge 0x10032ead
push eax
pop esi
push dword [ebp - 0x18]
lea ecx, [ebp - 0xda8]
call fcn.10016fbc
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10032e8e
xor esi, esi
inc esi
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x10032ec4
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10032ec8
mov ecx, eax
jmp 0x10032eca
mov ecx, esi
mov eax, dword [ebp - 0x2c]
imul eax, ecx
test eax, eax
je 0x10032efc
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10033013
push 0x975
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
jmp 0x10033013
push 2
mov dword [ebp - 0x34], esi
xor eax, eax
pop ecx
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jl 0x10033013
or edi, 0xffffffff
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x44], 0xd88101ae
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jg 0x10032fec
mov dword [ebp - 0x50], edi
xor ecx, ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], edi
mov eax, dword [ebp - 0x2c]
push esi
mov eax, dword [ebp + eax*4 - 0x11e4]
cmp eax, 0x279e56e
setle cl
xor edx, edx
add ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x50]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp + eax*4 - 0x11e4]
sub edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setle cl
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0xda8]
call fcn.10016fbc
mov ecx, dword [ebp - 0x44]
push 2
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x50], eax
pop ecx
jmp 0x10032fd8
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032fb3
push 0x23c3
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x34], eax
jmp 0x10032fd0
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032fcd
cmp dword [ebp - 0x34], ecx
jle 0x10032fb8
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], ecx
jle 0x10032f99
inc dword [ebp - 0x1c]
push 0
pop eax
cmp dword [ebp - 0x1c], ecx
jle 0x10032f2d
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033001
push eax
push eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
xor eax, eax
dec dword [ebp - 0x2c]
push 2
pop ecx
jns 0x10032f13
mov edi, dword [sym.imp.GDI32.dll_SetPolyFillMode]
or eax, 0xffffffff
lea ecx, [ebp - 0xda8]
mov dword [ebp - 4], eax
call fcn.10016fb7
push 5
pop eax
mov ecx, 0xf825e7a6
mov dword [ebp - 0xeac], ecx
mov dword [ebp - 0xea8], ecx
mov dword [ebp - 0xea4], ecx
mov dword [ebp - 0xea0], ecx
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x4c], 0x4d073ff8
mov dword [ebp - 0x30], 0xfffc
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x54], 0x4b5a
mov dword [ebp - 0x28], esi
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0xea8]
push 4
pop ecx
cmp ecx, eax
push 5
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov eax, 0xf825e7a6
setl dl
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0xe4c], eax
mov dword [ebp - 0xe48], eax
mov dword [ebp - 0xe44], eax
mov dword [ebp - 0xe40], eax
pop eax
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x4c], 0x4d073ff8
mov dword [ebp - 0x30], 0xfffc
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x28], esi
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0xe48]
push 4
pop ecx
cmp ecx, eax
push 3
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
lea ecx, [ebp - 0xb08]
setl dl
mov dword [ebp - 0x4c], edx
call fcn.10016f4f
mov dword [ebp - 4], 0x2e
push 4
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x28], 0xfffffff6
pop eax
push eax
lea ecx, [ebp - 0x1280]
call fcn.10016f4f
xor eax, eax
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1003316b
or esi, 0xffffffff
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb08]
call fcn.10016fbc
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003314d
xor esi, esi
xor eax, eax
inc esi
push 4
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1003319e
push ecx
or esi, 0xffffffff
pop edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1280]
call fcn.10016fbc
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1003317b
mov edi, dword [sym.imp.GDI32.dll_SetPolyFillMode]
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x34], eax
push 2
pop eax
cmp dword [ebp - 0x34], eax
jg 0x1003339f
push eax
pop edi
mov dword [ebp - 0x1c], 3
lea ecx, [ebp - 0x1054]
mov dword [ebp - 0x28], esi
push esi
call fcn.10016f4f
xor eax, eax
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100331f1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1054]
call fcn.10016fbc
mov dword [eax], 0x974ca779
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100331d3
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033207
push 0xb4d
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10033375
cmp dword [ebp - 0x1c], edi
jle 0x1003320f
lea ecx, [ebp - 0x1280]
call fcn.10016fb7
or eax, 0xffffffff
lea ecx, [ebp - 0xb08]
mov dword [ebp - 4], eax
call fcn.10016fb7
xor eax, eax
mov dword [ebp - 0x28], 0xbca6
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100333d6
push 0x10e5
push eax
call ebx
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100333fc
push 0x2301
push 0xcff
push 0x1cd7
push 0x1114
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor eax, eax
mov dword [ebp - 0x28], 0xbca6
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033416
push 0x10e5
push eax
call ebx
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003343c