Function at 0x1002ee5d
Capabilities:
Check os version
Delete directory
Delete file
Enumerate gui resources
Extract resource via kernel32 functions
Get disk information
Get disk size
Get file attributes
Get file system object information
Get system information on windows
Identify system language via api
Log keystrokes
Log keystrokes via polling
Parse pe header
Query or enumerate registry key
Resume thread
Suspend thread

Disassembly:
mov eax, 0x100896ec
call fcn.100882b0
mov eax, 0x16cc
call fcn.10085fe0
push ebx
push esi
push edi
mov edi, 0x83c7730f
mov byte [ebp - 0x79], dl
xor eax, eax
mov dword [ebp - 0x1c], edi
xor esi, esi
mov dword [ebp - 0x1c], eax
inc esi
mov dword [ebp - 0x68], ecx
cmp dword [ebp - 0x1c], esi
jge 0x1002eead
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x78c], 0
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002ee8f
xor esi, esi
xor eax, eax
inc esi
mov ebx, dword [sym.imp.USER32.dll_SetCursor]
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x1002eec1
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002eedd
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x78c], 0
jne 0x1002eedb
dec dword [ebp - 0x1c]
jns 0x1002eec9
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002ef06
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x83c], 0
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002eee8
xor esi, esi
xor eax, eax
inc esi
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x1002ef14
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002ef2e
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x83c], 0
jne 0x1002ef2e
dec dword [ebp - 0x1c]
jns 0x1002ef1c
mov dword [ebp - 0x38], 0xfffffffe
lea ecx, [ebp - 0xea4]
mov dword [ebp - 0x38], 0x5f394a2a
mov eax, 0x8144ad72
mov dword [ebp - 0x38], 0x2937a3a1
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x38], 0xfffffffa
push 3
call fcn.10016409
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x50], 0xf8ee
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002ef92
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x16c8], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002ef7d
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002efa8
push dword [ebp - 0x18]
call fcn.100164aa
mov dword [eax], 0xe6dc660f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
lea ecx, [ebp - 0xea4]
jl 0x1002ef97
inc dword [ebp - 0x50]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1001648e
mov dword [ebp - 0x18], 0x3df75dce
xor eax, eax
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x20], 0xbe02189f
mov dword [ebp - 0x18], eax
jmp 0x1002f1c4
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x3c], 0x6f4ed832
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002f027
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5b4], 0xa35f394a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f00e
xor eax, eax
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x1002f039
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor eax, eax
mov dword [ebp - 0x5b0], 4
cmp dword [ebp - 0x5b0], 0xffffffec
jl 0x1002f1c1
or ecx, 0xffffffff
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x2c], 0xc7a8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002f092
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9c], 0xff44cacf
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002f074
xor esi, esi
xor eax, eax
inc esi
dec dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1002f1ae
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x2c], eax
jmp 0x1002f0e8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002f0e5
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9c], ecx
xor eax, eax
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], eax
jl 0x1002f0de
inc dword [ebp - 0x30]
dec dword [ebp - 0x20]
jns 0x1002f0d6
dec dword [ebp - 0x1c]
jns 0x1002f0b4
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x1002f0ac
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x50]
jne 0x1002f112
cmp dword [ebp - 0x3c], eax
jne 0x1002f112
cmp dword [ebp - 0x2c], eax
jne 0x1002f112
mov edx, eax
jmp 0x1002f11a
xor eax, eax
xor esi, esi
inc esi
lea edx, [eax + 1]
mov eax, dword [ebp - 0x5ac]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setl cl
xor edx, edx
imul eax, ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x50]
cmp ecx, eax
setg dl
cmp edx, 0xdfe1602a
jb 0x1002f14f
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x5b4]
mov eax, dword [ebp - 0x9c]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002f167
cmp dword [ebp - 0x20], eax
je 0x1002f169
mov eax, esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffb
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xffffffff
setne cl
xor eax, eax
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x50], eax
jne 0x1002f19a
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x9c], 0
jne 0x1002f19a
xor eax, eax
jmp 0x1002f19c
mov eax, esi
mov dword [ebp - 0x64], eax
dec dword [ebp - 0x24]
push 0
pop eax
jns 0x1002f0a1
or ecx, 0xffffffff
dec dword [ebp - 0x5b0]
cmp dword [ebp - 0x5b0], 0xffffffec
jge 0x1002f053
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff5
jle 0x1002efe1
mov dword [ebp - 0x1c], edi
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0xb392
mov dword [ebp - 0x50], 0xe418a527
mov dword [ebp - 0x30], 0xc3414b5
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002f20b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1528], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002f1f7
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff9
push 8
pop edx
je 0x1002f26e
mov dword [ebp - 0x30], 0x977a124
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], 0xfaaa
mov dword [ebp - 0x50], esi
mov eax, dword [ebp - 0x24]
cmp eax, edx
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x50]
push 8
setl dl
xor ecx, ecx
cmp edx, eax
pop edx
setle cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
add eax, 0x383c67ee
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff9
jne 0x1002f217
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x24], eax
jmp 0x1002f2bd
mov dword [ebp - 0x14], 0x39e0
mov dword [ebp - 0x38], 0xaf2c9a13
mov dword [ebp - 0x38], 0xe974ca77
mov dword [ebp - 0x50], 0xfffb
dec dword [ebp - 0x50]
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x1002f2ba
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x1002f2b5
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1002f2a0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1002f279
push esi
lea ecx, [ebp - 0x5fc]
call fcn.10016409
push 3
lea ecx, [ebp - 0x100c]
mov dword [ebp - 4], esi
call fcn.10016409
push 2
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002f312
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5fc]
call fcn.100164aa
mov dword [eax], 0x3ae35568
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x1002f2ee
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002f337
push dword [ebp - 0x18]
lea ecx, [ebp - 0x100c]
call fcn.100164aa
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002f31b
xor eax, eax
push eax
lea ecx, [ebp - 0x5fc]
call fcn.100164aa
and dword [eax], 0
jmp 0x1002f3a7
xor eax, eax
mov dword [ebp - 0x1c], 0x8ab659d5
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], al
je 0x1002f369
push 0x1714
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x1c], eax
jmp 0x1002f394
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x1002f391
push 0x79b
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x1002f36e
push eax
lea ecx, [ebp - 0x5fc]
call fcn.100164aa
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x5fc]
push eax
call fcn.100164aa
push 2
pop ecx
cmp dword [eax], ecx
jne 0x1002f348
lea ecx, [ebp - 0x100c]
call fcn.1001648e
or eax, 0xffffffff
lea ecx, [ebp - 0x5fc]
mov dword [ebp - 4], eax
call fcn.1001648e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002f400
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x75c], 0
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002f3e2
xor esi, esi
xor eax, eax
inc esi
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x1002f40c
push eax
call ebx
push 4
pop ebx
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0xaac]
push ebx
call fcn.10016409
mov dword [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x3c], 0x64bae0f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002f454
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x33c], 0xfffffffa
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x1002f436
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002f47a
push dword [ebp - 0x18]
lea ecx, [ebp - 0xaac]
call fcn.100164aa
mov dword [eax], 0x272b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002f45c
xor eax, eax
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x1002f48c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov dword [ebp - 0x33c], eax
lea ecx, [ebp - 0xaac]
push esi
call fcn.100164aa
mov ecx, dword [ebp - 0x30]
mov esi, eax
neg ecx
push 8
sbb ecx, ecx
xor edx, edx
inc ecx
pop eax
cmp ecx, eax
mov ecx, dword [ebp - 0x30]
setne dl
xor eax, eax
cmp ecx, edx
mov ecx, dword [ebp - 0x30]
setle al
add eax, dword [esi]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x555b
jge 0x1002f4e1
cmp dword [ebp - 0x33c], eax
je 0x1002f4e1
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x1002f4e4
xor ebx, ebx
inc ebx
dec eax
lea ecx, [ebp - 0xaac]
cmp eax, 0x89480189
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1001648e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002f51e
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x75c], 0
jne 0x1002f51e
dec dword [ebp - 0x1c]
jns 0x1002f50c
mov dword [ebp - 0x38], 0xfffffffe
mov ecx, 0x8144ad72
mov dword [ebp - 0x38], 0x5f394a2a
mov dword [ebp - 0x38], 0x2937a3a1
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
push 3
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
lea ecx, [ebp - 0xebc]
pop esi
mov dword [ebp - 0x38], 0xfffffffa
push esi
call fcn.10016409
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x50], 0xf8ee
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002f586
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1680], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002f572
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002f59c
push dword [ebp - 0x18]
call fcn.100164aa
mov dword [eax], 0xe6dc660f
inc dword [ebp - 0x18]
lea ecx, [ebp - 0xebc]
cmp dword [ebp - 0x18], esi
jl 0x1002f58b
inc dword [ebp - 0x50]
or ebx, 0xffffffff
mov dword [ebp - 4], ebx
call fcn.1001648e
push esi
lea ecx, [ebp - 0x518]
call fcn.10016409
lea eax, [ebp - 0x10f4]
mov dword [ebp - 4], 5
movdqa xmm0, xmmword [0x10008260]
lea ecx, [ebp - 0x14e0]
push eax
lea eax, [ebp - 0x1104]
mov dword [ebp - 0x50], 0xf0720718
push eax
movdqu xmmword [ebp - 0x1104], xmm0
call fcn.100164b9
lea ecx, [ebp - 0x225]
mov esi, eax
call fcn.10009393
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xc2c]
push dword [esi]
call fcn.10016468
mov byte [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x30], 0xf2ba167c
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x1c], eax
jmp 0x1002f63f
push dword [ebp - 0x1c]
call fcn.100164aa
mov dword [eax], 0xde713a47
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
lea ecx, [ebp - 0x518]
jl 0x1002f62e
xor esi, esi
inc esi
push esi
call fcn.100164aa
push 2
pop ebx
push ebx
mov eax, dword [eax]
lea ecx, [ebp - 0xc2c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
call fcn.100164aa
push esi
lea ecx, [ebp - 0x518]
and dword [eax], 0
call fcn.100164aa
xor ecx, ecx
cmp dword [eax], 0x7631615e
setne cl
neg ecx
jne 0x1002f697
xor eax, eax
lea ecx, [ebp - 0x518]
push eax
call fcn.100164aa
push esi
lea ecx, [ebp - 0x518]
call fcn.100164aa
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0xc2c]
push ebx
call fcn.100164aa
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x518]
push esi
call fcn.100164aa
lea ecx, [ebp - 0xc2c]
mov eax, dword [eax]
add eax, 0x4f78
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
call fcn.1001648e
or eax, 0xffffffff
lea ecx, [ebp - 0x518]
mov dword [ebp - 4], eax
call fcn.1001648e
push ebx
lea ecx, [ebp - 0x850]
call fcn.10016409
push 7
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x50], 0x338886a6
mov dword [ebp - 0x1c], eax
jmp 0x1002f725
push dword [ebp - 0x1c]
call fcn.100164aa
and dword [eax], 0
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x850]
cmp dword [ebp - 0x1c], ebx
jl 0x1002f717
dec dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
push esi
call fcn.100164aa
mov ecx, dword [ebp - 0x50]
xor edx, edx
cmp ecx, 0x5b0b
lea ecx, [ebp - 0x850]
push esi
setne dl
xor ebx, ebx
add edx, dword [ebp - 0x14]
cmp edx, dword [eax]
setg bl
call fcn.100164aa
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp ecx, ebx
setge dl
mov dword [eax], edx
xor edx, edx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
inc ecx
cmp ecx, eax
setl dl
xor eax, eax
mov byte [ebp - 0x59], al
cmp edx, 5
je 0x1002f799
cmp byte [ebp - 0x59], al
je 0x1002f7b1
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetPropA]
jmp 0x1002f7b1
cmp byte [ebp - 0x59], al
je 0x1002f7b1
push eax
push eax
push 0xd15
push 0x641
push eax
call dword [sym.imp.USER32.dll_ModifyMenuW]
or ebx, 0xffffffff
lea ecx, [ebp - 0x850]
mov dword [ebp - 4], ebx
call fcn.1001648e
mov dword [ebp - 0x18], 0x3df75dce
xor eax, eax
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x20], 0xbe02189f
mov dword [ebp - 0x18], eax
jmp 0x1002f9b5
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x3c], 0x6f4ed832
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002f827
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x578], 0xa35f394a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002f80e
xor eax, eax
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x1002f839
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor eax, eax
mov dword [ebp - 0x574], 4
jmp 0x1002f9a5
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], 0xc7a8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002f887
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x94], 0xff44cacf
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002f869
xor esi, esi
xor eax, eax
inc esi
dec dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1002f99f
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x2c], eax
jmp 0x1002f8dd
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1002f8da
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x94]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x94], ecx
xor eax, eax
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], eax
jl 0x1002f8d3
inc dword [ebp - 0x30]
dec dword [ebp - 0x20]
jns 0x1002f8cb
dec dword [ebp - 0x1c]
jns 0x1002f8a9
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x1002f8a1
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x50]
jne 0x1002f907
cmp dword [ebp - 0x3c], eax
jne 0x1002f907
cmp dword [ebp - 0x2c], eax
jne 0x1002f907
mov edx, eax
jmp 0x1002f90f
xor eax, eax
xor esi, esi
inc esi
lea edx, [eax + 1]
mov eax, dword [ebp - 0x570]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setl cl
xor edx, edx
imul eax, ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x94]
mov eax, dword [ebp - 0x50]
cmp ecx, eax
setg dl
cmp edx, 0xdfe1602a
jb 0x1002f944
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x578]
mov eax, dword [ebp - 0x94]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002f95c
cmp dword [ebp - 0x20], eax
je 0x1002f95e
mov eax, esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffb
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, ebx
setne cl
xor eax, eax
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x50], eax
jne 0x1002f98e
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x94], 0
jne 0x1002f98e
xor eax, eax
jmp 0x1002f990
mov eax, esi
mov dword [ebp - 0x64], eax
dec dword [ebp - 0x24]
push 0
pop eax
jns 0x1002f896
dec dword [ebp - 0x574]
cmp dword [ebp - 0x574], 0xffffffec
jge 0x1002f848
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff5
jle 0x1002f7e1
mov dword [ebp - 0x24], 0x83c7730f
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], 0xb392
mov dword [ebp - 0x50], 0xe418a527
mov dword [ebp - 0x30], 0xc3414b5
push 2
mov dword [ebp - 0x1c], eax
pop ebx
cmp dword [ebp - 0x1c], ebx
jge 0x1002f9fd
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1548], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002f9e9
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff9
je 0x1002fa5d
mov dword [ebp - 0x30], 0x977a124
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], 0xfaaa
mov dword [ebp - 0x50], esi
mov eax, dword [ebp - 0x24]
push 8
pop edx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x50]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
add eax, 0x383c67ee
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff9
jne 0x1002fa06
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1002faa6
mov dword [ebp - 0x14], 0x39e0
mov dword [ebp - 0x38], 0xaf2c9a13
mov dword [ebp - 0x38], 0xe974ca77
mov dword [ebp - 0x50], 0xfffb
dec dword [ebp - 0x50]
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x1002faa3
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x1002fa9e
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1002fa89
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1002fa62
push esi
lea ecx, [ebp - 0x674]
call fcn.10016409
push 8
pop eax
push 3
lea ecx, [ebp - 0x1020]
mov dword [ebp - 4], eax
call fcn.10016409
push 9
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1002fafe
push dword [ebp - 0x18]
lea ecx, [ebp - 0x674]
call fcn.100164aa
mov dword [eax], 0x3ae35568
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x1002fada
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002fb23
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1020]
call fcn.100164aa
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002fb07
xor eax, eax
push eax
lea ecx, [ebp - 0x674]
call fcn.100164aa
and dword [eax], 0
jmp 0x1002fb8d
xor eax, eax
mov dword [ebp - 0x1c], 0x8ab659d5
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], al
je 0x1002fb52
push 0x1714
call dword [sym.imp.USER32.dll_GetSysColorBrush]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1002fb7a
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x1002fb77
push 0x79b
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1002fb57
push eax
lea ecx, [ebp - 0x674]
call fcn.100164aa
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x674]
push eax
call fcn.100164aa
cmp dword [eax], ebx
jne 0x1002fb34
lea ecx, [ebp - 0x1020]
call fcn.1001648e
or edi, 0xffffffff
lea ecx, [ebp - 0x674]
mov dword [ebp - 4], edi
call fcn.1001648e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002fbe3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7dc], 0
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1002fbc5
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x1c], 0x5b0e446d
mov ecx, 0xa023703a
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0x466e9f08
mov dword [ebp - 0x3c], 0x623b4709
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x464], ecx
mov dword [ebp - 0x460], ecx
mov dword [ebp - 0x45c], ecx
mov dword [ebp - 0x458], ecx
cmp dword [ebp - 0x1c], eax
je 0x1002fc2d
mov dword [ebp - 0x1c], 0x5db3
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], 0xc4e2bf5f
mov dword [ebp - 0x24], 0x18
cmp dword [ebp - 0x24], 0x32
jne 0x1002fe8c
push 3
xor eax, eax
pop edi
mov dword [ebp - 0x64], 0xd767c8fa
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x1002fe7c
mov dword [ebp - 0x2c], 0x3c7d
lea ecx, [ebp - 0x47c]
push edi
call fcn.10016409
or eax, 0xffffffff
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1002fcbc
push dword [ebp - 0x18]
lea ecx, [ebp - 0x47c]
call fcn.100164aa
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002fca2
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1002fcdc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe8c], 0x5251bb39
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002fcc4
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1002fe57
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0xac4]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x48], 0xc5108d7e
push 4
call fcn.10016409
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x1c], eax
jmp 0x1002fd20
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xac4]
call fcn.100164aa
mov dword [eax], 0xfbcda4f1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002fd09
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x47c]
mov dword [ebp - 0x50], eax
mov edi, dword [ebp - 0x45c]
sub edi, 6
neg edi
push esi
sbb edi, edi
inc edi
call fcn.100164aa
mov ecx, dword [ebp - 0x50]
mov esi, eax
xor eax, eax
cmp ecx, edi
mov ecx, dword [ebp - 0x64]
setge al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
mov ecx, 0xaf09d89c
setle dl
mov dword [esi], edx
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x464]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x464]
mov dword [ebp - 0x30], 0x5e04
mov eax, dword [ebp - 0x460]
sub ecx, eax
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, 0xcc3231a2
setl dl
cmp eax, edx
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
neg edx
mov eax, dword [ebp + eax*4 - 0x464]
cmp edx, eax
setg cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + eax*4 - 0x464]
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x47c]
push eax
call fcn.100164aa
xor eax, eax
lea ecx, [ebp - 0x47c]
push eax
call fcn.100164aa
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xac4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x464]
mov eax, dword [ebp - 0x48]
push 3
pop edi
push edi
call fcn.100164aa
xor esi, esi
lea ecx, [ebp - 0x47c]
inc esi
push esi
call fcn.100164aa
push esi
lea ecx, [ebp - 0x47c]
call fcn.100164aa
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2c]
mov dword [ebp - 0xe8c], eax
jne 0x1002fe3d
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1002fe3f
mov eax, esi
jmp 0x1002fe3f
xor eax, eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0xac4]
mov byte [ebp - 4], 0xa
call fcn.1001648e
inc dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], edi
jle 0x1002fce4
or eax, 0xffffffff
lea ecx, [ebp - 0x47c]
mov dword [ebp - 4], eax
call fcn.1001648e
dec dword [ebp - 0x20]
jns 0x1002fc78
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x32
je 0x1002fc62
or edi, 0xffffffff
xor eax, eax
lea ecx, [ebp - 0x614]
mov byte [ebp - 0xd], al
push ebx
call fcn.10016409
mov dword [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x18], 0x1c29000d
mov dword [ebp - 0x3c], 0xfc35327
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1002fee8
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x614]
call fcn.100164aa
mov dword [eax], 0x13b91020
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002feca
xor eax, eax
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x1003012e
mov dword [ebp - 0x54], 0xe55059b8
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x30], 0x7a2e4284
mov dword [ebp - 0x60], 0x9ee1
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], esi
jg 0x10030125
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], 0xca335c22
mov dword [ebp - 0x50], 0xfffffffa
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x40], 0x4572090f
cmp dword [ebp - 0x2c], eax
je 0x1002ff64
cmp dword [ebp - 0x54], eax
jne 0x1002ff4c
cmp dword [ebp - 0x2c], eax
je 0x1002ff4e
mov eax, esi
mov dword [ebp - 0x24], eax
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setl dl
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
jne 0x1002ff83
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1002ff83
mov edi, eax
jmp 0x1002ff88
xor eax, eax
lea edi, [eax + 1]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x614]
call fcn.100164aa
push dword [ebp - 0x18]
lea ecx, [ebp - 0x614]
mov esi, eax
call fcn.100164aa
xor edx, edx
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x18]
cmp edi, ecx
mov eax, dword [ebp - 0x50]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x3efe35fe
setle al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [esi]
sub ecx, eax
mov dword [ebp - 0x14], ecx
jne 0x1002ffe3
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x1002ffe3
mov ecx, eax
jmp 0x1002ffe8
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x48]
add eax, ecx
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10030104
mov dword [ebp - 0x44], 0x5b62
mov dword [ebp - 0x2c], 0xfffffff2
jmp 0x100300f7
or ecx, 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0x20
je 0x100300db
mov dword [ebp - 0x1c], 0xdfe1db4d
lea ecx, [ebp - 0x614]
push dword [ebp - 0x18]
call fcn.100164aa
cmp dword [eax], 0
jne 0x1003003d
mov eax, dword [ebp - 0x64]
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x10030047
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x44]
cmp eax, 0xfffffffc
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
setg cl
sub esi, ecx
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, 0x82c5a4ec
setge cl
cmp eax, ecx
lea ecx, [ebp - 0x614]
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
push dword [ebp - 0x18]
call fcn.100164aa
cmp dword [eax], 0
je 0x100300c7
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setle cl
sub eax, ecx
sub eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
je 0x100300c7
xor eax, eax
inc eax
jmp 0x100300c9
xor eax, eax
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x20
jne 0x10030020
xor eax, eax
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], 0
je 0x100300f4
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jne 0x1003000d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1c
jne 0x1002fffa
inc dword [ebp - 0x54]
xor esi, esi
push 0
pop eax
inc esi
push 0xffffffffffffffff
pop edi
cmp dword [ebp - 0x54], esi
jle 0x1002ff1e
or edi, edi
dec dword [ebp - 0x18]
jns 0x1002fef4
lea ecx, [ebp - 0x614]
mov dword [ebp - 4], edi
call fcn.1001648e
cmp byte [ebp - 0xd], 0
je 0x1003037d
push esi
lea ecx, [ebp - 0x16c]
call fcn.10016409
mov dword [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10030187
push dword [ebp - 0x18]
lea ecx, [ebp - 0x16c]
call fcn.100164aa
and dword [eax], 0
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10030166
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100301a9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x238], edi
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x1003018f
xor esi, esi
xor eax, eax
inc esi
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100301bb
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x10030366
jmp 0x100301cc
xor esi, esi
inc esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x16c]
call fcn.100164aa
push dword [ebp - 0x28]
lea ecx, [ebp - 0x16c]
call fcn.100164aa
xor ecx, ecx
cmp dword [eax], 0xffff2925
setne cl
xor eax, eax
cmp ecx, dword [ebp - 0x28]
jge 0x10030201
cmp dword [ebp - 0x28], eax
je 0x10030201
mov eax, esi
mov dword [ebp - 0x238], eax
lea ecx, [ebp - 0x16c]
push dword [ebp - 0x28]
call fcn.100164aa
mov esi, eax
lea ecx, [ebp - 0x16c]
xor eax, eax
push eax
call fcn.100164aa
mov ecx, dword [esi]
push dword [ebp - 0x28]
imul ecx, dword [eax]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp eax, ecx
lea ecx, [ebp - 0x16c]
sbb esi, esi
inc esi
call fcn.100164aa
xor ebx, ebx
lea ecx, [ebp - 0x16c]
cmp esi, dword [eax]
sete bl
xor eax, eax
push eax
call fcn.100164aa
cmp ebx, dword [eax]
je 0x1003026d
push dword [ebp - 0x28]
lea ecx, [ebp - 0x16c]
call fcn.100164aa
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x16c]
push dword [ebp - 0x28]
call fcn.100164aa
push dword [ebp - 0x28]
lea ecx, [ebp - 0x16c]
call fcn.100164aa
mov eax, dword [ebp - 0x238]
lea ecx, [ebp - 0x16c]
push dword [ebp - 0x28]
call fcn.100164aa
push dword [ebp - 0x28]
lea ecx, [ebp - 0x16c]
call fcn.100164aa
mov esi, dword [ebp - 0x238]
lea ecx, [ebp - 0x16c]
push dword [ebp - 0x28]
neg esi
sbb esi, esi
neg esi
call fcn.100164aa
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp esi, ecx
setl dl
sub edx, dword [ebp - 0x28]
cmp dword [eax], edx
jle 0x1003031b
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100302f7
inc eax
push eax
push 0xa3d
push 0x124c
call dword [sym.imp.USER32.dll_AttachThreadInput]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030347
push 0x79b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
jmp 0x10030345
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1003032e
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030345
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003035d
push 0x1637
push eax
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
dec dword [ebp - 0x28]
jns 0x100301c9
lea ecx, [ebp - 0x16c]
mov dword [ebp - 4], edi
call fcn.1001648e
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 4
pop ebx
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0xcec]
push ebx
call fcn.10016409
mov dword [ebp - 4], 0xe
xor eax, eax
xor esi, esi
mov dword [ebp - 0x3c], 0x64bae0f
mov dword [ebp - 0x18], eax
inc esi
cmp dword [ebp - 0x18], esi
jge 0x100303c8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3ac], 0xfffffffa
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100303aa
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100303ee
push dword [ebp - 0x18]
lea ecx, [ebp - 0xcec]
call fcn.100164aa
mov dword [eax], 0x272b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100303d0
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030400
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov dword [ebp - 0x3ac], eax
lea ecx, [ebp - 0xcec]
push esi
call fcn.100164aa
mov ecx, dword [ebp - 0x30]
neg ecx
push 8
sbb ecx, ecx
xor edx, edx
inc ecx
pop ebx
cmp ecx, ebx
mov ecx, dword [ebp - 0x30]
setne dl
xor ebx, ebx
cmp ecx, edx
setle bl
add ebx, dword [eax]
mov eax, dword [ebp - 0x30]
sub eax, ebx
neg eax
sbb eax, eax
inc eax
cmp eax, 0x555b
jge 0x1003044f
xor eax, eax
cmp dword [ebp - 0x3ac], eax
je 0x10030451
mov eax, esi
jmp 0x10030451
xor eax, eax
dec eax
lea ecx, [ebp - 0xcec]
cmp eax, 0x89480189
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], edi
call fcn.1001648e
xor eax, eax
mov dword [ebp - 0x24], eax
push 2
pop ebx
cmp dword [ebp - 0x24], eax
jl 0x10030597
push ebx
lea ecx, [ebp - 0xadc]
call fcn.10016409
mov dword [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x1c], 0x2236432a
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100304bf
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xadc]
call fcn.100164aa
mov dword [eax], 0x9b55bb2c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100304a1
xor eax, eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x100304f5
mov dword [ebp - 0x50], esi
lea ecx, [ebp - 0xadc]
mov dword [ebp - 0x3c], 4
mov esi, dword [ebp - 0x1c]
push dword [ebp - 0x1c]
call fcn.100164aa
push 1
mov dword [eax], esi
mov dword [ebp - 0x50], esi
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x1c]
pop esi
jns 0x100304c7
lea ecx, [ebp - 0xadc]
mov dword [ebp - 4], edi
call fcn.1001648e
mov dword [ebp - 0x20], 0x75b57fd5
xor eax, eax
mov dword [ebp - 0x1c], 0x7b1c2a2c
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x2b29949d
mov dword [ebp - 0x20], eax
jmp 0x1003057b
mov dword [ebp - 0x50], 0x5fa5fef9
mov dword [ebp - 0x3c], 0x425f5f99
dec dword [ebp - 0x50]
mov dword [ebp - 0x1c], 0xffffffe3
cmp dword [ebp - 0x1c], 0xffffffec
jg 0x10030578
mov dword [ebp - 0x3c], 0xf6fb
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030566
push 0x1577
push 0x177b
push 0x2377
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffec
push 0
pop eax
jle 0x10030540
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x10
jg 0x10030522
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x7dc], 0
jne 0x10030597
dec dword [ebp - 0x24]
jns 0x1003047d
mov dword [ebp - 0x38], 0xfffffffe
lea ecx, [ebp - 0xed4]
mov dword [ebp - 0x38], 0x5f394a2a
mov eax, 0x8144ad72
mov dword [ebp - 0x38], 0x2937a3a1
mov dword [ebp - 0x78], eax
push 3
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
pop edi
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x38], 0xfffffffa
push edi
call fcn.10016409
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x50], 0xf8ee
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100305ff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x16b0], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100305eb
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10030615
push dword [ebp - 0x18]
call fcn.100164aa
mov dword [eax], 0xe6dc660f
inc dword [ebp - 0x18]
lea ecx, [ebp - 0xed4]
cmp dword [ebp - 0x18], edi
jl 0x10030604
inc dword [ebp - 0x50]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1001648e
mov dword [ebp - 0x34], 0x4e2d
lea ecx, [ebp - 0x768]
push ebx
call fcn.10016409
mov dword [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x24], 0xa6c6
mov dword [ebp - 0x20], 0xfc37
mov dword [ebp - 0x3c], 0xad8edce5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030685
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x768]
call fcn.100164aa
mov dword [eax], 0xad59e57a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10030667
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x100306ee
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x100306ac
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x12e4], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10030693
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x100306ba
inc dword [ebp - 0x12e0]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x100306b1
mov dword [ebp - 0x34], eax
jmp 0x100306db
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100306d8
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x27
jle 0x100306c4
or ebx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10030833
mov dword [ebp - 0x14], 0x815898f0
lea ecx, [ebp - 0x768]
or ebx, 0xffffffff
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x48], 0xfffffffb
push eax
call fcn.100164aa
xor edx, edx
mov eax, dword [eax]
sub eax, 0xde9bf9f
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x3c]
add ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setle dl
xor ecx, ecx
sub eax, edx
cmp eax, 0x1b0c
setge cl
cmp dword [ebp - 0x14], ecx
jle 0x1003073f
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10030763
push eax
lea ecx, [ebp - 0x768]
call fcn.100164aa
cmp dword [eax], 0
je 0x10030761
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10030765
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor esi, esi
sub eax, ecx
inc esi
mov dword [ebp - 0x48], eax
jmp 0x100306e4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x328], ecx
mov dword [ebp - 0x324], ecx
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x31c], ecx
lea ecx, [ebp - 0x768]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
push esi
call fcn.100164aa
mov ecx, dword [ebp - 0x320]
xor edx, edx
cmp ecx, dword [eax]
setle dl
cmp dword [ebp - 0x320], edx
jg 0x100307c0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x31c]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x320]
mov eax, dword [ebp - 0x31c]
mov eax, dword [ebp - 0x24]
test eax, eax
push 0
setns cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x324]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x320]
cmp eax, 0xb5bcdce
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x328]
setge dl
imul ecx, edx
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x320]
mov ecx, 0x70c0f3ad
sete dl
sub ecx, edx
sub ecx, eax
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0x24]
pop eax
cmp dword [ebp - 0x24], 0xfffffff0
mov ecx, 0xbecc33ba
jne 0x10030775
lea ecx, [ebp - 0x768]
mov dword [ebp - 4], ebx
call fcn.1001648e
xor eax, eax
mov dword [ebp - 0x38], esi
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10030877
push eax
push 0x2512
push 0x455
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003088f
push 0x1278
push eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
xor eax, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 0x46a1c17c
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0xde661fbc
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100308cf
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x340], ebx
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100308b8
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100308e5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x76c], 0
inc dword [ebp - 0x18]
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100308d4
mov eax, dword [ebp - 0x14]
xor ebx, ebx
mov dword [ebp - 0x340], eax
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x6de
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setl dl
xor eax, eax
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x30], eax
jne 0x10030932
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x1038]
mov eax, dword [ebp - 0x76c]
mov eax, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x340]
mov eax, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x30], eax
push ebx
call fcn.10016409
mov dword [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, 0x544d1878
mov dword [ebp - 0x38], 0xa6b950ba
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100309b5
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1038]
call fcn.100164aa
mov dword [eax], 0x5b57fd54
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x10030991
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
jmp 0x10030a08
mov dword [ebp - 0x38], 0x9dfcf09c
mov dword [ebp - 0x38], 0x9d786592
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100309ee
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x384], 0x7f6f
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x100309d0
xor ebx, ebx
xor eax, eax
inc ebx
dec dword [ebp - 0x384]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030a05
call dword [sym.imp.USER32.dll_CreateMenu]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x100309ba
or eax, 0xffffffff
lea ecx, [ebp - 0x1038]
mov dword [ebp - 4], eax
call fcn.1001648e
push 2
pop eax
mov dword [ebp - 0x38], 0xfffffffe
lea ecx, [ebp - 0x9dc]
push eax
call fcn.10016409
push ebx
lea ecx, [ebp - 0x260]
mov dword [ebp - 4], 0x13
call fcn.10016409
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x50], 0xb4ebb0cb
push 2
mov dword [ebp - 0x4c], eax
pop ecx
cmp dword [ebp - 0x4c], ecx
jge 0x10030a7c
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x9dc]
call fcn.100164aa
push 2
mov dword [eax], ebx
inc dword [ebp - 0x4c]
pop eax
cmp dword [ebp - 0x4c], eax
jl 0x10030a5f
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], ebx
jge 0x10030aa8
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x260]
call fcn.100164aa
mov dword [eax], 0x622ba394
xor eax, eax
inc dword [ebp - 0x4c]
inc eax
cmp dword [ebp - 0x4c], eax
jl 0x10030a84
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], edi
jge 0x10030ac8
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xee8], 0x2758e92e
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], edi
jl 0x10030ab0
xor eax, eax
push 2
mov dword [ebp - 0x4c], eax
pop ecx
cmp dword [ebp - 0x4c], ecx
jge 0x10030aeb
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xff4], 0
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jl 0x10030ad3
xor eax, eax
push eax
lea ecx, [ebp - 0x260]
call fcn.100164aa
mov dword [eax], ebx
jmp 0x10030bac
xor eax, eax
mov dword [ebp - 0x50], 0xe17f7596
push eax
call fcn.100164aa
mov eax, dword [ebp - 0xee8]
lea ecx, [ebp - 0x260]
xor eax, eax
push eax
call fcn.100164aa
mov ecx, dword [ebp - 0xee8]
inc ecx
mov esi, dword [eax]
xor eax, eax
add esi, ecx
lea ecx, [ebp - 0x260]
push eax
mov dword [ebp - 0xff0], esi
call fcn.100164aa
lea ecx, [ebp - 0x9dc]
push dword [eax]
call fcn.100164aa
lea ecx, [esi - 0x4f6cbcb1]
imul ecx, dword [eax]
test ecx, ecx
je 0x10030b74
xor eax, eax
lea ecx, [ebp - 0x260]
push eax
call fcn.100164aa
cmp dword [eax], 0
je 0x10030b74
xor eax, eax
lea esi, [eax + 1]
jmp 0x10030b78
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x260]
call fcn.100164aa
lea ecx, [ebp - 0x9dc]
push dword [eax]
call fcn.100164aa
lea ecx, [ebp - 0x260]
mov eax, dword [eax]
imul eax, esi
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x50], eax
xor eax, eax
push eax
call fcn.100164aa
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x260]
push eax
call fcn.100164aa
lea ecx, [ebp - 0x260]
cmp dword [eax], 0
jge 0x10030afe
call fcn.1001648e
or eax, 0xffffffff
lea ecx, [ebp - 0x9dc]
mov dword [ebp - 4], eax
call fcn.1001648e
mov dword [ebp - 0x38], 0x5f394a2a
xor eax, eax
mov dword [ebp - 0x3c], 0xa137b189
mov dword [ebp - 0x1c], eax
jmp 0x10030c05
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x88], 6
inc dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x10030bf4
mov dword [ebp - 0x88], 0xfffffff7
jmp 0x10030c22
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x88]
cmp dword [ebp - 0x88], 0xfffffff1
mov eax, dword [ebp - 0x88]
jle 0x10030c19
mov dword [ebp - 0x88], eax
lea ecx, [ebp - 0x778]
mov dword [ebp - 0x38], 0x2937a3a1
push edi
call fcn.10016409
push 4
lea ecx, [ebp - 0xc44]
mov dword [ebp - 4], 0x15
call fcn.10016409
xor eax, eax
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x3c], eax
push 2
mov dword [ebp - 0x28], eax
pop ebx
cmp dword [ebp - 0x28], ebx
jge 0x10030c8a