Function at 0x1002a93a
Capabilities:
Connect pipe
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008bd5d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c0
push ebx
push esi
push edi
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x30], 0xd921b0ae
mov dword [ebp - 0xa8], 0x510afbd1
mov dword [ebp - 0x18], 0x3fd52a42
mov dword [ebp - 0x3c], 1
push 4
lea ecx, [ebp - 0xa4]
call fcn.10015795
and dword [ebp - 4], 0
mov dword [ebp - 0x11c], 0xc44f031b
mov dword [ebp - 0x230], 7
mov dword [ebp - 0x6c], 0
jmp 0x1002a9b6
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x1002a9cf
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xa4]
call fcn.10015802
and dword [eax], 0
jmp 0x1002a9af
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jg 0x1002a9e3
mov dword [ebp - 0x1f4], 1
jmp 0x1002a9ea
and dword [ebp - 0x1f4], 0
cmp dword [ebp - 0x18], 0
jne 0x1002a9fc
mov dword [ebp - 0x130], 1
jmp 0x1002aa03
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x130]
imul eax, eax, 0xffff
cmp eax, dword [ebp - 0x18]
je 0x1002aa23
mov dword [ebp - 0x1ec], 1
jmp 0x1002aa2a
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1ec], eax
jg 0x1002aa41
mov dword [ebp - 0x1f0], 1
jmp 0x1002aa48
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x1f0]
jg 0x1002aa74
mov dword [ebp - 0x1e4], 1
jmp 0x1002aa7b
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x1e4]
sub eax, 0xf5a2
cmp eax, dword [ebp - 0x18]
jge 0x1002aa97
mov dword [ebp - 0x258], 1
jmp 0x1002aa9e
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xa8], eax
jl 0x1002aabe
mov dword [ebp - 0xd4], 1
jmp 0x1002aac5
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xd4], eax
je 0x1002aadc
mov dword [ebp - 0x17c], 1
jmp 0x1002aae3
and dword [ebp - 0x17c], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x3c]
lea eax, [eax + ecx + 0x4ee21d57]
add eax, dword [ebp - 0x3c]
js 0x1002ab13
mov dword [ebp - 0xdc], 1
jmp 0x1002ab1a
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x3c], eax
mov esi, dword [ebp - 0x3c]
push 3
lea ecx, [ebp - 0xa4]
call fcn.10015802
imul esi, dword [eax]
push 3
lea ecx, [ebp - 0xa4]
call fcn.10015802
cmp esi, dword [eax]
jne 0x1002ab53
mov dword [ebp - 0x174], 1
jmp 0x1002ab5a
and dword [ebp - 0x174], 0
mov dword [ebp - 0x54], 1
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x174]
jg 0x1002ab78
mov dword [ebp - 0xe4], 1
jmp 0x1002ab7f
and dword [ebp - 0xe4], 0
imul esi, dword [ebp - 0xe4], 0
push 3
lea ecx, [ebp - 0xa4]
call fcn.10015802
mov dword [eax], esi
cmp dword [ebp - 0x3c], 0
je 0x1002abb6
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x1002abb1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x1002aeae
mov dword [ebp - 0x248], 0x18a84d23
mov dword [ebp - 0x2dc], 0xdae11cd4
mov dword [ebp - 0xec], 0x9d6b80f4
mov dword [ebp - 0x190], 0xfffffffa
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0xc4], 1
mov dword [ebp - 0xf4], 0xfffffffc
mov dword [ebp - 0x10], 0
jmp 0x1002ac0c
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002ac22
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x358], 0xa94
jmp 0x1002ac05
mov dword [ebp - 0x10], 0
jmp 0x1002ac32
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1002ac48
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x114], 1
jmp 0x1002ac2b
mov dword [ebp - 0x10], 0
jmp 0x1002ac58
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002ac6e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3c0], 0x8616691c
jmp 0x1002ac51
mov dword [ebp - 0x10], 0
jmp 0x1002ac7e
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002ac94
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x394], 0x30c1abdd
jmp 0x1002ac77
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x18], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x358]
cmp eax, dword [ebp - 0x18]
je 0x1002acb8
mov dword [ebp - 0x1d8], 1
jmp 0x1002acbf
and dword [ebp - 0x1d8], 0
cmp dword [ebp - 0xf4], 0xfffffffb
jg 0x1002acd4
mov dword [ebp - 0x178], 1
jmp 0x1002acdb
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
mov eax, 0x2a57d884
test eax, eax
je 0x1002ad25
xor eax, eax
je 0x1002ad25
mov dword [ebp - 0x234], 1
jmp 0x1002ad2c
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x310], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x394]
push 4
pop eax
imul eax, eax, 0
sub esi, dword [ebp + eax - 0x114]
push 0
lea ecx, [ebp - 0xa4]
call fcn.10015802
cmp esi, dword [eax]
jg 0x1002ad6f
mov dword [ebp - 0x1b8], 1
jmp 0x1002ad76
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0x1b8]
inc eax
jne 0x1002ad9a
push 0
lea ecx, [ebp - 0xa4]
call fcn.10015802
cmp dword [eax], 0
jne 0x1002ad9a
and dword [ebp - 0x250], 0
jmp 0x1002ada4
mov dword [ebp - 0x250], 1
push 2
lea ecx, [ebp - 0xa4]
call fcn.10015802
push 3
lea ecx, [ebp - 0xa4]
call fcn.10015802
cmp dword [eax], 0
je 0x1002adcf
mov dword [ebp - 0x180], 1
jmp 0x1002add6
and dword [ebp - 0x180], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x180], eax
je 0x1002adf0
mov dword [ebp - 0xfc], 1
jmp 0x1002adf7
and dword [ebp - 0xfc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x358]
cmp eax, dword [ebp - 0xfc]
jl 0x1002ae18
mov dword [ebp - 0x104], 1
jmp 0x1002ae1f
and dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x1d8]
cmp eax, dword [ebp - 0x104]
jge 0x1002ae39
mov dword [ebp - 0x188], 1
jmp 0x1002ae40
and dword [ebp - 0x188], 0
push 3
lea ecx, [ebp - 0xa4]
call fcn.10015802
mov ecx, dword [ebp - 0x188]
cmp ecx, dword [eax]
jl 0x1002ae63
mov dword [ebp - 0x10c], 1
jmp 0x1002ae6a
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x10c], eax
jne 0x1002ae81
mov dword [ebp - 0x1c0], 1
jmp 0x1002ae88
and dword [ebp - 0x1c0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c0]
mov dword [ebp + eax - 0x114], ecx
mov dword [ebp - 0x190], 0xa61b3e23
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x30], eax
push 0
lea ecx, [ebp - 0xa4]
call fcn.10015802
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x30], eax
mov esi, dword [ebp - 0x230]
mov edi, dword [ebp - 0x54]
mov ebx, dword [ebp - 0x30]
push 3
lea ecx, [ebp - 0xa4]
call fcn.10015802
imul ebx, dword [eax]
push 0
lea ecx, [ebp - 0xa4]
call fcn.10015802
imul ebx, dword [eax]
imul ebx, edi
imul ebx, esi
mov dword [ebp - 0x3c], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4]
call fcn.100157fd
push 1
lea eax, [ebp - 0x3cc]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.1004b524
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x3ac]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x3ac]
lea edi, [ebp - 0x284]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea ecx, [ebp - 0x220]
call fcn.10015795
mov dword [ebp - 4], 1
mov dword [ebp - 0x80], 0x3d7f1912
mov dword [ebp - 0x1c], 0
jmp 0x1002af77
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1002af93
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x220]
call fcn.10015802
mov dword [eax], 0x6c05baf4
jmp 0x1002af70
mov dword [ebp - 0x1c], 0
jmp 0x1002afa3
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002afb9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8c], 0x8da8e97e
jmp 0x1002af9c
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x8c], 3
jmp 0x1002afe7
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x8c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8c], 0
jl 0x1002b120
mov dword [ebp - 0x268], 0xa3dfad5b
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x8c]
lea ecx, [ebp - 0x220]
call fcn.10015802
cmp dword [eax], 0xe6f7fbf2
jae 0x1002b031
mov dword [ebp - 0x124], 1
jmp 0x1002b038
and dword [ebp - 0x124], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8c]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x8c]
cmp eax, 0x20b963ab
jge 0x1002b082
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x8c]
lea ecx, [ebp - 0x220]
call fcn.10015802
cmp dword [eax], 0
je 0x1002b082
mov dword [ebp - 0x260], 1
jmp 0x1002b089
and dword [ebp - 0x260], 0
push 1
lea ecx, [ebp - 0x220]
call fcn.10015802
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x8c]
lea ecx, [ebp - 0x220]
call fcn.10015802
cmp dword [eax], 0
je 0x1002b0c8
mov eax, 0x49598aaf
test eax, eax
je 0x1002b0c8
mov dword [ebp - 0x1e8], 1
jmp 0x1002b0cf
and dword [ebp - 0x1e8], 0
cmp dword [ebp - 0x1e8], 0x1188
je 0x1002b0e7
mov dword [ebp - 0x198], 1
jmp 0x1002b0ee
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x198]
je 0x1002b108
mov dword [ebp - 0x12c], 1
jmp 0x1002b10f
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x268], eax
jmp 0x1002afcc
mov dword [ebp - 0x80], 3
jmp 0x1002b130
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x1002b195
mov dword [ebp - 0x328], 0x39ee
mov dword [ebp - 0x330], 0xb42be197
mov dword [ebp - 0x338], 3
mov dword [ebp - 0x340], 0xfa4c8210
mov dword [ebp - 0x348], 0xfffffff7
mov dword [ebp - 0x334], 0xffffffff
mov dword [ebp - 0x324], 0x66ef3b06
mov dword [ebp - 0x1c8], 0x1dd2
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
jmp 0x1002b129
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.100157fd
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x24c], 0x4a12b57e
push 1
lea ecx, [ebp - 0x2b8]
call fcn.10015795
mov dword [ebp - 4], 2
push 3
lea ecx, [ebp - 0x200]
call fcn.10015795
mov byte [ebp - 4], 3
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x90], 0xffffffff
mov dword [ebp - 0x278], 0x509e13c9
mov dword [ebp - 0x74], 0
jmp 0x1002b205
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1002b221
push dword [ebp - 0x74]
lea ecx, [ebp - 0x200]
call fcn.10015802
mov dword [eax], 0xae9714a
jmp 0x1002b1fe
mov dword [ebp - 0x20], 2
jmp 0x1002b231
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x1002b4e3
mov dword [ebp - 0xb0], 1
push 3
lea ecx, [ebp - 0x2ac]
call fcn.10015795
mov byte [ebp - 4], 4
mov dword [ebp - 0x28], 0
jmp 0x1002b266
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002b27c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x28c], 0x702e6337
jmp 0x1002b25f
mov dword [ebp - 0x28], 0
jmp 0x1002b28c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002b2a8
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2ac]
call fcn.10015802
mov dword [eax], 0xfffffffe
jmp 0x1002b285
mov byte [ebp - 0x33], 0
movzx eax, byte [ebp - 0x33]
test eax, eax
je 0x1002b2d8
push 0xf98
push 0
push 0
push 0x1719
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x90], eax
mov esi, dword [ebp - 0xb0]
sub esi, 0x3b2247b4
push 0
lea ecx, [ebp - 0x200]
call fcn.10015802
cmp esi, dword [eax]
jge 0x1002b316
mov dword [ebp - 0x134], 1
jmp 0x1002b31d
and dword [ebp - 0x134], 0
cmp dword [ebp - 0x134], 8
je 0x1002b332
mov dword [ebp - 0x270], 1
jmp 0x1002b339
and dword [ebp - 0x270], 0
cmp dword [ebp - 0xb0], 0
jne 0x1002b354
mov eax, 0x1718
test eax, eax
jne 0x1002b354
and dword [ebp - 0x1a0], 0
jmp 0x1002b35e
mov dword [ebp - 0x1a0], 1
mov eax, dword [ebp - 0x1a0]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x13c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x13c]
mov dword [ebp + eax - 0x28c], ecx
cmp dword [ebp - 0x13c], 0
jne 0x1002b3a2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28c], 0
jne 0x1002b3a2
and dword [ebp - 0x1e0], 0
jmp 0x1002b3ac
mov dword [ebp - 0x1e0], 1
mov esi, dword [ebp - 0x20]
add esi, dword [ebp - 0x1e0]
push 2
lea ecx, [ebp - 0x200]
call fcn.10015802
cmp esi, dword [eax]
jl 0x1002b3d2
mov dword [ebp - 0x144], 1
jmp 0x1002b3d9
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x144], eax
jle 0x1002b402
push 0
lea ecx, [ebp - 0x200]
call fcn.10015802
cmp dword [eax], 0
je 0x1002b402
and dword [ebp - 0x1a8], 0
jmp 0x1002b40c
mov dword [ebp - 0x1a8], 1
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x90], eax
mov esi, dword [ebp - 0x90]
push 1
lea ecx, [ebp - 0x200]
call fcn.10015802
cmp esi, dword [eax]
jg 0x1002b43b
mov dword [ebp - 0x14c], 1
jmp 0x1002b442
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x14c], eax
jge 0x1002b459
mov dword [ebp - 0x1d0], 1
jmp 0x1002b460
and dword [ebp - 0x1d0], 0
cmp dword [ebp - 0x1d0], 0
jl 0x1002b475
mov dword [ebp - 0x154], 1
jmp 0x1002b47c
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x154], eax
je 0x1002b493
mov dword [ebp - 0x1b0], 1
jmp 0x1002b49a
and dword [ebp - 0x1b0], 0
cmp dword [ebp - 0x1b0], 0xffffffff
je 0x1002b4af
mov dword [ebp - 0x15c], 1
jmp 0x1002b4b6
and dword [ebp - 0x15c], 0
imul esi, dword [ebp - 0x15c], 0xe12f
push 0
lea ecx, [ebp - 0x2ac]
call fcn.10015802
mov dword [eax], esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2ac]
call fcn.100157fd
jmp 0x1002b22a
push 2
lea ecx, [ebp - 0x200]
call fcn.10015802
mov eax, dword [eax]
mov dword [ebp - 0x278], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x200]
call fcn.100157fd
mov dword [ebp - 0x384], 1
mov dword [ebp - 0x380], 1
mov dword [ebp - 0x37c], 1
mov dword [ebp - 0x378], 1
mov dword [ebp - 0x7c], 0xf94964a5
mov dword [ebp - 0x7c], 0
jmp 0x1002b546
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jg 0x1002b57a
mov byte [ebp - 0x3e], 0
movzx eax, byte [ebp - 0x3e]
test eax, eax
je 0x1002b578
push 0
push 0x105
push 0x7d3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
jmp 0x1002b53f
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x1002b58e
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [ebp - 0x98], 0
jmp 0x1002b5a7
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x1002b5c9
push dword [ebp - 0x98]
lea ecx, [ebp - 0x2b8]
call fcn.10015802
mov dword [eax], 0xfffffffb
jmp 0x1002b59a
mov dword [ebp - 0x2a0], 0xfffffffb
mov dword [ebp - 0x29c], 0xfffffffb
mov dword [ebp - 0x298], 0xfffffffb
mov dword [ebp - 0x294], 0xfffffffb
lea ecx, [ebp - 0xa9]
call fcn.10015811
push eax
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x2a0]
push eax
lea ecx, [ebp - 0x3b4]
call fcn.10015814
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3a0]
call fcn.100157d7
mov byte [ebp - 4], 5
mov dword [ebp - 0x238], 0x683648bd
mov dword [ebp - 0x64], 0
jmp 0x1002b644
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1002b657
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x4c], 0x5c8094a1
jmp 0x1002b63d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4c], 3
jmp 0x1002b67c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x4c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c], 0
jl 0x1002b7cb
push 3
lea ecx, [ebp - 0x22c]
call fcn.10015795
mov byte [ebp - 4], 6
mov dword [ebp - 0x25c], 0xfffffffd
mov dword [ebp - 0x164], 0xe28de637
mov dword [ebp - 0x26c], 0xd8c53784
mov dword [ebp - 0x84], 0
jmp 0x1002b6d5
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1002b6f7
push dword [ebp - 0x84]
lea ecx, [ebp - 0x22c]
call fcn.10015802
mov dword [eax], 0x34d0069
jmp 0x1002b6c8
push 0
lea ecx, [ebp - 0x22c]
call fcn.10015802
mov esi, dword [ebp - 0x25c]
push 0
lea ecx, [ebp - 0x22c]
call fcn.10015802
mov edi, eax
push 0
lea ecx, [ebp - 0x22c]
call fcn.10015802
mov ecx, dword [edi]
add ecx, dword [eax]
imul eax, ecx, 0x37ac
cmp esi, eax
jl 0x1002b740
mov dword [ebp - 0x170], 1
jmp 0x1002b747
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x170]
sub eax, dword [ebp - 0x238]
mov dword [ebp - 0x164], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
cmp dword [ebp - 0x164], eax
jg 0x1002b777
mov dword [ebp - 0x16c], 1
jmp 0x1002b77e
and dword [ebp - 0x16c], 0
push 0
lea ecx, [ebp - 0x22c]
call fcn.10015802
xor ecx, ecx
inc ecx
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x16c]
jne 0x1002b7a4
mov dword [ebp - 0xcc], 1
jmp 0x1002b7ab
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x26c], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x22c]
call fcn.100157fd
jmp 0x1002b667
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3a0]
call fcn.100157fd
push 0x583f
push 0
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x44]
push eax
push 0x3228
call fcn.1002702c
add esp, 0x14
mov dword [ebp - 0x388], 0xb4e1a362
mov dword [ebp - 0x2d0], 0xfffffffe
mov dword [ebp - 0x32c], 0
mov dword [ebp - 0x2d8], 0xfffffffe
mov dword [ebp - 0x35c], 1
mov dword [ebp - 0x2e0], 0xb4ebb0cb
mov dword [ebp - 0x2ec], 0xffffffff
mov dword [ebp - 0x2e8], 0xa149cec7
mov dword [ebp - 0x2f0], 0x3c0bf90a
mov dword [ebp - 0x2f8], 0x47adf1ad
mov dword [ebp - 0x2f4], 0xffffffff
mov dword [ebp - 0x2bc], 4
mov dword [ebp - 0x2fc], 0x12d2c87
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x304], 0xf13e13a6
push 1
lea ecx, [ebp - 0x368]
call fcn.10015795
mov byte [ebp - 4], 7
mov dword [ebp - 0x36c], 0xffffffff
mov dword [ebp - 0x30c], 0x488a9733
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0x94], 0
jmp 0x1002b8d7
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x1002b8f9
push dword [ebp - 0x94]
lea ecx, [ebp - 0x368]
call fcn.10015802
mov dword [eax], 0xfbce008f
jmp 0x1002b8ca
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x368]
call fcn.100157fd
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x68], 0xffffffeb
jmp 0x1002b92c
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jl 0x1002b9af
mov dword [ebp - 0x70], 0
jmp 0x1002b942
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1002b958
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x208], 1
jmp 0x1002b93b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x208], 0
jmp 0x1002b986
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x208]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x208], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x208], 0x1a
jle 0x1002b9aa
mov byte [ebp - 0x34], 0
movzx eax, byte [ebp - 0x34]
test eax, eax
je 0x1002b9a8
call dword [sym.imp.USER32.dll_GetCapture]
jmp 0x1002b96b
jmp 0x1002b925
mov dword [ebp - 0x44], 0
jmp 0x1002b9bf
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1002bd52
push 2
lea ecx, [ebp - 0x214]
call fcn.10015795
mov byte [ebp - 4], 8
mov dword [ebp - 0x264], 9
mov dword [ebp - 0xc8], 0xfb656d4c
mov dword [ebp - 0x24], 0
jmp 0x1002b9fe
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002ba1a
push dword [ebp - 0x24]
lea ecx, [ebp - 0x214]
call fcn.10015802
mov dword [eax], 9
jmp 0x1002b9f7
mov dword [ebp - 0x24], 0
jmp 0x1002ba2a
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002ba40
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xbc], 0xf1febaee
jmp 0x1002ba23
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xbc], 0
jmp 0x1002ba6e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbc]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xbc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbc], 1
jg 0x1002bd1f
mov dword [ebp - 0xc0], 1
mov dword [ebp - 0xe0], 0x5b689063
mov byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x1002baaa
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xbc]
lea ecx, [ebp - 0x214]
call fcn.10015802
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jne 0x1002bae0
mov eax, 0x64f1
test eax, eax
je 0x1002bcee
mov eax, 0x909b
test eax, eax
je 0x1002bcee
mov dword [ebp - 0x5c], 2
mov dword [ebp - 0xf0], 0xfffffff6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbc]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0xbc]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xbc]
je 0x1002bb32
mov dword [ebp - 0xd8], 1
jmp 0x1002bb39
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0xe0], eax
jg 0x1002bb5c
mov dword [ebp - 0xe8], 1
jmp 0x1002bb63
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x314], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbc]
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x31c], eax
imul esi, dword [ebp - 0x5c], 0x796
push 0
lea ecx, [ebp - 0x214]
call fcn.10015802
cmp esi, dword [eax]
jne 0x1002bbcf
mov eax, 0xff1eb7e5
test eax, eax
jne 0x1002bbcf
and dword [ebp - 0xf8], 0
jmp 0x1002bbd9
mov dword [ebp - 0xf8], 1
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0xf8], eax
je 0x1002bbf0
mov dword [ebp - 0x100], 1
jmp 0x1002bbf7
and dword [ebp - 0x100], 0
push 0
lea ecx, [ebp - 0x214]
call fcn.10015802
mov eax, dword [eax]
imul eax, dword [ebp - 0x100]
sub eax, 0x640f4466
cmp eax, dword [ebp - 0x5c]
jle 0x1002bc23
mov dword [ebp - 0x108], 1
jmp 0x1002bc2a
and dword [ebp - 0x108], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc]
imul eax, dword [ebp - 0x108]
cmp eax, 0x1404
jne 0x1002bc51
mov dword [ebp - 0x110], 1
jmp 0x1002bc58
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x110], eax
jg 0x1002bc6f
mov dword [ebp - 0x118], 1
jmp 0x1002bc76
and dword [ebp - 0x118], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xbc]
lea ecx, [ebp - 0x214]
call fcn.10015802
mov eax, dword [eax]
cmp eax, dword [ebp - 0x118]
jge 0x1002bca4
mov dword [ebp - 0x120], 1
jmp 0x1002bcab
and dword [ebp - 0x120], 0
cmp dword [ebp - 0x120], 0xd55be984
je 0x1002bcc3
mov dword [ebp - 0x128], 1
jmp 0x1002bcca
and dword [ebp - 0x128], 0
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0xc8], eax
mov byte [ebp - 0x36], 0
movzx eax, byte [ebp - 0x36]
test eax, eax
je 0x1002bcec
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1002bd1a
mov byte [ebp - 0x32], 0
movzx eax, byte [ebp - 0x32]
test eax, eax
je 0x1002bd10
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
mov dword [ebp - 0xc8], 8
jmp 0x1002ba53
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x214]
call fcn.100157fd
lea eax, [ebp - 0x44]
push eax
push 1
push 0x3ba0
push 0x1ed8
lea eax, [ebp - 0x2b8]
push eax
call fcn.1002702c
add esp, 0x14
jmp 0x1002b9b8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b8]
call fcn.100157fd
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x58], 0xcd4431fa
mov dword [ebp - 0x2c], 0x629c4ddb
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x50], 0x5fafe44f
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x60], 0x27ee
push 1
lea ecx, [ebp - 0x244]
call fcn.10015795
mov dword [ebp - 4], 9
mov dword [ebp - 0x1c4], 0xde726f2c
mov dword [ebp - 0x78], 0
jmp 0x1002bdc3
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1002bddc
push dword [ebp - 0x78]
lea ecx, [ebp - 0x244]
call fcn.10015802
and dword [eax], 0
jmp 0x1002bdbc
cmp dword [ebp - 0x14], 0
jne 0x1002bfa3
imul eax, dword [ebp - 0x2c], 0xa37d
test eax, eax
je 0x1002bdf5
cmp dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x14], eax
jge 0x1002be09
mov dword [ebp - 0x138], 1
jmp 0x1002be10
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x138], eax
je 0x1002be27
mov dword [ebp - 0x140], 1
jmp 0x1002be2e
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x140], eax
jge 0x1002be45
mov dword [ebp - 0x148], 1
jmp 0x1002be4c
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x21fafbf2
je 0x1002be6a
mov dword [ebp - 0x150], 1
jmp 0x1002be71
and dword [ebp - 0x150], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x58], eax
xor eax, eax
inc eax
sub eax, dword [ebp - 0x150]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x58], eax
jle 0x1002be97
mov dword [ebp - 0x158], 1
jmp 0x1002be9e
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x158]
jg 0x1002beb5
mov dword [ebp - 0x160], 1
jmp 0x1002bebc
and dword [ebp - 0x160], 0
mov eax, dword [ebp - 0x160]
add eax, 3
cmp eax, 0x6702e63
jl 0x1002bed8
mov dword [ebp - 0x168], 1
jmp 0x1002bedf
and dword [ebp - 0x168], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x50], eax
jge 0x1002befc
mov dword [ebp - 0x184], 1
jmp 0x1002bf03
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x184]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
je 0x1002bf26
mov dword [ebp - 0x18c], 1
jmp 0x1002bf2d
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x18c]
sub eax, dword [ebp - 0x14]
cmp eax, 0xfff9
ja 0x1002bf49
mov dword [ebp - 0x194], 1
jmp 0x1002bf50
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x194], eax
jne 0x1002bf6a
mov dword [ebp - 0x19c], 1
jmp 0x1002bf71
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x19c], eax
je 0x1002bf88
mov dword [ebp - 0x1a4], 1
jmp 0x1002bf8f
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x1a4], eax
je 0x1002bfa3
and dword [ebp - 0x1ac], 0
jmp 0x1002bfad
mov dword [ebp - 0x1ac], 1
mov esi, dword [ebp - 0x60]
imul esi, dword [ebp - 0x1ac]
push 0
lea ecx, [ebp - 0x244]
call fcn.10015802
mov dword [eax], esi
mov eax, dword [ebp - 0x1c4]
imul eax, dword [ebp - 0x60]
mov dword [ebp - 0x1b4], eax
push 0
lea ecx, [ebp - 0x244]
call fcn.10015802
mov ecx, dword [ebp - 0x1b4]
mov dword [eax], ecx
cmp dword [ebp - 0x1b4], 0
je 0x1002c04c
mov dword [ebp - 0x50], 1
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
sub eax, 8
imul eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x60]
imul ecx, eax
cmp ecx, 0xd85d
je 0x1002c025
mov dword [ebp - 0x1bc], 1
jmp 0x1002c02c
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x1c4], eax
jle 0x1002c04c
mov dword [ebp - 0x274], 1
jmp 0x1002c053
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x2cc], eax
mov eax, 0x83200138
test eax, eax
jne 0x1002c09b
push 0
lea ecx, [ebp - 0x244]
call fcn.10015802
cmp dword [eax], 0
jne 0x1002c09b
and dword [ebp - 0x1cc], 0
jmp 0x1002c0a5
mov dword [ebp - 0x1cc], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1cc], eax
jl 0x1002c0bc
mov dword [ebp - 0x1d4], 1
jmp 0x1002c0c3
and dword [ebp - 0x1d4], 0
cmp dword [ebp - 0x1d4], 0xfffffff7
jae 0x1002c0d8
mov dword [ebp - 0x1dc], 1
jmp 0x1002c0df
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x2c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x244]
call fcn.100157fd
cmp dword [ebp - 0x284], 0
je 0x1002c114
push 1
push dword [ebp - 0x27c]
push dword [ebp - 0x280]
call dword [ebp - 0x284]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret